From: Sasha Levin Date: Sun, 18 Sep 2022 23:17:50 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v4.9.329~19 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9d702d96d15908b9fb84fbd5a12fbf4f41fd3f26;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/arm64-kexec_file-use-more-system-keyrings-to-verify-.patch b/queue-5.15/arm64-kexec_file-use-more-system-keyrings-to-verify-.patch new file mode 100644 index 00000000000..400e08450c6 --- /dev/null +++ b/queue-5.15/arm64-kexec_file-use-more-system-keyrings-to-verify-.patch @@ -0,0 +1,74 @@ +From 8563af973a0b127e5fef22dd255ce2936d45e6ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 21:40:26 +0800 +Subject: arm64: kexec_file: use more system keyrings to verify kernel image + signature + +From: Coiby Xu + +[ Upstream commit 0d519cadf75184a24313568e7f489a7fc9b1be3b ] + +Currently, when loading a kernel image via the kexec_file_load() system +call, arm64 can only use the .builtin_trusted_keys keyring to verify +a signature whereas x86 can use three more keyrings i.e. +.secondary_trusted_keys, .machine and .platform keyrings. For example, +one resulting problem is kexec'ing a kernel image would be rejected +with the error "Lockdown: kexec: kexec of unsigned images is restricted; +see man kernel_lockdown.7". + +This patch set enables arm64 to make use of the same keyrings as x86 to +verify the signature kexec'ed kernel image. + +Fixes: 732b7b93d849 ("arm64: kexec_file: add kernel signature verification support") +Cc: stable@vger.kernel.org # 105e10e2cf1c: kexec_file: drop weak attribute from functions +Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig +Cc: stable@vger.kernel.org # 83b7bb2d49ae: kexec, KEYS: make the code in bzImage64_verify_sig generic +Acked-by: Baoquan He +Cc: kexec@lists.infradead.org +Cc: keyrings@vger.kernel.org +Cc: linux-security-module@vger.kernel.org +Co-developed-by: Michal Suchanek +Signed-off-by: Michal Suchanek +Acked-by: Will Deacon +Signed-off-by: Coiby Xu +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/kexec_image.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c +index 9ec34690e255..5ed6a585f21f 100644 +--- a/arch/arm64/kernel/kexec_image.c ++++ b/arch/arm64/kernel/kexec_image.c +@@ -14,7 +14,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -130,18 +129,10 @@ static void *image_load(struct kimage *image, + return NULL; + } + +-#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG +-static int image_verify_sig(const char *kernel, unsigned long kernel_len) +-{ +- return verify_pefile_signature(kernel, kernel_len, NULL, +- VERIFYING_KEXEC_PE_SIGNATURE); +-} +-#endif +- + const struct kexec_file_ops kexec_image_ops = { + .probe = image_probe, + .load = image_load, + #ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG +- .verify_sig = image_verify_sig, ++ .verify_sig = kexec_kernel_verify_pe_sig, + #endif + }; +-- +2.35.1 + diff --git a/queue-5.15/block-blk_queue_enter-__bio_queue_enter-must-return-.patch b/queue-5.15/block-blk_queue_enter-__bio_queue_enter-must-return-.patch new file mode 100644 index 00000000000..974c38e5685 --- /dev/null +++ b/queue-5.15/block-blk_queue_enter-__bio_queue_enter-must-return-.patch @@ -0,0 +1,55 @@ +From d2fdbf144987da632fbf09374518091755a1d71d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Sep 2022 09:53:25 -0700 +Subject: block: blk_queue_enter() / __bio_queue_enter() must return -EAGAIN + for nowait + +From: Stefan Roesch + +[ Upstream commit 56f99b8d06ef1ed1c9730948f9f05ac2b930a20b ] + +Today blk_queue_enter() and __bio_queue_enter() return -EBUSY for the +nowait code path. This is not correct: they should return -EAGAIN +instead. + +This problem was detected by fio. The following command exposed the +above problem: + +t/io_uring -p0 -d128 -b4096 -s32 -c32 -F1 -B0 -R0 -X1 -n24 -P1 -u1 -O0 /dev/ng0n1 + +By applying the patch, the retry case is handled correctly in the slow +path. + +Signed-off-by: Stefan Roesch +Fixes: bfd343aa1718 ("blk-mq: don't wait in blk_mq_queue_enter() if __GFP_WAIT isn't set") +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index 5009b9f1c3c9..13e1fca1e923 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -447,7 +447,7 @@ int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags) + + while (!blk_try_enter_queue(q, pm)) { + if (flags & BLK_MQ_REQ_NOWAIT) +- return -EBUSY; ++ return -EAGAIN; + + /* + * read pair of barrier in blk_freeze_queue_start(), we need to +@@ -478,7 +478,7 @@ static inline int bio_queue_enter(struct bio *bio) + if (test_bit(GD_DEAD, &disk->state)) + goto dead; + bio_wouldblock_error(bio); +- return -EBUSY; ++ return -EAGAIN; + } + + /* +-- +2.35.1 + diff --git a/queue-5.15/drm-meson-correct-osd1-global-alpha-value.patch b/queue-5.15/drm-meson-correct-osd1-global-alpha-value.patch new file mode 100644 index 00000000000..976955acee3 --- /dev/null +++ b/queue-5.15/drm-meson-correct-osd1-global-alpha-value.patch @@ -0,0 +1,40 @@ +From cc44f0ea373abad530aa9d9a5a86065651495c30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Sep 2022 16:51:03 +0100 +Subject: drm/meson: Correct OSD1 global alpha value + +From: Stuart Menefy + +[ Upstream commit 6836829c8ea453c9e3e518e61539e35881c8ed5f ] + +VIU_OSD1_CTRL_STAT.GLOBAL_ALPHA is a 9 bit field, so the maximum +value is 0x100 not 0xff. + +This matches the vendor kernel. + +Signed-off-by: Stuart Menefy +Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller") +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20220908155103.686904-1-stuart.menefy@mathembedded.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_plane.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/meson/meson_plane.c b/drivers/gpu/drm/meson/meson_plane.c +index 8640a8a8a469..44aa52629443 100644 +--- a/drivers/gpu/drm/meson/meson_plane.c ++++ b/drivers/gpu/drm/meson/meson_plane.c +@@ -168,7 +168,7 @@ static void meson_plane_atomic_update(struct drm_plane *plane, + + /* Enable OSD and BLK0, set max global alpha */ + priv->viu.osd1_ctrl_stat = OSD_ENABLE | +- (0xFF << OSD_GLOBAL_ALPHA_SHIFT) | ++ (0x100 << OSD_GLOBAL_ALPHA_SHIFT) | + OSD_BLK0_ENABLE; + + priv->viu.osd1_ctrl_stat2 = readl(priv->io_base + +-- +2.35.1 + diff --git a/queue-5.15/drm-meson-fix-osd1-rgb-to-ycbcr-coefficient.patch b/queue-5.15/drm-meson-fix-osd1-rgb-to-ycbcr-coefficient.patch new file mode 100644 index 00000000000..4c606b6f967 --- /dev/null +++ b/queue-5.15/drm-meson-fix-osd1-rgb-to-ycbcr-coefficient.patch @@ -0,0 +1,47 @@ +From c60c09fb70056b27d0f487e7b49d8eb72a515ba4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Sep 2022 16:52:43 +0100 +Subject: drm/meson: Fix OSD1 RGB to YCbCr coefficient + +From: Stuart Menefy + +[ Upstream commit 6463d3930ba5b6addcfc8f80a4543976a2fc7656 ] + +VPP_WRAP_OSD1_MATRIX_COEF22.Coeff22 is documented as being bits 0-12, +not 16-28. + +Without this the output tends to have a pink hue, changing it results +in better color accuracy. + +The vendor kernel doesn't use this register. However the code which +sets VIU2_OSD1_MATRIX_COEF22 also uses bits 0-12. There is a slightly +different style of registers for configuring some of the other matrices, +which do use bits 16-28 for this coefficient, but those have names +ending in MATRIX_COEF22_30, and this is not one of those. + +Signed-off-by: Stuart Menefy +Fixes: 728883948b0d ("drm/meson: Add G12A Support for VIU setup") +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20220908155243.687143-1-stuart.menefy@mathembedded.