--- /dev/null
+From 69238e2134d57bd7d55c02e1e19fcea75121f21c Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Thu, 19 Sep 2024 15:28:53 +0200
+Subject: bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 5fe6e308abaea082c20fbf2aa5df8e14495622cf upstream.
+
+If bpf_link_prime() fails, bpf_uprobe_multi_link_attach() goes to the
+error_free label and frees the array of bpf_uprobe's without calling
+bpf_uprobe_unregister().
+
+This leaks bpf_uprobe->uprobe and worse, this frees bpf_uprobe->consumer
+without removing it from the uprobe->consumers list.
+
+Fixes: 89ae89f53d20 ("bpf: Add multi uprobe link")
+Closes: https://lore.kernel.org/all/000000000000382d39061f59f2dd@google.com/
+Reported-by: syzbot+f7a1c2c2711e4a780f19@syzkaller.appspotmail.com
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Tested-by: syzbot+f7a1c2c2711e4a780f19@syzkaller.appspotmail.com
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240813152524.GA7292@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/bpf_trace.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -3285,17 +3285,20 @@ int bpf_uprobe_multi_link_attach(const u
+ uprobes[i].ref_ctr_offset,
+ &uprobes[i].consumer);
+ if (err) {
+- bpf_uprobe_unregister(&path, uprobes, i);
+- goto error_free;
++ link->cnt = i;
++ goto error_unregister;
+ }
+ }
+
+ err = bpf_link_prime(&link->link, &link_primer);
+ if (err)
+- goto error_free;
++ goto error_unregister;
+
+ return bpf_link_settle(&link_primer);
+
++error_unregister:
++ bpf_uprobe_unregister(&path, uprobes, link->cnt);
++
+ error_free:
+ kvfree(uprobes);
+ kfree(link);
--- /dev/null
+From 848f68c760ab1e14a9046ea6e45e3304ab9fa50b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Andr=C3=A9=20Apitzsch?= <git@apitzsch.eu>
+Date: Sun, 1 Oct 2023 18:09:56 +0200
+Subject: iio: magnetometer: ak8975: Fix 'Unexpected device' error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: André Apitzsch <git@apitzsch.eu>
+
+commit 848f68c760ab1e14a9046ea6e45e3304ab9fa50b upstream.
+
+Explicity specify array indices to fix mapping between
+asahi_compass_chipset and ak_def_array.
+While at it, remove unneeded AKXXXX.
+
+Fixes: 4f9ea93afde1 ("iio: magnetometer: ak8975: Convert enum->pointer for data in the match tables")
+Signed-off-by: André Apitzsch <git@apitzsch.eu>
+Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20231001-ak_magnetometer-v1-1-09bf3b8798a3@apitzsch.eu
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/magnetometer/ak8975.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/iio/magnetometer/ak8975.c
++++ b/drivers/iio/magnetometer/ak8975.c
+@@ -204,7 +204,6 @@ static long ak09912_raw_to_gauss(u16 dat
+
+ /* Compatible Asahi Kasei Compass parts */
+ enum asahi_compass_chipset {
+- AKXXXX = 0,
+ AK8975,
+ AK8963,
+ AK09911,
+@@ -248,7 +247,7 @@ struct ak_def {
+ };
+
+ static const struct ak_def ak_def_array[] = {
+- {
++ [AK8975] = {
+ .type = AK8975,
+ .raw_to_gauss = ak8975_raw_to_gauss,
+ .range = 4096,
+@@ -273,7 +272,7 @@ static const struct ak_def ak_def_array[
+ AK8975_REG_HYL,
+ AK8975_REG_HZL},
+ },
+- {
++ [AK8963] = {
+ .type = AK8963,
+ .raw_to_gauss = ak8963_09911_raw_to_gauss,
+ .range = 8190,
+@@ -298,7 +297,7 @@ static const struct ak_def ak_def_array[
+ AK8975_REG_HYL,
+ AK8975_REG_HZL},
+ },
+- {
++ [AK09911] = {
+ .type = AK09911,
+ .raw_to_gauss = ak8963_09911_raw_to_gauss,
+ .range = 8192,
+@@ -323,7 +322,7 @@ static const struct ak_def ak_def_array[
+ AK09912_REG_HYL,
+ AK09912_REG_HZL},
+ },
+- {
++ [AK09912] = {
+ .type = AK09912,
+ .raw_to_gauss = ak09912_raw_to_gauss,
+ .range = 32752,
+@@ -348,7 +347,7 @@ static const struct ak_def ak_def_array[
+ AK09912_REG_HYL,
+ AK09912_REG_HZL},
+ },
+- {
++ [AK09916] = {
+ .type = AK09916,
+ .raw_to_gauss = ak09912_raw_to_gauss,
+ .range = 32752,
--- /dev/null
+From c9f115564561af63db662791e9a35fcf1dfefd2a Mon Sep 17 00:00:00 2001
+From: Martin KaFai Lau <martin.lau@kernel.org>
+Date: Wed, 24 Jan 2024 14:44:18 -0800
+Subject: libbpf: Ensure undefined bpf_attr field stays 0
+
+From: Martin KaFai Lau <martin.lau@kernel.org>
+
+commit c9f115564561af63db662791e9a35fcf1dfefd2a upstream.
+
+The commit 9e926acda0c2 ("libbpf: Find correct module BTFs for struct_ops maps and progs.")
+sets a newly added field (value_type_btf_obj_fd) to -1 in libbpf when
+the caller of the libbpf's bpf_map_create did not define this field by
+passing a NULL "opts" or passing in a "opts" that does not cover this
+new field. OPT_HAS(opts, field) is used to decide if the field is
+defined or not:
+
+ ((opts) && opts->sz >= offsetofend(typeof(*(opts)), field))
+
+Once OPTS_HAS decided the field is not defined, that field should
+be set to 0. For this particular new field (value_type_btf_obj_fd),
+its corresponding map_flags "BPF_F_VTYPE_BTF_OBJ_FD" is not set.
+Thus, the kernel does not treat it as an fd field.
+
+Fixes: 9e926acda0c2 ("libbpf: Find correct module BTFs for struct_ops maps and progs.")
+Reported-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20240124224418.2905133-1-martin.lau@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/lib/bpf/bpf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/lib/bpf/bpf.c
++++ b/tools/lib/bpf/bpf.c
+@@ -192,7 +192,7 @@ int bpf_map_create(enum bpf_map_type map
+ attr.btf_key_type_id = OPTS_GET(opts, btf_key_type_id, 0);
+ attr.btf_value_type_id = OPTS_GET(opts, btf_value_type_id, 0);
+ attr.btf_vmlinux_value_type_id = OPTS_GET(opts, btf_vmlinux_value_type_id, 0);
+- attr.value_type_btf_obj_fd = OPTS_GET(opts, value_type_btf_obj_fd, -1);
++ attr.value_type_btf_obj_fd = OPTS_GET(opts, value_type_btf_obj_fd, 0);
+
+ attr.inner_map_fd = OPTS_GET(opts, inner_map_fd, 0);
+ attr.map_flags = OPTS_GET(opts, map_flags, 0);
--- /dev/null
+From 1892fe103c3a20fced306c8dafa74f7f6d4ea0a3 Mon Sep 17 00:00:00 2001
+From: Robin Murphy <robin.murphy@arm.com>
+Date: Mon, 11 Dec 2023 19:27:28 +0000
+Subject: perf/arm-cmn: Fail DTC counter allocation correctly
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+commit 1892fe103c3a20fced306c8dafa74f7f6d4ea0a3 upstream.
+
+Calling arm_cmn_event_clear() before all DTC indices are allocated is
+wrong, and can lead to arm_cmn_event_add() erroneously clearing live
+counters from full DTCs where allocation fails. Since the DTC counters
+are only updated by arm_cmn_init_counter() after all DTC and DTM
+allocations succeed, nothing actually needs cleaning up in this case
+anyway, and it should just return directly as it did before.
+
+Fixes: 7633ec2c262f ("perf/arm-cmn: Rework DTC counters (again)")
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Acked-by: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/ed589c0d8e4130dc68b8ad1625226d28bdc185d4.1702322847.git.robin.murphy@arm.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/perf/arm-cmn.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -1794,7 +1794,7 @@ static int arm_cmn_event_add(struct perf
+ idx = 0;
+ while (cmn->dtc[j].counters[idx])
+ if (++idx == CMN_DT_NUM_COUNTERS)
+- goto free_dtms;
++ return -ENOSPC;
+ }
+ hw->dtc_idx[j] = idx;
+ }
i2c-aspeed-update-the-stop-sw-state-when-the-bus-recovery-occurs.patch
i2c-isch-add-missed-else.patch
documentation-kvm-fix-warning-in-make-htmldocs.patch
+bpf-fix-use-after-free-in-bpf_uprobe_multi_link_attach.patch
+usb-yurex-fix-inconsistent-locking-bug-in-yurex_read.patch
+perf-arm-cmn-fail-dtc-counter-allocation-correctly.patch
+iio-magnetometer-ak8975-fix-unexpected-device-error.patch
+wifi-brcmfmac-add-linefeed-at-end-of-file.patch
+libbpf-ensure-undefined-bpf_attr-field-stays-0.patch
+thunderbolt-send-uevent-after-asymmetric-symmetric-switch.patch
+thunderbolt-fix-minimum-allocated-usb-3.x-and-pcie-bandwidth.patch
+thunderbolt-fix-null-pointer-dereference-in-tb_port_update_credits.patch
--- /dev/null
+From f0b94c1c5c7994a74e487f43c91cfc922105a423 Mon Sep 17 00:00:00 2001
+From: Gil Fine <gil.fine@linux.intel.com>
+Date: Thu, 30 Nov 2023 18:17:13 +0200
+Subject: thunderbolt: Fix minimum allocated USB 3.x and PCIe bandwidth
+
+From: Gil Fine <gil.fine@linux.intel.com>
+
+commit f0b94c1c5c7994a74e487f43c91cfc922105a423 upstream.
+
+With the current bandwidth allocation we end up reserving too much for the USB
+3.x and PCIe tunnels that leads to reduced capabilities for the second
+DisplayPort tunnel.
+
+Fix this by decreasing the USB 3.x allocation to 900 Mb/s which then allows
+both tunnels to get the maximum HBR2 bandwidth. This way, the reserved
+bandwidth for USB 3.x and PCIe, would be 1350 Mb/s (taking weights of USB 3.x
+and PCIe into account). So bandwidth allocations on a link are:
+USB 3.x + PCIe tunnels => 1350 Mb/s
+DisplayPort tunnel #1 => 17280 Mb/s
+DisplayPort tunnel #2 => 17280 Mb/s
+
+Total consumed bandwidth is 35910 Mb/s. So that all the above can be tunneled
+on a Gen 3 link (which allows maximum of 36000 Mb/s).
+
+Fixes: 582e70b0d3a4 ("thunderbolt: Change bandwidth reservations to comply USB4 v2")
+Signed-off-by: Gil Fine <gil.fine@linux.intel.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thunderbolt/usb4.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/thunderbolt/usb4.c
++++ b/drivers/thunderbolt/usb4.c
+@@ -2380,13 +2380,13 @@ int usb4_usb3_port_release_bandwidth(str
+ goto err_request;
+
+ /*
+- * Always keep 1000 Mb/s to make sure xHCI has at least some
++ * Always keep 900 Mb/s to make sure xHCI has at least some
+ * bandwidth available for isochronous traffic.
