--- /dev/null
+From 467d4e231ed957108cd0788d3dbc868baab42188 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:38 +0200
+Subject: ARM: dts: rockchip: drop grf reference from rk3036 hdmi
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 1580ccb6ed9dc76b8ff3e2d8912e8215c8b0fa6d ]
+
+Neither the binding nor the driver implementation specify/use the grf
+reference provided in the rk3036. And neither does the newer rk3128
+user of the hdmi controller. So drop the rockchip,grf property.
+
+Fixes: b7217cf19c63 ("ARM: dts: rockchip: add hdmi device node for rk3036")
+Cc: Caesar Wang <wxt@rock-chips.com>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-13-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3036.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi
+index 4dabcb9cd4b8c..f8f9f1bffd9bc 100644
+--- a/arch/arm/boot/dts/rk3036.dtsi
++++ b/arch/arm/boot/dts/rk3036.dtsi
+@@ -332,7 +332,6 @@
+ interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cru PCLK_HDMI>;
+ clock-names = "pclk";
+- rockchip,grf = <&grf>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&hdmi_ctl>;
+ status = "disabled";
+--
+2.43.0
+
--- /dev/null
+From 44c70ed473ff954f4a60094704ca763b582678c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:37 +0200
+Subject: ARM: dts: rockchip: fix rk3036 acodec node
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit c7206853cd7d31c52575fb1dc7616b4398f3bc8f ]
+
+The acodec node is not conformant to the binding.
+
+Set the correct nodename, use the correct compatible, add the needed
+#sound-dai-cells and sort the rockchip,grf below clocks properties
+as expected.
+
+Fixes: faea098e1808 ("ARM: dts: rockchip: add core rk3036 dtsi")
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-12-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3036.dtsi | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi
+index 5f47b638f5327..4dabcb9cd4b8c 100644
+--- a/arch/arm/boot/dts/rk3036.dtsi
++++ b/arch/arm/boot/dts/rk3036.dtsi
+@@ -316,12 +316,13 @@
+ };
+ };
+
+- acodec: acodec-ana@20030000 {
+- compatible = "rk3036-codec";
++ acodec: audio-codec@20030000 {
++ compatible = "rockchip,rk3036-codec";
+ reg = <0x20030000 0x4000>;
+- rockchip,grf = <&grf>;
+ clock-names = "acodec_pclk";
+ clocks = <&cru PCLK_ACODEC>;
++ rockchip,grf = <&grf>;
++ #sound-dai-cells = <0>;
+ status = "disabled";
+ };
+
+--
+2.43.0
+
--- /dev/null
+From 9143eff8e750af4674bdb5cd21dfa932a4cf5232 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:40 +0200
+Subject: ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 77a9a7f2d3b94d29d13d71b851114d593a2147cf ]
+
+Both the node name as well as the compatible were not named
+according to the binding expectations, fix that.
+
+Fixes: 47bf3a5c9e2a ("ARM: dts: rockchip: add the sound setup for rk3036-kylin board")
+Cc: Caesar Wang <wxt@rock-chips.com>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-15-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3036-kylin.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/rk3036-kylin.dts b/arch/arm/boot/dts/rk3036-kylin.dts
+index e817eba8c622b..0c8cd25d0ba5c 100644
+--- a/arch/arm/boot/dts/rk3036-kylin.dts
++++ b/arch/arm/boot/dts/rk3036-kylin.dts
+@@ -300,8 +300,8 @@
+ &i2c2 {
+ status = "okay";
+
+- rt5616: rt5616@1b {
+- compatible = "rt5616";
++ rt5616: audio-codec@1b {
++ compatible = "realtek,rt5616";
+ reg = <0x1b>;
+ clocks = <&cru SCLK_I2S_OUT>;
+ clock-names = "mclk";
+--
+2.43.0
+
--- /dev/null
+From cba1ee69687dae405b8150d9bddb272349f83249 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:39 +0200
+Subject: ARM: dts: rockchip: Fix the spi controller on rk3036
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 8bade1ad1f0821aef31f6a8fb1027ae292566d85 ]
+
+Compatible and clock names did not match the existing binding.
+So set the correct values and re-order+rename the clocks.
+
+It looks like no rk3036 board did use the spi controller so far,
+so this was never detected on a running device yet.
+
+Fixes: f629fcfab2cd ("ARM: dts: rockchip: support the spi for rk3036")
+Cc: Caesar Wang <wxt@rock-chips.com>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-14-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3036.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi
+index f8f9f1bffd9bc..5cd640ac0d1a4 100644
+--- a/arch/arm/boot/dts/rk3036.dtsi
++++ b/arch/arm/boot/dts/rk3036.dtsi
+@@ -488,11 +488,11 @@
+ };
+
+ spi: spi@20074000 {
+- compatible = "rockchip,rockchip-spi";
++ compatible = "rockchip,rk3036-spi";
+ reg = <0x20074000 0x1000>;
+ interrupts = <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&cru PCLK_SPI>, <&cru SCLK_SPI>;
+- clock-names = "apb-pclk","spi_pclk";
++ clocks = <&cru SCLK_SPI>, <&cru PCLK_SPI>;
++ clock-names = "spiclk", "apb_pclk";
+ dmas = <&pdma 8>, <&pdma 9>;
+ dma-names = "tx", "rx";
+ pinctrl-names = "default";
+--
+2.43.0
+
--- /dev/null
+From 42a99e6bd1760e1e8120a7cb129bbf63610080cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Oct 2024 10:52:21 +0800
+Subject: arm64: dts: imx8mp: correct sdhc ipg clk
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit eab6ba2aa3bbaf598a66e31f709bf84b7bb7dc8a ]
+
+The ipg clk for sdhc sources from IPG_CLK_ROOT per i.MX 8M Plus
+Applications Processor Reference Manual, Table 5-2. System Clocks.
+
+Fixes: 6d9b8d20431f ("arm64: dts: freescale: Add i.MX8MP dtsi support")
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+index acee71ca32d83..0186b3992b95f 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+@@ -659,7 +659,7 @@
+ compatible = "fsl,imx8mp-usdhc", "fsl,imx7d-usdhc";
+ reg = <0x30b40000 0x10000>;
+ interrupts = <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clk IMX8MP_CLK_DUMMY>,
++ clocks = <&clk IMX8MP_CLK_IPG_ROOT>,
+ <&clk IMX8MP_CLK_NAND_USDHC_BUS>,
+ <&clk IMX8MP_CLK_USDHC1_ROOT>;
+ clock-names = "ipg", "ahb", "per";
+@@ -673,7 +673,7 @@
+ compatible = "fsl,imx8mp-usdhc", "fsl,imx7d-usdhc";
+ reg = <0x30b50000 0x10000>;
+ interrupts = <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clk IMX8MP_CLK_DUMMY>,
++ clocks = <&clk IMX8MP_CLK_IPG_ROOT>,
+ <&clk IMX8MP_CLK_NAND_USDHC_BUS>,
+ <&clk IMX8MP_CLK_USDHC2_ROOT>;
+ clock-names = "ipg", "ahb", "per";
+@@ -687,7 +687,7 @@
+ compatible = "fsl,imx8mp-usdhc", "fsl,imx7d-usdhc";
+ reg = <0x30b60000 0x10000>;
+ interrupts = <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clk IMX8MP_CLK_DUMMY>,
++ clocks = <&clk IMX8MP_CLK_IPG_ROOT>,
+ <&clk IMX8MP_CLK_NAND_USDHC_BUS>,
+ <&clk IMX8MP_CLK_USDHC3_ROOT>;
+ clock-names = "ipg", "ahb", "per";
+--
+2.43.0
+
--- /dev/null
+From 803322c7a22a32697b6104b188de65b8a21802b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:30 +0200
+Subject: arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit ea74528aaea5a1dfc8e3de09ef2af37530eca526 ]
+
+The expected clock-name is different, and extclk also is deprecated
+in favor of txco for clocks that are not crystals.
+
+So fix it to match the binding.
+
+Fixes: c72235c288c8 ("arm64: dts: rockchip: Add on-board WiFi/BT support for Rock960 boards")
+Cc: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-5-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi
+index 5e3ac589bc54a..6fa94cb4d5f79 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi
+@@ -568,7 +568,7 @@
+ bluetooth {
+ compatible = "brcm,bcm43438-bt";
+ clocks = <&rk808 1>;
+- clock-names = "ext_clock";
++ clock-names = "txco";
+ device-wakeup-gpios = <&gpio2 RK_PD3 GPIO_ACTIVE_HIGH>;
+ host-wakeup-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_HIGH>;
+ shutdown-gpios = <&gpio0 RK_PB1 GPIO_ACTIVE_HIGH>;
+--
+2.43.0
+
--- /dev/null
+From c3a95c606ae40bfd78906ce04418fb8ce4bf3a71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:33 +0200
+Subject: arm64: dts: rockchip: Fix LED triggers on rk3308-roc-cc
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 3a53a7187f41ec3db12cf4c2cb0db4ba87c2f3a1 ]
+
+There are two LEDs on the board, power and user events.
+Currently both are assigned undocumented IR(-remote)
+triggers that are probably only part of the vendor-kernel.
+
+To make dtbs check happier, assign the power-led to a generic
+default-on trigger and the user led to the documented rc-feedback
+trigger that should mostly match its current usage.
+
+Fixes: 4403e1237be3 ("arm64: dts: rockchip: Add devicetree for board roc-rk3308-cc")
+Cc: Andy Yan <andy.yan@rock-chips.com>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-8-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts
+index 213c0759c4b85..bf09b2818e20d 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts
+@@ -30,14 +30,14 @@
+
+ power_led: led-0 {
+ label = "firefly:red:power";
+- linux,default-trigger = "ir-power-click";
++ linux,default-trigger = "default-on";
+ default-state = "on";
+ gpios = <&gpio0 RK_PA6 GPIO_ACTIVE_HIGH>;
+ };
+
+ user_led: led-1 {
+ label = "firefly:blue:user";
+- linux,default-trigger = "ir-user-click";
++ linux,default-trigger = "rc-feedback";
+ default-state = "off";
+ gpios = <&gpio0 RK_PB2 GPIO_ACTIVE_HIGH>;
+ };
+--
+2.43.0
+
--- /dev/null
+From 741570d683f95eecf6b1587ec04caa24e433d0f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 15:48:41 +0200
+Subject: arm64: dts: rockchip: Fix rt5651 compatible value on
+ rk3399-sapphire-excavator
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 577b5761679da90e691acc939ebbe7879fff5f31 ]
+
+There are no DT bindings and driver support for a "rockchip,rt5651"
+codec. Replace "rockchip,rt5651" by "realtek,rt5651", which matches the
+"simple-audio-card,name" property in the "rt5651-sound" node.
+
+Fixes: 0a3c78e251b3a266 ("arm64: dts: rockchip: Add support for rk3399 excavator main board")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/abc6c89811b3911785601d6d590483eacb145102.1727358193.git.geert+renesas@glider.be
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
+index 73e269a8ae0cc..bcc4f31982e11 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
+@@ -159,7 +159,7 @@
+ status = "okay";
+
+ rt5651: rt5651@1a {
+- compatible = "rockchip,rt5651";
++ compatible = "realtek,rt5651";
+ reg = <0x1a>;
+ clocks = <&cru SCLK_I2S_8CH_OUT>;
+ clock-names = "mclk";
+--
+2.43.0
+
--- /dev/null
+From dc2bf51bd80be58ee12e6eee6eded3d48ac6b44e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:32 +0200
+Subject: arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma
+ lion
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 5ed96580568c4f79a0aff11a67f10b3e9229ba86 ]
+
+All Theobroma boards use a ti,amc6821 as fan controller.
+It normally runs in an automatically controlled way and while it may be
+possible to use it as part of a dt-based thermal management, this is
+not yet specified in the binding, nor implemented in any kernel.
+
+Newer boards already don't contain that #cooling-cells property, but
+older ones do. So remove them for now, they can be re-added if thermal
+integration gets implemented in the future.
+
+There are two further occurences in v6.12-rc in px30-ringneck and
+rk3399-puma, but those already get removed by the i2c-mux conversion
+scheduled for 6.13 . As the undocumented property is in the kernel so
+long, I opted for not causing extra merge conflicts between 6.12 and 6.13
+
+Fixes: d99a02bcfa81 ("arm64: dts: rockchip: add RK3368-uQ7 (Lion) SoM")
+Cc: Quentin Schulz <quentin.schulz@theobroma-systems.com>
+Cc: Klaus Goger <klaus.goger@theobroma-systems.com>
+Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-7-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi
+index 24d28be4736cf..843988ecaf91d 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi
+@@ -56,7 +56,6 @@
+ fan: fan@18 {
+ compatible = "ti,amc6821";
+ reg = <0x18>;
+- #cooling-cells = <2>;
+ };
+
+ rtc_twi: rtc@6f {
+--
+2.43.0
+
--- /dev/null
+From 63c97df297243928f25733073dd5ecebb8ab20a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 13:15:37 +0200
+Subject: arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328
+
+From: Diederik de Haas <didi.debian@cknow.org>
+
+[ Upstream commit de50a7e3681771c6b990238af82bf1dea9b11b21 ]
+
+The "synopsys,dw-hdmi.yaml" binding specifies that the interrupts
+property of the hdmi node has 'maxItems: 1', so the hdmi node in
+rk3328.dtsi having 2 is incorrect.
+
+Paragraph 1.3 ("System Interrupt connection") of the RK3328 TRM v1.1
+page 16 and 17 define the following hdmi related interrupts:
+- 67 hdmi_intr
+- 103 hdmi_intr_wakeup
+
+The difference of 32 is due to a different base used in the TRM.
+
+The RK3399 (which uses the same binding) has '23: hdmi_irq' and
+'24: hdmi_wakeup_irq' according to its TRM (page 19).
+The RK3568 (also same binding) has '76: hdmi_wakeup' and '77: hdmi'
+according to page 17 of its TRM.
+In both cases the non-wakeup IRQ was used, so use that too for rk3328.
+
+Helped-by: Heiko Stuebner <heiko@sntech.de>
+Fixes: 725e351c265a ("arm64: dts: rockchip: add rk3328 display nodes")
+Signed-off-by: Diederik de Haas <didi.debian@cknow.org>
+Link: https://lore.kernel.org/r/20241008113344.23957-3-didi.debian@cknow.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3328.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+index 3c6398e98f767..9e1701f421841 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+@@ -715,8 +715,7 @@
+ compatible = "rockchip,rk3328-dw-hdmi";
+ reg = <0x0 0xff3c0000 0x0 0x20000>;
+ reg-io-width = <4>;
+- interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 71 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cru PCLK_HDMI>,
+ <&cru SCLK_HDMI_SFC>,
+ <&cru SCLK_RTC32K>;
+--
+2.43.0
+
--- /dev/null
+From c9ab5a9e9291715db8b54cd6a550230c3b26a9a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 15:53:13 +0200
+Subject: can: c_can: fix {rx,tx}_errors statistics
+
+From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+
+[ Upstream commit 4d6d26537940f3b3e17138987ed9e4a334780bf7 ]
+
+The c_can_handle_bus_err() function was incorrectly incrementing only the
+receive error counter, even in cases of bit or acknowledgment errors that
+occur during transmission. The patch fixes the issue by incrementing the
+appropriate counter based on the type of error.
+
+Fixes: 881ff67ad450 ("can: c_can: Added support for Bosch C_CAN controller")
+Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Link: https://patch.msgid.link/20241014135319.2009782-1-dario.binacchi@amarulasolutions.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/c_can/c_can.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 6c75e5897620d..6cdb28f1f2e23 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -992,7 +992,6 @@ static int c_can_handle_bus_err(struct net_device *dev,
+
+ /* common for all type of bus errors */
+ priv->can.can_stats.bus_error++;
+- stats->rx_errors++;
+
+ /* propagate the error condition to the CAN stack */
+ skb = alloc_can_err_skb(dev, &cf);
+@@ -1009,26 +1008,32 @@ static int c_can_handle_bus_err(struct net_device *dev,
+ case LEC_STUFF_ERROR:
+ netdev_dbg(dev, "stuff error\n");
+ cf->data[2] |= CAN_ERR_PROT_STUFF;
++ stats->rx_errors++;
+ break;
+ case LEC_FORM_ERROR:
+ netdev_dbg(dev, "form error\n");
+ cf->data[2] |= CAN_ERR_PROT_FORM;
++ stats->rx_errors++;
+ break;
+ case LEC_ACK_ERROR:
+ netdev_dbg(dev, "ack error\n");
+ cf->data[3] = CAN_ERR_PROT_LOC_ACK;
++ stats->tx_errors++;
+ break;
+ case LEC_BIT1_ERROR:
+ netdev_dbg(dev, "bit1 error\n");
+ cf->data[2] |= CAN_ERR_PROT_BIT1;
++ stats->tx_errors++;
+ break;
+ case LEC_BIT0_ERROR:
+ netdev_dbg(dev, "bit0 error\n");
+ cf->data[2] |= CAN_ERR_PROT_BIT0;
++ stats->tx_errors++;
+ break;
+ case LEC_CRC_ERROR:
+ netdev_dbg(dev, "CRC error\n");
+ cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
++ stats->rx_errors++;
+ break;
+ default:
+ break;
+--
+2.43.0
+
--- /dev/null
+From f15d49a311780448cf41ddf9b422a14760db100a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 15:44:35 +0100
+Subject: HID: core: zero-initialize the report buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jiri Kosina <jkosina@suse.com>
+
+[ Upstream commit 177f25d1292c7e16e1199b39c85480f7f8815552 ]
+
+Since the report buffer is used by all kinds of drivers in various ways, let's
+zero-initialize it during allocation to make sure that it can't be ever used
+to leak kernel memory via specially-crafted report.
+
+Fixes: 27ce405039bf ("HID: fix data access in implement()")
+Reported-by: Benoît Sevens <bsevens@google.com>
+Acked-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 5281d693b32d2..0fef4bdb90f14 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1664,7 +1664,7 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags)
+
+ u32 len = hid_report_len(report) + 7;
+
+- return kmalloc(len, flags);
++ return kzalloc(len, flags);
+ }
+ EXPORT_SYMBOL_GPL(hid_alloc_report_buf);
+
+--
+2.43.0
+
--- /dev/null
+From 3e5fe18933ed09f2d368f6c7bfaf76f322414cbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 21:01:38 +0800
+Subject: net: arc: fix the device for dma_map_single/dma_unmap_single
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 71803c1dfa29e0d13b99e48fda11107cc8caebc7 ]
+
+The ndev->dev and pdev->dev aren't the same device, use ndev->dev.parent
+which has dma_mask, ndev->dev.parent is just pdev->dev.
+Or it would cause the following issue:
+
+[ 39.933526] ------------[ cut here ]------------
+[ 39.938414] WARNING: CPU: 1 PID: 501 at kernel/dma/mapping.c:149 dma_map_page_attrs+0x90/0x1f8
+
+Fixes: f959dcd6ddfd ("dma-direct: Fix potential NULL pointer dereference")
+Signed-off-by: David Wu <david.wu@rock-chips.com>
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/arc/emac_main.c | 27 ++++++++++++++++-----------
+ 1 file changed, 16 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
+index b56a9e2aecd93..61d076e09571c 100644
+--- a/drivers/net/ethernet/arc/emac_main.c
++++ b/drivers/net/ethernet/arc/emac_main.c
+@@ -111,6 +111,7 @@ static void arc_emac_tx_clean(struct net_device *ndev)
+ {
+ struct arc_emac_priv *priv = netdev_priv(ndev);
+ struct net_device_stats *stats = &ndev->stats;
++ struct device *dev = ndev->dev.parent;
+ unsigned int i;
+
+ for (i = 0; i < TX_BD_NUM; i++) {
+@@ -140,7 +141,7 @@ static void arc_emac_tx_clean(struct net_device *ndev)
+ stats->tx_bytes += skb->len;
+ }
+
+- dma_unmap_single(&ndev->dev, dma_unmap_addr(tx_buff, addr),
++ dma_unmap_single(dev, dma_unmap_addr(tx_buff, addr),
+ dma_unmap_len(tx_buff, len), DMA_TO_DEVICE);
+
+ /* return the sk_buff to system */
+@@ -174,6 +175,7 @@ static void arc_emac_tx_clean(struct net_device *ndev)
+ static int arc_emac_rx(struct net_device *ndev, int budget)
+ {
+ struct arc_emac_priv *priv = netdev_priv(ndev);
++ struct device *dev = ndev->dev.parent;
+ unsigned int work_done;
+
+ for (work_done = 0; work_done < budget; work_done++) {
+@@ -223,9 +225,9 @@ static int arc_emac_rx(struct net_device *ndev, int budget)
+ continue;
+ }
+
+- addr = dma_map_single(&ndev->dev, (void *)skb->data,
++ addr = dma_map_single(dev, (void *)skb->data,
+ EMAC_BUFFER_SIZE, DMA_FROM_DEVICE);
+- if (dma_mapping_error(&ndev->dev, addr)) {
++ if (dma_mapping_error(dev, addr)) {
+ if (net_ratelimit())