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_viu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/meson/meson_viu.c b/drivers/gpu/drm/meson/meson_viu.c +index bb7e109534de..d4b907889a21 100644 +--- a/drivers/gpu/drm/meson/meson_viu.c ++++ b/drivers/gpu/drm/meson/meson_viu.c +@@ -94,7 +94,7 @@ static void meson_viu_set_g12a_osd1_matrix(struct meson_drm *priv, + priv->io_base + _REG(VPP_WRAP_OSD1_MATRIX_COEF11_12)); + writel(((m[9] & 0x1fff) << 16) | (m[10] & 0x1fff), + priv->io_base + _REG(VPP_WRAP_OSD1_MATRIX_COEF20_21)); +- writel((m[11] & 0x1fff) << 16, ++ writel((m[11] & 0x1fff), + priv->io_base + _REG(VPP_WRAP_OSD1_MATRIX_COEF22)); + + writel(((m[18] & 0xfff) << 16) | (m[19] & 0xfff), +-- +2.35.1 + diff --git a/queue-5.15/drm-tegra-vic-fix-build-warning-when-config_pm-n.patch b/queue-5.15/drm-tegra-vic-fix-build-warning-when-config_pm-n.patch new file mode 100644 index 00000000000..37c1cffad20 --- /dev/null +++ b/queue-5.15/drm-tegra-vic-fix-build-warning-when-config_pm-n.patch @@ -0,0 +1,54 @@ +From 521d8684a84a9bdb5ff0e67774979ab3a5ce1dc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Mar 2022 20:32:00 +0800 +Subject: drm/tegra: vic: Fix build warning when CONFIG_PM=n +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: YueHaibing + +[ Upstream commit b5d5288a46876f6767950449aea310f71ac86277 ] + +drivers/gpu/drm/tegra/vic.c:326:12: error: ‘vic_runtime_suspend’ defined but not used [-Werror=unused-function] + static int vic_runtime_suspend(struct device *dev) + ^~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/tegra/vic.c:292:12: error: ‘vic_runtime_resume’ defined but not used [-Werror=unused-function] + static int vic_runtime_resume(struct device *dev) + ^~~~~~~~~~~~~~~~~~ + +Mark it as __maybe_unused. + +Signed-off-by: YueHaibing +Signed-off-by: Thierry Reding +Stable-dep-of: c7860cbee998 ("drm/tegra: Fix vmapping of prime buffers") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/vic.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/tegra/vic.c b/drivers/gpu/drm/tegra/vic.c +index da4af5371991..d3e2fab91086 100644 +--- a/drivers/gpu/drm/tegra/vic.c ++++ b/drivers/gpu/drm/tegra/vic.c +@@ -275,7 +275,7 @@ static int vic_load_firmware(struct vic *vic) + } + + +-static int vic_runtime_resume(struct device *dev) ++static int __maybe_unused vic_runtime_resume(struct device *dev) + { + struct vic *vic = dev_get_drvdata(dev); + int err; +@@ -309,7 +309,7 @@ static int vic_runtime_resume(struct device *dev) + return err; + } + +-static int vic_runtime_suspend(struct device *dev) ++static int __maybe_unused vic_runtime_suspend(struct device *dev) + { + struct vic *vic = dev_get_drvdata(dev); + int err; +-- +2.35.1 + diff --git a/queue-5.15/gpio-mpc8xxx-fix-support-for-irq_type_level_low-flow.patch b/queue-5.15/gpio-mpc8xxx-fix-support-for-irq_type_level_low-flow.patch new file mode 100644 index 00000000000..ee141d6c7ba --- /dev/null +++ b/queue-5.15/gpio-mpc8xxx-fix-support-for-irq_type_level_low-flow.patch @@ -0,0 +1,48 @@ +From db5dffb080bb8378897fdd999b8e9c6e67a8fab1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 12:54:31 +0200 +Subject: gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in + mpc85xx +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 279c12df8d2efb28def9d037f288cbfb97c30fe2 ] + +Commit e39d5ef67804 ("powerpc/5xxx: extend mpc8xxx_gpio driver to support +mpc512x gpios") implemented support for IRQ_TYPE_LEVEL_LOW flow type in +mpc512x via falling edge type. Do same for mpc85xx which support was added +in commit 345e5c8a1cc3 ("powerpc: Add interrupt support to mpc8xxx_gpio"). + +Fixes probing of lm90 hwmon driver on mpc85xx based board which use level +interrupt. Without it kernel prints error and refuse lm90 to work: + + [ 15.258370] genirq: Setting trigger mode 8 for irq 49 failed (mpc8xxx_irq_set_type+0x0/0xf8) + [ 15.267168] lm90 0-004c: cannot request IRQ 49 + [ 15.272708] lm90: probe of 0-004c failed with error -22 + +Fixes: 345e5c8a1cc3 ("powerpc: Add interrupt support to mpc8xxx_gpio") +Signed-off-by: Pali Rohár +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-mpc8xxx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c +index a964e25ea620..763256efddc2 100644 +--- a/drivers/gpio/gpio-mpc8xxx.c ++++ b/drivers/gpio/gpio-mpc8xxx.c +@@ -172,6 +172,7 @@ static int mpc8xxx_irq_set_type(struct irq_data *d, unsigned int flow_type) + + switch (flow_type) { + case IRQ_TYPE_EDGE_FALLING: ++ case IRQ_TYPE_LEVEL_LOW: + raw_spin_lock_irqsave(&mpc8xxx_gc->lock, flags); + gc->write_reg(mpc8xxx_gc->regs + GPIO_ICR, + gc->read_reg(mpc8xxx_gc->regs + GPIO_ICR) +-- +2.35.1 + diff --git a/queue-5.15/nfsv4-turn-off-open-by-filehandle-and-nfs-re-export-.patch b/queue-5.15/nfsv4-turn-off-open-by-filehandle-and-nfs-re-export-.patch new file mode 100644 index 00000000000..214dd30a1f5 --- /dev/null +++ b/queue-5.15/nfsv4-turn-off-open-by-filehandle-and-nfs-re-export-.patch @@ -0,0 +1,69 @@ +From cdde9757b81e28c67e2d178af9f7c8aef120b129 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Aug 2022 14:49:05 -0400 +Subject: NFSv4: Turn off open-by-filehandle and NFS re-export for NFSv4.0 + +From: Trond Myklebust + +[ Upstream commit 2a9d683b48c8a87e61a4215792d44c90bcbbb536 ] + +The NFSv4.0 protocol only supports open() by name. It cannot therefore +be used with open_by_handle() and friends, nor can it be re-exported by +knfsd. + +Reported-by: Chuck Lever III +Fixes: 20fa19027286 ("nfs: add export operations") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/super.c | 27 ++++++++++++++++++--------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/fs/nfs/super.c b/fs/nfs/super.c +index e65c83494c05..a847011f36c9 100644 +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -1046,22 +1046,31 @@ static void nfs_fill_super(struct super_block *sb, struct nfs_fs_context *ctx) + if (ctx->bsize) + sb->s_blocksize = nfs_block_size(ctx->bsize, &sb->s_blocksize_bits); + +- if (server->nfs_client->rpc_ops->version != 2) { +- /* The VFS shouldn't apply the umask to mode bits. We will do +- * so ourselves when necessary. ++ switch (server->nfs_client->rpc_ops->version) { ++ case 2: ++ sb->s_time_gran = 1000; ++ sb->s_time_min = 0; ++ sb->s_time_max = U32_MAX; ++ break; ++ case 3: ++ /* ++ * The VFS shouldn't apply the umask to mode bits. ++ * We will do so ourselves when necessary. + */ + sb->s_flags |= SB_POSIXACL; + sb->s_time_gran = 1; +- sb->s_export_op = &nfs_export_ops; +- } else +- sb->s_time_gran = 1000; +- +- if (server->nfs_client->rpc_ops->version != 4) { + sb->s_time_min = 0; + sb->s_time_max = U32_MAX; +- } else { ++ sb->s_export_op = &nfs_export_ops; ++ break; ++ case 4: ++ sb->s_flags |= SB_POSIXACL; ++ sb->s_time_gran = 1; + sb->s_time_min = S64_MIN; + sb->s_time_max = S64_MAX; ++ if (server->caps & NFS_CAP_ATOMIC_OPEN_V1) ++ sb->s_export_op = &nfs_export_ops; ++ break; + } + + sb->s_magic = NFS_SUPER_MAGIC; +-- +2.35.1 + diff --git a/queue-5.15/of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch b/queue-5.15/of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch new file mode 100644 index 00000000000..429d67bc264 --- /dev/null +++ b/queue-5.15/of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch @@ -0,0 +1,41 @@ +From a03aaca34c09a5435f30660a786e82c7abbc24c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Aug 2022 23:34:16 +0300 +Subject: of: fdt: fix off-by-one error in unflatten_dt_nodes() + +From: Sergey Shtylyov + +[ Upstream commit 2f945a792f67815abca26fa8a5e863ccf3fa1181 ] + +Commit 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree") +forgot to fix up the depth check in the loop body in unflatten_dt_nodes() +which makes it possible to overflow the nps[] buffer... + +Found by Linux Verification Center (linuxtesting.org) with the SVACE static +analysis tool. + +Fixes: 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Rob Herring +Link: https://lore.kernel.org/r/7c354554-006f-6b31-c195-cdfe4caee392@omp.ru +Signed-off-by: Sasha Levin +--- + drivers/of/fdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c +index d245628b15dd..338171c978cc 100644 +--- a/drivers/of/fdt.c ++++ b/drivers/of/fdt.c +@@ -313,7 +313,7 @@ static int unflatten_dt_nodes(const void *blob, + for (offset = 0; + offset >= 0 && depth >= initial_depth; + offset = fdt_next_node(blob, offset, &depth)) { +- if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH)) ++ if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH - 1)) + continue; + + if (!IS_ENABLED(CONFIG_OF_KOBJ) && +-- +2.35.1 + diff --git a/queue-5.15/pinctrl-qcom-sc8180x-fix-gpio_wakeirq_map.patch b/queue-5.15/pinctrl-qcom-sc8180x-fix-gpio_wakeirq_map.patch new file mode 100644 index 00000000000..85a5d99ad5f --- /dev/null +++ b/queue-5.15/pinctrl-qcom-sc8180x-fix-gpio_wakeirq_map.patch @@ -0,0 +1,40 @@ +From f045115bfb5753d11dbecc2549fcc4b8a12b69b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Aug 2022 20:26:44 +0800 +Subject: pinctrl: qcom: sc8180x: Fix gpio_wakeirq_map + +From: Molly Sophia + +[ Upstream commit 6124cec530c7d8faab96d340ab2df5161e5d1c8a ] + +Currently in the wakeirq_map, gpio36 and gpio37 have the same wakeirq +number, resulting in gpio37 being unable to trigger interrupts. +It looks like that this is a typo in the wakeirq map. So fix it. + +Signed-off-by: Molly Sophia +Fixes: 97423113ec4b ("pinctrl: qcom: Add sc8180x TLMM driver") +Tested-by: Bjorn Andersson +Reviewed-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220807122645.13830-2-mollysophia379@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-sc8180x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-sc8180x.c b/drivers/pinctrl/qcom/pinctrl-sc8180x.c +index 0d9654b4ab60..32a2d8c5ceae 100644 +--- a/drivers/pinctrl/qcom/pinctrl-sc8180x.c ++++ b/drivers/pinctrl/qcom/pinctrl-sc8180x.c +@@ -1582,7 +1582,7 @@ static const int sc8180x_acpi_reserved_gpios[] = { + static const struct msm_gpio_wakeirq_map sc8180x_pdc_map[] = { + { 3, 31 }, { 5, 32 }, { 8, 33 }, { 9, 34 }, { 10, 100 }, { 12, 104 }, + { 24, 37 }, { 26, 38 }, { 27, 41 }, { 28, 42 }, { 30, 39 }, { 36, 43 }, +- { 37, 43 }, { 38, 45 }, { 39, 118 }, { 39, 125 }, { 41, 47 }, ++ { 37, 44 }, { 38, 45 }, { 39, 118 }, { 39, 125 }, { 41, 47 }, + { 42, 48 }, { 46, 50 }, { 47, 49 }, { 48, 51 }, { 49, 53 }, { 50, 52 }, + { 51, 116 }, { 51, 123 }, { 53, 54 }, { 54, 55 }, { 55, 56 }, + { 56, 57 }, { 58, 58 }, { 60, 60 }, { 68, 62 }, { 70, 63 }, { 76, 86 }, +-- +2.35.1 + diff --git a/queue-5.15/pinctrl-qcom-sc8180x-fix-wrong-pin-numbers.patch b/queue-5.15/pinctrl-qcom-sc8180x-fix-wrong-pin-numbers.patch new file mode 100644 index 00000000000..69659a176e7 --- /dev/null +++ b/queue-5.15/pinctrl-qcom-sc8180x-fix-wrong-pin-numbers.patch @@ -0,0 +1,45 @@ +From 3d20ad47b3d06ec5c9f02cbf6132077cf7d40228 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Aug 2022 20:26:45 +0800 +Subject: pinctrl: qcom: sc8180x: Fix wrong pin numbers + +From: Molly Sophia + +[ Upstream commit 48ec73395887694f13c9452b4dcfb43710451757 ] + +The pin numbers for UFS_RESET and SDC2_* are not +consistent in the pinctrl driver for sc8180x. +So fix it. + +Signed-off-by: Molly Sophia +Fixes: 97423113ec4b ("pinctrl: qcom: Add sc8180x TLMM driver") +Reviewed-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220807122645.13830-3-mollysophia379@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-sc8180x.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-sc8180x.c b/drivers/pinctrl/qcom/pinctrl-sc8180x.c +index 32a2d8c5ceae..a4725ff12da0 100644 +--- a/drivers/pinctrl/qcom/pinctrl-sc8180x.c ++++ b/drivers/pinctrl/qcom/pinctrl-sc8180x.c +@@ -530,10 +530,10 @@ DECLARE_MSM_GPIO_PINS(187); + DECLARE_MSM_GPIO_PINS(188); + DECLARE_MSM_GPIO_PINS(189); + +-static const unsigned int sdc2_clk_pins[] = { 190 }; +-static const unsigned int sdc2_cmd_pins[] = { 191 }; +-static const unsigned int sdc2_data_pins[] = { 192 }; +-static const unsigned int ufs_reset_pins[] = { 193 }; ++static const unsigned int ufs_reset_pins[] = { 190 }; ++static const unsigned int sdc2_clk_pins[] = { 191 }; ++static const unsigned int sdc2_cmd_pins[] = { 192 }; ++static const unsigned int sdc2_data_pins[] = { 193 }; + + enum sc8180x_functions { + msm_mux_adsp_ext, +-- +2.35.1 + diff --git a/queue-5.15/pinctrl-rockchip-enhance-support-for-irq_type_edge_b.patch b/queue-5.15/pinctrl-rockchip-enhance-support-for-irq_type_edge_b.patch new file mode 100644 index 00000000000..1f29286ecbe --- /dev/null +++ b/queue-5.15/pinctrl-rockchip-enhance-support-for-irq_type_edge_b.patch @@ -0,0 +1,49 @@ +From 2d274b0082f37f92efc088fcf4608179d888843a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Aug 2022 02:51:20 +0000 +Subject: pinctrl: rockchip: Enhance support for IRQ_TYPE_EDGE_BOTH +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: João H. Spies + +[ Upstream commit b871656aa4f54e04207f62bdd0d7572be1d86b36 ] + +Switching between falling/rising edges for IRQ_TYPE_EDGE_BOTH on pins that +require debounce can cause the device to lose events due to a desync +between pin state and irq type. + +This problem is resolved by switching between IRQ_TYPE_LEVEL_LOW and +IRQ_TYPE_LEVEL_HIGH instead. + +Fixes: 936ee2675eee ("gpio/rockchip: add driver for rockchip gpio") +Signed-off-by: João H. Spies +Link: https://lore.kernel.org/r/20220808025121.110223-1-jhlspies@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-rockchip.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-rockchip.c b/drivers/gpio/gpio-rockchip.c +index 22b8f0aa80f1..f31b0947eaaa 100644 +--- a/drivers/gpio/gpio-rockchip.c ++++ b/drivers/gpio/gpio-rockchip.c +@@ -418,11 +418,11 @@ static int rockchip_irq_set_type(struct irq_data *d, unsigned int type) + goto out; + } else { + bank->toggle_edge_mode |= mask; +- level |= mask; ++ level &= ~mask; + + /* + * Determine gpio state. If 1 next interrupt should be +- * falling otherwise rising. ++ * low otherwise high. + */ + data = readl(bank->reg_base + bank->gpio_regs->ext_port); + if (data & mask) +-- +2.35.1 + diff --git a/queue-5.15/pinctrl-sunxi-fix-name-for-a100-r_pio.patch b/queue-5.15/pinctrl-sunxi-fix-name-for-a100-r_pio.patch new file mode 100644 index 00000000000..0bb74601354 --- /dev/null +++ b/queue-5.15/pinctrl-sunxi-fix-name-for-a100-r_pio.patch @@ -0,0 +1,38 @@ +From 0efbe4e17bf54d85201813cee1ad478c588147fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Aug 2022 10:45:41 +0800 +Subject: pinctrl: sunxi: Fix name for A100 R_PIO + +From: Michael Wu + +[ Upstream commit 76648c867c6c03b8a468d9c9222025873ecc613d ] + +The name of A100 R_PIO driver should be sun50i-a100-r-pinctrl, +not sun50iw10p1-r-pinctrl. + +Fixes: 473436e7647d6 ("pinctrl: sunxi: add support for the Allwinner A100 pin controller") +Signed-off-by: Michael Wu +Acked-by: Samuel Holland +Link: https://lore.kernel.org/r/20220819024541.74191-1-michael@allwinnertech.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sunxi/pinctrl-sun50i-a100-r.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/sunxi/pinctrl-sun50i-a100-r.c b/drivers/pinctrl/sunxi/pinctrl-sun50i-a100-r.c +index 21054fcacd34..18088f6f44b2 100644 +--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-a100-r.c ++++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-a100-r.c +@@ -98,7 +98,7 @@ MODULE_DEVICE_TABLE(of, a100_r_pinctrl_match); + static struct platform_driver a100_r_pinctrl_driver = { + .probe = a100_r_pinctrl_probe, + .driver = { +- .name = "sun50iw10p1-r-pinctrl", ++ .name = "sun50i-a100-r-pinctrl", + .of_match_table = a100_r_pinctrl_match, + }, + }; +-- +2.35.1 + diff --git a/queue-5.15/serial-atmel-remove-redundant-assignment-in-rs485_co.patch b/queue-5.15/serial-atmel-remove-redundant-assignment-in-rs485_co.patch new file mode 100644 index 00000000000..eea83935df5 --- /dev/null +++ b/queue-5.15/serial-atmel-remove-redundant-assignment-in-rs485_co.patch @@ -0,0 +1,46 @@ +From d6fb10176b9f161716f355ba192f3a3f7ee40178 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Apr 2022 12:46:42 +0200 +Subject: serial: atmel: remove redundant assignment in rs485_config + +From: Lino Sanfilippo + +[ Upstream commit 60efd0513916f195dd85bfbf21653f74f9ab019c ] + +In uart_set_rs485_config() the serial core already assigns the passed +serial_rs485 struct to the uart port. + +So remove the assignment from the drivers rs485_config() function to avoid +redundancy. + +Reviewed-by: Claudiu Beznea +Acked-by: Richard Genoud +Signed-off-by: Lino Sanfilippo +Link: https://lore.kernel.org/r/20220410104642.32195-10-LinoSanfilippo@gmx.de +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 692a8ebcfc24 ("tty: serial: atmel: Preserve previous USART mode if RS485 disabled") +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/atmel_serial.