From: Greg Kroah-Hartman Date: Sat, 14 Jan 2023 15:10:31 +0000 (+0100) Subject: 5.15-stable patches X-Git-Tag: v4.14.303~65 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c5b595b52be67eb97bf3d421a178733be126e3b5;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: cifs-fix-uninitialized-memory-read-for-smb311-posix-symlink-create.patch drm-msm-adreno-make-adreno-quirks-not-overwrite-each-other.patch drm-msm-dp-do-not-complete-dp_aux_cmd_fifo_tx-if-irq-is-not-for-aux-transfer.patch dt-bindings-msm-dsi-controller-main-fix-description-of-core-clock.patch dt-bindings-msm-dsi-controller-main-fix-operating-points-v2-constraint.patch dt-bindings-msm-dsi-controller-main-fix-power-domain-constraint.patch dt-bindings-msm-dsi-don-t-require-vcca-supply-on-14nm-phy.patch dt-bindings-msm-dsi-don-t-require-vdds-supply-on-10nm-phy.patch dt-bindings-msm-dsi-phy-28nm-add-missing-qcom-dsi-phy-regulator-ldo-mode.patch ipv6-raw-deduct-extension-header-length-in-rawv6_push_pending_frames.patch ixgbe-fix-pci-device-refcount-leak.patch platform-surface-aggregator-ignore-command-messages-not-intended-for-us.patch platform-x86-dell-privacy-fix-sw_camera_lens_cover-reporting.patch platform-x86-dell-privacy-only-register-sw_camera_lens_cover-if-present.patch platform-x86-ideapad-laptop-add-legion-5-15arh05-dmi-id-to-set_fn_lock_led_list.patch platform-x86-sony-laptop-don-t-turn-off-0x153-keyboard-backlight-during-probe.patch --- diff --git a/queue-5.15/cifs-fix-uninitialized-memory-read-for-smb311-posix-symlink-create.patch b/queue-5.15/cifs-fix-uninitialized-memory-read-for-smb311-posix-symlink-create.patch new file mode 100644 index 00000000000..ea83157141b --- /dev/null +++ b/queue-5.15/cifs-fix-uninitialized-memory-read-for-smb311-posix-symlink-create.patch @@ -0,0 +1,34 @@ +From a152d05ae4a71d802d50cf9177dba34e8bb09f68 Mon Sep 17 00:00:00 2001 +From: Volker Lendecke +Date: Wed, 11 Jan 2023 12:37:58 +0100 +Subject: cifs: Fix uninitialized memory read for smb311 posix symlink create + +From: Volker Lendecke + +commit a152d05ae4a71d802d50cf9177dba34e8bb09f68 upstream. + +If smb311 posix is enabled, we send the intended mode for file +creation in the posix create context. Instead of using what's there on +the stack, create the mfsymlink file with 0644. + +Fixes: ce558b0e17f8a ("smb3: Add posix create context for smb3.11 posix mounts") +Cc: stable@vger.kernel.org +Signed-off-by: Volker Lendecke +Reviewed-by: Tom Talpey +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/cifs/link.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/cifs/link.c ++++ b/fs/cifs/link.c +@@ -459,6 +459,7 @@ smb3_create_mf_symlink(unsigned int xid, + oparms.disposition = FILE_CREATE; + oparms.fid = &fid; + oparms.reconnect = false; ++ oparms.mode = 0644; + + rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL, + NULL, NULL); diff --git a/queue-5.15/drm-msm-adreno-make-adreno-quirks-not-overwrite-each-other.patch b/queue-5.15/drm-msm-adreno-make-adreno-quirks-not-overwrite-each-other.patch new file mode 100644 index 00000000000..409400567f4 --- /dev/null +++ b/queue-5.15/drm-msm-adreno-make-adreno-quirks-not-overwrite-each-other.patch @@ -0,0 +1,56 @@ +From 13ef096e342b00e30b95a90c6c13eee1f0bec4c5 Mon Sep 17 00:00:00 2001 +From: Konrad Dybcio +Date: Mon, 2 Jan 2023 11:02:00 +0100 +Subject: drm/msm/adreno: Make adreno quirks not overwrite each other + +From: Konrad Dybcio + +commit 13ef096e342b00e30b95a90c6c13eee1f0bec4c5 upstream. + +So far the adreno quirks have all been assigned with an OR operator, +which is problematic, because they were assigned consecutive integer +values, which makes checking them with an AND operator kind of no bueno.. + +Switch to using BIT(n) so that only the quirks that the programmer chose +are taken into account when evaluating info->quirks & ADRENO_QUIRK_... + +Fixes: 370063ee427a ("drm/msm/adreno: Add A540 support") +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Marijn Suijten +Reviewed-by: Rob Clark +Signed-off-by: Konrad Dybcio +Reviewed-by: Akhil P Oommen +Patchwork: https://patchwork.freedesktop.org/patch/516456/ +Link: https://lore.kernel.org/r/20230102100201.77286-1-konrad.dybcio@linaro.org +Signed-off-by: Rob Clark +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/adreno/adreno_gpu.h | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.h ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.h +@@ -29,11 +29,9 @@ enum { + ADRENO_FW_MAX, + }; + +-enum adreno_quirks { +- ADRENO_QUIRK_TWO_PASS_USE_WFI = 1, +- ADRENO_QUIRK_FAULT_DETECT_MASK = 2, +- ADRENO_QUIRK_LMLOADKILL_DISABLE = 3, +-}; ++#define ADRENO_QUIRK_TWO_PASS_USE_WFI BIT(0) ++#define ADRENO_QUIRK_FAULT_DETECT_MASK BIT(1) ++#define ADRENO_QUIRK_LMLOADKILL_DISABLE BIT(2) + + struct adreno_rev { + uint8_t core; +@@ -65,7 +63,7 @@ struct adreno_info { + const char *name; + const char *fw[ADRENO_FW_MAX]; + uint32_t gmem; +- enum adreno_quirks quirks; ++ u64 quirks; + struct msm_gpu *(*init)(struct drm_device *dev); + const char *zapfw; + u32 inactive_period; diff --git a/queue-5.15/drm-msm-dp-do-not-complete-dp_aux_cmd_fifo_tx-if-irq-is-not-for-aux-transfer.patch b/queue-5.15/drm-msm-dp-do-not-complete-dp_aux_cmd_fifo_tx-if-irq-is-not-for-aux-transfer.patch new file mode 100644 index 00000000000..c5a7228cc0f --- /dev/null +++ b/queue-5.15/drm-msm-dp-do-not-complete-dp_aux_cmd_fifo_tx-if-irq-is-not-for-aux-transfer.patch @@ -0,0 +1,77 @@ +From 1cba0d150fa102439114a91b3e215909efc9f169 Mon Sep 17 00:00:00 2001 +From: Kuogee Hsieh +Date: Tue, 27 Dec 2022 18:16:24 -0800 +Subject: drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer + +From: Kuogee Hsieh + +commit 1cba0d150fa102439114a91b3e215909efc9f169 upstream. + +There are 3 possible interrupt sources are handled by DP controller, +HPDstatus, Controller state changes and Aux read/write transaction. +At every irq, DP controller have to check isr status of every interrupt +sources and service the interrupt if its isr status bits shows interrupts +are pending. There is potential race condition may happen at current aux +isr handler implementation since it is always complete dp_aux_cmd_fifo_tx() +even irq is not for aux read or write transaction. This may cause aux read +transaction return premature if host aux data read is in the middle of +waiting for sink to complete transferring data to host while irq happen. +This will cause host's receiving buffer contains unexpected data. This +patch fixes this problem by checking aux isr and return immediately at +aux isr handler if there are no any isr status bits set. + +Current there is a bug report regrading eDP edid corruption happen during +system booting up. After lengthy debugging to found that VIDEO_READY +interrupt was continuously firing during system booting up which cause +dp_aux_isr() to complete dp_aux_cmd_fifo_tx() prematurely to retrieve data +from aux hardware buffer which is not yet contains complete data transfer +from sink. This cause edid corruption. + +Follows are the signature at kernel logs when problem happen, +EDID has corrupt header +panel-simple-dp-aux aux-aea0000.edp: Couldn't identify panel via EDID + +Changes in v2: +-- do complete if (ret == IRQ_HANDLED) ay dp-aux_isr() +-- add more commit text + +Changes in v3: +-- add Stephen suggested +-- dp_aux_isr() return IRQ_XXX back to caller +-- dp_ctrl_isr() return IRQ_XXX back to caller + +Changes in v4: +-- split into two patches + +Changes in v5: +-- delete empty line between tags + +Changes in v6: +-- remove extra "that" and fixed line more than 75 char at commit text + +Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") +Signed-off-by: Kuogee Hsieh +Tested-by: Douglas Anderson +Reviewed-by: Abhinav Kumar +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/516121/ +Link: https://lore.kernel.org/r/1672193785-11003-2-git-send-email-quic_khsieh@quicinc.com +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/dp/dp_aux.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/msm/dp/dp_aux.c ++++ b/drivers/gpu/drm/msm/dp/dp_aux.c +@@ -406,6 +406,10 @@ void dp_aux_isr(struct drm_dp_aux *dp_au + + isr = dp_catalog_aux_get_irq(aux->catalog); + ++ /* no interrupts pending, return immediately */ ++ if (!isr) ++ return; ++ + if (!aux->cmd_busy) + return; + diff --git a/queue-5.15/dt-bindings-msm-dsi-controller-main-fix-description-of-core-clock.patch b/queue-5.15/dt-bindings-msm-dsi-controller-main-fix-description-of-core-clock.patch new file mode 100644 index 00000000000..7e514506317 --- /dev/null +++ b/queue-5.15/dt-bindings-msm-dsi-controller-main-fix-description-of-core-clock.patch @@ -0,0 +1,35 @@ +From 654ffe4b793b42ed6b5909daff0b91809916d94e Mon Sep 17 00:00:00 2001 +From: Bryan O'Donoghue +Date: Fri, 23 Dec 2022 02:10:10 +0000 +Subject: dt-bindings: msm: dsi-controller-main: Fix description of core clock + +From: Bryan O'Donoghue + +commit 654ffe4b793b42ed6b5909daff0b91809916d94e upstream. + +There's a typo in describing the core clock as an 'escape' clock. The +accurate description is 'core'. + +Fixes: 4dbe55c97741 ("dt-bindings: msm: dsi: add yaml schemas for DSI bindings") +Reviewed-by: Dmitry Baryshkov +Acked-by: Krzysztof Kozlowski +Signed-off-by: Bryan O'Donoghue +Patchwork: https://patchwork.freedesktop.org/patch/515938/ +Link: https://lore.kernel.org/r/20221223021025.1646636-4-bryan.odonoghue@linaro.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml ++++ b/Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml +@@ -31,7 +31,7 @@ properties: + - description: Display byte clock + - description: Display byte interface clock + - description: Display pixel clock +- - description: Display escape clock ++ - description: Display core clock + - description: Display AHB clock + - description: Display AXI clock + diff --git a/queue-5.15/dt-bindings-msm-dsi-controller-main-fix-operating-points-v2-constraint.patch b/queue-5.15/dt-bindings-msm-dsi-controller-main-fix-operating-points-v2-constraint.patch new file mode 100644 index 00000000000..de18b811f35 --- /dev/null +++ b/queue-5.15/dt-bindings-msm-dsi-controller-main-fix-operating-points-v2-constraint.patch @@ -0,0 +1,33 @@ +From cdf64343f91a1225e9e3d4ce4261962cd41b4ddd Mon Sep 17 00:00:00 2001 +From: Bryan O'Donoghue +Date: Fri, 23 Dec 2022 02:10:08 +0000 +Subject: dt-bindings: msm: dsi-controller-main: Fix operating-points-v2 constraint + +From: Bryan O'Donoghue + +commit cdf64343f91a1225e9e3d4ce4261962cd41b4ddd upstream. + +The existing msm8916.dtsi does not depend on nor require operating points. + +Fixes: 4dbe55c97741 ("dt-bindings: msm: dsi: add yaml schemas for DSI bindings") +Reviewed-by: Dmitry Baryshkov +Acked-by: Krzysztof Kozlowski +Signed-off-by: Bryan O'Donoghue +Patchwork: https://patchwork.freedesktop.org/patch/515940/ +Link: https://lore.kernel.org/r/20221223021025.1646636-2-bryan.odonoghue@linaro.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml | 1 - + 1 file changed, 1 deletion(-) + +--- a/Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml ++++ b/Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml +@@ -136,7 +136,6 @@ required: + - assigned-clocks + - assigned-clock-parents + - power-domains +- - operating-points-v2 + - ports + + additionalProperties: false diff --git a/queue-5.15/dt-bindings-msm-dsi-controller-main-fix-power-domain-constraint.patch b/queue-5.15/dt-bindings-msm-dsi-controller-main-fix-power-domain-constraint.patch new file mode 100644 index 00000000000..61d0ba92ac4 --- /dev/null +++ b/queue-5.15/dt-bindings-msm-dsi-controller-main-fix-power-domain-constraint.patch @@ -0,0 +1,51 @@ +From a6f033938beb31f893302a93f83ec0b6460c6cac Mon Sep 17 00:00:00 2001 +From: Bryan O'Donoghue +Date: Fri, 23 Dec 2022 02:10:09 +0000 +Subject: dt-bindings: msm: dsi-controller-main: Fix power-domain constraint + +From: Bryan O'Donoghue + +commit a6f033938beb31f893302a93f83ec0b6460c6cac upstream. + +power-domain is required for the sc7180 dispcc GDSC but not every qcom SoC +has a similar dependency for example the apq8064. + +Most Qcom SoC's using mdss-dsi-ctrl seem to have the ability to +power-collapse the MDP without collapsing DSI. + +For example the qcom vendor kernel commit for apq8084, msm8226, msm8916, +msm8974. + +https://review.carbonrom.org/plugins/gitiles/CarbonROM/android_kernel_oneplus_msm8994/+/7b5c011a770daa2811778937ed646237a28a8694 + +"ARM: dts: msm: add mdss gdsc supply to dsi controller device + + It is possible for the DSI controller to be active when MDP is + power collapsed. DSI controller needs to have it's own vote for + mdss gdsc to ensure that gdsc remains on in such cases." + +This however doesn't appear to be the case for the apq8064 so we shouldn't +be marking power-domain as required in yaml checks. + +Fixes: 4dbe55c97741 ("dt-bindings: msm: dsi: add yaml schemas for DSI bindings") +Reviewed-by: Dmitry Baryshkov +Acked-by: Krzysztof Kozlowski +Signed-off-by: Bryan O'Donoghue +Patchwork: https://patchwork.freedesktop.org/patch/515958/ +Link: https://lore.kernel.org/r/20221223021025.1646636-3-bryan.odonoghue@linaro.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml | 1 - + 1 file changed, 1 deletion(-) + +--- a/Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml ++++ b/Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml +@@ -135,7 +135,6 @@ required: + - phy-names + - assigned-clocks + - assigned-clock-parents +- - power-domains + - ports + + additionalProperties: false diff --git a/queue-5.15/dt-bindings-msm-dsi-don-t-require-vcca-supply-on-14nm-phy.patch b/queue-5.15/dt-bindings-msm-dsi-don-t-require-vcca-supply-on-14nm-phy.patch new file mode 100644 index 00000000000..24740c5462c --- /dev/null +++ b/queue-5.15/dt-bindings-msm-dsi-don-t-require-vcca-supply-on-14nm-phy.patch @@ -0,0 +1,36 @@ +From a2117773c839a8439a3771e0c040b5c505b083a7 Mon Sep 17 00:00:00 2001 +From: Konrad Dybcio +Date: Wed, 30 Nov 2022 14:58:07 +0100 +Subject: dt-bindings: msm/dsi: Don't require vcca-supply on 14nm PHY + +From: Konrad Dybcio + +commit a2117773c839a8439a3771e0c040b5c505b083a7 upstream. + +On some SoCs (hello SM6115) vcca-supply is not wired to any smd-rpm +or rpmh regulator, but instead powered by the VDD_MX line, which is +voted for in the DSI ctrl node. + +Signed-off-by: Konrad Dybcio +Acked-by: Krzysztof Kozlowski +Reviewed-by: Dmitry Baryshkov +Fixes: 8fc939e72ff8 ("dt-bindings: msm: dsi: add yaml schemas for DSI PHY bindings") +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/513555/ +Link: https://lore.kernel.org/r/20221130135807.45028-1-konrad.dybcio@linaro.