+ netdev_err(ndev, "cannot map dma buffer\n");
+ dev_kfree_skb(skb);
+@@ -237,7 +239,7 @@ static int arc_emac_rx(struct net_device *ndev, int budget)
+ }
+
+ /* unmap previosly mapped skb */
+- dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
++ dma_unmap_single(dev, dma_unmap_addr(rx_buff, addr),
+ dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
+
+ pktlen = info & LEN_MASK;
+@@ -423,6 +425,7 @@ static int arc_emac_open(struct net_device *ndev)
+ {
+ struct arc_emac_priv *priv = netdev_priv(ndev);
+ struct phy_device *phy_dev = ndev->phydev;
++ struct device *dev = ndev->dev.parent;
+ int i;
+
+ phy_dev->autoneg = AUTONEG_ENABLE;
+@@ -445,9 +448,9 @@ static int arc_emac_open(struct net_device *ndev)
+ if (unlikely(!rx_buff->skb))
+ return -ENOMEM;
+
+- addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data,
++ addr = dma_map_single(dev, (void *)rx_buff->skb->data,
+ EMAC_BUFFER_SIZE, DMA_FROM_DEVICE);
+- if (dma_mapping_error(&ndev->dev, addr)) {
++ if (dma_mapping_error(dev, addr)) {
+ netdev_err(ndev, "cannot dma map\n");
+ dev_kfree_skb(rx_buff->skb);
+ return -ENOMEM;
+@@ -548,6 +551,7 @@ static void arc_emac_set_rx_mode(struct net_device *ndev)
+ static void arc_free_tx_queue(struct net_device *ndev)
+ {
+ struct arc_emac_priv *priv = netdev_priv(ndev);
++ struct device *dev = ndev->dev.parent;
+ unsigned int i;
+
+ for (i = 0; i < TX_BD_NUM; i++) {
+@@ -555,7 +559,7 @@ static void arc_free_tx_queue(struct net_device *ndev)
+ struct buffer_state *tx_buff = &priv->tx_buff[i];
+
+ if (tx_buff->skb) {
+- dma_unmap_single(&ndev->dev,
++ dma_unmap_single(dev,
+ dma_unmap_addr(tx_buff, addr),
+ dma_unmap_len(tx_buff, len),
+ DMA_TO_DEVICE);
+@@ -579,6 +583,7 @@ static void arc_free_tx_queue(struct net_device *ndev)
+ static void arc_free_rx_queue(struct net_device *ndev)
+ {
+ struct arc_emac_priv *priv = netdev_priv(ndev);
++ struct device *dev = ndev->dev.parent;
+ unsigned int i;
+
+ for (i = 0; i < RX_BD_NUM; i++) {
+@@ -586,7 +591,7 @@ static void arc_free_rx_queue(struct net_device *ndev)
+ struct buffer_state *rx_buff = &priv->rx_buff[i];
+
+ if (rx_buff->skb) {
+- dma_unmap_single(&ndev->dev,
++ dma_unmap_single(dev,
+ dma_unmap_addr(rx_buff, addr),
+ dma_unmap_len(rx_buff, len),
+ DMA_FROM_DEVICE);
+@@ -679,6 +684,7 @@ static netdev_tx_t arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
+ unsigned int len, *txbd_curr = &priv->txbd_curr;
+ struct net_device_stats *stats = &ndev->stats;
+ __le32 *info = &priv->txbd[*txbd_curr].info;
++ struct device *dev = ndev->dev.parent;
+ dma_addr_t addr;
+
+ if (skb_padto(skb, ETH_ZLEN))
+@@ -692,10 +698,9 @@ static netdev_tx_t arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
+ return NETDEV_TX_BUSY;
+ }
+
+- addr = dma_map_single(&ndev->dev, (void *)skb->data, len,
+- DMA_TO_DEVICE);
++ addr = dma_map_single(dev, (void *)skb->data, len, DMA_TO_DEVICE);
+
+- if (unlikely(dma_mapping_error(&ndev->dev, addr))) {
++ if (unlikely(dma_mapping_error(dev, addr))) {
+ stats->tx_dropped++;
+ stats->tx_errors++;
+ dev_kfree_skb_any(skb);
+--
+2.43.0
+
--- /dev/null
+From 23b7d2d30bf9e887864561f1a4a665bba93e6af4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 17:04:06 +0800
+Subject: net: enetc: set MAC address to the VF net_device
+
+From: Wei Fang <wei.fang@nxp.com>
+
+[ Upstream commit badccd49b93bb945bf4e5cc8707db67cdc5e27e5 ]
+
+The MAC address of VF can be configured through the mailbox mechanism of
+ENETC, but the previous implementation forgot to set the MAC address in
+net_device, resulting in the SMAC of the sent frames still being the old
+MAC address. Since the MAC address in the hardware has been changed, Rx
+cannot receive frames with the DMAC address as the new MAC address. The
+most obvious phenomenon is that after changing the MAC address, we can
+see that the MAC address of eno0vf0 has not changed through the "ifconfig
+eno0vf0" command and the IP address cannot be obtained .
+
+root@ls1028ardb:~# ifconfig eno0vf0 down
+root@ls1028ardb:~# ifconfig eno0vf0 hw ether 00:04:9f:3a:4d:56 up
+root@ls1028ardb:~# ifconfig eno0vf0
+eno0vf0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
+ ether 66:36:2c:3b:87:76 txqueuelen 1000 (Ethernet)
+ RX packets 794 bytes 69239 (69.2 KB)
+ RX errors 0 dropped 0 overruns 0 frame 0
+ TX packets 11 bytes 2226 (2.2 KB)
+ TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
+
+Fixes: beb74ac878c8 ("enetc: Add vf to pf messaging support")
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Link: https://patch.msgid.link/20241029090406.841836-1-wei.fang@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc_vf.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_vf.c b/drivers/net/ethernet/freescale/enetc/enetc_vf.c
+index 5ce3e2593bdde..1b0d0ef20562b 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_vf.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_vf.c
+@@ -78,11 +78,18 @@ static int enetc_vf_set_mac_addr(struct net_device *ndev, void *addr)
+ {
+ struct enetc_ndev_priv *priv = netdev_priv(ndev);
+ struct sockaddr *saddr = addr;
++ int err;
+
+ if (!is_valid_ether_addr(saddr->sa_data))
+ return -EADDRNOTAVAIL;
+
+- return enetc_msg_vsi_set_primary_mac_addr(priv, saddr);
++ err = enetc_msg_vsi_set_primary_mac_addr(priv, saddr);
++ if (err)
++ return err;
++
++ eth_hw_addr_set(ndev, saddr->sa_data);
++
++ return 0;
+ }
+
+ static int enetc_vf_set_features(struct net_device *ndev,
+--
+2.43.0
+
--- /dev/null
+From a85f526599493aee39f0f239bc30a89765e24fcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2024 17:15:07 +0800
+Subject: net: hns3: fix kernel crash when uninstalling driver
+
+From: Peiyang Wang <wangpeiyang1@huawei.com>
+
+[ Upstream commit df3dff8ab6d79edc942464999d06fbaedf8cdd18 ]
+
+When the driver is uninstalled and the VF is disabled concurrently, a
+kernel crash occurs. The reason is that the two actions call function
+pci_disable_sriov(). The num_VFs is checked to determine whether to
+release the corresponding resources. During the second calling, num_VFs
+is not 0 and the resource release function is called. However, the
+corresponding resource has been released during the first invoking.
+Therefore, the problem occurs:
+
+[15277.839633][T50670] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
+...