+ */
+- if (consumed_up < 1000)
+- consumed_up = 1000;
+- if (consumed_down < 1000)
+- consumed_down = 1000;
++ if (consumed_up < 900)
++ consumed_up = 900;
++ if (consumed_down < 900)
++ consumed_down = 900;
+
+ ret = usb4_usb3_port_write_allocated_bandwidth(port, consumed_up,
+ consumed_down);
--- /dev/null
+From d3d17e23d1a0d1f959b4fa55b35f1802d9c584fa Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Mon, 12 Feb 2024 13:03:34 +0200
+Subject: thunderbolt: Fix NULL pointer dereference in tb_port_update_credits()
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit d3d17e23d1a0d1f959b4fa55b35f1802d9c584fa upstream.
+
+Olliver reported that his system crashes when plugging in Thunderbolt 1
+device:
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000020
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 0 P4D 0
+ Oops: 0000 [#1] PREEMPT SMP NOPTI
+ RIP: 0010:tb_port_do_update_credits+0x1b/0x130 [thunderbolt]
+ Call Trace:
+ <TASK>
+ ? __die+0x23/0x70
+ ? page_fault_oops+0x171/0x4e0
+ ? exc_page_fault+0x7f/0x180
+ ? asm_exc_page_fault+0x26/0x30
+ ? tb_port_do_update_credits+0x1b/0x130
+ ? tb_switch_update_link_attributes+0x83/0xd0
+ tb_switch_add+0x7a2/0xfe0
+ tb_scan_port+0x236/0x6f0
+ tb_handle_hotplug+0x6db/0x900
+ process_one_work+0x171/0x340
+ worker_thread+0x27b/0x3a0
+ ? __pfx_worker_thread+0x10/0x10
+ kthread+0xe5/0x120
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork+0x31/0x50
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork_asm+0x1b/0x30
+ </TASK>
+
+This is due the fact that some Thunderbolt 1 devices only have one lane
+adapter. Fix this by checking for the lane 1 before we read its credits.
+
+Reported-by: Olliver Schinagl <oliver@schinagl.nl>
+Closes: https://lore.kernel.org/linux-usb/c24c7882-6254-4e68-8f22-f3e8f65dc84f@schinagl.nl/
+Fixes: 81af2952e606 ("thunderbolt: Add support for asymmetric link")
+Cc: stable@vger.kernel.org
+Cc: Gil Fine <gil.fine@linux.intel.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thunderbolt/switch.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/thunderbolt/switch.c
++++ b/drivers/thunderbolt/switch.c
+@@ -1271,6 +1271,9 @@ int tb_port_update_credits(struct tb_por
+ ret = tb_port_do_update_credits(port);
+ if (ret)
+ return ret;
++
++ if (!port->dual_link_port)
++ return 0;
+ return tb_port_do_update_credits(port->dual_link_port);
+ }
+
--- /dev/null
+From 5391bcfa56c79a891734e4d22aa0ca3217b86491 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Tue, 7 Nov 2023 14:34:27 +0200
+Subject: thunderbolt: Send uevent after asymmetric/symmetric switch
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit 5391bcfa56c79a891734e4d22aa0ca3217b86491 upstream.
+
+We should send uevent to userspace whenever the link speed or width
+changes but tb_switch_asym_enable() and tb_switch_asym_disable() set the
+sw->link_width already so tb_switch_update_link_attributes() never
+noticed the change.
+
+Fix this so that we let tb_switch_update_link_attributes() update the
+fields accordingly.
+
+Fixes: 81af2952e606 ("thunderbolt: Add support for asymmetric link")
+Reported-by: Pengfei Xu <pengfei.xu@intel.com>
+Tested-by: Pengfei Xu <pengfei.xu@intel.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thunderbolt/switch.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/thunderbolt/switch.c
++++ b/drivers/thunderbolt/switch.c
+@@ -2981,6 +2981,7 @@ static int tb_switch_lane_bonding_disabl
+ return tb_port_wait_for_link_width(down, TB_LINK_WIDTH_SINGLE, 100);
+ }
+
++/* Note updating sw->link_width done in tb_switch_update_link_attributes() */
+ static int tb_switch_asym_enable(struct tb_switch *sw, enum tb_link_width width)
+ {
+ struct tb_port *up, *down, *port;
+@@ -3020,10 +3021,10 @@ static int tb_switch_asym_enable(struct
+ return ret;
+ }
+
+- sw->link_width = width;
+ return 0;
+ }
+
++/* Note updating sw->link_width done in tb_switch_update_link_attributes() */
+ static int tb_switch_asym_disable(struct tb_switch *sw)
+ {
+ struct tb_port *up, *down;
+@@ -3058,7 +3059,6 @@ static int tb_switch_asym_disable(struct
+ return ret;
+ }
+
+- sw->link_width = TB_LINK_WIDTH_DUAL;
+ return 0;
+ }
+
--- /dev/null
+From e7d3b9f28654dbfce7e09f8028210489adaf6a33 Mon Sep 17 00:00:00 2001
+From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Date: Mon, 18 Dec 2023 22:36:35 -0800
+Subject: usb: yurex: Fix inconsistent locking bug in yurex_read()
+
+From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+
+commit e7d3b9f28654dbfce7e09f8028210489adaf6a33 upstream.
+
+Unlock before returning on the error path.
+
+Fixes: 86b20af11e84 ("usb: yurex: Replace snprintf() with the safer scnprintf() variant")
+Reported-by: Dan Carpenter <error27@gmail.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/r/202312170252.3udgrIcP-lkp@intel.com/
+Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Link: https://lore.kernel.org/r/20231219063639.450994-1-harshit.m.mogalapalli@oracle.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/misc/yurex.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/misc/yurex.c
++++ b/drivers/usb/misc/yurex.c
+@@ -413,8 +413,10 @@ static ssize_t yurex_read(struct file *f
+ return -ENODEV;
+ }
+
+- if (WARN_ON_ONCE(dev->bbu > S64_MAX || dev->bbu < S64_MIN))
++ if (WARN_ON_ONCE(dev->bbu > S64_MAX || dev->bbu < S64_MIN)) {
++ mutex_unlock(&dev->io_mutex);
+ return -EIO;
++ }
+
+ spin_lock_irq(&dev->lock);
+ scnprintf(in_buffer, MAX_S64_STRLEN, "%lld\n", dev->bbu);
--- /dev/null
+From 26f0dc8a705ae182eaa126cef0a9870d1a87a5ac Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Sun, 28 Jan 2024 10:30:56 +0100
+Subject: wifi: brcmfmac: add linefeed at end of file
+
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+
+commit 26f0dc8a705ae182eaa126cef0a9870d1a87a5ac upstream.
+
+The following sparse warning was reported:
+
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c:432:49:
+ warning: no newline at end of file
+
+Fixes: 31343230abb1 ("wifi: brcmfmac: export firmware interface functions")
+Reported-by: Jakub Kicinski <kuba@kernel.org>
+Closes: https://lore.kernel.org/all/20240125165128.7e43a1f3@kernel.org/
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240128093057.164791-2-arend.vanspriel@broadcom.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
+@@ -429,4 +429,4 @@ s32 brcmf_fil_xtlv_data_get(struct brcmf
+ mutex_unlock(&drvr->proto_block);
+ return err;
+ }
+-BRCMF_EXPORT_SYMBOL_GPL(brcmf_fil_xtlv_data_get);
+\ No newline at end of file
++BRCMF_EXPORT_SYMBOL_GPL(brcmf_fil_xtlv_data_get);
projects / thirdparty / kernel / stable-queue.git / commitdiff