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/display/msm/dsi-phy-14nm.yaml | 1 - + 1 file changed, 1 deletion(-) + +--- a/Documentation/devicetree/bindings/display/msm/dsi-phy-14nm.yaml ++++ b/Documentation/devicetree/bindings/display/msm/dsi-phy-14nm.yaml +@@ -37,7 +37,6 @@ required: + - compatible + - reg + - reg-names +- - vcca-supply + + unevaluatedProperties: false + diff --git a/queue-5.15/dt-bindings-msm-dsi-don-t-require-vdds-supply-on-10nm-phy.patch b/queue-5.15/dt-bindings-msm-dsi-don-t-require-vdds-supply-on-10nm-phy.patch new file mode 100644 index 00000000000..e0903c31dd4 --- /dev/null +++ b/queue-5.15/dt-bindings-msm-dsi-don-t-require-vdds-supply-on-10nm-phy.patch @@ -0,0 +1,35 @@ +From ef11cb7a29c0e13031c968190ea8f86104e7fb6a Mon Sep 17 00:00:00 2001 +From: Konrad Dybcio +Date: Wed, 16 Nov 2022 17:32:18 +0100 +Subject: dt-bindings: msm/dsi: Don't require vdds-supply on 10nm PHY + +From: Konrad Dybcio + +commit ef11cb7a29c0e13031c968190ea8f86104e7fb6a upstream. + +On some SoCs (hello SM6350) vdds-supply is not wired to any smd-rpm +or rpmh regulator, but instead powered by the VDD_MX/mx.lvl line, +which is voted for in the DSI ctrl node. + +Signed-off-by: Konrad Dybcio +Acked-by: Rob Herring +Fixes: 8fc939e72ff8 ("dt-bindings: msm: dsi: add yaml schemas for DSI PHY bindings") +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/511889/ +Link: https://lore.kernel.org/r/20221116163218.42449-1-konrad.dybcio@linaro.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/display/msm/dsi-phy-10nm.yaml | 1 - + 1 file changed, 1 deletion(-) + +--- a/Documentation/devicetree/bindings/display/msm/dsi-phy-10nm.yaml ++++ b/Documentation/devicetree/bindings/display/msm/dsi-phy-10nm.yaml +@@ -39,7 +39,6 @@ required: + - compatible + - reg + - reg-names +- - vdds-supply + + unevaluatedProperties: false + diff --git a/queue-5.15/dt-bindings-msm-dsi-phy-28nm-add-missing-qcom-dsi-phy-regulator-ldo-mode.patch b/queue-5.15/dt-bindings-msm-dsi-phy-28nm-add-missing-qcom-dsi-phy-regulator-ldo-mode.patch new file mode 100644 index 00000000000..97bdc9e4de4 --- /dev/null +++ b/queue-5.15/dt-bindings-msm-dsi-phy-28nm-add-missing-qcom-dsi-phy-regulator-ldo-mode.patch @@ -0,0 +1,41 @@ +From be79f805a1e1b95605c825f1c513bdd2c8b167ed Mon Sep 17 00:00:00 2001 +From: Bryan O'Donoghue +Date: Thu, 29 Dec 2022 12:44:38 +0000 +Subject: dt-bindings: msm: dsi-phy-28nm: Add missing qcom, dsi-phy-regulator-ldo-mode + +From: Bryan O'Donoghue + +commit be79f805a1e1b95605c825f1c513bdd2c8b167ed upstream. + +Add in missing qcom,dsi-phy-regulator-ldo-mode to the 28nm DSI PHY. +When converting from .txt to .yaml we missed this one. + +Fixes: 4dbe55c97741 ("dt-bindings: msm: dsi: add yaml schemas for DSI bindings") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Bryan O'Donoghue +Patchwork: https://patchwork.freedesktop.org/patch/516205/ +Link: https://lore.kernel.org/r/20221229124438.504770-2-bryan.odonoghue@linaro.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + .../devicetree/bindings/display/msm/dsi-phy-28nm.yaml | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/Documentation/devicetree/bindings/display/msm/dsi-phy-28nm.yaml b/Documentation/devicetree/bindings/display/msm/dsi-phy-28nm.yaml +index 3d8540a06fe2..2f1fd140c87d 100644 +--- a/Documentation/devicetree/bindings/display/msm/dsi-phy-28nm.yaml ++++ b/Documentation/devicetree/bindings/display/msm/dsi-phy-28nm.yaml +@@ -34,6 +34,10 @@ properties: + vddio-supply: + description: Phandle to vdd-io regulator device node. + ++ qcom,dsi-phy-regulator-ldo-mode: ++ type: boolean ++ description: Indicates if the LDO mode PHY regulator is wanted. ++ + required: + - compatible + - reg +-- +2.39.0 + diff --git a/queue-5.15/ipv6-raw-deduct-extension-header-length-in-rawv6_push_pending_frames.patch b/queue-5.15/ipv6-raw-deduct-extension-header-length-in-rawv6_push_pending_frames.patch new file mode 100644 index 00000000000..43dc059121c --- /dev/null +++ b/queue-5.15/ipv6-raw-deduct-extension-header-length-in-rawv6_push_pending_frames.patch @@ -0,0 +1,42 @@ +From cb3e9864cdbe35ff6378966660edbcbac955fe17 Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Tue, 10 Jan 2023 08:59:06 +0800 +Subject: ipv6: raw: Deduct extension header length in rawv6_push_pending_frames + +From: Herbert Xu + +commit cb3e9864cdbe35ff6378966660edbcbac955fe17 upstream. + +The total cork length created by ip6_append_data includes extension +headers, so we must exclude them when comparing them against the +IPV6_CHECKSUM offset which does not include extension headers. + +Reported-by: Kyle Zeng +Fixes: 357b40a18b04 ("[IPV6]: IPV6_CHECKSUM socket option can corrupt kernel memory") +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/raw.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/ipv6/raw.c ++++ b/net/ipv6/raw.c +@@ -539,6 +539,7 @@ csum_copy_err: + static int rawv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6, + struct raw6_sock *rp) + { ++ struct ipv6_txoptions *opt; + struct sk_buff *skb; + int err = 0; + int offset; +@@ -556,6 +557,9 @@ static int rawv6_push_pending_frames(str + + offset = rp->offset; + total_len = inet_sk(sk)->cork.base.length; ++ opt = inet6_sk(sk)->cork.opt; ++ total_len -= opt ? opt->opt_flen : 0; ++ + if (offset >= total_len - 1) { + err = -EINVAL; + ip6_flush_pending_frames(sk); diff --git a/queue-5.15/ixgbe-fix-pci-device-refcount-leak.patch b/queue-5.15/ixgbe-fix-pci-device-refcount-leak.patch new file mode 100644 index 00000000000..cfb3780513d --- /dev/null +++ b/queue-5.15/ixgbe-fix-pci-device-refcount-leak.patch @@ -0,0 +1,70 @@ +From b93fb4405fcb5112c5739c5349afb52ec7f15c07 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Tue, 29 Nov 2022 09:57:48 +0800 +Subject: ixgbe: fix pci device refcount leak + +From: Yang Yingliang + +commit b93fb4405fcb5112c5739c5349afb52ec7f15c07 upstream. + +As the comment of pci_get_domain_bus_and_slot() says, it +returns a PCI device with refcount incremented, when finish +using it, the caller must decrement the reference count by +calling pci_dev_put(). + +In ixgbe_get_first_secondary_devfn() and ixgbe_x550em_a_has_mii(), +pci_dev_put() is called to avoid leak. + +Fixes: 8fa10ef01260 ("ixgbe: register a mdiobus") +Signed-off-by: Yang Yingliang +Tested-by: Gurucharan G (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c +@@ -855,9 +855,11 @@ static struct pci_dev *ixgbe_get_first_s + rp_pdev = pci_get_domain_bus_and_slot(0, 0, devfn); + if (rp_pdev && rp_pdev->subordinate) { + bus = rp_pdev->subordinate->number; ++ pci_dev_put(rp_pdev); + return pci_get_domain_bus_and_slot(0, bus, 0); + } + ++ pci_dev_put(rp_pdev); + return NULL; + } + +@@ -874,6 +876,7 @@ static bool ixgbe_x550em_a_has_mii(struc + struct ixgbe_adapter *adapter = hw->back; + struct pci_dev *pdev = adapter->pdev; + struct pci_dev *func0_pdev; ++ bool has_mii = false; + + /* For the C3000 family of SoCs (x550em_a) the internal ixgbe devices + * are always downstream of root ports @ 0000:00:16.0 & 0000:00:17.0 +@@ -884,15 +887,16 @@ static bool ixgbe_x550em_a_has_mii(struc + func0_pdev = ixgbe_get_first_secondary_devfn(PCI_DEVFN(0x16, 0)); + if (func0_pdev) { + if (func0_pdev == pdev) +- return true; +- else +- return false; ++ has_mii = true; ++ goto out; + } + func0_pdev = ixgbe_get_first_secondary_devfn(PCI_DEVFN(0x17, 0)); + if (func0_pdev == pdev) +- return true; ++ has_mii = true; + +- return false; ++out: ++ pci_dev_put(func0_pdev); ++ return has_mii; + } + + /** diff --git a/queue-5.15/platform-surface-aggregator-ignore-command-messages-not-intended-for-us.patch b/queue-5.15/platform-surface-aggregator-ignore-command-messages-not-intended-for-us.patch new file mode 100644 index 00000000000..bbe7d70ff6c --- /dev/null +++ b/queue-5.15/platform-surface-aggregator-ignore-command-messages-not-intended-for-us.patch @@ -0,0 +1,79 @@ +From ae0fa0a3126a86c801c3220fcd8eefe03aa39f3e Mon Sep 17 00:00:00 2001 +From: Maximilian Luz +Date: Fri, 2 Dec 2022 23:33:19 +0100 +Subject: platform/surface: aggregator: Ignore command messages not intended for us + +From: Maximilian Luz + +commit ae0fa0a3126a86c801c3220fcd8eefe03aa39f3e upstream. + +It is possible that we (the host/kernel driver) receive command messages +that are not intended for us. Ignore those for now. + +The whole story is a bit more complicated: It is possible to enable +debug output on SAM, which is sent via SSH command messages. By default +this output is sent to a debug connector, with its own target ID +(TID=0x03). It is possible to override the target of the debug output +and set it to the host/kernel driver. This, however, does not change the +original target ID of the message. Meaning, we receive messages with +TID=0x03 (debug) but expect to only receive messages with TID=0x00 +(host). + +The problem is that the different target ID also comes with a different +scope of request IDs. In particular, these do not follow the standard +event rules (i.e. do not fall into a set of small reserved values). +Therefore, current message handling interprets them as responses to +pending requests and tries to match them up via the request ID. However, +these debug output messages are not in fact responses, and therefore +this will at best fail to find the request and at worst pass on the +wrong data as response for a request. + +Therefore ignore any command messages not intended for us (host) for +now. We can implement support for the debug messages once we have a +better understanding of them. + +Note that this may also provide a bit more stability and avoid some +driver confusion in case any other targets want to talk to us in the +future, since we don't yet know what to do with those as well. A warning +for the dropped messages should suffice for now and also give us a +chance of discovering new targets if they come along without any +potential for bugs/instabilities. + +Fixes: c167b9c7e3d6 ("platform/surface: Add Surface Aggregator subsystem") +Signed-off-by: Maximilian Luz +Link: https://lore.kernel.org/r/20221202223327.690880-2-luzmaximilian@gmail.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman +--- + .../surface/aggregator/ssh_request_layer.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/platform/surface/aggregator/ssh_request_layer.c b/drivers/platform/surface/aggregator/ssh_request_layer.c +index f5565570f16c..69132976d297 100644 +--- a/drivers/platform/surface/aggregator/ssh_request_layer.c ++++ b/drivers/platform/surface/aggregator/ssh_request_layer.c +@@ -916,6 +916,20 @@ static void ssh_rtl_rx_command(struct ssh_ptl *p, const struct ssam_span *data) + if (sshp_parse_command(dev, data, &command, &command_data)) + return; + ++ /* ++ * Check if the message was intended for us. If not, drop it. ++ * ++ * Note: We will need to change this to handle debug messages. On newer ++ * generation devices, these seem to be sent to tid_out=0x03. We as ++ * host can still receive them as they can be forwarded via an override ++ * option on SAM, but doing so does not change tid_out=0x00. ++ */ ++ if (command->tid_out != 0x00) { ++ rtl_warn(rtl, "rtl: dropping message not intended for us (tid = %#04x)\n", ++ command->tid_out); ++ return; ++ } ++ + if (ssh_rqid_is_event(get_unaligned_le16(&command->rqid))) + ssh_rtl_rx_event(rtl, command, &command_data); + else +-- +2.39.0 + diff --git a/queue-5.15/platform-x86-dell-privacy-fix-sw_camera_lens_cover-reporting.patch b/queue-5.15/platform-x86-dell-privacy-fix-sw_camera_lens_cover-reporting.patch new file mode 100644 index 00000000000..4a938ba39c9 --- /dev/null +++ b/queue-5.15/platform-x86-dell-privacy-fix-sw_camera_lens_cover-reporting.patch @@ -0,0 +1,80 @@ +From 1af7fef0d9d3fa075bf4e850f705df1fe97d33ce Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 21 Dec 2022 23:07:23 +0100 +Subject: platform/x86: dell-privacy: Fix SW_CAMERA_LENS_COVER reporting + +From: Hans de Goede + +commit 1af7fef0d9d3fa075bf4e850f705df1fe97d33ce upstream. + +Use KE_VSW instead of KE_SW for the SW_CAMERA_LENS_COVER key_entry +and get the value of the switch from the status field when handling +SW_CAMERA_LENS_COVER events, instead of always reporting 0. + +Also correctly set the initial SW_CAMERA_LENS_COVER value. + +Fixes: 8af9fa37b8a3 ("platform/x86: dell-privacy: Add support for Dell hardware privacy") +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20221221220724.119594-1-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/dell/dell-wmi-privacy.c | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +--- a/drivers/platform/x86/dell/dell-wmi-privacy.c ++++ b/drivers/platform/x86/dell/dell-wmi-privacy.c +@@ -61,7 +61,7 @@ static const struct key_entry dell_wmi_k + /* privacy mic mute */ + { KE_KEY, 0x0001, { KEY_MICMUTE } }, + /* privacy camera mute */ +- { KE_SW, 0x0002, { SW_CAMERA_LENS_COVER } }, ++ { KE_VSW, 0x0002, { SW_CAMERA_LENS_COVER } }, + { KE_END, 0}, + }; + +@@ -115,11 +115,15 @@ bool dell_privacy_process_event(int type + + switch (code) { + case DELL_PRIVACY_AUDIO_EVENT: /* Mic mute */ +- case DELL_PRIVACY_CAMERA_EVENT: /* Camera mute */ + priv->last_status = status; + sparse_keymap_report_entry(priv->input_dev, key, 1, true); + ret = true; + break; ++ case DELL_PRIVACY_CAMERA_EVENT: /* Camera mute */ ++ priv->last_status = status; ++ sparse_keymap_report_entry(priv->input_dev, key, !(status & CAMERA_STATUS), false); ++ ret = true; ++ break; + default: + dev_dbg(&priv->wdev->dev, "unknown event type 0x%04x 0x%04x\n", type, code); + } +@@ -307,6 +311,11 @@ static int dell_privacy_wmi_probe(struct + + dev_set_drvdata(&wdev->dev, priv); + priv->wdev = wdev; ++ ++ ret = get_current_status(priv->wdev); ++ if (ret) ++ return ret; ++ + /* create evdev passing interface */ + priv->input_dev = devm_input_allocate_device(&wdev->dev); + if (!priv->input_dev) +@@ -345,11 +354,12 @@ static int dell_privacy_wmi_probe(struct + priv->input_dev->name = "Dell Privacy Driver"; + priv->input_dev->id.bustype = BUS_HOST; + +- ret = input_register_device(priv->input_dev); +- if (ret) +- return ret; ++ /* Report initial camera-cover status */ ++ if (priv->features_present & BIT(DELL_PRIVACY_TYPE_CAMERA)) ++ input_report_switch(priv->input_dev, SW_CAMERA_LENS_COVER, ++ !(priv->last_status & CAMERA_STATUS)); + +- ret = get_current_status(priv->wdev); ++ ret = input_register_device(priv->input_dev); + if (ret) + return ret; + diff --git a/queue-5.15/platform-x86-dell-privacy-only-register-sw_camera_lens_cover-if-present.patch b/queue-5.15/platform-x86-dell-privacy-only-register-sw_camera_lens_cover-if-present.patch new file mode 100644 index 00000000000..7c68f4d5c0c --- /dev/null +++ b/queue-5.15/platform-x86-dell-privacy-only-register-sw_camera_lens_cover-if-present.patch @@ -0,0 +1,65 @@ +From 6dc485f9940df8105ea729cbeb7a7d18d409dde5 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 21 Dec 2022 23:07:24 +0100 +Subject: platform/x86: dell-privacy: Only register SW_CAMERA_LENS_COVER if present + +From: Hans de Goede + +commit 6dc485f9940df8105ea729cbeb7a7d18d409dde5 upstream. + +Unlike keys where userspace only reacts to keypresses, userspace may act +on switches in both (0 and 1) of their positions. + +For example if a SW_TABLET_MODE switch is registered then GNOME will not +automatically show the onscreen keyboard when a text field gets focus on +touchscreen devices when SW_TABLET_MODE reports 0 and when SW_TABLET_MODE +reports 1 libinput will block (filter out) builtin keyboard and touchpad +events. + +So to avoid unwanted side-effects EV_SW type inputs should only be +registered if they are actually present, only register SW_CAMERA_LENS_COVER +if it is actually there. + +Fixes: 8af9fa37b8a3 ("platform/x86: dell-privacy: Add support for Dell hardware privacy") +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20221221220724.119594-2-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/dell/dell-wmi-privacy.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/platform/x86/dell/dell-wmi-privacy.c ++++ b/drivers/platform/x86/dell/dell-wmi-privacy.c +@@ -295,7 +295,7 @@ static int dell_privacy_wmi_probe(struct + { + struct privacy_wmi_data *priv; + struct key_entry *keymap; +- int ret, i; ++ int ret, i, j; + + ret = wmi_has_guid(DELL_PRIVACY_GUID); + if (!ret) +@@ -321,9 +321,20 @@ static int dell_privacy_wmi_probe(struct + /* remap the keymap code with Dell privacy key type 0x12 as prefix + * KEY_MICMUTE scancode will be reported as 0x120001 + */ +- for (i = 0; i < ARRAY_SIZE(dell_wmi_keymap_type_0012); i++) { +- keymap[i] = dell_wmi_keymap_type_0012[i]; +- keymap[i].code |= (0x0012 << 16); ++ for (i = 0, j = 0; i < ARRAY_SIZE(dell_wmi_keymap_type_0012); i++) { ++ /* ++ * Unlike keys where only presses matter, userspace may act ++ * on switches in both of their positions. Only register ++ * SW_CAMERA_LENS_COVER if it is actually there. ++ */ ++ if (dell_wmi_keymap_type_0012[i].type == KE_VSW && ++ dell_wmi_keymap_type_0012[i].sw.code == SW_CAMERA_LENS_COVER && ++ !(priv->features_present & BIT(DELL_PRIVACY_TYPE_CAMERA))) ++ continue; ++ ++ keymap[j] = dell_wmi_keymap_type_0012[i]; ++ keymap[j].code |= (0x0012 << 16); ++ j++; + } + ret = sparse_keymap_setup(priv->input_dev, keymap, NULL); + kfree(keymap); diff --git a/queue-5.15/platform-x86-ideapad-laptop-add-legion-5-15arh05-dmi-id-to-set_fn_lock_led_list.patch b/queue-5.15/platform-x86-ideapad-laptop-add-legion-5-15arh05-dmi-id-to-set_fn_lock_led_list.patch new file mode 100644 index 00000000000..34b456f3bbf --- /dev/null +++ b/queue-5.15/platform-x86-ideapad-laptop-add-legion-5-15arh05-dmi-id-to-set_fn_lock_led_list.patch @@ -0,0 +1,39 @@ +From f4b7f8febd4d9b615fbec2a06bf352b9c3729b11 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 15 Dec 2022 16:43:57 +0100 +Subject: platform/x86: ideapad-laptop: Add Legion 5 15ARH05 DMI id to set_fn_lock_led_list[] + +From: Hans de Goede + +commit f4b7f8febd4d9b615fbec2a06bf352b9c3729b11 upstream. + +The Lenovo Legion 5 15ARH05 needs ideapad-laptop to call SALS_FNLOCK_ON / +SALS_FNLOCK_OFF on Fn-lock state change to get the LED in the Fn key to +correctly reflect the Fn-lock state. + +Add a DMI match for the Legion 5 15ARH05 to the set_fn_lock_led_list[] +table for this. + +Fixes: 81a5603a0f50 ("platform/x86: ideapad-laptop: Fix interrupt storm on fn-lock toggle on some Yoga laptops") +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20221215154357.123876-1-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/ideapad-laptop.