+[15278.131557][T50670] Call trace:
+[15278.134686][T50670] klist_put+0x28/0x12c
+[15278.138682][T50670] klist_del+0x14/0x20
+[15278.142592][T50670] device_del+0xbc/0x3c0
+[15278.146676][T50670] pci_remove_bus_device+0x84/0x120
+[15278.151714][T50670] pci_stop_and_remove_bus_device+0x6c/0x80
+[15278.157447][T50670] pci_iov_remove_virtfn+0xb4/0x12c
+[15278.162485][T50670] sriov_disable+0x50/0x11c
+[15278.166829][T50670] pci_disable_sriov+0x24/0x30
+[15278.171433][T50670] hnae3_unregister_ae_algo_prepare+0x60/0x90 [hnae3]
+[15278.178039][T50670] hclge_exit+0x28/0xd0 [hclge]
+[15278.182730][T50670] __se_sys_delete_module.isra.0+0x164/0x230
+[15278.188550][T50670] __arm64_sys_delete_module+0x1c/0x30
+[15278.193848][T50670] invoke_syscall+0x50/0x11c
+[15278.198278][T50670] el0_svc_common.constprop.0+0x158/0x164
+[15278.203837][T50670] do_el0_svc+0x34/0xcc
+[15278.207834][T50670] el0_svc+0x20/0x30
+
+For details, see the following figure.
+
+ rmmod hclge disable VFs
+----------------------------------------------------
+hclge_exit() sriov_numvfs_store()
+ ... device_lock()
+ pci_disable_sriov() hns3_pci_sriov_configure()
+ pci_disable_sriov()
+ sriov_disable()
+ sriov_disable() if !num_VFs :
+ if !num_VFs : return;
+ return; sriov_del_vfs()
+ sriov_del_vfs() ...
+ ... klist_put()
+ klist_put() ...
+ ... num_VFs = 0;
+ num_VFs = 0; device_unlock();
+
+In this patch, when driver is removing, we get the device_lock()
+to protect num_VFs, just like sriov_numvfs_store().
+
+Fixes: 0dd8a25f355b ("net: hns3: disable sriov before unload hclge layer")
+Signed-off-by: Peiyang Wang <wangpeiyang1@huawei.com>
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20241101091507.3644584-1-shaojijie@huawei.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hnae3.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+index 67b0bf310daaa..9a63fbc694083 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+@@ -25,8 +25,11 @@ void hnae3_unregister_ae_algo_prepare(struct hnae3_ae_algo *ae_algo)
+ pci_id = pci_match_id(ae_algo->pdev_id_table, ae_dev->pdev);
+ if (!pci_id)
+ continue;
+- if (IS_ENABLED(CONFIG_PCI_IOV))
++ if (IS_ENABLED(CONFIG_PCI_IOV)) {
++ device_lock(&ae_dev->pdev->dev);
+ pci_disable_sriov(ae_dev->pdev);
++ device_unlock(&ae_dev->pdev->dev);
++ }
+ }
+ }
+ EXPORT_SYMBOL(hnae3_unregister_ae_algo_prepare);
+--
+2.43.0
+
--- /dev/null
+From 50ea5d4cbf7ad47254d0012d59bc7d5c2bf2c618 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Nov 2020 14:50:56 +0200
+Subject: net: phy: export phy_error and phy_trigger_machine
+
+From: Ioana Ciornei <ioana.ciornei@nxp.com>
+
+[ Upstream commit 293e9a3d950dfebc76d9fa6931e6f91ef856b9ab ]
+
+These functions are currently used by phy_interrupt() to either signal
+an error condition or to trigger the link state machine. In an attempt
+to actually support shared PHY IRQs, export these two functions so that
+the actual PHY drivers can use them.
+
+Cc: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Cc: Andre Edich <andre.edich@microchip.com>
+Cc: Antoine Tenart <atenart@kernel.org>
+Cc: Baruch Siach <baruch@tkos.co.il>
+Cc: Christophe Leroy <christophe.leroy@c-s.fr>
+Cc: Dan Murphy <dmurphy@ti.com>
+Cc: Divya Koppera <Divya.Koppera@microchip.com>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Heiner Kallweit <hkallweit1@gmail.com>
+Cc: Jerome Brunet <jbrunet@baylibre.com>
+Cc: Kavya Sree Kotagiri <kavyasree.kotagiri@microchip.com>
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Cc: Marco Felsch <m.felsch@pengutronix.de>
+Cc: Marek Vasut <marex@denx.de>
+Cc: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Cc: Mathias Kresin <dev@kresin.me>
+Cc: Maxim Kochetkov <fido_max@inbox.ru>
+Cc: Michael Walle <michael@walle.cc>
+Cc: Neil Armstrong <narmstrong@baylibre.com>
+Cc: Nisar Sayed <Nisar.Sayed@microchip.com>
+Cc: Oleksij Rempel <o.rempel@pengutronix.de>
+Cc: Philippe Schenker <philippe.schenker@toradex.com>
+Cc: Willy Liu <willy.liu@realtek.com>
+Cc: Yuiko Oshino <yuiko.oshino@microchip.com>
+Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 256748d5480b ("net: phy: ti: add PHY_RST_AFTER_CLK_EN flag")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy.c | 6 ++++--
+ include/linux/phy.h | 2 ++
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index f3e606b6617e9..eb0f2e11cc216 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -461,10 +461,11 @@ EXPORT_SYMBOL(phy_queue_state_machine);
+ *
+ * @phydev: the phy_device struct
+ */
+-static void phy_trigger_machine(struct phy_device *phydev)
++void phy_trigger_machine(struct phy_device *phydev)
+ {
+ phy_queue_state_machine(phydev, 0);
+ }
++EXPORT_SYMBOL(phy_trigger_machine);
+
+ static void phy_abort_cable_test(struct phy_device *phydev)
+ {
+@@ -970,7 +971,7 @@ void phy_stop_machine(struct phy_device *phydev)
+ * Must not be called from interrupt context, or while the
+ * phydev->lock is held.
+ */
+-static void phy_error(struct phy_device *phydev)
++void phy_error(struct phy_device *phydev)
+ {
+ WARN_ON(1);
+
+@@ -980,6 +981,7 @@ static void phy_error(struct phy_device *phydev)
+
+ phy_trigger_machine(phydev);
+ }
++EXPORT_SYMBOL(phy_error);
+
+ /**
+ * phy_disable_interrupts - Disable the PHY interrupts from the PHY side
+diff --git a/include/linux/phy.h b/include/linux/phy.h
+index 08725a262f320..203d53ea19d1b 100644
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -1542,8 +1542,10 @@ void phy_drivers_unregister(struct phy_driver *drv, int n);
+ int phy_driver_register(struct phy_driver *new_driver, struct module *owner);
+ int phy_drivers_register(struct phy_driver *new_driver, int n,
+ struct module *owner);
++void phy_error(struct phy_device *phydev);
+ void phy_state_machine(struct work_struct *work);
+ void phy_queue_state_machine(struct phy_device *phydev, unsigned long jiffies);
++void phy_trigger_machine(struct phy_device *phydev);
+ void phy_mac_interrupt(struct phy_device *phydev);
+ void phy_start_machine(struct phy_device *phydev);
+ void phy_stop_machine(struct phy_device *phydev);
+--
+2.43.0
+
--- /dev/null
+From 6a1ef352cb04ae229eb9a4a829f202fe2f57bad6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Nov 2024 16:15:05 +0100
+Subject: net: phy: ti: add PHY_RST_AFTER_CLK_EN flag
+
+From: Diogo Silva <diogompaissilva@gmail.com>
+
+[ Upstream commit 256748d5480bb3c4b731236c6d6fc86a8e2815d8 ]
+
+DP83848 datasheet (section 4.7.2) indicates that the reset pin should be
+toggled after the clocks are running. Add the PHY_RST_AFTER_CLK_EN to
+make sure that this indication is respected.
+
+In my experience not having this flag enabled would lead to, on some
+boots, the wrong MII mode being selected if the PHY was initialized on
+the bootloader and was receiving data during Linux boot.
+
+Signed-off-by: Diogo Silva <diogompaissilva@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Fixes: 34e45ad9378c ("net: phy: dp83848: Add TI DP83848 Ethernet PHY")
+Link: https://patch.msgid.link/20241102151504.811306-1-paissilva@ld-100007.ds1.internal
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/dp83848.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/phy/dp83848.c b/drivers/net/phy/dp83848.c
+index b707a9b278471..406538ba50445 100644
+--- a/drivers/net/phy/dp83848.c
++++ b/drivers/net/phy/dp83848.c
+@@ -137,6 +137,8 @@ MODULE_DEVICE_TABLE(mdio, dp83848_tbl);
+ .ack_interrupt = dp83848_ack_interrupt, \
+ .config_intr = dp83848_config_intr, \
+ .handle_interrupt = dp83848_handle_interrupt, \
++ \
++ .flags = PHY_RST_AFTER_CLK_EN, \
+ }
+
+ static struct phy_driver dp83848_driver[] = {
+--
+2.43.0
+
--- /dev/null
+From 3eaf5a5ef53c3be041f4f7ea6c71c1e84450aa2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 17:38:13 +0200
+Subject: net: phy: ti: implement generic .handle_interrupt() callback
+
+From: Ioana Ciornei <ioana.ciornei@nxp.com>
+
+[ Upstream commit 1d1ae3c6ca3ff49843d73852bb2a8153ce16f432 ]
+
+In an attempt to actually support shared IRQs in phylib, we now move the
+responsibility of triggering the phylib state machine or just returning
+IRQ_NONE, based on the IRQ status register, to the PHY driver. Having
+3 different IRQ handling callbacks (.handle_interrupt(),
+.did_interrupt() and .ack_interrupt() ) is confusing so let the PHY
+driver implement directly an IRQ handler like any other device driver.
+Make this driver follow the new convention.
+
+Cc: Dan Murphy <dmurphy@ti.com>
+Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 256748d5480b ("net: phy: ti: add PHY_RST_AFTER_CLK_EN flag")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/dp83640.c | 27 +++++++++++++++++++++++
+ drivers/net/phy/dp83822.c | 37 +++++++++++++++++++++++++++++++
+ drivers/net/phy/dp83848.c | 33 ++++++++++++++++++++++++++++
+ drivers/net/phy/dp83867.c | 25 +++++++++++++++++++++
+ drivers/net/phy/dp83869.c | 25 +++++++++++++++++++++
+ drivers/net/phy/dp83tc811.c | 44 +++++++++++++++++++++++++++++++++++++
+ 6 files changed, 191 insertions(+)
+
+diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
+index f2caccaf4408f..89577f1d35766 100644
+--- a/drivers/net/phy/dp83640.c
++++ b/drivers/net/phy/dp83640.c
+@@ -50,6 +50,14 @@
+ #define MII_DP83640_MISR_LINK_INT_EN 0x20
+ #define MII_DP83640_MISR_ED_INT_EN 0x40
+ #define MII_DP83640_MISR_LQ_INT_EN 0x80
++#define MII_DP83640_MISR_ANC_INT 0x400
++#define MII_DP83640_MISR_DUP_INT 0x800
++#define MII_DP83640_MISR_SPD_INT 0x1000
++#define MII_DP83640_MISR_LINK_INT 0x2000
++#define MII_DP83640_MISR_INT_MASK (MII_DP83640_MISR_ANC_INT |\
++ MII_DP83640_MISR_DUP_INT |\
++ MII_DP83640_MISR_SPD_INT |\
++ MII_DP83640_MISR_LINK_INT)
+
+ /* phyter seems to miss the mark by 16 ns */
+ #define ADJTIME_FIX 16
+@@ -1193,6 +1201,24 @@ static int dp83640_config_intr(struct phy_device *phydev)
+ }
+ }
+
++static irqreturn_t dp83640_handle_interrupt(struct phy_device *phydev)
++{
++ int irq_status;
++
++ irq_status = phy_read(phydev, MII_DP83640_MISR);
++ if (irq_status < 0) {
++ phy_error(phydev);
++ return IRQ_NONE;
++ }
++
++ if (!(irq_status & MII_DP83640_MISR_INT_MASK))
++ return IRQ_NONE;
++
++ phy_trigger_machine(phydev);
++
++ return IRQ_HANDLED;
++}
++
+ static int dp83640_hwtstamp(struct mii_timestamper *mii_ts, struct ifreq *ifr)
+ {
+ struct dp83640_private *dp83640 =
+@@ -1517,6 +1543,7 @@ static struct phy_driver dp83640_driver = {
+ .config_init = dp83640_config_init,
+ .ack_interrupt = dp83640_ack_interrupt,
+ .config_intr = dp83640_config_intr,
++ .handle_interrupt = dp83640_handle_interrupt,
+ };
+
+ static int __init dp83640_init(void)
+diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c
+index c3828beccbad8..45fbb65085f96 100644
+--- a/drivers/net/phy/dp83822.c
++++ b/drivers/net/phy/dp83822.c
+@@ -303,6 +303,41 @@ static int dp83822_config_intr(struct phy_device *phydev)
+ return phy_write(phydev, MII_DP83822_PHYSCR, physcr_status);
+ }
+
++static irqreturn_t dp83822_handle_interrupt(struct phy_device *phydev)
++{
++ int irq_status;
++
++ /* The MISR1 and MISR2 registers are holding the interrupt status in
++ * the upper half (15:8), while the lower half (7:0) is used for
++ * controlling the interrupt enable state of those individual interrupt
++ * sources. To determine the possible interrupt sources, just read the
++ * MISR* register and use it directly to know which interrupts have
++ * been enabled previously or not.
++ */
++ irq_status = phy_read(phydev, MII_DP83822_MISR1);
++ if (irq_status < 0) {
++ phy_error(phydev);
++ return IRQ_NONE;
++ }
++ if (irq_status & ((irq_status & GENMASK(7, 0)) << 8))
++ goto trigger_machine;
++
++ irq_status = phy_read(phydev, MII_DP83822_MISR2);
++ if (irq_status < 0) {
++ phy_error(phydev);
++ return IRQ_NONE;
++ }
++ if (irq_status & ((irq_status & GENMASK(7, 0)) << 8))
++ goto trigger_machine;
++
++ return IRQ_NONE;
++
++trigger_machine:
++ phy_trigger_machine(phydev);
++
++ return IRQ_HANDLED;
++}
++
+ static int dp8382x_disable_wol(struct phy_device *phydev)
+ {
+ return phy_clear_bits_mmd(phydev, DP83822_DEVADDR, MII_DP83822_WOL_CFG,
+@@ -586,6 +621,7 @@ static int dp83822_resume(struct phy_device *phydev)
+ .set_wol = dp83822_set_wol, \
+ .ack_interrupt = dp83822_ack_interrupt, \
+ .config_intr = dp83822_config_intr, \
++ .handle_interrupt = dp83822_handle_interrupt, \
+ .suspend = dp83822_suspend, \
+ .resume = dp83822_resume, \
+ }
+@@ -601,6 +637,7 @@ static int dp83822_resume(struct phy_device *phydev)
+ .set_wol = dp83822_set_wol, \
+ .ack_interrupt = dp83822_ack_interrupt, \
+ .config_intr = dp83822_config_intr, \
++ .handle_interrupt = dp83822_handle_interrupt, \
+ .suspend = dp83822_suspend, \
+ .resume = dp83822_resume, \
+ }
+diff --git a/drivers/net/phy/dp83848.c b/drivers/net/phy/dp83848.c
+index 54c7c1b44e4d0..b707a9b278471 100644
+--- a/drivers/net/phy/dp83848.c
++++ b/drivers/net/phy/dp83848.c
+@@ -37,6 +37,20 @@
+ DP83848_MISR_SPD_INT_EN | \
+ DP83848_MISR_LINK_INT_EN)
+
++#define DP83848_MISR_RHF_INT BIT(8)
++#define DP83848_MISR_FHF_INT BIT(9)
++#define DP83848_MISR_ANC_INT BIT(10)
++#define DP83848_MISR_DUP_INT BIT(11)
++#define DP83848_MISR_SPD_INT BIT(12)
++#define DP83848_MISR_LINK_INT BIT(13)
++#define DP83848_MISR_ED_INT BIT(14)
++
++#define DP83848_INT_MASK \
++ (DP83848_MISR_ANC_INT | \
++ DP83848_MISR_DUP_INT | \
++ DP83848_MISR_SPD_INT | \
++ DP83848_MISR_LINK_INT)
++
+ static int dp83848_ack_interrupt(struct phy_device *phydev)
+ {
+ int err = phy_read(phydev, DP83848_MISR);
+@@ -66,6 +80,24 @@ static int dp83848_config_intr(struct phy_device *phydev)
+ return phy_write(phydev, DP83848_MICR, control);
+ }
+
++static irqreturn_t dp83848_handle_interrupt(struct phy_device *phydev)
++{
++ int irq_status;
++
++ irq_status = phy_read(phydev, DP83848_MISR);
++ if (irq_status < 0) {
++ phy_error(phydev);
++ return IRQ_NONE;
++ }
++
++ if (!(irq_status & DP83848_INT_MASK))
++ return IRQ_NONE;
++
++ phy_trigger_machine(phydev);
++
++ return IRQ_HANDLED;
++}
++
+ static int dp83848_config_init(struct phy_device *phydev)
+ {
+ int val;
+@@ -104,6 +136,7 @@ MODULE_DEVICE_TABLE(mdio, dp83848_tbl);
+ /* IRQ related */ \
+ .ack_interrupt = dp83848_ack_interrupt, \
+ .config_intr = dp83848_config_intr, \
++ .handle_interrupt = dp83848_handle_interrupt, \
+ }
+
+ static struct phy_driver dp83848_driver[] = {
+diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c
+index 834bf63dc2009..0cb24bfbfa237 100644
+--- a/drivers/net/phy/dp83867.c
++++ b/drivers/net/phy/dp83867.c
+@@ -312,6 +312,30 @@ static int dp83867_config_intr(struct phy_device *phydev)
+ return phy_write(phydev, MII_DP83867_MICR, micr_status);
+ }
+
++static irqreturn_t dp83867_handle_interrupt(struct phy_device *phydev)
++{
++ int irq_status, irq_enabled;
++
++ irq_status = phy_read(phydev, MII_DP83867_ISR);
++ if (irq_status < 0) {
++ phy_error(phydev);
++ return IRQ_NONE;
++ }
++
++ irq_enabled = phy_read(phydev, MII_DP83867_MICR);
++ if (irq_enabled < 0) {
++ phy_error(phydev);
++ return IRQ_NONE;
++ }
++
++ if (!(irq_status & irq_enabled))
++ return IRQ_NONE;
++
++ phy_trigger_machine(phydev);
++
++ return IRQ_HANDLED;
++}
++
+ static int dp83867_read_status(struct phy_device *phydev)
+ {
+ int status = phy_read(phydev, MII_DP83867_PHYSTS);
+@@ -878,6 +902,7 @@ static struct phy_driver dp83867_driver[] = {
+ /* IRQ related */
+ .ack_interrupt = dp83867_ack_interrupt,
+ .config_intr = dp83867_config_intr,
++ .handle_interrupt = dp83867_handle_interrupt,
+
+ .suspend = genphy_suspend,
+ .resume = genphy_resume,
+diff --git a/drivers/net/phy/dp83869.c b/drivers/net/phy/dp83869.c
+index 01b593e0bb4a1..e2fe89c8059ea 100644
+--- a/drivers/net/phy/dp83869.c
++++ b/drivers/net/phy/dp83869.c
+@@ -207,6 +207,30 @@ static int dp83869_config_intr(struct phy_device *phydev)
+ return phy_write(phydev, MII_DP83869_MICR, micr_status);
+ }
+
++static irqreturn_t dp83869_handle_interrupt(struct phy_device *phydev)
++{
++ int irq_status, irq_enabled;
++
++ irq_status = phy_read(phydev, MII_DP83869_ISR);
++ if (irq_status < 0) {
++ phy_error(phydev);
++ return IRQ_NONE;
++ }
++
++ irq_enabled = phy_read(phydev, MII_DP83869_MICR);
++ if (irq_enabled < 0) {
++ phy_error(phydev);
++ return IRQ_NONE;
++ }
++
++ if (!(irq_status & irq_enabled))
++ return IRQ_NONE;
++
++ phy_trigger_machine(phydev);
++
++ return IRQ_HANDLED;
++}
++
+ static int dp83869_set_wol(struct phy_device *phydev,
+ struct ethtool_wolinfo *wol)
+ {
+@@ -853,6 +877,7 @@ static struct phy_driver dp83869_driver[] = {
+ /* IRQ related */
+ .ack_interrupt = dp83869_ack_interrupt,
+ .config_intr = dp83869_config_intr,
++ .handle_interrupt = dp83869_handle_interrupt,
+ .read_status = dp83869_read_status,
+
+ .get_tunable = dp83869_get_tunable,
+diff --git a/drivers/net/phy/dp83tc811.c b/drivers/net/phy/dp83tc811.c
+index d73725312c7c3..a93c64ac76a39 100644
+--- a/drivers/net/phy/dp83tc811.c
++++ b/drivers/net/phy/dp83tc811.c
+@@ -254,6 +254,49 @@ static int dp83811_config_intr(struct phy_device *phydev)
+ return err;
+ }
+
++static irqreturn_t dp83811_handle_interrupt(struct phy_device *phydev)
++{
++ int irq_status;
++
++ /* The INT_STAT registers 1, 2 and 3 are holding the interrupt status
++ * in the upper half (15:8), while the lower half (7:0) is used for
++ * controlling the interrupt enable state of those individual interrupt
++ * sources. To determine the possible interrupt sources, just read the
++ * INT_STAT* register and use it directly to know which interrupts have
++ * been enabled previously or not.
