From: Sasha Levin Date: Wed, 7 Feb 2024 16:25:08 +0000 (-0500) Subject: Fixes for 5.4 X-Git-Tag: v6.1.78~73 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b71857c191baaef185fa246fbc8fc3a4b230feec;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/dmaengine-fix-is_slave_direction-return-false-when-d.patch b/queue-5.4/dmaengine-fix-is_slave_direction-return-false-when-d.patch new file mode 100644 index 00000000000..7b40868fe5f --- /dev/null +++ b/queue-5.4/dmaengine-fix-is_slave_direction-return-false-when-d.patch @@ -0,0 +1,37 @@ +From f13a1a90f5db4ee9ca9911d4aa1caac3363c294e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 12:28:41 -0500 +Subject: dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV + +From: Frank Li + +[ Upstream commit a22fe1d6dec7e98535b97249fdc95c2be79120bb ] + +is_slave_direction() should return true when direction is DMA_DEV_TO_DEV. + +Fixes: 49920bc66984 ("dmaengine: add new enum dma_transfer_direction") +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20240123172842.3764529-1-Frank.Li@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + include/linux/dmaengine.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h +index 8013562751a5..aa8bdc7473ff 100644 +--- a/include/linux/dmaengine.h ++++ b/include/linux/dmaengine.h +@@ -815,7 +815,8 @@ static inline int dmaengine_slave_config(struct dma_chan *chan, + + static inline bool is_slave_direction(enum dma_transfer_direction direction) + { +- return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM); ++ return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM) || ++ (direction == DMA_DEV_TO_DEV); + } + + static inline struct dma_async_tx_descriptor *dmaengine_prep_slave_single( +-- +2.43.0 + diff --git a/queue-5.4/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch b/queue-5.4/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch new file mode 100644 index 00000000000..5dbf7d65074 --- /dev/null +++ b/queue-5.4/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch @@ -0,0 +1,70 @@ +From 41adf577050c0f6c7e461efdd418a88c98173f7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Jan 2024 11:02:03 +0100 +Subject: dmaengine: fsl-qdma: Fix a memory leak related to the status queue + DMA + +From: Christophe JAILLET + +[ Upstream commit 968bc1d7203d384e72afe34124a1801b7af76514 ] + +This dma_alloc_coherent() is undone in the remove function, but not in the +error handling path of fsl_qdma_probe(). + +Switch to the managed version to fix the issue in the probe and simplify +the remove function. + +Fixes: b092529e0aa0 ("dmaengine: fsl-qdma: Add qDMA controller driver for Layerscape SoCs") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/a0ef5d0f5a47381617ef339df776ddc68ce48173.1704621515.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsl-qdma.c | 17 +++++------------ + 1 file changed, 5 insertions(+), 12 deletions(-) + +diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c +index f5a1ae164193..e3d07013ae8d 100644 +--- a/drivers/dma/fsl-qdma.c ++++ b/drivers/dma/fsl-qdma.c +@@ -551,11 +551,11 @@ static struct fsl_qdma_queue + /* + * Buffer for queue command + */ +- status_head->cq = dma_alloc_coherent(&pdev->dev, +- sizeof(struct fsl_qdma_format) * +- status_size, +- &status_head->bus_addr, +- GFP_KERNEL); ++ status_head->cq = dmam_alloc_coherent(&pdev->dev, ++ sizeof(struct fsl_qdma_format) * ++ status_size, ++ &status_head->bus_addr, ++ GFP_KERNEL); + if (!status_head->cq) { + devm_kfree(&pdev->dev, status_head); + return NULL; +@@ -1221,8 +1221,6 @@ static void fsl_qdma_cleanup_vchan(struct dma_device *dmadev) + + static int fsl_qdma_remove(struct platform_device *pdev) + { +- int i; +- struct fsl_qdma_queue *status; + struct device_node *np = pdev->dev.of_node; + struct fsl_qdma_engine *fsl_qdma = platform_get_drvdata(pdev); + +@@ -1231,11 +1229,6 @@ static int fsl_qdma_remove(struct platform_device *pdev) + of_dma_controller_free(np); + dma_async_device_unregister(&fsl_qdma->dma_dev); + +- for (i = 0; i < fsl_qdma->block_number; i++) { +- status = fsl_qdma->status[i]; +- dma_free_coherent(&pdev->dev, sizeof(struct fsl_qdma_format) * +- status->n_cq, status->cq, status->bus_addr); +- } + return 0; + } + +-- +2.43.0 + diff --git a/queue-5.4/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-2747 b/queue-5.4/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-2747 new file mode 100644 index 00000000000..586b84bde6b --- /dev/null +++ b/queue-5.4/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-2747 @@ -0,0 +1,48 @@ +From 3c2f3bc888923443a146d8cb976636fbb34abad4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Jan 2024 11:02:04 +0100 +Subject: dmaengine: fsl-qdma: Fix a memory leak related to the queue command + DMA + +From: Christophe JAILLET + +[ Upstream commit 3aa58cb51318e329d203857f7a191678e60bb714 ] + +This dma_alloc_coherent() is undone neither in the remove function, nor in +the error handling path of fsl_qdma_probe(). + +Switch to the managed version to fix both issues. + +Fixes: b092529e0aa0 ("dmaengine: fsl-qdma: Add qDMA controller driver for Layerscape SoCs") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/7f66aa14f59d32b13672dde28602b47deb294e1f.1704621515.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsl-qdma.