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -1493,6 +1493,12 @@ static const struct dmi_system_id set_fn + DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Legion R7000P2020H"), + } + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Legion 5 15ARH05"), ++ } ++ }, + {} + }; + diff --git a/queue-5.15/platform-x86-sony-laptop-don-t-turn-off-0x153-keyboard-backlight-during-probe.patch b/queue-5.15/platform-x86-sony-laptop-don-t-turn-off-0x153-keyboard-backlight-during-probe.patch new file mode 100644 index 00000000000..eebc1ac551c --- /dev/null +++ b/queue-5.15/platform-x86-sony-laptop-don-t-turn-off-0x153-keyboard-backlight-during-probe.patch @@ -0,0 +1,58 @@ +From ad75bd85b1db69c97eefea07b375567821f6ef58 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Tue, 13 Dec 2022 13:29:43 +0100 +Subject: platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe + +From: Hans de Goede + +commit ad75bd85b1db69c97eefea07b375567821f6ef58 upstream. + +The 0x153 version of the kbd backlight control SNC handle has no separate +address to probe if the backlight is there. + +This turns the probe call into a set keyboard backlight call with a value +of 0 turning off the keyboard backlight. + +Skip probing when there is no separate probe address to avoid this. + +Link: https://bugzilla.redhat.com/show_bug.cgi?id=1583752 +Fixes: 800f20170dcf ("Keyboard backlight control for some Vaio Fit models") +Signed-off-by: Hans de Goede +Reviewed-by: Mattia Dongili +Link: https://lore.kernel.org/r/20221213122943.11123-1-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/sony-laptop.c | 21 ++++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +--- a/drivers/platform/x86/sony-laptop.c ++++ b/drivers/platform/x86/sony-laptop.c +@@ -1892,14 +1892,21 @@ static int sony_nc_kbd_backlight_setup(s + break; + } + +- ret = sony_call_snc_handle(handle, probe_base, &result); +- if (ret) +- return ret; ++ /* ++ * Only probe if there is a separate probe_base, otherwise the probe call ++ * is equivalent to __sony_nc_kbd_backlight_mode_set(0), resulting in ++ * the keyboard backlight being turned off. ++ */ ++ if (probe_base) { ++ ret = sony_call_snc_handle(handle, probe_base, &result); ++ if (ret) ++ return ret; + +- if ((handle == 0x0137 && !(result & 0x02)) || +- !(result & 0x01)) { +- dprintk("no backlight keyboard found\n"); +- return 0; ++ if ((handle == 0x0137 && !(result & 0x02)) || ++ !(result & 0x01)) { ++ dprintk("no backlight keyboard found\n"); ++ return 0; ++ } + } + + kbdbl_ctl = kzalloc(sizeof(*kbdbl_ctl), GFP_KERNEL); diff --git a/queue-5.15/series b/queue-5.15/series index b0af4542ee1..a90ec1c1f53 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -16,3 +16,19 @@ s390-percpu-add-read_once-to-arch_this_cpu_to_op_simple.patch drm-virtio-fix-gem-handle-creation-uaf.patch drm-i915-gt-reset-twice.patch net-mlx5e-set-action-fwd-flag-when-parsing-tc-action-goto.patch +cifs-fix-uninitialized-memory-read-for-smb311-posix-symlink-create.patch +platform-x86-dell-privacy-only-register-sw_camera_lens_cover-if-present.patch +platform-surface-aggregator-ignore-command-messages-not-intended-for-us.patch +platform-x86-dell-privacy-fix-sw_camera_lens_cover-reporting.patch +dt-bindings-msm-dsi-controller-main-fix-operating-points-v2-constraint.patch +drm-msm-adreno-make-adreno-quirks-not-overwrite-each-other.patch +dt-bindings-msm-dsi-controller-main-fix-power-domain-constraint.patch +dt-bindings-msm-dsi-controller-main-fix-description-of-core-clock.patch +dt-bindings-msm-dsi-phy-28nm-add-missing-qcom-dsi-phy-regulator-ldo-mode.patch +platform-x86-ideapad-laptop-add-legion-5-15arh05-dmi-id-to-set_fn_lock_led_list.patch +drm-msm-dp-do-not-complete-dp_aux_cmd_fifo_tx-if-irq-is-not-for-aux-transfer.patch +dt-bindings-msm-dsi-don-t-require-vdds-supply-on-10nm-phy.patch +dt-bindings-msm-dsi-don-t-require-vcca-supply-on-14nm-phy.patch +platform-x86-sony-laptop-don-t-turn-off-0x153-keyboard-backlight-during-probe.patch +ixgbe-fix-pci-device-refcount-leak.patch +ipv6-raw-deduct-extension-header-length-in-rawv6_push_pending_frames.patch