From 7a994e859e913e10df2eea76ac42b9ea40487211 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 15 Aug 2022 15:19:37 +0200 Subject: [PATCH] 5.19-stable patches added patches: crypto-lib-blake2s-reduce-stack-frame-usage-in-self-test.patch mptcp-refine-memory-scheduling.patch net-dsa-felix-fix-min-gate-len-calculation-for-tc-when-its-first-gate-is-closed.patch powerpc-kexec-fix-build-failure-from-uninitialised-variable.patch raw-fix-a-typo-in-raw_icmp_error.patch raw-remove-unused-variables-from-raw6_icmp_error.patch revert-devcoredump-remove-the-useless-gfp_t-parameter-in-dev_coredumpv-and-dev_coredumpm.patch revert-drm-bridge-anx7625-use-dpi-bus-type.patch revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch revert-s390-smp-enforce-lowcore-protection-on-cpu-restart.patch tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch tracing-use-a-copy-of-the-va_list-for-__assign_vstr.patch wifi-cfg80211-handle-ibss-in-channel-switch.patch wifi-cfg80211-remove-chandef-check-in-cfg80211_cac_event.patch wifi-nl80211-acquire-wdev-mutex-earlier-in-start_ap.patch wifi-nl80211-hold-wdev-mutex-for-tid-config.patch wifi-nl80211-relax-wdev-mutex-check-in-wdev_chandef.patch --- ...educe-stack-frame-usage-in-self-test.patch | 53 +++ .../mptcp-refine-memory-scheduling.patch | 35 ++ ...for-tc-when-its-first-gate-is-closed.patch | 87 ++++ ...-failure-from-uninitialised-variable.patch | 48 ++ .../raw-fix-a-typo-in-raw_icmp_error.patch | 36 ++ ...nused-variables-from-raw6_icmp_error.patch | 41 ++ ...r-in-dev_coredumpv-and-dev_coredumpm.patch | 437 ++++++++++++++++++ ...-drm-bridge-anx7625-use-dpi-bus-type.patch | 54 +++ ...context-bugs-caused-by-dev_coredumpv.patch | 100 ++++ ...ce-lowcore-protection-on-cpu-restart.patch | 31 ++ queue-5.19/series | 17 + ...estimation-in-sk_forced_mem_schedule.patch | 45 ++ ...opy-of-the-va_list-for-__assign_vstr.patch | 61 +++ ...g80211-handle-ibss-in-channel-switch.patch | 34 ++ ...-chandef-check-in-cfg80211_cac_event.patch | 37 ++ ...quire-wdev-mutex-earlier-in-start_ap.patch | 129 ++++++ ...80211-hold-wdev-mutex-for-tid-config.patch | 40 ++ ...lax-wdev-mutex-check-in-wdev_chandef.patch | 45 ++ 18 files changed, 1330 insertions(+) create mode 100644 queue-5.19/crypto-lib-blake2s-reduce-stack-frame-usage-in-self-test.patch create mode 100644 queue-5.19/mptcp-refine-memory-scheduling.patch create mode 100644 queue-5.19/net-dsa-felix-fix-min-gate-len-calculation-for-tc-when-its-first-gate-is-closed.patch create mode 100644 queue-5.19/powerpc-kexec-fix-build-failure-from-uninitialised-variable.patch create mode 100644 queue-5.19/raw-fix-a-typo-in-raw_icmp_error.patch create mode 100644 queue-5.19/raw-remove-unused-variables-from-raw6_icmp_error.patch create mode 100644 queue-5.19/revert-devcoredump-remove-the-useless-gfp_t-parameter-in-dev_coredumpv-and-dev_coredumpm.patch create mode 100644 queue-5.19/revert-drm-bridge-anx7625-use-dpi-bus-type.patch create mode 100644 queue-5.19/revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch create mode 100644 queue-5.19/revert-s390-smp-enforce-lowcore-protection-on-cpu-restart.patch create mode 100644 queue-5.19/tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch create mode 100644 queue-5.19/tracing-use-a-copy-of-the-va_list-for-__assign_vstr.patch create mode 100644 queue-5.19/wifi-cfg80211-handle-ibss-in-channel-switch.patch create mode 100644 queue-5.19/wifi-cfg80211-remove-chandef-check-in-cfg80211_cac_event.patch create mode 100644 queue-5.19/wifi-nl80211-acquire-wdev-mutex-earlier-in-start_ap.patch create mode 100644 queue-5.19/wifi-nl80211-hold-wdev-mutex-for-tid-config.patch create mode 100644 queue-5.19/wifi-nl80211-relax-wdev-mutex-check-in-wdev_chandef.patch diff --git a/queue-5.19/crypto-lib-blake2s-reduce-stack-frame-usage-in-self-test.patch b/queue-5.19/crypto-lib-blake2s-reduce-stack-frame-usage-in-self-test.patch new file mode 100644 index 00000000000..098d5da4e18 --- /dev/null +++ b/queue-5.19/crypto-lib-blake2s-reduce-stack-frame-usage-in-self-test.patch @@ -0,0 +1,53 @@ +From d6c14da474bf260d73953fbf7992c98d9112aec7 Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Mon, 20 Jun 2022 09:52:43 +0200 +Subject: crypto: lib/blake2s - reduce stack frame usage in self test + +From: Jason A. Donenfeld + +commit d6c14da474bf260d73953fbf7992c98d9112aec7 upstream. + +Using 3 blocks here doesn't give us much more than using 2, and it +causes a stack frame size warning on certain compiler/config/arch +combinations: + + lib/crypto/blake2s-selftest.c: In function 'blake2s_selftest': +>> lib/crypto/blake2s-selftest.c:632:1: warning: the frame size of 1088 bytes is larger than 1024 bytes [-Wframe-larger-than=] + 632 | } + | ^ + +So this patch just reduces the block from 3 to 2, which makes the +warning go away. + +Reported-by: kernel test robot +Link: https://lore.kernel.org/linux-crypto/202206200851.gE3MHCgd-lkp@intel.com +Fixes: 2d16803c562e ("crypto: blake2s - remove shash module") +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + lib/crypto/blake2s-selftest.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/lib/crypto/blake2s-selftest.c ++++ b/lib/crypto/blake2s-selftest.c +@@ -593,7 +593,7 @@ bool __init blake2s_selftest(void) + enum { TEST_ALIGNMENT = 16 }; + u8 unaligned_block[BLAKE2S_BLOCK_SIZE + TEST_ALIGNMENT - 1] + __aligned(TEST_ALIGNMENT); +- u8 blocks[BLAKE2S_BLOCK_SIZE * 3]; ++ u8 blocks[BLAKE2S_BLOCK_SIZE * 2]; + struct blake2s_state state1, state2; + + get_random_bytes(blocks, sizeof(blocks)); +@@ -603,8 +603,8 @@ bool __init blake2s_selftest(void) + defined(CONFIG_CRYPTO_ARCH_HAVE_LIB_BLAKE2S) + memcpy(&state1, &state, sizeof(state1)); + memcpy(&state2, &state, sizeof(state2)); +- blake2s_compress(&state1, blocks, 3, BLAKE2S_BLOCK_SIZE); +- blake2s_compress_generic(&state2, blocks, 3, BLAKE2S_BLOCK_SIZE); ++ blake2s_compress(&state1, blocks, 2, BLAKE2S_BLOCK_SIZE); ++ blake2s_compress_generic(&state2, blocks, 2, BLAKE2S_BLOCK_SIZE); + if (memcmp(&state1, &state2, sizeof(state1))) { + pr_err("blake2s random compress self-test %d: FAIL\n", + i + 1); diff --git a/queue-5.19/mptcp-refine-memory-scheduling.patch b/queue-5.19/mptcp-refine-memory-scheduling.patch new file mode 100644 index 00000000000..4980a58bca3 --- /dev/null +++ b/queue-5.19/mptcp-refine-memory-scheduling.patch @@ -0,0 +1,35 @@ +From 69d93daec026cdda98e29e8edb12534bfa5b1a9b Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Thu, 30 Jun 2022 15:17:56 -0700 +Subject: mptcp: refine memory scheduling + +From: Paolo Abeni + +commit 69d93daec026cdda98e29e8edb12534bfa5b1a9b upstream. + +Similar to commit 7c80b038d23e ("net: fix sk_wmem_schedule() and +sk_rmem_schedule() errors"), let the MPTCP receive path schedule +exactly the required amount of memory. + +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -323,9 +323,10 @@ static bool mptcp_rmem_schedule(struct s + struct mptcp_sock *msk = mptcp_sk(sk); + int amt, amount; + +- if (size < msk->rmem_fwd_alloc) ++ if (size <= msk->rmem_fwd_alloc) + return true; + ++ size -= msk->rmem_fwd_alloc; + amt = sk_mem_pages(size); + amount = amt << SK_MEM_QUANTUM_SHIFT; + msk->rmem_fwd_alloc += amount; diff --git a/queue-5.19/net-dsa-felix-fix-min-gate-len-calculation-for-tc-when-its-first-gate-is-closed.patch b/queue-5.19/net-dsa-felix-fix-min-gate-len-calculation-for-tc-when-its-first-gate-is-closed.patch new file mode 100644 index 00000000000..b91fa58b50e --- /dev/null +++ b/queue-5.19/net-dsa-felix-fix-min-gate-len-calculation-for-tc-when-its-first-gate-is-closed.patch @@ -0,0 +1,87 @@ +From 7e4babffa6f340a74c820d44d44d16511e666424 Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Thu, 4 Aug 2022 23:28:17 +0300 +Subject: net: dsa: felix: fix min gate len calculation for tc when its first gate is closed + +From: Vladimir Oltean + +commit 7e4babffa6f340a74c820d44d44d16511e666424 upstream. + +min_gate_len[tc] is supposed to track the shortest interval of +continuously open gates for a traffic class. For example, in the +following case: + +TC 76543210 + +t0 00000001b 200000 ns +t1 00000010b 200000 ns + +min_gate_len[0] and min_gate_len[1] should be 200000, while +min_gate_len[2-7] should be 0. + +However what happens is that min_gate_len[0] is 200000, but +min_gate_len[1] ends up being 0 (despite gate_len[1] being 200000 at the +point where the logic detects the gate close event for TC 1). + +The problem is that the code considers a "gate close" event whenever it +sees that there is a 0 for that TC (essentially it's level rather than +edge triggered). By doing that, any time a gate is seen as closed +without having been open prior, gate_len, which is 0, will be written +into min_gate_len. Once min_gate_len becomes 0, it's impossible for it +to track anything higher than that (the length of actually open +intervals). + +To fix this, we make the writing to min_gate_len[tc] be edge-triggered, +which avoids writes for gates that are closed in consecutive intervals. +However what this does is it makes us need to special-case the +permanently closed gates at the end. + +Fixes: 55a515b1f5a9 ("net: dsa: felix: drop oversized frames with tc-taprio instead of hanging the port") +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20220804202817.1677572-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/ocelot/felix_vsc9959.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +--- a/drivers/net/dsa/ocelot/felix_vsc9959.c ++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c +@@ -1136,6 +1136,7 @@ static void vsc9959_tas_min_gate_lengths + { + struct tc_taprio_sched_entry *entry; + u64 gate_len[OCELOT_NUM_TC]; ++ u8 gates_ever_opened = 0; + int tc, i, n; + + /* Initialize arrays */ +@@ -1163,16 +1164,28 @@ static void vsc9959_tas_min_gate_lengths + for (tc = 0; tc < OCELOT_NUM_TC; tc++) { + if (entry->gate_mask & BIT(tc)) { + gate_len[tc] += entry->interval; ++ gates_ever_opened |= BIT(tc); + } else { + /* Gate closes now, record a potential new + * minimum and reinitialize length + */ +- if (min_gate_len[tc] > gate_len[tc]) ++ if (min_gate_len[tc] > gate_len[tc] && ++ gate_len[tc]) + min_gate_len[tc] = gate_len[tc]; + gate_len[tc] = 0; + } + } + } ++ ++ /* min_gate_len[tc] actually tracks minimum *open* gate time, so for ++ * permanently closed gates, min_gate_len[tc] will still be U64_MAX. ++ * Therefore they are currently indistinguishable from permanently ++ * open gates. Overwrite the gate len with 0 when we know they're ++ * actually permanently closed, i.e. after the loop above. ++ */ ++ for (tc = 0; tc < OCELOT_NUM_TC; tc++) ++ if (!(gates_ever_opened & BIT(tc))) ++ min_gate_len[tc] = 0; + } + + /* Update QSYS_PORT_MAX_SDU to make sure the static guard bands added by the diff --git a/queue-5.19/powerpc-kexec-fix-build-failure-from-uninitialised-variable.patch b/queue-5.19/powerpc-kexec-fix-build-failure-from-uninitialised-variable.patch new file mode 100644 index 00000000000..b078a655deb --- /dev/null +++ b/queue-5.19/powerpc-kexec-fix-build-failure-from-uninitialised-variable.patch @@ -0,0 +1,48 @@ +From 83ee9f23763a432a4077bf20624ee35de87bce99 Mon Sep 17 00:00:00 2001 +From: Russell Currey +Date: Wed, 10 Aug 2022 15:43:31 +1000 +Subject: powerpc/kexec: Fix build failure from uninitialised variable + +From: Russell Currey + +commit 83ee9f23763a432a4077bf20624ee35de87bce99 upstream. + +clang 14 won't build because ret is uninitialised and can be returned if +both prop and fdtprop are NULL. Drop the ret variable and return an +error in that failure case. + +Fixes: b1fc44eaa9ba ("pseries/iommu/ddw: Fix kdump to work in absence of ibm,dma-window") +Suggested-by: Christophe Leroy +Signed-off-by: Russell Currey +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220810054331.373761-1-ruscur@russell.cc +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kexec/file_load_64.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/arch/powerpc/kexec/file_load_64.c ++++ b/arch/powerpc/kexec/file_load_64.c +@@ -1043,17 +1043,17 @@ static int copy_property(void *fdt, int + const char *propname) + { + const void *prop, *fdtprop; +- int len = 0, fdtlen = 0, ret; ++ int len = 0, fdtlen = 0; + + prop = of_get_property(dn, propname, &len); + fdtprop = fdt_getprop(fdt, node_offset, propname, &fdtlen); + + if (fdtprop && !prop) +- ret = fdt_delprop(fdt, node_offset, propname); ++ return fdt_delprop(fdt, node_offset, propname); + else if (prop) +- ret = fdt_setprop(fdt, node_offset, propname, prop, len); +- +- return ret; ++ return fdt_setprop(fdt, node_offset, propname, prop, len); ++ else ++ return -FDT_ERR_NOTFOUND; + } + + static int update_pci_dma_nodes(void *fdt, const char *dmapropname) diff --git a/queue-5.19/raw-fix-a-typo-in-raw_icmp_error.patch b/queue-5.19/raw-fix-a-typo-in-raw_icmp_error.patch new file mode 100644 index 00000000000..546666828c1 --- /dev/null +++ b/queue-5.19/raw-fix-a-typo-in-raw_icmp_error.patch @@ -0,0 +1,36 @@ +From 97a4d46b1516250d640c1ae0c9e7129d160d6a1c Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 23 Jun 2022 19:35:40 +0000 +Subject: raw: fix a typo in raw_icmp_error() + +From: Eric Dumazet + +commit 97a4d46b1516250d640c1ae0c9e7129d160d6a1c upstream. + +I accidentally broke IPv4 traceroute, by swapping iph->saddr +and iph->daddr. + +Probably because raw_icmp_error() and raw_v4_input() +use different order for iph->saddr and iph->daddr. + +Fixes: ba44f8182ec2 ("raw: use more conventional iterators") +Reported-by: John Sperbeck +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20220623193540.2851799-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/raw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/raw.c ++++ b/net/ipv4/raw.c +@@ -278,7 +278,7 @@ void raw_icmp_error(struct sk_buff *skb, + hlist_nulls_for_each_entry(sk, hnode, hlist, sk_nulls_node) { + iph = (const struct iphdr *)skb->data; + if (!raw_v4_match(net, sk, iph->protocol, +- iph->saddr, iph->daddr, dif, sdif)) ++ iph->daddr, iph->saddr, dif, sdif)) + continue; + raw_err(sk, skb, info); + } diff --git a/queue-5.19/raw-remove-unused-variables-from-raw6_icmp_error.patch b/queue-5.19/raw-remove-unused-variables-from-raw6_icmp_error.patch new file mode 100644 index 00000000000..db433ab35f0 --- /dev/null +++ b/queue-5.19/raw-remove-unused-variables-from-raw6_icmp_error.patch @@ -0,0 +1,41 @@ +From c4fceb46add65481ef0dfb79cad24c3c269b4cad Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 22 Jun 2022 03:23:03 +0000 +Subject: raw: remove unused variables from raw6_icmp_error() + +From: Eric Dumazet + +commit c4fceb46add65481ef0dfb79cad24c3c269b4cad upstream. + +saddr and daddr are set but not used. + +Fixes: ba44f8182ec2 ("raw: use more conventional iterators") +Reported-by: kernel test robot +Signed-off-by: Eric Dumazet +Acked-by: Jonathan Lemon +Link: https://lore.kernel.org/r/20220622032303.159394-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/raw.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/net/ipv6/raw.c ++++ b/net/ipv6/raw.c +@@ -332,7 +332,6 @@ static void rawv6_err(struct sock *sk, s + void raw6_icmp_error(struct sk_buff *skb, int nexthdr, + u8 type, u8 code, int inner_offset, __be32 info) + { +- const struct in6_addr *saddr, *daddr; + struct net *net = dev_net(skb->dev); + struct hlist_nulls_head *hlist; + struct hlist_nulls_node *hnode; +@@ -345,8 +344,6 @@ void raw6_icmp_error(struct sk_buff *skb + hlist_nulls_for_each_entry(sk, hnode, hlist, sk_nulls_node) { + /* Note: ipv6_hdr(skb) != skb->data */ + const struct ipv6hdr *ip6h = (const struct ipv6hdr *)skb->data; +- saddr = &ip6h->saddr; +- daddr = &ip6h->daddr; + + if (!raw_v6_match(net, sk, nexthdr, &ip6h->saddr, &ip6h->daddr, + inet6_iif(skb), inet6_iif(skb))) diff --git a/queue-5.19/revert-devcoredump-remove-the-useless-gfp_t-parameter-in-dev_coredumpv-and-dev_coredumpm.patch b/queue-5.19/revert-devcoredump-remove-the-useless-gfp_t-parameter-in-dev_coredumpv-and-dev_coredumpm.patch new file mode 100644 index 00000000000..117d7ddc5ea --- /dev/null +++ b/queue-5.19/revert-devcoredump-remove-the-useless-gfp_t-parameter-in-dev_coredumpv-and-dev_coredumpm.patch @@ -0,0 +1,437 @@ +From 38a523a2946d3a0961d141d477a1ee2b1f3bdbb1 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Mon, 27 Jun 2022 16:36:57 +0200 +Subject: Revert "devcoredump: remove the useless gfp_t parameter in dev_coredumpv and dev_coredumpm" + +From: Greg Kroah-Hartman + +commit 38a523a2946d3a0961d141d477a1ee2b1f3bdbb1 upstream. + +This reverts commit 77515ebaf01920e2db49e04672ef669a7c2907f2 as it +causes build problems in linux-next. It needs to be reintroduced in a +way that can allow the api to evolve and not require a "flag day" to +catch all users. + +Link: https://lore.kernel.org/r/20220623160723.7a44b573@canb.auug.org.au +Cc: Duoming Zhou +Cc: Brian Norris +Cc: Johannes Berg +Reported-by: Stephen Rothwell +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/devcoredump.c | 16 +++++++++------ + drivers/bluetooth/btmrvl_sdio.c | 2 - + drivers/bluetooth/hci_qca.c | 2 - + drivers/gpu/drm/etnaviv/etnaviv_dump.c | 2 - + drivers/gpu/drm/msm/disp/msm_disp_snapshot.c | 4 +-- + drivers/gpu/drm/msm/msm_gpu.c | 4 +-- + drivers/media/platform/qcom/venus/core.c | 2 - + drivers/net/can/spi/mcp251xfd/mcp251xfd-dump.c | 2 - + drivers/net/wireless/ath/ath10k/coredump.c | 2 - + drivers/net/wireless/ath/wil6210/wil_crash_dump.c | 2 - + drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c | 2 - + drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 6 +++-- + drivers/net/wireless/marvell/mwifiex/main.c | 3 +- + drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 3 +- + drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 3 +- + drivers/net/wireless/realtek/rtw88/main.c | 2 - + drivers/net/wireless/realtek/rtw89/ser.c | 2 - + drivers/remoteproc/qcom_q6v5_mss.c | 2 - + drivers/remoteproc/remoteproc_coredump.c | 8 +++---- + include/drm/drm_print.h | 2 - + include/linux/devcoredump.h | 13 ++++++------ + sound/soc/intel/avs/apl.c | 2 - + sound/soc/intel/avs/skl.c | 2 - + sound/soc/intel/catpt/dsp.c | 2 - + 24 files changed, 50 insertions(+), 40 deletions(-) + +--- a/drivers/base/devcoredump.c ++++ b/drivers/base/devcoredump.c +@@ -173,13 +173,15 @@ static void devcd_freev(void *data) + * @dev: the struct device for the crashed device + * @data: vmalloc data containing the device coredump + * @datalen: length of the data ++ * @gfp: allocation flags + * + * This function takes ownership of the vmalloc'ed data and will free + * it when it is no longer used. See dev_coredumpm() for more information. + */ +-void dev_coredumpv(struct device *dev, void *data, size_t datalen) ++void dev_coredumpv(struct device *dev, void *data, size_t datalen, ++ gfp_t gfp) + { +- dev_coredumpm(dev, NULL, data, datalen, devcd_readv, devcd_freev); ++ dev_coredumpm(dev, NULL, data, datalen, gfp, devcd_readv, devcd_freev); + } + EXPORT_SYMBOL_GPL(dev_coredumpv); + +@@ -234,6 +236,7 @@ static ssize_t devcd_read_from_sgtable(c + * @owner: the module that contains the read/free functions, use %THIS_MODULE + * @data: data cookie for the @read/@free functions + * @datalen: length of the data ++ * @gfp: allocation flags + * @read: function to read from the given buffer + * @free: function to free the given buffer + * +@@ -243,7 +246,7 @@ static ssize_t devcd_read_from_sgtable(c + * function will be called to free the data. + */ + void dev_coredumpm(struct device *dev, struct module *owner, +- void *data, size_t datalen, ++ void *data, size_t datalen, gfp_t gfp, + ssize_t (*read)(char *buffer, loff_t offset, size_t count, + void *data, size_t datalen), + void (*free)(void *data)) +@@ -265,7 +268,7 @@ void dev_coredumpm(struct device *dev, s + if (!try_module_get(owner)) + goto free; + +- devcd = kzalloc(sizeof(*devcd), GFP_KERNEL); ++ devcd = kzalloc(sizeof(*devcd), gfp); + if (!devcd) + goto put_module; + +@@ -315,6 +318,7 @@ EXPORT_SYMBOL_GPL(dev_coredumpm); + * @dev: the struct device for the crashed device + * @table: the dump data + * @datalen: length of the data ++ * @gfp: allocation flags + * + * Creates a new device coredump for the given device. If a previous one hasn't + * been read yet, the new coredump is discarded. The data lifetime is determined +@@ -322,9 +326,9 @@ EXPORT_SYMBOL_GPL(dev_coredumpm); + * it will free the data. + */ + void dev_coredumpsg(struct device *dev, struct scatterlist *table, +- size_t datalen) ++ size_t datalen, gfp_t gfp) + { +- dev_coredumpm(dev, NULL, table, datalen, devcd_read_from_sgtable, ++ dev_coredumpm(dev, NULL, table, datalen, gfp, devcd_read_from_sgtable, + devcd_free_sgtable); + } + EXPORT_SYMBOL_GPL(dev_coredumpsg); +--- a/drivers/bluetooth/btmrvl_sdio.c ++++ b/drivers/bluetooth/btmrvl_sdio.c +@@ -1515,7 +1515,7 @@ done: + /* fw_dump_data will be free in device coredump release function + * after 5 min + */ +- dev_coredumpv(&card->func->dev, fw_dump_data, fw_dump_len); ++ dev_coredumpv(&card->func->dev, fw_dump_data, fw_dump_len, GFP_KERNEL); + BT_INFO("== btmrvl firmware dump to /sys/class/devcoredump end"); + } + +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -1120,7 +1120,7 @@ static void qca_controller_memdump(struc + qca_memdump->ram_dump_size); + memdump_buf = qca_memdump->memdump_buf_head; + dev_coredumpv(&hu->serdev->dev, memdump_buf, +- qca_memdump->received_dump); ++ qca_memdump->received_dump, GFP_KERNEL); + cancel_delayed_work(&qca->ctrl_memdump_timeout); + kfree(qca->qca_memdump); + qca->qca_memdump = NULL; +--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c +@@ -225,5 +225,5 @@ void etnaviv_core_dump(struct etnaviv_ge + + etnaviv_core_dump_header(&iter, ETDUMP_BUF_END, iter.data); + +- dev_coredumpv(gpu->dev, iter.start, iter.data - iter.start); ++ dev_coredumpv(gpu->dev, iter.start, iter.data - iter.start, GFP_KERNEL); + } +--- a/drivers/gpu/drm/msm/disp/msm_disp_snapshot.c ++++ b/drivers/gpu/drm/msm/disp/msm_disp_snapshot.c +@@ -74,8 +74,8 @@ static void _msm_disp_snapshot_work(stru + * If there is a codedump pending for the device, the dev_coredumpm() + * will also free new coredump state. + */ +- dev_coredumpm(disp_state->dev, THIS_MODULE, disp_state, 0, +- disp_devcoredump_read, msm_disp_state_free); ++ dev_coredumpm(disp_state->dev, THIS_MODULE, disp_state, 0, GFP_KERNEL, ++ disp_devcoredump_read, msm_disp_state_free); + } + + void msm_disp_snapshot_state(struct drm_device *drm_dev) +--- a/drivers/gpu/drm/msm/msm_gpu.c ++++ b/drivers/gpu/drm/msm/msm_gpu.c +@@ -299,8 +299,8 @@ static void msm_gpu_crashstate_capture(s + gpu->crashstate = state; + + /* FIXME: Release the crashstate if this errors out? */ +- dev_coredumpm(gpu->dev->dev, THIS_MODULE, gpu, 0, +- msm_gpu_devcoredump_read, msm_gpu_devcoredump_free); ++ dev_coredumpm(gpu->dev->dev, THIS_MODULE, gpu, 0, GFP_KERNEL, ++ msm_gpu_devcoredump_read, msm_gpu_devcoredump_free); + } + #else + static void msm_gpu_crashstate_capture(struct msm_gpu *gpu, +--- a/drivers/media/platform/qcom/venus/core.c ++++ b/drivers/media/platform/qcom/venus/core.c +@@ -49,7 +49,7 @@ static void venus_coredump(struct venus_ + + memcpy(data, mem_va, mem_size); + memunmap(mem_va); +- dev_coredumpv(dev, data, mem_size); ++ dev_coredumpv(dev, data, mem_size, GFP_KERNEL); + } + + static void venus_event_notify(struct venus_core *core, u32 event) +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-dump.c ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-dump.c +@@ -281,5 +281,5 @@ void mcp251xfd_dump(const struct mcp251x + mcp251xfd_dump_end(priv, &iter); + + dev_coredumpv(&priv->spi->dev, iter.start, +- iter.data - iter.start); ++ iter.data - iter.start, GFP_KERNEL); + } +--- a/drivers/net/wireless/ath/ath10k/coredump.c ++++ b/drivers/net/wireless/ath/ath10k/coredump.c +@@ -1607,7 +1607,7 @@ int ath10k_coredump_submit(struct ath10k + return -ENODATA; + } + +- dev_coredumpv(ar->dev, dump, le32_to_cpu(dump->len)); ++ dev_coredumpv(ar->dev, dump, le32_to_cpu(dump->len), GFP_KERNEL); + + return 0; + } +--- a/drivers/net/wireless/ath/wil6210/wil_crash_dump.c ++++ b/drivers/net/wireless/ath/wil6210/wil_crash_dump.c +@@ -117,6 +117,6 @@ void wil_fw_core_dump(struct wil6210_pri + /* fw_dump_data will be free in device coredump release function + * after 5 min + */ +- dev_coredumpv(wil_to_dev(wil), fw_dump_data, fw_dump_size); ++ dev_coredumpv(wil_to_dev(wil), fw_dump_data, fw_dump_size, GFP_KERNEL); + wil_info(wil, "fw core dumped, size %d bytes\n", fw_dump_size); + } +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c +@@ -37,7 +37,7 @@ int brcmf_debug_create_memdump(struct br + return err; + } + +- dev_coredumpv(bus->dev, dump, len + ramsize); ++ dev_coredumpv(bus->dev, dump, len + ramsize, GFP_KERNEL); + + return 0; + } +--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c +@@ -2601,7 +2601,8 @@ static void iwl_fw_error_dump(struct iwl + fw_error_dump.trans_ptr->data, + fw_error_dump.trans_ptr->len, + fw_error_dump.fwrt_len); +- dev_coredumpsg(fwrt->trans->dev, sg_dump_data, file_len); ++ dev_coredumpsg(fwrt->trans->dev, sg_dump_data, file_len, ++ GFP_KERNEL); + } + vfree(fw_error_dump.fwrt_ptr); + vfree(fw_error_dump.trans_ptr); +@@ -2646,7 +2647,8 @@ static void iwl_fw_error_ini_dump(struct + entry->data, entry->size, offs); + offs += entry->size; + } +- dev_coredumpsg(fwrt->trans->dev, sg_dump_data, file_len); ++ dev_coredumpsg(fwrt->trans->dev, sg_dump_data, file_len, ++ GFP_KERNEL); + } + iwl_dump_ini_list_free(&dump_list); + } +--- a/drivers/net/wireless/marvell/mwifiex/main.c ++++ b/drivers/net/wireless/marvell/mwifiex/main.c +@@ -1115,7 +1115,8 @@ void mwifiex_upload_device_dump(struct m + */ + mwifiex_dbg(adapter, MSG, + "== mwifiex dump information to /sys/class/devcoredump start\n"); +- dev_coredumpv(adapter->dev, adapter->devdump_data, adapter->devdump_len); ++ dev_coredumpv(adapter->dev, adapter->devdump_data, adapter->devdump_len, ++ GFP_KERNEL); + mwifiex_dbg(adapter, MSG, + "== mwifiex dump information to /sys/class/devcoredump end\n"); + +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +@@ -2422,5 +2422,6 @@ void mt7615_coredump_work(struct work_st + + dev_kfree_skb(skb); + } +- dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ); ++ dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ, ++ GFP_KERNEL); + } +--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c +@@ -1419,7 +1419,8 @@ void mt7921_coredump_work(struct work_st + } + + if (dump) +- dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ); ++ dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ, ++ GFP_KERNEL); + + mt7921_reset(&dev->mt76); + } +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -414,7 +414,7 @@ static void rtw_fwcd_dump(struct rtw_dev + * framework. Note that a new dump will be discarded if a previous one + * hasn't been released yet. + */ +- dev_coredumpv(rtwdev->dev, desc->data, desc->size); ++ dev_coredumpv(rtwdev->dev, desc->data, desc->size, GFP_KERNEL); + } + + static void rtw_fwcd_free(struct rtw_dev *rtwdev, bool free_self) +--- a/drivers/net/wireless/realtek/rtw89/ser.c ++++ b/drivers/net/wireless/realtek/rtw89/ser.c +@@ -127,7 +127,7 @@ static void rtw89_ser_cd_send(struct rtw + * will be discarded if a previous one hasn't been released by + * framework yet. + */ +- dev_coredumpv(rtwdev->dev, buf, sizeof(*buf)); ++ dev_coredumpv(rtwdev->dev, buf, sizeof(*buf), GFP_KERNEL); + } + + static void rtw89_ser_cd_free(struct rtw89_dev *rtwdev, +--- a/drivers/remoteproc/qcom_q6v5_mss.c ++++ b/drivers/remoteproc/qcom_q6v5_mss.c +@@ -597,7 +597,7 @@ static void q6v5_dump_mba_logs(struct q6 + data = vmalloc(MBA_LOG_SIZE); + if (data) { + memcpy(data, mba_region, MBA_LOG_SIZE); +- dev_coredumpv(&rproc->dev, data, MBA_LOG_SIZE); ++ dev_coredumpv(&rproc->dev, data, MBA_LOG_SIZE, GFP_KERNEL); + } + memunmap(mba_region); + } +--- a/drivers/remoteproc/remoteproc_coredump.c ++++ b/drivers/remoteproc/remoteproc_coredump.c +@@ -309,7 +309,7 @@ void rproc_coredump(struct rproc *rproc) + phdr += elf_size_of_phdr(class); + } + if (dump_conf == RPROC_COREDUMP_ENABLED) { +- dev_coredumpv(&rproc->dev, data, data_size); ++ dev_coredumpv(&rproc->dev, data, data_size, GFP_KERNEL); + return; + } + +@@ -318,7 +318,7 @@ void rproc_coredump(struct rproc *rproc) + dump_state.header = data; + init_completion(&dump_state.dump_done); + +- dev_coredumpm(&rproc->dev, NULL, &dump_state, data_size, ++ dev_coredumpm(&rproc->dev, NULL, &dump_state, data_size, GFP_KERNEL, + rproc_coredump_read, rproc_coredump_free); + + /* +@@ -449,7 +449,7 @@ void rproc_coredump_using_sections(struc + } + + if (dump_conf == RPROC_COREDUMP_ENABLED) { +- dev_coredumpv(&rproc->dev, data, data_size); ++ dev_coredumpv(&rproc->dev, data, data_size, GFP_KERNEL); + return; + } + +@@ -458,7 +458,7 @@ void rproc_coredump_using_sections(struc + dump_state.header = data; + init_completion(&dump_state.dump_done); + +- dev_coredumpm(&rproc->dev, NULL, &dump_state, data_size, ++ dev_coredumpm(&rproc->dev, NULL, &dump_state, data_size, GFP_KERNEL, + rproc_coredump_read, rproc_coredump_free); + + /* Wait until the dump is read and free is called. Data is freed +--- a/include/drm/drm_print.h ++++ b/include/drm/drm_print.h +@@ -162,7 +162,7 @@ struct drm_print_iterator { + * void makecoredump(...) + * { + * ... +- * dev_coredumpm(dev, THIS_MODULE, data, 0, ++ * dev_coredumpm(dev, THIS_MODULE, data, 0, GFP_KERNEL, + * coredump_read, ...) + * } + * +--- a/include/linux/devcoredump.h ++++ b/include/linux/devcoredump.h +@@ -52,26 +52,27 @@ static inline void _devcd_free_sgtable(s + + + #ifdef CONFIG_DEV_COREDUMP +-void dev_coredumpv(struct device *dev, void *data, size_t datalen); ++void dev_coredumpv(struct device *dev, void *data, size_t datalen, ++ gfp_t gfp); + + void dev_coredumpm(struct device *dev, struct module *owner, +- void *data, size_t datalen, ++ void *data, size_t datalen, gfp_t gfp, + ssize_t (*read)(char *buffer, loff_t offset, size_t count, + void *data, size_t datalen), + void (*free)(void *data)); + + void dev_coredumpsg(struct device *dev, struct scatterlist *table, +- size_t datalen); ++ size_t datalen, gfp_t gfp); + #else + static inline void dev_coredumpv(struct device *dev, void *data, +- size_t datalen) ++ size_t datalen, gfp_t gfp) + { + vfree(data); + } + + static inline void + dev_coredumpm(struct device *dev, struct module *owner, +- void *data, size_t datalen, ++ void *data, size_t datalen, gfp_t gfp, + ssize_t (*read)(char *buffer, loff_t offset, size_t count, + void *data, size_t datalen), + void (*free)(void *data)) +@@ -80,7 +81,7 @@ dev_coredumpm(struct device *dev, struct + } + + static inline void dev_coredumpsg(struct device *dev, struct scatterlist *table, +- size_t datalen) ++ size_t datalen, gfp_t gfp) + { + _devcd_free_sgtable(table); + } +--- a/sound/soc/intel/avs/apl.c ++++ b/sound/soc/intel/avs/apl.c +@@ -164,7 +164,7 @@ static int apl_coredump(struct avs_dev * + } while (offset < msg->ext.coredump.stack_dump_size); + + exit: +- dev_coredumpv(adev->dev, dump, dump_size); ++ dev_coredumpv(adev->dev, dump, dump_size, GFP_KERNEL); + + return 0; + } +--- a/sound/soc/intel/avs/skl.c ++++ b/sound/soc/intel/avs/skl.c +@@ -88,7 +88,7 @@ static int skl_coredump(struct avs_dev * + return -ENOMEM; + + memcpy_fromio(dump, avs_sram_addr(adev, AVS_FW_REGS_WINDOW), AVS_FW_REGS_SIZE); +- dev_coredumpv(adev->dev, dump, AVS_FW_REGS_SIZE); ++ dev_coredumpv(adev->dev, dump, AVS_FW_REGS_SIZE, GFP_KERNEL); + + return 0; + } +--- a/sound/soc/intel/catpt/dsp.c ++++ b/sound/soc/intel/catpt/dsp.c +@@ -539,7 +539,7 @@ int catpt_coredump(struct catpt_dev *cde + pos += CATPT_DMA_REGS_SIZE; + } + +- dev_coredumpv(cdev->dev, dump, dump_size); ++ dev_coredumpv(cdev->dev, dump, dump_size, GFP_KERNEL); + + return 0; + } diff --git a/queue-5.19/revert-drm-bridge-anx7625-use-dpi-bus-type.patch b/queue-5.19/revert-drm-bridge-anx7625-use-dpi-bus-type.patch new file mode 100644 index 00000000000..6598e692b55 --- /dev/null +++ b/queue-5.19/revert-drm-bridge-anx7625-use-dpi-bus-type.patch @@ -0,0 +1,54 @@ +From 61922beba36adea8702fe8069b309c806f6608af Mon Sep 17 00:00:00 2001 +From: Robert Foss +Date: Mon, 23 May 2022 18:15:19 +0200 +Subject: Revert "drm/bridge: anx7625: Use DPI bus type" + +From: Robert Foss + +commit 61922beba36adea8702fe8069b309c806f6608af upstream. + +This reverts commit a77c2af0994e24ee36c7ffb6dc852770bdf06fb1. + +This patch depends on the patches just aplied to the media tree, and will +not build without them, which leaves drm-misc-next in a broken state. +Let's revert the two latter patches until rc1 has been branched, +and rc1 has been backmerged into drm-misc-next. + +Signed-off-by: Robert Foss +Acked-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20220523161520.354687-1-robert.foss@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -1623,14 +1623,14 @@ static int anx7625_parse_dt(struct devic + + anx7625_get_swing_setting(dev, pdata); + +- pdata->is_dpi = 0; /* default dsi mode */ ++ pdata->is_dpi = 1; /* default dpi mode */ + pdata->mipi_host_node = of_graph_get_remote_node(np, 0, 0); + if (!pdata->mipi_host_node) { + DRM_DEV_ERROR(dev, "fail to get internal panel.\n"); + return -ENODEV; + } + +- bus_type = 0; ++ bus_type = V4L2_FWNODE_BUS_TYPE_PARALLEL; + mipi_lanes = MAX_LANES_SUPPORT; + ep0 = of_graph_get_endpoint_by_regs(np, 0, 0); + if (ep0) { +@@ -1640,8 +1640,8 @@ static int anx7625_parse_dt(struct devic + mipi_lanes = of_property_count_u32_elems(ep0, "data-lanes"); + } + +- if (bus_type == V4L2_FWNODE_BUS_TYPE_DPI) /* bus type is DPI */ +- pdata->is_dpi = 1; ++ if (bus_type == V4L2_FWNODE_BUS_TYPE_PARALLEL) /* bus type is Parallel(DSI) */ ++ pdata->is_dpi = 0; + + pdata->mipi_lanes = mipi_lanes; + if (pdata->mipi_lanes > MAX_LANES_SUPPORT || pdata->mipi_lanes <= 0) diff --git a/queue-5.19/revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch b/queue-5.19/revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch new file mode 100644 index 00000000000..f3d38f35ae8 --- /dev/null +++ b/queue-5.19/revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch @@ -0,0 +1,100 @@ +From 5f8954e099b8ae96e7de1bb95950e00c85bedd40 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Mon, 27 Jun 2022 16:35:59 +0200 +Subject: Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv" + +From: Greg Kroah-Hartman + +commit 5f8954e099b8ae96e7de1bb95950e00c85bedd40 upstream. + +This reverts commit a52ed4866d2b90dd5e4ae9dabd453f3ed8fa3cbc as it +causes build problems in linux-next. It needs to be reintroduced in a +way that can allow the api to evolve and not require a "flag day" to +catch all users. + +Link: https://lore.kernel.org/r/20220623160723.7a44b573@canb.auug.org.au +Cc: Duoming Zhou +Cc: Brian Norris +Cc: Johannes Berg +Reported-by: Stephen Rothwell +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/init.c | 9 ++++----- + drivers/net/wireless/marvell/mwifiex/main.h | 3 +-- + drivers/net/wireless/marvell/mwifiex/sta_event.c | 6 +++--- + 3 files changed, 8 insertions(+), 10 deletions(-) + +--- a/drivers/net/wireless/marvell/mwifiex/init.c ++++ b/drivers/net/wireless/marvell/mwifiex/init.c +@@ -63,10 +63,9 @@ static void wakeup_timer_fn(struct timer + adapter->if_ops.card_reset(adapter); + } + +-static void fw_dump_work(struct work_struct *work) ++static void fw_dump_timer_fn(struct timer_list *t) + { +- struct mwifiex_adapter *adapter = +- container_of(work, struct mwifiex_adapter, devdump_work.work); ++ struct mwifiex_adapter *adapter = from_timer(adapter, t, devdump_timer); + + mwifiex_upload_device_dump(adapter); + } +@@ -322,7 +321,7 @@ static void mwifiex_init_adapter(struct + adapter->active_scan_triggered = false; + timer_setup(&adapter->wakeup_timer, wakeup_timer_fn, 0); + adapter->devdump_len = 0; +- INIT_DELAYED_WORK(&adapter->devdump_work, fw_dump_work); ++ timer_setup(&adapter->devdump_timer, fw_dump_timer_fn, 0); + } + + /* +@@ -401,7 +400,7 @@ static void + mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter) + { + del_timer(&adapter->wakeup_timer); +- cancel_delayed_work_sync(&adapter->devdump_work); ++ del_timer_sync(&adapter->devdump_timer); + mwifiex_cancel_all_pending_cmd(adapter); + wake_up_interruptible(&adapter->cmd_wait_q.wait); + wake_up_interruptible(&adapter->hs_activate_wait_q); +--- a/drivers/net/wireless/marvell/mwifiex/main.h ++++ b/drivers/net/wireless/marvell/mwifiex/main.h +@@ -49,7 +49,6 @@ + #include + #include + #include +-#include + + #include "decl.h" + #include "ioctl.h" +@@ -1056,7 +1055,7 @@ struct mwifiex_adapter { + /* Device dump data/length */ + void *devdump_data; + int devdump_len; +- struct delayed_work devdump_work; ++ struct timer_list devdump_timer; + + bool ignore_btcoex_events; + }; +--- a/drivers/net/wireless/marvell/mwifiex/sta_event.c ++++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c +@@ -623,8 +623,8 @@ mwifiex_fw_dump_info_event(struct mwifie + * transmission event get lost, in this cornel case, + * user would still get partial of the dump. + */ +- schedule_delayed_work(&adapter->devdump_work, +- msecs_to_jiffies(MWIFIEX_TIMER_10S)); ++ mod_timer(&adapter->devdump_timer, ++ jiffies + msecs_to_jiffies(MWIFIEX_TIMER_10S)); + } + + /* Overflow check */ +@@ -643,7 +643,7 @@ mwifiex_fw_dump_info_event(struct mwifie + return; + + upload_dump: +- cancel_delayed_work_sync(&adapter->devdump_work); ++ del_timer_sync(&adapter->devdump_timer); + mwifiex_upload_device_dump(adapter); + } + diff --git a/queue-5.19/revert-s390-smp-enforce-lowcore-protection-on-cpu-restart.patch b/queue-5.19/revert-s390-smp-enforce-lowcore-protection-on-cpu-restart.patch new file mode 100644 index 00000000000..a4c4c52ce12 --- /dev/null +++ b/queue-5.19/revert-s390-smp-enforce-lowcore-protection-on-cpu-restart.patch @@ -0,0 +1,31 @@ +From 953503751a426413ea8aee2299ae3ee971b70d9b Mon Sep 17 00:00:00 2001 +From: Alexander Gordeev +Date: Sat, 6 Aug 2022 09:29:46 +0200 +Subject: Revert "s390/smp: enforce lowcore protection on CPU restart" + +From: Alexander Gordeev + +commit 953503751a426413ea8aee2299ae3ee971b70d9b upstream. + +This reverts commit 6f5c672d17f583b081e283927f5040f726c54598. + +This breaks normal crash dump when CPU0 is offline. + +Signed-off-by: Alexander Gordeev +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/kernel/setup.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -508,8 +508,8 @@ static void __init setup_lowcore_dat_on( + S390_lowcore.svc_new_psw.mask |= PSW_MASK_DAT; + S390_lowcore.program_new_psw.mask |= PSW_MASK_DAT; + S390_lowcore.io_new_psw.mask |= PSW_MASK_DAT; +- __ctl_set_bit(0, 28); + __ctl_store(S390_lowcore.cregs_save_area, 0, 15); ++ __ctl_set_bit(0, 28); + put_abs_lowcore(restart_flags, RESTART_FLAG_CTLREGS); + put_abs_lowcore(program_new_psw, lc->program_new_psw); + for (cr = 0; cr < ARRAY_SIZE(lc->cregs_save_area); cr++) diff --git a/queue-5.19/series b/queue-5.19/series index 7e3db596e5e..5738365d606 100644 --- a/queue-5.19/series +++ b/queue-5.19/series @@ -1138,3 +1138,20 @@ powerpc-fix-eh-field-when-calling-lwarx-on-ppc32.patch powerpc64-ftrace-fix-ftrace-for-clang-builds.patch net_sched-cls_route-remove-from-list-when-handle-is-0.patch arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch +revert-drm-bridge-anx7625-use-dpi-bus-type.patch +tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch +crypto-lib-blake2s-reduce-stack-frame-usage-in-self-test.patch +raw-remove-unused-variables-from-raw6_icmp_error.patch +raw-fix-a-typo-in-raw_icmp_error.patch +revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch +revert-devcoredump-remove-the-useless-gfp_t-parameter-in-dev_coredumpv-and-dev_coredumpm.patch +mptcp-refine-memory-scheduling.patch +wifi-cfg80211-handle-ibss-in-channel-switch.patch +wifi-nl80211-hold-wdev-mutex-for-tid-config.patch +wifi-nl80211-relax-wdev-mutex-check-in-wdev_chandef.patch +wifi-nl80211-acquire-wdev-mutex-earlier-in-start_ap.patch +wifi-cfg80211-remove-chandef-check-in-cfg80211_cac_event.patch +tracing-use-a-copy-of-the-va_list-for-__assign_vstr.patch +net-dsa-felix-fix-min-gate-len-calculation-for-tc-when-its-first-gate-is-closed.patch +revert-s390-smp-enforce-lowcore-protection-on-cpu-restart.patch +powerpc-kexec-fix-build-failure-from-uninitialised-variable.patch diff --git a/queue-5.19/tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch b/queue-5.19/tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch new file mode 100644 index 00000000000..cd36a119d93 --- /dev/null +++ b/queue-5.19/tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch @@ -0,0 +1,45 @@ +From c4ee118561a0f74442439b7b5b486db1ac1ddfeb Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 14 Jun 2022 10:17:33 -0700 +Subject: tcp: fix over estimation in sk_forced_mem_schedule() + +From: Eric Dumazet + +commit c4ee118561a0f74442439b7b5b486db1ac1ddfeb upstream. + +sk_forced_mem_schedule() has a bug similar to ones fixed +in commit 7c80b038d23e ("net: fix sk_wmem_schedule() and +sk_rmem_schedule() errors") + +While this bug has little chance to trigger in old kernels, +we need to fix it before the following patch. + +Fixes: d83769a580f1 ("tcp: fix possible deadlock in tcp_send_fin()") +Signed-off-by: Eric Dumazet +Acked-by: Soheil Hassas Yeganeh +Reviewed-by: Shakeel Butt +Reviewed-by: Wei Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_output.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -3369,11 +3369,12 @@ void tcp_xmit_retransmit_queue(struct so + */ + void sk_forced_mem_schedule(struct sock *sk, int size) + { +- int amt; ++ int delta, amt; + +- if (size <= sk->sk_forward_alloc) ++ delta = size - sk->sk_forward_alloc; ++ if (delta <= 0) + return; +- amt = sk_mem_pages(size); ++ amt = sk_mem_pages(delta); + sk->sk_forward_alloc += amt * SK_MEM_QUANTUM; + sk_memory_allocated_add(sk, amt); + diff --git a/queue-5.19/tracing-use-a-copy-of-the-va_list-for-__assign_vstr.patch b/queue-5.19/tracing-use-a-copy-of-the-va_list-for-__assign_vstr.patch new file mode 100644 index 00000000000..92bea233e16 --- /dev/null +++ b/queue-5.19/tracing-use-a-copy-of-the-va_list-for-__assign_vstr.patch @@ -0,0 +1,61 @@ +From 3a2dcbaf4d31023106975d6ae75b6df080c454cb Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Google)" +Date: Tue, 19 Jul 2022 18:20:04 -0400 +Subject: tracing: Use a copy of the va_list for __assign_vstr() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Steven Rostedt (Google) + +commit 3a2dcbaf4d31023106975d6ae75b6df080c454cb upstream. + +If an instance of tracing enables the same trace event as another +instance, or the top level instance, or even perf, then the va_list passed +into some tracepoints can be used more than once. + +As va_list can only be traversed once, this can cause issues: + + # cat /sys/kernel/tracing/instances/qla2xxx/trace + cat-56106 [012] ..... 2419873.470098: ql_dbg_log: qla2xxx [0000:05:00.0]-1054:14: Entered (null). + cat-56106 [012] ..... 2419873.470101: ql_dbg_log: qla2xxx [0000:05:00.0]-1000:14: Entered ×+<96>²Ü<98>^H. + cat-56106 [012] ..... 2419873.470102: ql_dbg_log: qla2xxx [0000:05:00.0]-1006:14: Prepare to issue mbox cmd=0xde589000. + + # cat /sys/kernel/tracing/trace + cat-56106 [012] ..... 2419873.470097: ql_dbg_log: qla2xxx [0000:05:00.0]-1054:14: Entered qla2x00_get_firmware_state. + cat-56106 [012] ..... 2419873.470100: ql_dbg_log: qla2xxx [0000:05:00.0]-1000:14: Entered qla2x00_mailbox_command. + cat-56106 [012] ..... 2419873.470102: ql_dbg_log: qla2xxx [0000:05:00.0]-1006:14: Prepare to issue mbox cmd=0x69. + +The instance version is corrupted because the top level instance iterated +the va_list first. + +Use va_copy() in the __assign_vstr() macro to make sure that each trace +event for each use case gets a fresh va_list. + +Link: https://lore.kernel.org/all/259d53a5-958e-6508-4e45-74dba2821242@marvell.com/ +Link: https://lkml.kernel.org/r/20220719182004.21daa83e@gandalf.local.home + +Fixes: 0563231f93c6d ("tracing/events: Add __vstring() and __assign_vstr() helper macros") +Reported-by: Arun Easi +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + include/trace/stages/stage6_event_callback.h | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/include/trace/stages/stage6_event_callback.h ++++ b/include/trace/stages/stage6_event_callback.h +@@ -40,7 +40,12 @@ + + #undef __assign_vstr + #define __assign_vstr(dst, fmt, va) \ +- vsnprintf(__get_str(dst), TRACE_EVENT_STR_MAX, fmt, *(va)) ++ do { \ ++ va_list __cp_va; \ ++ va_copy(__cp_va, *(va)); \ ++ vsnprintf(__get_str(dst), TRACE_EVENT_STR_MAX, fmt, __cp_va); \ ++ va_end(__cp_va); \ ++ } while (0) + + #undef __bitmask + #define __bitmask(item, nr_bits) __dynamic_array(unsigned long, item, -1) diff --git a/queue-5.19/wifi-cfg80211-handle-ibss-in-channel-switch.patch b/queue-5.19/wifi-cfg80211-handle-ibss-in-channel-switch.patch new file mode 100644 index 00000000000..bab73817706 --- /dev/null +++ b/queue-5.19/wifi-cfg80211-handle-ibss-in-channel-switch.patch @@ -0,0 +1,34 @@ +From 77e7b6ba78edf817bddfa97fadb15a971992b1ee Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 27 Jun 2022 12:36:03 +0200 +Subject: wifi: cfg80211: handle IBSS in channel switch + +From: Johannes Berg + +commit 77e7b6ba78edf817bddfa97fadb15a971992b1ee upstream. + +Prior to commit 7b0a0e3c3a88 ("wifi: cfg80211: do some +rework towards MLO link APIs") the interface type didn't +really matter here, but now we need to handle all of the +possible cases. Add IBSS ("ADHOC") and handle it. + +Fixes: 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link APIs") +Reported-by: syzbot+90d912872157e63589e4@syzkaller.appspotmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/nl80211.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -18294,6 +18294,9 @@ void cfg80211_ch_switch_notify(struct ne + case NL80211_IFTYPE_P2P_GO: + wdev->links[link_id].ap.chandef = *chandef; + break; ++ case NL80211_IFTYPE_ADHOC: ++ wdev->u.ibss.chandef = *chandef; ++ break; + default: + WARN_ON(1); + break; diff --git a/queue-5.19/wifi-cfg80211-remove-chandef-check-in-cfg80211_cac_event.patch b/queue-5.19/wifi-cfg80211-remove-chandef-check-in-cfg80211_cac_event.patch new file mode 100644 index 00000000000..c64cb7b213d --- /dev/null +++ b/queue-5.19/wifi-cfg80211-remove-chandef-check-in-cfg80211_cac_event.patch @@ -0,0 +1,37 @@ +From d6f671c8a339d5b655acfacb8be6918c744fbabf Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 27 Jun 2022 12:49:03 +0200 +Subject: wifi: cfg80211: remove chandef check in cfg80211_cac_event() + +From: Johannes Berg + +commit d6f671c8a339d5b655acfacb8be6918c744fbabf upstream. + +The current check only worked for AP mode, but we can do +radar detection in mesh as well (for example). We could +try to check this using wdev_chandef(), but we also don't +really care since the chandef is passed in and we have no +need to use it anymore (since we added the argument in +commit d2859df5e7f0 ("cfg80211/mac80211: DFS setup chandef +for cac event")). + +Change-Id: I856e4344d5e64ff4d2eead0b4c53b11f264be9b8 +Fixes: 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link APIs") +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/mlme.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/net/wireless/mlme.c ++++ b/net/wireless/mlme.c +@@ -955,9 +955,6 @@ void cfg80211_cac_event(struct net_devic + if (WARN_ON(!wdev->cac_started && event != NL80211_RADAR_CAC_STARTED)) + return; + +- if (WARN_ON(!wdev->links[0].ap.chandef.chan)) +- return; +- + switch (event) { + case NL80211_RADAR_CAC_FINISHED: + timeout = wdev->cac_start_time + diff --git a/queue-5.19/wifi-nl80211-acquire-wdev-mutex-earlier-in-start_ap.patch b/queue-5.19/wifi-nl80211-acquire-wdev-mutex-earlier-in-start_ap.patch new file mode 100644 index 00000000000..d8bd26c91dd --- /dev/null +++ b/queue-5.19/wifi-nl80211-acquire-wdev-mutex-earlier-in-start_ap.patch @@ -0,0 +1,129 @@ +From c2653990d5729a445296d6d04395be5dea8e282e Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 27 Jun 2022 12:49:03 +0200 +Subject: wifi: nl80211: acquire wdev mutex earlier in start_ap + +From: Johannes Berg + +commit c2653990d5729a445296d6d04395be5dea8e282e upstream. + +We need to hold the wdev mutex already in order to call +nl80211_parse_tx_bitrate_mask(), so acquire it earlier. + +Fixes: 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link APIs") +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/nl80211.c | 25 +++++++++++++------------ + 1 file changed, 13 insertions(+), 12 deletions(-) + +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -5747,18 +5747,20 @@ static int nl80211_start_ap(struct sk_bu + goto out; + } + ++ wdev_lock(wdev); ++ + if (info->attrs[NL80211_ATTR_TX_RATES]) { + err = nl80211_parse_tx_bitrate_mask(info, info->attrs, + NL80211_ATTR_TX_RATES, + ¶ms->beacon_rate, + dev, false, link_id); + if (err) +- goto out; ++ goto out_unlock; + + err = validate_beacon_tx_rate(rdev, params->chandef.chan->band, + ¶ms->beacon_rate); + if (err) +- goto out; ++ goto out_unlock; + } + + if (info->attrs[NL80211_ATTR_SMPS_MODE]) { +@@ -5771,19 +5773,19 @@ static int nl80211_start_ap(struct sk_bu + if (!(rdev->wiphy.features & + NL80211_FEATURE_STATIC_SMPS)) { + err = -EINVAL; +- goto out; ++ goto out_unlock; + } + break; + case NL80211_SMPS_DYNAMIC: + if (!(rdev->wiphy.features & + NL80211_FEATURE_DYNAMIC_SMPS)) { + err = -EINVAL; +- goto out; ++ goto out_unlock; + } + break; + default: + err = -EINVAL; +- goto out; ++ goto out_unlock; + } + } else { + params->smps_mode = NL80211_SMPS_OFF; +@@ -5792,7 +5794,7 @@ static int nl80211_start_ap(struct sk_bu + params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); + if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) { + err = -EOPNOTSUPP; +- goto out; ++ goto out_unlock; + } + + if (info->attrs[NL80211_ATTR_ACL_POLICY]) { +@@ -5800,7 +5802,7 @@ static int nl80211_start_ap(struct sk_bu + if (IS_ERR(params->acl)) { + err = PTR_ERR(params->acl); + params->acl = NULL; +- goto out; ++ goto out_unlock; + } + } + +@@ -5812,7 +5814,7 @@ static int nl80211_start_ap(struct sk_bu + info->attrs[NL80211_ATTR_HE_OBSS_PD], + ¶ms->he_obss_pd); + if (err) +- goto out; ++ goto out_unlock; + } + + if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) { +@@ -5820,7 +5822,7 @@ static int nl80211_start_ap(struct sk_bu + info->attrs[NL80211_ATTR_FILS_DISCOVERY], + params); + if (err) +- goto out; ++ goto out_unlock; + } + + if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) { +@@ -5828,7 +5830,7 @@ static int nl80211_start_ap(struct sk_bu + rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP], + params); + if (err) +- goto out; ++ goto out_unlock; + } + + if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) { +@@ -5839,7 +5841,7 @@ static int nl80211_start_ap(struct sk_bu + params->beacon.mbssid_ies->cnt : + 0); + if (err) +- goto out; ++ goto out_unlock; + } + + nl80211_calculate_ap_params(params); +@@ -5850,7 +5852,6 @@ static int nl80211_start_ap(struct sk_bu + else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT]) + params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT; + +- wdev_lock(wdev); + if (wdev->conn_owner_nlportid && + info->attrs[NL80211_ATTR_SOCKET_OWNER] && + wdev->conn_owner_nlportid != info->snd_portid) { diff --git a/queue-5.19/wifi-nl80211-hold-wdev-mutex-for-tid-config.patch b/queue-5.19/wifi-nl80211-hold-wdev-mutex-for-tid-config.patch new file mode 100644 index 00000000000..bc904cf64d9 --- /dev/null +++ b/queue-5.19/wifi-nl80211-hold-wdev-mutex-for-tid-config.patch @@ -0,0 +1,40 @@ +From 206bbcf76121664e95a42e1c014c3fe168d07a3d Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 27 Jun 2022 12:43:37 +0200 +Subject: wifi: nl80211: hold wdev mutex for tid config + +From: Johannes Berg + +commit 206bbcf76121664e95a42e1c014c3fe168d07a3d upstream. + +We need wdev_chandef() in this code, which now requires +the wdev mutex due to the per-link nature. Hold it here +to make sure we can access the link. + +Reported-by: syzbot+b4e9aa0f32ffd9902442@syzkaller.appspotmail.com +Fixes: 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link APIs") +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/nl80211.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -15285,6 +15285,8 @@ static int nl80211_set_tid_config(struct + if (info->attrs[NL80211_ATTR_MAC]) + tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]); + ++ wdev_lock(dev->ieee80211_ptr); ++ + nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG], + rem_conf) { + ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX, +@@ -15306,6 +15308,7 @@ static int nl80211_set_tid_config(struct + + bad_tid_conf: + kfree(tid_config); ++ wdev_unlock(dev->ieee80211_ptr); + return ret; + } + diff --git a/queue-5.19/wifi-nl80211-relax-wdev-mutex-check-in-wdev_chandef.patch b/queue-5.19/wifi-nl80211-relax-wdev-mutex-check-in-wdev_chandef.patch new file mode 100644 index 00000000000..0082fe79cb0 --- /dev/null +++ b/queue-5.19/wifi-nl80211-relax-wdev-mutex-check-in-wdev_chandef.patch @@ -0,0 +1,45 @@ +From 31177127e067eb73d5ca46ce32a410e41333d42f Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 27 Jun 2022 12:49:03 +0200 +Subject: wifi: nl80211: relax wdev mutex check in wdev_chandef() + +From: Johannes Berg + +commit 31177127e067eb73d5ca46ce32a410e41333d42f upstream. + +In many cases we might get here from driver code that's +not really set up to care about the locking, and for the +non-MLO cases we really don't care so much about it. So +relax the checking here for now, perhaps we should even +remove it completely since we might not really care if +we point to an invalid link's chandef and can require +the caller to check the link validity first. + +Fixes: 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link APIs") +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/chan.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/net/wireless/chan.c ++++ b/net/wireless/chan.c +@@ -1433,7 +1433,17 @@ EXPORT_SYMBOL(cfg80211_any_usable_channe + struct cfg80211_chan_def *wdev_chandef(struct wireless_dev *wdev, + unsigned int link_id) + { +- ASSERT_WDEV_LOCK(wdev); ++ /* ++ * We need to sort out the locking here - in some cases ++ * where we get here we really just don't care (yet) ++ * about the valid links, but in others we do. But we ++ * get here with various driver cases, so we cannot ++ * easily require the wdev mutex. ++ */ ++ if (link_id || wdev->valid_links & BIT(0)) { ++ ASSERT_WDEV_LOCK(wdev); ++ WARN_ON(!(wdev->valid_links & BIT(link_id))); ++ } + + switch (wdev->iftype) { + case NL80211_IFTYPE_MESH_POINT: -- 2.47.3