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index dd350c590880..92383c8610ee 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -298,11 +298,9 @@ static int atmel_config_rs485(struct uart_port *port, + /* Resetting serial mode to RS232 (0x0) */ + mode &= ~ATMEL_US_USMODE; + +- port->rs485 = *rs485conf; +- + if (rs485conf->flags & SER_RS485_ENABLED) { + dev_dbg(port->dev, "Setting UART to RS485\n"); +- if (port->rs485.flags & SER_RS485_RX_DURING_TX) ++ if (rs485conf->flags & SER_RS485_RX_DURING_TX) + atmel_port->tx_done_mask = ATMEL_US_TXRDY; + else + atmel_port->tx_done_mask = ATMEL_US_TXEMPTY; +-- +2.35.1 + diff --git a/queue-5.15/series b/queue-5.15/series index 3cfc181c51b..be96c69826b 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -32,3 +32,18 @@ usb-gadget-f_uac2-clean-up-some-inconsistent-indenting.patch usb-gadget-f_uac2-fix-superspeed-transfer.patch rdma-irdma-use-s-g-array-in-post-send-only-when-its-valid.patch input-goodix-add-compatible-string-for-gt1158.patch +drm-tegra-vic-fix-build-warning-when-config_pm-n.patch +arm64-kexec_file-use-more-system-keyrings-to-verify-.patch +usb-gadget-fix-use-after-free-read-in-usb_udc_uevent.patch +serial-atmel-remove-redundant-assignment-in-rs485_co.patch +tty-serial-atmel-preserve-previous-usart-mode-if-rs4.patch +of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch +pinctrl-qcom-sc8180x-fix-gpio_wakeirq_map.patch +pinctrl-qcom-sc8180x-fix-wrong-pin-numbers.patch +pinctrl-rockchip-enhance-support-for-irq_type_edge_b.patch +pinctrl-sunxi-fix-name-for-a100-r_pio.patch +nfsv4-turn-off-open-by-filehandle-and-nfs-re-export-.patch +gpio-mpc8xxx-fix-support-for-irq_type_level_low-flow.patch +drm-meson-correct-osd1-global-alpha-value.patch +drm-meson-fix-osd1-rgb-to-ycbcr-coefficient.patch +block-blk_queue_enter-__bio_queue_enter-must-return-.patch diff --git a/queue-5.15/tty-serial-atmel-preserve-previous-usart-mode-if-rs4.patch b/queue-5.15/tty-serial-atmel-preserve-previous-usart-mode-if-rs4.patch new file mode 100644 index 00000000000..1b2abb6f319 --- /dev/null +++ b/queue-5.15/tty-serial-atmel-preserve-previous-usart-mode-if-rs4.patch @@ -0,0 +1,74 @@ +From 4f3d08ceb9ff4501d58bcae56cda96adb22c2aa4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 17:29:03 +0300 +Subject: tty: serial: atmel: Preserve previous USART mode if RS485 disabled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sergiu Moga + +[ Upstream commit 692a8ebcfc24f4a5bea0eb2967e450f584193da6 ] + +Whenever the atmel_rs485_config() driver method would be called, +the USART mode is reset to normal mode before even checking if +RS485 flag is set, thus resulting in losing the previous USART +mode in the case where the checking fails. + +Some tools, such as `linux-serial-test`, lead to the driver calling +this method when doing the setup of the serial port: after setting the +port mode (Hardware Flow Control, Normal Mode, RS485 Mode, etc.), +`linux-serial-test` tries to enable/disable RS485 depending on +the commandline arguments that were passed. + +Example of how this issue could reveal itself: +When doing a serial communication with Hardware Flow Control through +`linux-serial-test`, the tool would lead to the driver roughly doing +the following: +- set the corresponding bit to 1 (ATMEL_US_USMODE_HWHS bit in the +ATMEL_US_MR register) through the atmel_set_termios() to enable +Hardware Flow Control +- disable RS485 through the atmel_config_rs485() method +Thus, when the latter is called, the mode will be reset and the +previously set bit is unset, leaving USART in normal mode instead of +the expected Hardware Flow Control mode. + +This fix ensures that this reset is only done if the checking for +RS485 succeeds and that the previous mode is preserved otherwise. + +Fixes: e8faff7330a35 ("ARM: 6092/1: atmel_serial: support for RS485 communications") +Cc: stable +Reviewed-by: Ilpo Järvinen +Signed-off-by: Sergiu Moga +Link: https://lore.kernel.org/r/20220824142902.502596-1-sergiu.moga@microchip.