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c +index e3d07013ae8d..ad5818c0ce22 100644 +--- a/drivers/dma/fsl-qdma.c ++++ b/drivers/dma/fsl-qdma.c +@@ -502,11 +502,11 @@ static struct fsl_qdma_queue + queue_temp = queue_head + i + (j * queue_num); + + queue_temp->cq = +- dma_alloc_coherent(&pdev->dev, +- sizeof(struct fsl_qdma_format) * +- queue_size[i], +- &queue_temp->bus_addr, +- GFP_KERNEL); ++ dmam_alloc_coherent(&pdev->dev, ++ sizeof(struct fsl_qdma_format) * ++ queue_size[i], ++ &queue_temp->bus_addr, ++ GFP_KERNEL); + if (!queue_temp->cq) + return NULL; + queue_temp->block_base = fsl_qdma->block_base + +-- +2.43.0 + diff --git a/queue-5.4/phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch b/queue-5.4/phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch new file mode 100644 index 00000000000..857bd8234f4 --- /dev/null +++ b/queue-5.4/phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch @@ -0,0 +1,51 @@ +From 9d0d76ba5f8eb484a440b2d4e449710789283207 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jan 2024 18:37:03 +0900 +Subject: phy: renesas: rcar-gen3-usb2: Fix returning wrong error code + +From: Yoshihiro Shimoda + +[ Upstream commit 249abaf3bf0dd07f5ddebbb2fe2e8f4d675f074e ] + +Even if device_create_file() returns error code, +rcar_gen3_phy_usb2_probe() will return zero because the "ret" is +variable shadowing. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202312161021.gOLDl48K-lkp@intel.com/ +Fixes: 441a681b8843 ("phy: rcar-gen3-usb2: fix implementation for runtime PM") +Signed-off-by: Yoshihiro Shimoda +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20240105093703.3359949-1-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/renesas/phy-rcar-gen3-usb2.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +index cfb98bba7715..ddc41db1f65a 100644 +--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c ++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +@@ -631,8 +631,6 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) + channel->irq = platform_get_irq_optional(pdev, 0); + channel->dr_mode = rcar_gen3_get_dr_mode(dev->of_node); + if (channel->dr_mode != USB_DR_MODE_UNKNOWN) { +- int ret; +- + channel->is_otg_channel = true; + channel->uses_otg_pins = !of_property_read_bool(dev->of_node, + "renesas,no-otg-pins"); +@@ -691,8 +689,6 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) + ret = PTR_ERR(provider); + goto error; + } else if (channel->is_otg_channel) { +- int ret; +- + ret = device_create_file(dev, &dev_attr_role); + if (ret < 0) + goto error; +-- +2.43.0 + diff --git a/queue-5.4/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch b/queue-5.4/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch new file mode 100644 index 00000000000..c6b0d23e005 --- /dev/null +++ b/queue-5.4/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch @@ -0,0 +1,75 @@ +From d044386af4051d630ba2f8a55516e591bea011e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 14:05:54 +0200 +Subject: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP + +From: Tony Lindgren + +[ Upstream commit 7104ba0f1958adb250319e68a15eff89ec4fd36d ] + +If the external phy working together with phy-omap-usb2 does not implement +send_srp(), we may still attempt to call it. This can happen on an idle +Ethernet gadget triggering a wakeup for example: + +configfs-gadget.g1 gadget.0: ECM Suspend +configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup +... +Unable to handle kernel NULL pointer dereference at virtual address +00000000 when execute +... +PC is at 0x0 +LR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc] +... +musb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core] +usb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether] +eth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c +dev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4 +sch_direct_xmit from __dev_queue_xmit+0x334/0xd88 +__dev_queue_xmit from arp_solicit+0xf0/0x268 +arp_solicit from neigh_probe+0x54/0x7c +neigh_probe from __neigh_event_send+0x22c/0x47c +__neigh_event_send from neigh_resolve_output+0x14c/0x1c0 +neigh_resolve_output from ip_finish_output2+0x1c8/0x628 +ip_finish_output2 from ip_send_skb+0x40/0xd8 +ip_send_skb from udp_send_skb+0x124/0x340 +udp_send_skb from udp_sendmsg+0x780/0x984 +udp_sendmsg from __sys_sendto+0xd8/0x158 +__sys_sendto from ret_fast_syscall+0x0/0x58 + +Let's fix the issue by checking for send_srp() and set_vbus() before +calling them. For USB peripheral only cases these both could be NULL. + +Fixes: 657b306a7bdf ("usb: phy: add a new driver for omap usb2 phy") +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20240128120556.8848-1-tony@atomide.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-omap-usb2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/ti/phy-omap-usb2.c b/drivers/phy/ti/phy-omap-usb2.c +index 471fe2e80f4e..fc2fee6d532d 100644 +--- a/drivers/phy/ti/phy-omap-usb2.c ++++ b/drivers/phy/ti/phy-omap-usb2.c +@@ -58,7 +58,7 @@ static int omap_usb_set_vbus(struct usb_otg *otg, bool enabled) + { + struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); + +- if (!phy->comparator) ++ if (!phy->comparator || !phy->comparator->set_vbus) + return -ENODEV; + + return phy->comparator->set_vbus(phy->comparator, enabled); +@@ -68,7 +68,7 @@ static int omap_usb_start_srp(struct usb_otg *otg) + { + struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); + +- if (!phy->comparator) ++ if (!phy->comparator || !phy->comparator->start_srp) + return -ENODEV; + + return phy->comparator->start_srp(phy->comparator); +-- +2.43.0 + diff --git a/queue-5.4/series b/queue-5.4/series index cfa83beefe1..181194d3e54 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -174,3 +174,8 @@ hid-apple-add-support-for-the-2021-magic-keyboard.patch hid-apple-swap-the-fn-and-left-control-keys-on-apple-keyboards.patch hid-apple-add-2021-magic-keyboard-fn-key-mapping.patch bonding-remove-print-in-bond_verify_device_path.patch +dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch +dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-2747 +phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch +dmaengine-fix-is_slave_direction-return-false-when-d.patch +phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch