From: Sasha Levin Date: Wed, 7 Feb 2024 16:25:08 +0000 (-0500) Subject: Fixes for 5.10 X-Git-Tag: v6.1.78~74 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d9417b3c1cc91ec7e690995bb3bd80902cdae229;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/dmaengine-fix-is_slave_direction-return-false-when-d.patch b/queue-5.10/dmaengine-fix-is_slave_direction-return-false-when-d.patch new file mode 100644 index 00000000000..e2407485eb1 --- /dev/null +++ b/queue-5.10/dmaengine-fix-is_slave_direction-return-false-when-d.patch @@ -0,0 +1,37 @@ +From b6fbe7585e943fd426021de49ad904a2759448b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 12:28:41 -0500 +Subject: dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV + +From: Frank Li + +[ Upstream commit a22fe1d6dec7e98535b97249fdc95c2be79120bb ] + +is_slave_direction() should return true when direction is DMA_DEV_TO_DEV. + +Fixes: 49920bc66984 ("dmaengine: add new enum dma_transfer_direction") +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20240123172842.3764529-1-Frank.Li@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + include/linux/dmaengine.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h +index dd357a747780..4e4cce0ad4d7 100644 +--- a/include/linux/dmaengine.h ++++ b/include/linux/dmaengine.h +@@ -949,7 +949,8 @@ static inline int dmaengine_slave_config(struct dma_chan *chan, + + static inline bool is_slave_direction(enum dma_transfer_direction direction) + { +- return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM); ++ return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM) || ++ (direction == DMA_DEV_TO_DEV); + } + + static inline struct dma_async_tx_descriptor *dmaengine_prep_slave_single( +-- +2.43.0 + diff --git a/queue-5.10/dmaengine-fsl-dpaa2-qdma-fix-the-size-of-dma-pools.patch b/queue-5.10/dmaengine-fsl-dpaa2-qdma-fix-the-size-of-dma-pools.patch new file mode 100644 index 00000000000..214d7e67fd0 --- /dev/null +++ b/queue-5.10/dmaengine-fsl-dpaa2-qdma-fix-the-size-of-dma-pools.patch @@ -0,0 +1,54 @@ +From b41053dd48f9e48d448bf9b1cb14e4bf74072f39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 11:29:16 -0500 +Subject: dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools + +From: Guanhua Gao + +[ Upstream commit b73e43dcd7a8be26880ef8ff336053b29e79dbc5 ] + +In case of long format of qDMA command descriptor, there are one frame +descriptor, three entries in the frame list and two data entries. So the +size of dma_pool_create for these three fields should be the same with +the total size of entries respectively, or the contents may be overwritten +by the next allocated descriptor. + +Fixes: 7fdf9b05c73b ("dmaengine: fsl-dpaa2-qdma: Add NXP dpaa2 qDMA controller driver for Layerscape SoCs") +Signed-off-by: Guanhua Gao +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20240118162917.2951450-1-Frank.Li@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c b/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c +index 4ae057922ef1..2d905f0633d5 100644 +--- a/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c ++++ b/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c +@@ -38,15 +38,17 @@ static int dpaa2_qdma_alloc_chan_resources(struct dma_chan *chan) + if (!dpaa2_chan->fd_pool) + goto err; + +- dpaa2_chan->fl_pool = dma_pool_create("fl_pool", dev, +- sizeof(struct dpaa2_fl_entry), +- sizeof(struct dpaa2_fl_entry), 0); ++ dpaa2_chan->fl_pool = ++ dma_pool_create("fl_pool", dev, ++ sizeof(struct dpaa2_fl_entry) * 3, ++ sizeof(struct dpaa2_fl_entry), 0); ++ + if (!dpaa2_chan->fl_pool) + goto err_fd; + + dpaa2_chan->sdd_pool = + dma_pool_create("sdd_pool", dev, +- sizeof(struct dpaa2_qdma_sd_d), ++ sizeof(struct dpaa2_qdma_sd_d) * 2, + sizeof(struct dpaa2_qdma_sd_d), 0); + if (!dpaa2_chan->sdd_pool) + goto err_fl; +-- +2.43.0 + diff --git a/queue-5.10/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch b/queue-5.10/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch new file mode 100644 index 00000000000..d7add37d0fa --- /dev/null +++ b/queue-5.10/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch @@ -0,0 +1,70 @@ +From 887d9876d7f13fd2177d6b8c80b4fd1134704ec9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Jan 2024 11:02:03 +0100 +Subject: dmaengine: fsl-qdma: Fix a memory leak related to the status queue + DMA + +From: Christophe JAILLET + +[ Upstream commit 968bc1d7203d384e72afe34124a1801b7af76514 ] + +This dma_alloc_coherent() is undone in the remove function, but not in the +error handling path of fsl_qdma_probe(). + +Switch to the managed version to fix the issue in the probe and simplify +the remove function. + +Fixes: b092529e0aa0 ("dmaengine: fsl-qdma: Add qDMA controller driver for Layerscape SoCs") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/a0ef5d0f5a47381617ef339df776ddc68ce48173.1704621515.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsl-qdma.c | 17 +++++------------ + 1 file changed, 5 insertions(+), 12 deletions(-) + +diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c +index 045ead46ec8f..5cc887acb05b 100644 +--- a/drivers/dma/fsl-qdma.c ++++ b/drivers/dma/fsl-qdma.c +@@ -563,11 +563,11 @@ static struct fsl_qdma_queue + /* + * Buffer for queue command + */ +- status_head->cq = dma_alloc_coherent(&pdev->dev, +- sizeof(struct fsl_qdma_format) * +- status_size, +- &status_head->bus_addr, +- GFP_KERNEL); ++ status_head->cq = dmam_alloc_coherent(&pdev->dev, ++ sizeof(struct fsl_qdma_format) * ++ status_size, ++ &status_head->bus_addr, ++ GFP_KERNEL); + if (!status_head->cq) { + devm_kfree(&pdev->dev, status_head); + return NULL; +@@ -1272,8 +1272,6 @@ static void fsl_qdma_cleanup_vchan(struct dma_device *dmadev) + + static int fsl_qdma_remove(struct platform_device *pdev) + { +- int i; +- struct fsl_qdma_queue *status; + struct device_node *np = pdev->dev.of_node; + struct fsl_qdma_engine *fsl_qdma = platform_get_drvdata(pdev); + +@@ -1282,11 +1280,6 @@ static int fsl_qdma_remove(struct platform_device *pdev) + of_dma_controller_free(np); + dma_async_device_unregister(&fsl_qdma->dma_dev); + +- for (i = 0; i < fsl_qdma->block_number; i++) { +- status = fsl_qdma->status[i]; +- dma_free_coherent(&pdev->dev, sizeof(struct fsl_qdma_format) * +- status->n_cq, status->cq, status->bus_addr); +- } + return 0; + } + +-- +2.43.0 + diff --git a/queue-5.10/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-25347 b/queue-5.10/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-25347 new file mode 100644 index 00000000000..18f01caa0f2 --- /dev/null +++ b/queue-5.10/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-25347 @@ -0,0 +1,48 @@ +From 26f4e04a3a6060824bc1026aa907db3813141cf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Jan 2024 11:02:04 +0100 +Subject: dmaengine: fsl-qdma: Fix a memory leak related to the queue command + DMA + +From: Christophe JAILLET + +[ Upstream commit 3aa58cb51318e329d203857f7a191678e60bb714 ] + +This dma_alloc_coherent() is undone neither in the remove function, nor in +the error handling path of fsl_qdma_probe(). + +Switch to the managed version to fix both issues. + +Fixes: b092529e0aa0 ("dmaengine: fsl-qdma: Add qDMA controller driver for Layerscape SoCs") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/7f66aa14f59d32b13672dde28602b47deb294e1f.1704621515.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsl-qdma.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c +index 5cc887acb05b..69385f32e275 100644 +--- a/drivers/dma/fsl-qdma.c ++++ b/drivers/dma/fsl-qdma.c +@@ -514,11 +514,11 @@ static struct fsl_qdma_queue + queue_temp = queue_head + i + (j * queue_num); + + queue_temp->cq = +- dma_alloc_coherent(&pdev->dev, +- sizeof(struct fsl_qdma_format) * +- queue_size[i], +- &queue_temp->bus_addr, +- GFP_KERNEL); ++ dmam_alloc_coherent(&pdev->dev, ++ sizeof(struct fsl_qdma_format) * ++ queue_size[i], ++ &queue_temp->bus_addr, ++ GFP_KERNEL); + if (!queue_temp->cq) + return NULL; + queue_temp->block_base = fsl_qdma->block_base + +-- +2.43.0 + diff --git