From 6b8357a8af880d93d714cb9b7404dcd751f55dae Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 24 Dec 2023 19:41:20 -0500 Subject: [PATCH] Fixes for 6.6 Signed-off-by: Sasha Levin --- ...d-separate-config-for-axg-soc-family.patch | 60 +++++++++++++++++++ ...050-fix-an-error-code-problem-in-inv.patch | 45 ++++++++++++++ ...-keys-add-error-handling-for-devm_km.patch | 40 +++++++++++++ ...onnect-qcom-sm8250-enable-sync_state.patch | 36 +++++++++++ ...at-xlate-returning-null-node-as-an-e.patch | 45 ++++++++++++++ ...fc-fix-skb-double-free-in-bnx2fc_rcv.patch | 55 +++++++++++++++++ ...t-the-sq_lock-protect-sq_tail_slot-a.patch | 44 ++++++++++++++ ...turn-ufs_qcom_clk_scale_-errors-in-u.patch | 54 +++++++++++++++++ queue-6.6/series | 8 +++ 9 files changed, 387 insertions(+) create mode 100644 queue-6.6/iio-adc-meson-add-separate-config-for-axg-soc-family.patch create mode 100644 queue-6.6/iio-imu-inv_mpu6050-fix-an-error-code-problem-in-inv.patch create mode 100644 queue-6.6/input-ipaq-micro-keys-add-error-handling-for-devm_km.patch create mode 100644 queue-6.6/interconnect-qcom-sm8250-enable-sync_state.patch create mode 100644 queue-6.6/interconnect-treat-xlate-returning-null-node-as-an-e.patch create mode 100644 queue-6.6/scsi-bnx2fc-fix-skb-double-free-in-bnx2fc_rcv.patch create mode 100644 queue-6.6/scsi-ufs-core-let-the-sq_lock-protect-sq_tail_slot-a.patch create mode 100644 queue-6.6/scsi-ufs-qcom-return-ufs_qcom_clk_scale_-errors-in-u.patch diff --git a/queue-6.6/iio-adc-meson-add-separate-config-for-axg-soc-family.patch b/queue-6.6/iio-adc-meson-add-separate-config-for-axg-soc-family.patch new file mode 100644 index 00000000000..6f659b0ec35 --- /dev/null +++ b/queue-6.6/iio-adc-meson-add-separate-config-for-axg-soc-family.patch @@ -0,0 +1,60 @@ +From 154aedcb03f6515f05d9404c917a30f4bf98cfc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 02:55:58 +0300 +Subject: iio: adc: meson: add separate config for axg SoC family + +From: George Stark + +[ Upstream commit 59b75dcb0953813676b5030877f3f37cedaed87d ] + +According to Amlogic custom kernels ADC of axg SoC family has +vref_select and requires this setting to work nominally and thus +needs a separate config. + +Fixes: 90c6241860bf ("iio: adc: meson: init voltage control bits") +Signed-off-by: George Stark +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20231127235558.71995-1-gnstark@salutedevices.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/meson_saradc.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c +index 320e3e7e3d4d4..57cfabe80c826 100644 +--- a/drivers/iio/adc/meson_saradc.c ++++ b/drivers/iio/adc/meson_saradc.c +@@ -1239,6 +1239,20 @@ static const struct meson_sar_adc_param meson_sar_adc_gxl_param = { + .cmv_select = 1, + }; + ++static const struct meson_sar_adc_param meson_sar_adc_axg_param = { ++ .has_bl30_integration = true, ++ .clock_rate = 1200000, ++ .bandgap_reg = MESON_SAR_ADC_REG11, ++ .regmap_config = &meson_sar_adc_regmap_config_gxbb, ++ .resolution = 12, ++ .disable_ring_counter = 1, ++ .has_reg11 = true, ++ .vref_volatge = 1, ++ .has_vref_select = true, ++ .vref_select = VREF_VDDA, ++ .cmv_select = 1, ++}; ++ + static const struct meson_sar_adc_param meson_sar_adc_g12a_param = { + .has_bl30_integration = false, + .clock_rate = 1200000, +@@ -1283,7 +1297,7 @@ static const struct meson_sar_adc_data meson_sar_adc_gxm_data = { + }; + + static const struct meson_sar_adc_data meson_sar_adc_axg_data = { +- .param = &meson_sar_adc_gxl_param, ++ .param = &meson_sar_adc_axg_param, + .name = "meson-axg-saradc", + }; + +-- +2.43.0 + diff --git a/queue-6.6/iio-imu-inv_mpu6050-fix-an-error-code-problem-in-inv.patch b/queue-6.6/iio-imu-inv_mpu6050-fix-an-error-code-problem-in-inv.patch new file mode 100644 index 00000000000..e34f89a81e8 --- /dev/null +++ b/queue-6.6/iio-imu-inv_mpu6050-fix-an-error-code-problem-in-inv.patch @@ -0,0 +1,45 @@ +From b939482a4f8114883ca49c1a19801d95537a5c3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Oct 2023 10:02:19 +0800 +Subject: iio: imu: inv_mpu6050: fix an error code problem in + inv_mpu6050_read_raw + +From: Su Hui + +[ Upstream commit c3df0e29fb7788c4b3ddf37d5ed87dda2b822943 ] + +inv_mpu6050_sensor_show() can return -EINVAL or IIO_VAL_INT. Return the +true value rather than only return IIO_VAL_INT. + +Fixes: d5098447147c ("iio: imu: mpu6050: add calibration offset support") +Signed-off-by: Su Hui +Link: https://lore.kernel.org/r/20231030020218.65728-1-suhui@nfschina.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +index 29f906c884bd8..a9a5fb266ef13 100644 +--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c ++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +@@ -749,13 +749,13 @@ inv_mpu6050_read_raw(struct iio_dev *indio_dev, + ret = inv_mpu6050_sensor_show(st, st->reg->gyro_offset, + chan->channel2, val); + mutex_unlock(&st->lock); +- return IIO_VAL_INT; ++ return ret; + case IIO_ACCEL: + mutex_lock(&st->lock); + ret = inv_mpu6050_sensor_show(st, st->reg->accl_offset, + chan->channel2, val); + mutex_unlock(&st->lock); +- return IIO_VAL_INT; ++ return ret; + + default: + return -EINVAL; +-- +2.43.0 + diff --git a/queue-6.6/input-ipaq-micro-keys-add-error-handling-for-devm_km.patch b/queue-6.6/input-ipaq-micro-keys-add-error-handling-for-devm_km.patch new file mode 100644 index 00000000000..22fc41908c0 --- /dev/null +++ b/queue-6.6/input-ipaq-micro-keys-add-error-handling-for-devm_km.patch @@ -0,0 +1,40 @@ +From 5e1dc09db1c0ad7f42ed8a188f15d5c7e220bf38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Dec 2023 19:00:23 +0000 +Subject: Input: ipaq-micro-keys - add error handling for devm_kmemdup + +From: Haoran Liu + +[ Upstream commit 59b6a747e2d39227ac2325c5e29d6ab3bb070c2a ] + +Check the return value of i2c_add_adapter. Static analysis revealed that +the function did not properly handle potential failures of +i2c_add_adapter, which could lead to partial initialization of the I2C +adapter and unstable operation. + +Signed-off-by: Haoran Liu +Link: https://lore.kernel.org/r/20231203164653.38983-1-liuhaoran14@163.com +Fixes: d7535ffa427b ("Input: driver for microcontroller keys on the iPaq h3xxx") +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/ipaq-micro-keys.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/input/keyboard/ipaq-micro-keys.c b/drivers/input/keyboard/ipaq-micro-keys.c +index 7b509bce2b332..1d71dd79ffd28 100644 +--- a/drivers/input/keyboard/ipaq-micro-keys.c ++++ b/drivers/input/keyboard/ipaq-micro-keys.c +@@ -105,6 +105,9 @@ static int micro_key_probe(struct platform_device *pdev) + keys->codes = devm_kmemdup(&pdev->dev, micro_keycodes, + keys->input->keycodesize * keys->input->keycodemax, + GFP_KERNEL); ++ if (!keys->codes) ++ return -ENOMEM; ++ + keys->input->keycode = keys->codes; + + __set_bit(EV_KEY, keys->input->evbit); +-- +2.43.0 + diff --git a/queue-6.6/interconnect-qcom-sm8250-enable-sync_state.patch b/queue-6.6/interconnect-qcom-sm8250-enable-sync_state.patch new file mode 100644 index 00000000000..784476c7ee8 --- /dev/null +++ b/queue-6.6/interconnect-qcom-sm8250-enable-sync_state.patch @@ -0,0 +1,36 @@ +From 29f0702288247ef45775b32b1e8c55ad5e2d6367 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 15:04:45 +0100 +Subject: interconnect: qcom: sm8250: Enable sync_state + +From: Konrad Dybcio + +[ Upstream commit bfc7db1cb94ad664546d70212699f8cc6c539e8c ] + +Add the generic icc sync_state callback to ensure interconnect votes +are taken into account, instead of being pegged at maximum values. + +Fixes: b95b668eaaa2 ("interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231130-topic-8250icc_syncstate-v1-1-7ce78ba6e04c@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/sm8250.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/interconnect/qcom/sm8250.c b/drivers/interconnect/qcom/sm8250.c +index 661dc18d99dba..2a2f56b993733 100644 +--- a/drivers/interconnect/qcom/sm8250.c ++++ b/drivers/interconnect/qcom/sm8250.c +@@ -1995,6 +1995,7 @@ static struct platform_driver qnoc_driver = { + .driver = { + .name = "qnoc-sm8250", + .of_match_table = qnoc_of_match, ++ .sync_state = icc_sync_state, + }, + }; + module_platform_driver(qnoc_driver); +-- +2.43.0 + diff --git a/queue-6.6/interconnect-treat-xlate-returning-null-node-as-an-e.patch b/queue-6.6/interconnect-treat-xlate-returning-null-node-as-an-e.patch new file mode 100644 index 00000000000..8c7e0da8867 --- /dev/null +++ b/queue-6.6/interconnect-treat-xlate-returning-null-node-as-an-e.patch @@ -0,0 +1,45 @@ +From a9811c0db16f65de31318627f1ab9b1cbb570dc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Oct 2023 07:58:29 -0700 +Subject: interconnect: Treat xlate() returning NULL node as an error + +From: Mike Tipton + +[ Upstream commit ad2ab1297d0c80899125a842bb7a078abfe1e6ce ] + +Currently, if provider->xlate() or provider->xlate_extended() +"successfully" return a NULL node, then of_icc_get_from_provider() won't +consider that an error and will successfully return the NULL node. This +bypasses error handling in of_icc_get_by_index() and leads to NULL +dereferences in path_find(). + +This could be avoided by ensuring provider callbacks always return an +error for NULL nodes, but it's better to explicitly protect against this +in the common framework. + +Fixes: 87e3031b6fbd ("interconnect: Allow endpoints translation via DT") +Signed-off-by: Mike Tipton +Link: https://lore.kernel.org/r/20231025145829.11603-1-quic_mdtipton@quicinc.com +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/interconnect/core.c b/drivers/interconnect/core.c +index dfab160ca5293..50bac2d79d9b5 100644 +--- a/drivers/interconnect/core.c ++++ b/drivers/interconnect/core.c +@@ -395,6 +395,9 @@ struct icc_node_data *of_icc_get_from_provider(struct of_phandle_args *spec) + } + mutex_unlock(&icc_lock); + ++ if (!node) ++ return ERR_PTR(-EINVAL); ++ + if (IS_ERR(node)) + return ERR_CAST(node); + +-- +2.43.0 + diff --git a/queue-6.6/scsi-bnx2fc-fix-skb-double-free-in-bnx2fc_rcv.patch b/queue-6.6/scsi-bnx2fc-fix-skb-double-free-in-bnx2fc_rcv.patch new file mode 100644 index 00000000000..c607124decd --- /dev/null +++ b/queue-6.6/scsi-bnx2fc-fix-skb-double-free-in-bnx2fc_rcv.patch @@ -0,0 +1,55 @@ +From b3e41a64aca5d157ffa6d572792ef372fca78e40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 11:06:26 +0000 +Subject: scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() + +From: Wei Yongjun + +[ Upstream commit 08c94d80b2da481652fb633e79cbc41e9e326a91 ] + +skb_share_check() already drops the reference to the skb when returning +NULL. Using kfree_skb() in the error handling path leads to an skb double +free. + +Fix this by removing the variable tmp_skb, and return directly when +skb_share_check() returns NULL. + +Fixes: 01a4cc4d0cd6 ("bnx2fc: do not add shared skbs to the fcoe_rx_list") +Signed-off-by: Wei Yongjun +Link: https://lore.kernel.org/r/20221114110626.526643-1-weiyongjun@huaweicloud.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +index 05ddbb9bb7d8a..451a58e0fd969 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +@@ -429,7 +429,6 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev, + struct fcoe_ctlr *ctlr; + struct fcoe_rcv_info *fr; + struct fcoe_percpu_s *bg; +- struct sk_buff *tmp_skb; + + interface = container_of(ptype, struct bnx2fc_interface, + fcoe_packet_type); +@@ -441,11 +440,9 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev, + goto err; + } + +- tmp_skb = skb_share_check(skb, GFP_ATOMIC); +- if (!tmp_skb) +- goto err; +- +- skb = tmp_skb; ++ skb = skb_share_check(skb, GFP_ATOMIC); ++ if (!skb) ++ return -1; + + if (unlikely(eth_hdr(skb)->h_proto != htons(ETH_P_FCOE))) { + printk(KERN_ERR PFX "bnx2fc_rcv: Wrong FC type frame\n"); +-- +2.43.0 + diff --git a/queue-6.6/scsi-ufs-core-let-the-sq_lock-protect-sq_tail_slot-a.patch b/queue-6.6/scsi-ufs-core-let-the-sq_lock-protect-sq_tail_slot-a.patch new file mode 100644 index 00000000000..e8483d2423b --- /dev/null +++ b/queue-6.6/scsi-ufs-core-let-the-sq_lock-protect-sq_tail_slot-a.patch @@ -0,0 +1,44 @@ +From 2ce913c6a7939609e67b18f15394a37e59ec04c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Dec 2023 07:32:17 -0800 +Subject: scsi: ufs: core: Let the sq_lock protect sq_tail_slot access + +From: Can Guo + +[ Upstream commit 04c116e2bdfc3969f9819d2cebfdf678353c354c ] + +When accessing sq_tail_slot without protection from sq_lock, a race +condition can cause multiple SQEs to be copied to duplicate SQE slots. This +can lead to multiple stability issues. Fix this by moving the *dest +initialization in ufshcd_send_command() back under protection from the +sq_lock. + +Fixes: 3c85f087faec ("scsi: ufs: mcq: Use pointer arithmetic in ufshcd_send_command()") +Signed-off-by: Can Guo +Link: https://lore.kernel.org/r/1702913550-20631-1-git-send-email-quic_cang@quicinc.com +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 170fbd5715b21..a885cc177cff7 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -2172,9 +2172,10 @@ void ufshcd_send_command(struct ufs_hba *hba, unsigned int task_tag, + if (is_mcq_enabled(hba)) { + int utrd_size = sizeof(struct utp_transfer_req_desc); + struct utp_transfer_req_desc *src = lrbp->utr_descriptor_ptr; +- struct utp_transfer_req_desc *dest = hwq->sqe_base_addr + hwq->sq_tail_slot; ++ struct utp_transfer_req_desc *dest; + + spin_lock(&hwq->sq_lock); ++ dest = hwq->sqe_base_addr + hwq->sq_tail_slot; + memcpy(dest, src, utrd_size); + ufshcd_inc_sq_tail(hwq); + spin_unlock(&hwq->sq_lock); +-- +2.43.0 + diff --git a/queue-6.6/scsi-ufs-qcom-return-ufs_qcom_clk_scale_-errors-in-u.patch b/queue-6.6/scsi-ufs-qcom-return-ufs_qcom_clk_scale_-errors-in-u.patch new file mode 100644 index 00000000000..9501eca0678 --- /dev/null +++ b/queue-6.6/scsi-ufs-qcom-return-ufs_qcom_clk_scale_-errors-in-u.patch @@ -0,0 +1,54 @@ +From 659011ea7747a2cb258293035de51495a0e4eeb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Dec 2023 09:38:12 +0900 +Subject: scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in + ufs_qcom_clk_scale_notify() + +From: ChanWoo Lee + +[ Upstream commit 9264fd61e628ce180a168e6b90bde134dd49ec28 ] + +In commit 031312dbc695 ("scsi: ufs: ufs-qcom: Remove unnecessary goto +statements") the error handling was accidentally changed, resulting in the +error of ufs_qcom_clk_scale_*() calls not being returned. + +This is the case I checked: + + ufs_qcom_clk_scale_notify -> + 'ufs_qcom_clk_scale_up_/down_pre_change' error -> + return 0; + +Make sure those errors are properly returned. + +Fixes: 031312dbc695 ("scsi: ufs: ufs-qcom: Remove unnecessary goto statements") +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: ChanWoo Lee +Link: https://lore.kernel.org/r/20231215003812.29650-1-cw9316.lee@samsung.com +Reviewed-by: Andrew Halaney +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/host/ufs-qcom.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c +index b1d720031251e..fc40726e13c26 100644 +--- a/drivers/ufs/host/ufs-qcom.c ++++ b/drivers/ufs/host/ufs-qcom.c +@@ -1399,9 +1399,11 @@ static int ufs_qcom_clk_scale_notify(struct ufs_hba *hba, + err = ufs_qcom_clk_scale_up_pre_change(hba); + else + err = ufs_qcom_clk_scale_down_pre_change(hba); +- if (err) +- ufshcd_uic_hibern8_exit(hba); + ++ if (err) { ++ ufshcd_uic_hibern8_exit(hba); ++ return err; ++ } + } else { + if (scale_up) + err = ufs_qcom_clk_scale_up_post_change(hba); +-- +2.43.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 619153f053b..dc7f38a3f7c 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -78,3 +78,11 @@ x86-xen-add-cpu-dependencies-for-32-bit-build.patch pinctrl-at91-pio4-use-dedicated-lock-class-for-irq.patch gpiolib-cdev-add-gpio_device-locking-wrapper-around-.patch nvme-pci-fix-sleeping-function-called-from-interrupt.patch +interconnect-treat-xlate-returning-null-node-as-an-e.patch +iio-imu-inv_mpu6050-fix-an-error-code-problem-in-inv.patch +interconnect-qcom-sm8250-enable-sync_state.patch +input-ipaq-micro-keys-add-error-handling-for-devm_km.patch +iio-adc-meson-add-separate-config-for-axg-soc-family.patch +scsi-bnx2fc-fix-skb-double-free-in-bnx2fc_rcv.patch +scsi-ufs-qcom-return-ufs_qcom_clk_scale_-errors-in-u.patch +scsi-ufs-core-let-the-sq_lock-protect-sq_tail_slot-a.patch -- 2.47.3