From: Greg Kroah-Hartman Date: Sun, 7 May 2023 10:59:07 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.15.111~80 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e02b99718b6ba68df3089fc7d15ae63b5d939570;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: clk-rockchip-rk3399-allow-clk_cifout-to-force-clk_cifout_src-to-reparent.patch mailbox-zynqmp-fix-ipi-isr-handling.patch mailbox-zynqmp-fix-typo-in-ipi-documentation.patch md-raid10-fix-null-ptr-deref-in-raid10_sync_request.patch wifi-rtl8xxxu-rtl8192eu-always-needs-full-init.patch --- diff --git a/queue-5.4/alsa-hda-realtek-add-quirk-for-asus-um3402yar-using-cs35l41.patch b/queue-5.4/alsa-hda-realtek-add-quirk-for-asus-um3402yar-using-cs35l41.patch deleted file mode 100644 index 92c1ec27a28..00000000000 --- a/queue-5.4/alsa-hda-realtek-add-quirk-for-asus-um3402yar-using-cs35l41.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 7e2d06628aab6324e1ac885910a52f4c038d4043 Mon Sep 17 00:00:00 2001 -From: Mark Asselstine -Date: Mon, 1 May 2023 19:13:46 -0400 -Subject: ALSA: hda/realtek: Add quirk for ASUS UM3402YAR using CS35L41 - -From: Mark Asselstine - -commit 7e2d06628aab6324e1ac885910a52f4c038d4043 upstream. - -This Asus Zenbook laptop uses Realtek HDA codec combined with -2xCS35L41 Amplifiers using I2C with External Boost. - -Signed-off-by: Mark Asselstine -Cc: -Link: https://lore.kernel.org/r/20230501231346.54979-1-asselsm@gmail.com -Signed-off-by: Takashi Iwai -Signed-off-by: Greg Kroah-Hartman ---- - sound/pci/hda/patch_realtek.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -8255,6 +8255,7 @@ static const struct snd_pci_quirk alc269 - SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK), - SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), - SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK), -+ SND_PCI_QUIRK(0x1043, 0x1683, "ASUS UM3402YAR", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), - SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC), - SND_PCI_QUIRK(0x1043, 0x1740, "ASUS UX430UA", ALC295_FIXUP_ASUS_DACS), diff --git a/queue-5.4/clk-rockchip-rk3399-allow-clk_cifout-to-force-clk_cifout_src-to-reparent.patch b/queue-5.4/clk-rockchip-rk3399-allow-clk_cifout-to-force-clk_cifout_src-to-reparent.patch new file mode 100644 index 00000000000..8cf0760ccd7 --- /dev/null +++ b/queue-5.4/clk-rockchip-rk3399-allow-clk_cifout-to-force-clk_cifout_src-to-reparent.patch @@ -0,0 +1,39 @@ +From 933bf364e152cd60902cf9585c2ba310d593e69f Mon Sep 17 00:00:00 2001 +From: Quentin Schulz +Date: Thu, 17 Nov 2022 13:04:31 +0100 +Subject: clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent + +From: Quentin Schulz + +commit 933bf364e152cd60902cf9585c2ba310d593e69f upstream. + +clk_cifout is derived from clk_cifout_src through an integer divider +limited to 32. clk_cifout_src is a child of either cpll, gpll or npll +without any possibility of a divider of any sort. The default clock +parent is cpll. + +Let's allow clk_cifout to ask its parent clk_cifout_src to reparent in +order to find the real closest possible rate for clk_cifout and not one +derived from cpll only. + +Cc: stable@vger.kernel.org # 4.10+ +Fixes: fd8bc829336a ("clk: rockchip: fix the rk3399 cifout clock") +Signed-off-by: Quentin Schulz +Link: https://lore.kernel.org/r/20221117-rk3399-cifout-set-rate-parent-v1-0-432548d04081@theobroma-systems.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/rockchip/clk-rk3399.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/rockchip/clk-rk3399.c ++++ b/drivers/clk/rockchip/clk-rk3399.c +@@ -1259,7 +1259,7 @@ static struct rockchip_clk_branch rk3399 + RK3399_CLKSEL_CON(56), 6, 2, MFLAGS, + RK3399_CLKGATE_CON(10), 7, GFLAGS), + +- COMPOSITE_NOGATE(SCLK_CIF_OUT, "clk_cifout", mux_clk_cif_p, 0, ++ COMPOSITE_NOGATE(SCLK_CIF_OUT, "clk_cifout", mux_clk_cif_p, CLK_SET_RATE_PARENT, + RK3399_CLKSEL_CON(56), 5, 1, MFLAGS, 0, 5, DFLAGS), + + /* gic */ diff --git a/queue-5.4/mailbox-zynqmp-fix-ipi-isr-handling.patch b/queue-5.4/mailbox-zynqmp-fix-ipi-isr-handling.patch new file mode 100644 index 00000000000..07eab65de26 --- /dev/null +++ b/queue-5.4/mailbox-zynqmp-fix-ipi-isr-handling.patch @@ -0,0 +1,50 @@ +From 74ad37a30ffee3643bc34f9ca7225b20a66abaaf Mon Sep 17 00:00:00 2001 +From: Tanmay Shah +Date: Fri, 10 Mar 2023 17:24:05 -0800 +Subject: mailbox: zynqmp: Fix IPI isr handling + +From: Tanmay Shah + +commit 74ad37a30ffee3643bc34f9ca7225b20a66abaaf upstream. + +Multiple IPI channels are mapped to same interrupt handler. +Current isr implementation handles only one channel per isr. +Fix this behavior by checking isr status bit of all child +mailbox nodes. + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Tanmay Shah +Acked-by: Michal Simek +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230311012407.1292118-3-tanmay.shah@amd.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -152,7 +152,7 @@ static irqreturn_t zynqmp_ipi_interrupt( + struct zynqmp_ipi_message *msg; + u64 arg0, arg3; + struct arm_smccc_res res; +- int ret, i; ++ int ret, i, status = IRQ_NONE; + + (void)irq; + arg0 = SMC_IPI_MAILBOX_STATUS_ENQUIRY; +@@ -170,11 +170,11 @@ static irqreturn_t zynqmp_ipi_interrupt( + memcpy_fromio(msg->data, mchan->req_buf, + msg->len); + mbox_chan_received_data(chan, (void *)msg); +- return IRQ_HANDLED; ++ status = IRQ_HANDLED; + } + } + } +- return IRQ_NONE; ++ return status; + } + + /** diff --git a/queue-5.4/mailbox-zynqmp-fix-typo-in-ipi-documentation.patch b/queue-5.4/mailbox-zynqmp-fix-typo-in-ipi-documentation.patch new file mode 100644 index 00000000000..73ca4a43939 --- /dev/null +++ b/queue-5.4/mailbox-zynqmp-fix-typo-in-ipi-documentation.patch @@ -0,0 +1,34 @@ +From 79963fbfc233759bd8a43462f120d15a1bd4f4fa Mon Sep 17 00:00:00 2001 +From: Tanmay Shah +Date: Fri, 10 Mar 2023 17:24:06 -0800 +Subject: mailbox: zynqmp: Fix typo in IPI documentation + +From: Tanmay Shah + +commit 79963fbfc233759bd8a43462f120d15a1bd4f4fa upstream. + +Xilinx IPI message buffers allows 32-byte data transfer. +Fix documentation that says 12 bytes + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Tanmay Shah +Acked-by: Michal Simek +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230311012407.1292118-4-tanmay.shah@amd.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/mailbox/zynqmp-ipi-message.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/mailbox/zynqmp-ipi-message.h ++++ b/include/linux/mailbox/zynqmp-ipi-message.h +@@ -9,7 +9,7 @@ + * @data: message payload + * + * This is the structure for data used in mbox_send_message +- * the maximum length of data buffer is fixed to 12 bytes. ++ * the maximum length of data buffer is fixed to 32 bytes. + * Client is supposed to be aware of this. + */ + struct zynqmp_ipi_message { diff --git a/queue-5.4/md-raid10-fix-null-ptr-deref-in-raid10_sync_request.patch b/queue-5.4/md-raid10-fix-null-ptr-deref-in-raid10_sync_request.patch new file mode 100644 index 00000000000..9e31fc8a6a0 --- /dev/null +++ b/queue-5.4/md-raid10-fix-null-ptr-deref-in-raid10_sync_request.patch @@ -0,0 +1,64 @@ +From a405c6f0229526160aa3f177f65e20c86fce84c5 Mon Sep 17 00:00:00 2001 +From: Li Nan +Date: Wed, 22 Feb 2023 12:10:00 +0800 +Subject: md/raid10: fix null-ptr-deref in raid10_sync_request + +From: Li Nan + +commit a405c6f0229526160aa3f177f65e20c86fce84c5 upstream. + +init_resync() inits mempool and sets conf->have_replacemnt at the beginning +of sync, close_sync() frees the mempool when sync is completed. + +After [1] recovery might be skipped and init_resync() is called but +close_sync() is not. null-ptr-deref occurs with r10bio->dev[i].repl_bio. + +The following is one way to reproduce the issue. + + 1) create a array, wait for resync to complete, mddev->recovery_cp is set + to MaxSector. + 2) recovery is woken and it is skipped. conf->have_replacement is set to + 0 in init_resync(). close_sync() not called. + 3) some io errors and rdev A is set to WantReplacement. + 4) a new device is added and set to A's replacement. + 5) recovery is woken, A have replacement, but conf->have_replacemnt is + 0. r10bio->dev[i].repl_bio will not be alloced and null-ptr-deref + occurs. + +Fix it by not calling init_resync() if recovery skipped. + +[1] commit 7e83ccbecd60 ("md/raid10: Allow skipping recovery when clean arrays are assembled") +Fixes: 7e83ccbecd60 ("md/raid10: Allow skipping recovery when clean arrays are assembled") +Cc: stable@vger.kernel.org +Signed-off-by: Li Nan +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230222041000.3341651-3-linan666@huaweicloud.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/raid10.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -2920,10 +2920,6 @@ static sector_t raid10_sync_request(stru + sector_t chunk_mask = conf->geo.chunk_mask; + int page_idx = 0; + +- if (!mempool_initialized(&conf->r10buf_pool)) +- if (init_resync(conf)) +- return 0; +- + /* + * Allow skipping a full rebuild for incremental assembly + * of a clean array, like RAID1 does. +@@ -2939,6 +2935,10 @@ static sector_t raid10_sync_request(stru + return mddev->dev_sectors - sector_nr; + } + ++ if (!mempool_initialized(&conf->r10buf_pool)) ++ if (init_resync(conf)) ++ return 0; ++ + skipped: + max_sector = mddev->dev_sectors; + if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery) || diff --git a/queue-5.4/series b/queue-5.4/series index 2b200070141..00c4cefee53 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -192,6 +192,10 @@ dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch afs-fix-updating-of-i_size-with-dv-jump-from-server.patch parisc-fix-argument-pointer-in-real64_call_asm.patch -alsa-hda-realtek-add-quirk-for-asus-um3402yar-using-cs35l41.patch nilfs2-do-not-write-dirty-data-after-degenerating-to-read-only.patch nilfs2-fix-infinite-loop-in-nilfs_mdt_get_block.patch +md-raid10-fix-null-ptr-deref-in-raid10_sync_request.patch +mailbox-zynqmp-fix-ipi-isr-handling.patch +mailbox-zynqmp-fix-typo-in-ipi-documentation.patch +wifi-rtl8xxxu-rtl8192eu-always-needs-full-init.patch +clk-rockchip-rk3399-allow-clk_cifout-to-force-clk_cifout_src-to-reparent.patch diff --git a/queue-5.4/wifi-rtl8xxxu-rtl8192eu-always-needs-full-init.patch b/queue-5.4/wifi-rtl8xxxu-rtl8192eu-always-needs-full-init.patch new file mode 100644 index 00000000000..19c44d42a6c --- /dev/null +++ b/queue-5.4/wifi-rtl8xxxu-rtl8192eu-always-needs-full-init.patch @@ -0,0 +1,43 @@ +From d46e04ccd40457a0119b76e11ab64a2ad403e138 Mon Sep 17 00:00:00 2001 +From: Bitterblue Smith +Date: Mon, 13 Mar 2023 15:42:59 +0200 +Subject: wifi: rtl8xxxu: RTL8192EU always needs full init + +From: Bitterblue Smith + +commit d46e04ccd40457a0119b76e11ab64a2ad403e138 upstream. + +Always run the entire init sequence (rtl8xxxu_init_device()) for +RTL8192EU. It's what the vendor driver does too. + +This fixes a bug where the device is unable to connect after +rebooting: + +wlp3s0f3u2: send auth to ... (try 1/3) +wlp3s0f3u2: send auth to ... (try 2/3) +wlp3s0f3u2: send auth to ... (try 3/3) +wlp3s0f3u2: authentication with ... timed out + +Rebooting leaves the device powered on (partially? at least the +firmware is still running), but not really in a working state. + +Cc: stable@vger.kernel.org +Signed-off-by: Bitterblue Smith +Acked-by: Jes Sorensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/4eb111a9-d4c4-37d0-b376-4e202de7153c@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c +@@ -1702,6 +1702,7 @@ struct rtl8xxxu_fileops rtl8192eu_fops = + .rx_desc_size = sizeof(struct rtl8xxxu_rxdesc24), + .has_s0s1 = 0, + .gen2_thermal_meter = 1, ++ .needs_full_init = 1, + .adda_1t_init = 0x0fc01616, + .adda_1t_path_on = 0x0fc01616, + .adda_2t_path_on_a = 0x0fc01616,