a/queue-5.10/dmaengine-ti-k3-udma-report-short-packet-errors.patch b/queue-5.10/dmaengine-ti-k3-udma-report-short-packet-errors.patch new file mode 100644 index 00000000000..666e1c7d940 --- /dev/null +++ b/queue-5.10/dmaengine-ti-k3-udma-report-short-packet-errors.patch @@ -0,0 +1,67 @@ +From ec5f60affeabe58a861a93cccec53ffc84aeb77a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 14:37:55 +0530 +Subject: dmaengine: ti: k3-udma: Report short packet errors + +From: Jai Luthra + +[ Upstream commit bc9847c9ba134cfe3398011e343dcf6588c1c902 ] + +Propagate the TR response status to the device using BCDMA +split-channels. For example CSI-RX driver should be able to check if a +frame was not transferred completely (short packet) and needs to be +discarded. + +Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA") +Signed-off-by: Jai Luthra +Acked-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20240103-tr_resp_err-v1-1-2fdf6d48ab92@ti.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/k3-udma.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c +index d3902784cae2..15eecb757619 100644 +--- a/drivers/dma/ti/k3-udma.c ++++ b/drivers/dma/ti/k3-udma.c +@@ -2877,6 +2877,7 @@ static void udma_desc_pre_callback(struct virt_dma_chan *vc, + { + struct udma_chan *uc = to_udma_chan(&vc->chan); + struct udma_desc *d; ++ u8 status; + + if (!vd) + return; +@@ -2886,12 +2887,12 @@ static void udma_desc_pre_callback(struct virt_dma_chan *vc, + if (d->metadata_size) + udma_fetch_epib(uc, d); + +- /* Provide residue information for the client */ + if (result) { + void *desc_vaddr = udma_curr_cppi5_desc_vaddr(d, d->desc_idx); + + if (cppi5_desc_get_type(desc_vaddr) == + CPPI5_INFO0_DESC_TYPE_VAL_HOST) { ++ /* Provide residue information for the client */ + result->residue = d->residue - + cppi5_hdesc_get_pktlen(desc_vaddr); + if (result->residue) +@@ -2900,7 +2901,12 @@ static void udma_desc_pre_callback(struct virt_dma_chan *vc, + result->result = DMA_TRANS_NOERROR; + } else { + result->residue = 0; +- result->result = DMA_TRANS_NOERROR; ++ /* Propagate TR Response errors to the client */ ++ status = d->hwdesc[0].tr_resp_base->status; ++ if (status) ++ result->result = DMA_TRANS_ABORTED; ++ else ++ result->result = DMA_TRANS_NOERROR; + } + } + } +-- +2.43.0 + diff --git a/queue-5.10/phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch b/queue-5.10/phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch new file mode 100644 index 00000000000..76b8b828732 --- /dev/null +++ b/queue-5.10/phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch @@ -0,0 +1,51 @@ +From 59723f51e12192abcc79f52b5958c70dd0c6c081 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jan 2024 18:37:03 +0900 +Subject: phy: renesas: rcar-gen3-usb2: Fix returning wrong error code + +From: Yoshihiro Shimoda + +[ Upstream commit 249abaf3bf0dd07f5ddebbb2fe2e8f4d675f074e ] + +Even if device_create_file() returns error code, +rcar_gen3_phy_usb2_probe() will return zero because the "ret" is +variable shadowing. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202312161021.gOLDl48K-lkp@intel.com/ +Fixes: 441a681b8843 ("phy: rcar-gen3-usb2: fix implementation for runtime PM") +Signed-off-by: Yoshihiro Shimoda +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20240105093703.3359949-1-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/renesas/phy-rcar-gen3-usb2.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +index 2cb949f931b6..c0802152f30b 100644 +--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c ++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +@@ -633,8 +633,6 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) + channel->irq = platform_get_irq_optional(pdev, 0); + channel->dr_mode = rcar_gen3_get_dr_mode(dev->of_node); + if (channel->dr_mode != USB_DR_MODE_UNKNOWN) { +- int ret; +- + channel->is_otg_channel = true; + channel->uses_otg_pins = !of_property_read_bool(dev->of_node, + "renesas,no-otg-pins"); +@@ -693,8 +691,6 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) + ret = PTR_ERR(provider); + goto error; + } else if (channel->is_otg_channel) { +- int ret; +- + ret = device_create_file(dev, &dev_attr_role); + if (ret < 0) + goto error; +-- +2.43.0 + diff --git a/queue-5.10/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch b/queue-5.10/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch new file mode 100644 index 00000000000..725ec4f3a94 --- /dev/null +++ b/queue-5.10/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch @@ -0,0 +1,75 @@ +From 06a9ffcf079ed6fcc307c85c1b00ced70ed1a9b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 14:05:54 +0200 +Subject: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP + +From: Tony Lindgren + +[ Upstream commit 7104ba0f1958adb250319e68a15eff89ec4fd36d ] + +If the external phy working together with phy-omap-usb2 does not implement +send_srp(), we may still attempt to call it. This can happen on an idle +Ethernet gadget triggering a wakeup for example: + +configfs-gadget.g1 gadget.0: ECM Suspend +configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup +... +Unable to handle kernel NULL pointer dereference at virtual address +00000000 when execute +... +PC is at 0x0 +LR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc] +... +musb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core] +usb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether] +eth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c +dev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4 +sch_direct_xmit from __dev_queue_xmit+0x334/0xd88 +__dev_queue_xmit from arp_solicit+0xf0/0x268 +arp_solicit from neigh_probe+0x54/0x7c +neigh_probe from __neigh_event_send+0x22c/0x47c +__neigh_event_send from neigh_resolve_output+0x14c/0x1c0 +neigh_resolve_output from ip_finish_output2+0x1c8/0x628 +ip_finish_output2 from ip_send_skb+0x40/0xd8 +ip_send_skb from udp_send_skb+0x124/0x340 +udp_send_skb from udp_sendmsg+0x780/0x984 +udp_sendmsg from __sys_sendto+0xd8/0x158 +__sys_sendto from ret_fast_syscall+0x0/0x58 + +Let's fix the issue by checking for send_srp() and set_vbus() before +calling them. For USB peripheral only cases these both could be NULL. + +Fixes: 657b306a7bdf ("usb: phy: add a new driver for omap usb2 phy") +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20240128120556.8848-1-tony@atomide.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-omap-usb2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/ti/phy-omap-usb2.c b/drivers/phy/ti/phy-omap-usb2.c +index f77ac041d836..95e72f7a3199 100644 +--- a/drivers/phy/ti/phy-omap-usb2.c ++++ b/drivers/phy/ti/phy-omap-usb2.c +@@ -116,7 +116,7 @@ static int omap_usb_set_vbus(struct usb_otg *otg, bool enabled) + { + struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); + +- if (!phy->comparator) ++ if (!phy->comparator || !phy->comparator->set_vbus) + return -ENODEV; + + return phy->comparator->set_vbus(phy->comparator, enabled); +@@ -126,7 +126,7 @@ static int omap_usb_start_srp(struct usb_otg *otg) + { + struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); + +- if (!phy->comparator) ++ if (!phy->comparator || !phy->comparator->start_srp) + return -ENODEV; + + return phy->comparator->start_srp(phy->comparator); +-- +2.43.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 5a785a9c4c5..45a8bb5e7ad 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -245,3 +245,10 @@ hid-apple-add-2021-magic-keyboard-fn-key-mapping.patch bonding-remove-print-in-bond_verify_device_path.patch uapi-stddef.h-fix-__declare_flex_array-for-c.patch pm-sleep-fix-error-handling-in-dpm_prepare.patch +dmaengine-fsl-dpaa2-qdma-fix-the-size-of-dma-pools.patch +dmaengine-ti-k3-udma-report-short-packet-errors.patch +dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch +dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-25347 +phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch +dmaengine-fix-is_slave_direction-return-false-when-d.patch +phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch