From e92bc4b99445d144bbb0c74bd5f1f92d18454082 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 7 May 2023 12:59:14 +0200 Subject: [PATCH] 5.10-stable patches added patches: clk-rockchip-rk3399-allow-clk_cifout-to-force-clk_cifout_src-to-reparent.patch mailbox-zynqmp-fix-ipi-isr-handling.patch mailbox-zynqmp-fix-typo-in-ipi-documentation.patch md-raid10-fix-null-ptr-deref-in-raid10_sync_request.patch wifi-rtl8xxxu-rtl8192eu-always-needs-full-init.patch --- ...-to-force-clk_cifout_src-to-reparent.patch | 39 +++++++++++ .../mailbox-zynqmp-fix-ipi-isr-handling.patch | 50 +++++++++++++++ ...zynqmp-fix-typo-in-ipi-documentation.patch | 34 ++++++++++ ...ull-ptr-deref-in-raid10_sync_request.patch | 64 +++++++++++++++++++ queue-5.10/series | 5 ++ ...xxu-rtl8192eu-always-needs-full-init.patch | 43 +++++++++++++ 6 files changed, 235 insertions(+) create mode 100644 queue-5.10/clk-rockchip-rk3399-allow-clk_cifout-to-force-clk_cifout_src-to-reparent.patch create mode 100644 queue-5.10/mailbox-zynqmp-fix-ipi-isr-handling.patch create mode 100644 queue-5.10/mailbox-zynqmp-fix-typo-in-ipi-documentation.patch create mode 100644 queue-5.10/md-raid10-fix-null-ptr-deref-in-raid10_sync_request.patch create mode 100644 queue-5.10/wifi-rtl8xxxu-rtl8192eu-always-needs-full-init.patch diff --git a/queue-5.10/clk-rockchip-rk3399-allow-clk_cifout-to-force-clk_cifout_src-to-reparent.patch b/queue-5.10/clk-rockchip-rk3399-allow-clk_cifout-to-force-clk_cifout_src-to-reparent.patch new file mode 100644 index 00000000000..be23067934a --- /dev/null +++ b/queue-5.10/clk-rockchip-rk3399-allow-clk_cifout-to-force-clk_cifout_src-to-reparent.patch @@ -0,0 +1,39 @@ +From 933bf364e152cd60902cf9585c2ba310d593e69f Mon Sep 17 00:00:00 2001 +From: Quentin Schulz +Date: Thu, 17 Nov 2022 13:04:31 +0100 +Subject: clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent + +From: Quentin Schulz + +commit 933bf364e152cd60902cf9585c2ba310d593e69f upstream. + +clk_cifout is derived from clk_cifout_src through an integer divider +limited to 32. clk_cifout_src is a child of either cpll, gpll or npll +without any possibility of a divider of any sort. The default clock +parent is cpll. + +Let's allow clk_cifout to ask its parent clk_cifout_src to reparent in +order to find the real closest possible rate for clk_cifout and not one +derived from cpll only. + +Cc: stable@vger.kernel.org # 4.10+ +Fixes: fd8bc829336a ("clk: rockchip: fix the rk3399 cifout clock") +Signed-off-by: Quentin Schulz +Link: https://lore.kernel.org/r/20221117-rk3399-cifout-set-rate-parent-v1-0-432548d04081@theobroma-systems.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/rockchip/clk-rk3399.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/rockchip/clk-rk3399.c ++++ b/drivers/clk/rockchip/clk-rk3399.c +@@ -1261,7 +1261,7 @@ static struct rockchip_clk_branch rk3399 + RK3399_CLKSEL_CON(56), 6, 2, MFLAGS, + RK3399_CLKGATE_CON(10), 7, GFLAGS), + +- COMPOSITE_NOGATE(SCLK_CIF_OUT, "clk_cifout", mux_clk_cif_p, 0, ++ COMPOSITE_NOGATE(SCLK_CIF_OUT, "clk_cifout", mux_clk_cif_p, CLK_SET_RATE_PARENT, + RK3399_CLKSEL_CON(56), 5, 1, MFLAGS, 0, 5, DFLAGS), + + /* gic */ diff --git a/queue-5.10/mailbox-zynqmp-fix-ipi-isr-handling.patch b/queue-5.10/mailbox-zynqmp-fix-ipi-isr-handling.patch new file mode 100644 index 00000000000..07eab65de26 --- /dev/null +++ b/queue-5.10/mailbox-zynqmp-fix-ipi-isr-handling.patch @@ -0,0 +1,50 @@ +From 74ad37a30ffee3643bc34f9ca7225b20a66abaaf Mon Sep 17 00:00:00 2001 +From: Tanmay Shah +Date: Fri, 10 Mar 2023 17:24:05 -0800 +Subject: mailbox: zynqmp: Fix IPI isr handling + +From: Tanmay Shah + +commit 74ad37a30ffee3643bc34f9ca7225b20a66abaaf upstream. + +Multiple IPI channels are mapped to same interrupt handler. +Current isr implementation handles only one channel per isr. +Fix this behavior by checking isr status bit of all child +mailbox nodes. + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Tanmay Shah +Acked-by: Michal Simek +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230311012407.1292118-3-tanmay.shah@amd.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mailbox/zynqmp-ipi-mailbox.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -152,7 +152,7 @@ static irqreturn_t zynqmp_ipi_interrupt( + struct zynqmp_ipi_message *msg; + u64 arg0, arg3; + struct arm_smccc_res res; +- int ret, i; ++ int ret, i, status = IRQ_NONE; + + (void)irq; + arg0 = SMC_IPI_MAILBOX_STATUS_ENQUIRY; +@@ -170,11 +170,11 @@ static irqreturn_t zynqmp_ipi_interrupt( + memcpy_fromio(msg->data, mchan->req_buf, + msg->len); + mbox_chan_received_data(chan, (void *)msg); +- return IRQ_HANDLED; ++ status = IRQ_HANDLED; + } + } + } +- return IRQ_NONE; ++ return status; + } + + /** diff --git a/queue-5.10/mailbox-zynqmp-fix-typo-in-ipi-documentation.patch b/queue-5.10/mailbox-zynqmp-fix-typo-in-ipi-documentation.patch new file mode 100644 index 00000000000..73ca4a43939 --- /dev/null +++ b/queue-5.10/mailbox-zynqmp-fix-typo-in-ipi-documentation.patch @@ -0,0 +1,34 @@ +From 79963fbfc233759bd8a43462f120d15a1bd4f4fa Mon Sep 17 00:00:00 2001 +From: Tanmay Shah +Date: Fri, 10 Mar 2023 17:24:06 -0800 +Subject: mailbox: zynqmp: Fix typo in IPI documentation + +From: Tanmay Shah + +commit 79963fbfc233759bd8a43462f120d15a1bd4f4fa upstream. + +Xilinx IPI message buffers allows 32-byte data transfer. +Fix documentation that says 12 bytes + +Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") +Signed-off-by: Tanmay Shah +Acked-by: Michal Simek +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230311012407.1292118-4-tanmay.shah@amd.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/mailbox/zynqmp-ipi-message.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/mailbox/zynqmp-ipi-message.h ++++ b/include/linux/mailbox/zynqmp-ipi-message.h +@@ -9,7 +9,7 @@ + * @data: message payload + * + * This is the structure for data used in mbox_send_message +- * the maximum length of data buffer is fixed to 12 bytes. ++ * the maximum length of data buffer is fixed to 32 bytes. + * Client is supposed to be aware of this. + */ + struct zynqmp_ipi_message { diff --git a/queue-5.10/md-raid10-fix-null-ptr-deref-in-raid10_sync_request.patch b/queue-5.10/md-raid10-fix-null-ptr-deref-in-raid10_sync_request.patch new file mode 100644 index 00000000000..dff1b7f91da --- /dev/null +++ b/queue-5.10/md-raid10-fix-null-ptr-deref-in-raid10_sync_request.patch @@ -0,0 +1,64 @@ +From a405c6f0229526160aa3f177f65e20c86fce84c5 Mon Sep 17 00:00:00 2001 +From: Li Nan +Date: Wed, 22 Feb 2023 12:10:00 +0800 +Subject: md/raid10: fix null-ptr-deref in raid10_sync_request + +From: Li Nan + +commit a405c6f0229526160aa3f177f65e20c86fce84c5 upstream. + +init_resync() inits mempool and sets conf->have_replacemnt at the beginning +of sync, close_sync() frees the mempool when sync is completed. + +After [1] recovery might be skipped and init_resync() is called but +close_sync() is not. null-ptr-deref occurs with r10bio->dev[i].repl_bio. + +The following is one way to reproduce the issue. + + 1) create a array, wait for resync to complete, mddev->recovery_cp is set + to MaxSector. + 2) recovery is woken and it is skipped. conf->have_replacement is set to + 0 in init_resync(). close_sync() not called. + 3) some io errors and rdev A is set to WantReplacement. + 4) a new device is added and set to A's replacement. + 5) recovery is woken, A have replacement, but conf->have_replacemnt is + 0. r10bio->dev[i].repl_bio will not be alloced and null-ptr-deref + occurs. + +Fix it by not calling init_resync() if recovery skipped. + +[1] commit 7e83ccbecd60 ("md/raid10: Allow skipping recovery when clean arrays are assembled") +Fixes: 7e83ccbecd60 ("md/raid10: Allow skipping recovery when clean arrays are assembled") +Cc: stable@vger.kernel.org +Signed-off-by: Li Nan +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230222041000.3341651-3-linan666@huaweicloud.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/raid10.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -2900,10 +2900,6 @@ static sector_t raid10_sync_request(stru + sector_t chunk_mask = conf->geo.chunk_mask; + int page_idx = 0; + +- if (!mempool_initialized(&conf->r10buf_pool)) +- if (init_resync(conf)) +- return 0; +- + /* + * Allow skipping a full rebuild for incremental assembly + * of a clean array, like RAID1 does. +@@ -2919,6 +2915,10 @@ static sector_t raid10_sync_request(stru + return mddev->dev_sectors - sector_nr; + } + ++ if (!mempool_initialized(&conf->r10buf_pool)) ++ if (init_resync(conf)) ++ return 0; ++ + skipped: + max_sector = mddev->dev_sectors; + if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery) || diff --git a/queue-5.10/series b/queue-5.10/series index 82faa0a2aba..fb6daae2f61 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -54,6 +54,11 @@ alsa-usb-audio-add-quirk-for-pioneer-ddj-800.patch alsa-hda-realtek-add-quirk-for-asus-um3402yar-using-cs35l41.patch nilfs2-do-not-write-dirty-data-after-degenerating-to-read-only.patch nilfs2-fix-infinite-loop-in-nilfs_mdt_get_block.patch +md-raid10-fix-null-ptr-deref-in-raid10_sync_request.patch +mailbox-zynqmp-fix-ipi-isr-handling.patch +mailbox-zynqmp-fix-typo-in-ipi-documentation.patch +wifi-rtl8xxxu-rtl8192eu-always-needs-full-init.patch +clk-rockchip-rk3399-allow-clk_cifout-to-force-clk_cifout_src-to-reparent.patch rcu-fix-missing-tick_dep_mask_rcu_exp-dependency-che.patch selftests-resctrl-return-null-if-malloc_and_init_mem.patch selftests-resctrl-check-for-return-value-after-write.patch diff --git a/queue-5.10/wifi-rtl8xxxu-rtl8192eu-always-needs-full-init.patch b/queue-5.10/wifi-rtl8xxxu-rtl8192eu-always-needs-full-init.patch new file mode 100644 index 00000000000..19c44d42a6c --- /dev/null +++ b/queue-5.10/wifi-rtl8xxxu-rtl8192eu-always-needs-full-init.patch @@ -0,0 +1,43 @@ +From d46e04ccd40457a0119b76e11ab64a2ad403e138 Mon Sep 17 00:00:00 2001 +From: Bitterblue Smith +Date: Mon, 13 Mar 2023 15:42:59 +0200 +Subject: wifi: rtl8xxxu: RTL8192EU always needs full init + +From: Bitterblue Smith + +commit d46e04ccd40457a0119b76e11ab64a2ad403e138 upstream. + +Always run the entire init sequence (rtl8xxxu_init_device()) for +RTL8192EU. It's what the vendor driver does too. + +This fixes a bug where the device is unable to connect after +rebooting: + +wlp3s0f3u2: send auth to ... (try 1/3) +wlp3s0f3u2: send auth to ... (try 2/3) +wlp3s0f3u2: send auth to ... (try 3/3) +wlp3s0f3u2: authentication with ... timed out + +Rebooting leaves the device powered on (partially? at least the +firmware is still running), but not really in a working state. + +Cc: stable@vger.kernel.org +Signed-off-by: Bitterblue Smith +Acked-by: Jes Sorensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/4eb111a9-d4c4-37d0-b376-4e202de7153c@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c +@@ -1702,6 +1702,7 @@ struct rtl8xxxu_fileops rtl8192eu_fops = + .rx_desc_size = sizeof(struct rtl8xxxu_rxdesc24), + .has_s0s1 = 0, + .gen2_thermal_meter = 1, ++ .needs_full_init = 1, + .adda_1t_init = 0x0fc01616, + .adda_1t_path_on = 0x0fc01616, + .adda_2t_path_on_a = 0x0fc01616, -- 2.47.3