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/atmel_serial.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index 92383c8610ee..c0a86558ceaa 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -295,9 +295,6 @@ static int atmel_config_rs485(struct uart_port *port, + + mode = atmel_uart_readl(port, ATMEL_US_MR); + +- /* Resetting serial mode to RS232 (0x0) */ +- mode &= ~ATMEL_US_USMODE; +- + if (rs485conf->flags & SER_RS485_ENABLED) { + dev_dbg(port->dev, "Setting UART to RS485\n"); + if (rs485conf->flags & SER_RS485_RX_DURING_TX) +@@ -307,6 +304,7 @@ static int atmel_config_rs485(struct uart_port *port, + + atmel_uart_writel(port, ATMEL_US_TTGR, + rs485conf->delay_rts_after_send); ++ mode &= ~ATMEL_US_USMODE; + mode |= ATMEL_US_USMODE_RS485; + } else { + dev_dbg(port->dev, "Setting UART to RS232\n"); +-- +2.35.1 + diff --git a/queue-5.15/usb-gadget-fix-use-after-free-read-in-usb_udc_uevent.patch b/queue-5.15/usb-gadget-fix-use-after-free-read-in-usb_udc_uevent.patch new file mode 100644 index 00000000000..c354bc2302e --- /dev/null +++ b/queue-5.15/usb-gadget-fix-use-after-free-read-in-usb_udc_uevent.patch @@ -0,0 +1,78 @@ +From 4ec57709f69f35643cc6d375e876e352e732b99f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jul 2022 11:07:10 -0400 +Subject: USB: gadget: Fix use-after-free Read in usb_udc_uevent() + +From: Alan Stern + +[ Upstream commit 2191c00855b03aa59c20e698be713d952d51fc18 ] + +The syzbot fuzzer found a race between uevent callbacks and gadget +driver unregistration that can cause a use-after-free bug: + +--------------------------------------------------------------- +BUG: KASAN: use-after-free in usb_udc_uevent+0x11f/0x130 +drivers/usb/gadget/udc/core.c:1732 +Read of size 8 at addr ffff888078ce2050 by task udevd/2968 + +CPU: 1 PID: 2968 Comm: udevd Not tainted 5.19.0-rc4-next-20220628-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google +06/29/2022 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 + print_address_description mm/kasan/report.c:317 [inline] + print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 + kasan_report+0xbe/0x1f0 mm/kasan/report.c:495 + usb_udc_uevent+0x11f/0x130 drivers/usb/gadget/udc/core.c:1732 + dev_uevent+0x290/0x770 drivers/base/core.c:2424 +--------------------------------------------------------------- + +The bug occurs because usb_udc_uevent() dereferences udc->driver but +does so without acquiring the udc_lock mutex, which protects this +field. If the gadget driver is unbound from the udc concurrently with +uevent processing, the driver structure may be accessed after it has +been deallocated. + +To prevent the race, we make sure that the routine holds the mutex +around the racing accesses. + +Link: +CC: stable@vger.kernel.org # fc274c1e9973 +Reported-and-tested-by: syzbot+b0de012ceb1e2a97891b@syzkaller.appspotmail.com +Signed-off-by: Alan Stern +Link: https://lore.kernel.org/r/YtlrnhHyrHsSky9m@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/core.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c +index 61099f2d057d..eb3895ad7136 100644 +--- a/drivers/usb/gadget/udc/core.c ++++ b/drivers/usb/gadget/udc/core.c +@@ -1739,13 +1739,14 @@ static int usb_udc_uevent(struct device *dev, struct kobj_uevent_env *env) + return ret; + } + +- if (udc->driver) { ++ mutex_lock(&udc_lock); ++ if (udc->driver) + ret = add_uevent_var(env, "USB_UDC_DRIVER=%s", + udc->driver->function); +- if (ret) { +- dev_err(dev, "failed to add uevent USB_UDC_DRIVER\n"); +- return ret; +- } ++ mutex_unlock(&udc_lock); ++ if (ret) { ++ dev_err(dev, "failed to add uevent USB_UDC_DRIVER\n"); ++ return ret; + } + + return 0; +-- +2.35.1 +