++ */
++ irq_status = phy_read(phydev, MII_DP83811_INT_STAT1);
++ if (irq_status < 0) {
++ phy_error(phydev);
++ return IRQ_NONE;
++ }
++ if (irq_status & ((irq_status & GENMASK(7, 0)) << 8))
++ goto trigger_machine;
++
++ irq_status = phy_read(phydev, MII_DP83811_INT_STAT2);
++ if (irq_status < 0) {
++ phy_error(phydev);
++ return IRQ_NONE;
++ }
++ if (irq_status & ((irq_status & GENMASK(7, 0)) << 8))
++ goto trigger_machine;
++
++ irq_status = phy_read(phydev, MII_DP83811_INT_STAT3);
++ if (irq_status < 0) {
++ phy_error(phydev);
++ return IRQ_NONE;
++ }
++ if (irq_status & ((irq_status & GENMASK(7, 0)) << 8))
++ goto trigger_machine;
++
++ return IRQ_NONE;
++
++trigger_machine:
++ phy_trigger_machine(phydev);
++
++ return IRQ_HANDLED;
++}
++
+ static int dp83811_config_aneg(struct phy_device *phydev)
+ {
+ int value, err;
+@@ -345,6 +388,7 @@ static struct phy_driver dp83811_driver[] = {
+ .set_wol = dp83811_set_wol,
+ .ack_interrupt = dp83811_ack_interrupt,
+ .config_intr = dp83811_config_intr,
++ .handle_interrupt = dp83811_handle_interrupt,
+ .suspend = dp83811_suspend,
+ .resume = dp83811_resume,
+ },
+--
+2.43.0
+
--- /dev/null
+From b82fae5692d9ecc50d6dffdee2d6ade3b03dc647 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 13:46:21 -0400
+Subject: sctp: properly validate chunk size in sctp_sf_ootb()
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 0ead60804b64f5bd6999eec88e503c6a1a242d41 ]
+
+A size validation fix similar to that in Commit 50619dbf8db7 ("sctp: add
+size validation when walking chunks") is also required in sctp_sf_ootb()
+to address a crash reported by syzbot:
+
+ BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712
+ sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712
+ sctp_do_sm+0x181/0x93d0 net/sctp/sm_sideeffect.c:1166
+ sctp_endpoint_bh_rcv+0xc38/0xf90 net/sctp/endpointola.c:407
+ sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88
+ sctp_rcv+0x3831/0x3b20 net/sctp/input.c:243
+ sctp4_rcv+0x42/0x50 net/sctp/protocol.c:1159
+ ip_protocol_deliver_rcu+0xb51/0x13d0 net/ipv4/ip_input.c:205
+ ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233
+
+Reported-by: syzbot+f0cbb34d39392f2746ca@syzkaller.appspotmail.com
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Link: https://patch.msgid.link/a29ebb6d8b9f8affd0f9abb296faafafe10c17d8.1730223981.git.lucien.xin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/sm_statefuns.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 1e82c51657a7e..93ebd14b48ed7 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -3637,7 +3637,7 @@ enum sctp_disposition sctp_sf_ootb(struct net *net,
+ }
+
+ ch = (struct sctp_chunkhdr *)ch_end;
+- } while (ch_end < skb_tail_pointer(skb));
++ } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb));
+
+ if (ootb_shut_ack)
+ return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands);
+--
+2.43.0
+
--- /dev/null
+From 2f46b1b0bffbb9997681eed25898d9f2ffc49480 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 12:46:39 +0000
+Subject: security/keys: fix slab-out-of-bounds in key_task_permission
+
+From: Chen Ridong <chenridong@huawei.com>
+
+[ Upstream commit 4a74da044ec9ec8679e6beccc4306b936b62873f ]
+
+KASAN reports an out of bounds read:
+BUG: KASAN: slab-out-of-bounds in __kuid_val include/linux/uidgid.h:36
+BUG: KASAN: slab-out-of-bounds in uid_eq include/linux/uidgid.h:63 [inline]
+BUG: KASAN: slab-out-of-bounds in key_task_permission+0x394/0x410
+security/keys/permission.c:54
+Read of size 4 at addr ffff88813c3ab618 by task stress-ng/4362
+
+CPU: 2 PID: 4362 Comm: stress-ng Not tainted 5.10.0-14930-gafbffd6c3ede #15
+Call Trace:
+ __dump_stack lib/dump_stack.c:82 [inline]
+ dump_stack+0x107/0x167 lib/dump_stack.c:123
+ print_address_description.constprop.0+0x19/0x170 mm/kasan/report.c:400
+ __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560
+ kasan_report+0x3a/0x50 mm/kasan/report.c:585
+ __kuid_val include/linux/uidgid.h:36 [inline]
+ uid_eq include/linux/uidgid.h:63 [inline]
+ key_task_permission+0x394/0x410 security/keys/permission.c:54
+ search_nested_keyrings+0x90e/0xe90 security/keys/keyring.c:793
+
+This issue was also reported by syzbot.
+
+It can be reproduced by following these steps(more details [1]):
+1. Obtain more than 32 inputs that have similar hashes, which ends with the
+ pattern '0xxxxxxxe6'.
+2. Reboot and add the keys obtained in step 1.
+
+The reproducer demonstrates how this issue happened:
+1. In the search_nested_keyrings function, when it iterates through the
+ slots in a node(below tag ascend_to_node), if the slot pointer is meta
+ and node->back_pointer != NULL(it means a root), it will proceed to
+ descend_to_node. However, there is an exception. If node is the root,
+ and one of the slots points to a shortcut, it will be treated as a
+ keyring.
+2. Whether the ptr is keyring decided by keyring_ptr_is_keyring function.
+ However, KEYRING_PTR_SUBTYPE is 0x2UL, the same as
+ ASSOC_ARRAY_PTR_SUBTYPE_MASK.
+3. When 32 keys with the similar hashes are added to the tree, the ROOT
+ has keys with hashes that are not similar (e.g. slot 0) and it splits
+ NODE A without using a shortcut. When NODE A is filled with keys that
+ all hashes are xxe6, the keys are similar, NODE A will split with a
+ shortcut. Finally, it forms the tree as shown below, where slot 6 points
+ to a shortcut.
+
+ NODE A
+ +------>+---+
+ ROOT | | 0 | xxe6
+ +---+ | +---+
+ xxxx | 0 | shortcut : : xxe6
+ +---+ | +---+
+ xxe6 : : | | | xxe6
+ +---+ | +---+
+ | 6 |---+ : : xxe6
+ +---+ +---+
+ xxe6 : : | f | xxe6
+ +---+ +---+
+ xxe6 | f |
+ +---+
+
+4. As mentioned above, If a slot(slot 6) of the root points to a shortcut,
+ it may be mistakenly transferred to a key*, leading to a read
+ out-of-bounds read.
+
+To fix this issue, one should jump to descend_to_node if the ptr is a
+shortcut, regardless of whether the node is root or not.
+
+[1] https://lore.kernel.org/linux-kernel/1cfa878e-8c7b-4570-8606-21daf5e13ce7@huaweicloud.com/
+
+[jarkko: tweaked the commit message a bit to have an appropriate closes
+ tag.]
+Fixes: b2a4df200d57 ("KEYS: Expand the capacity of a keyring")
+Reported-by: syzbot+5b415c07907a2990d1a3@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/000000000000cbb7860611f61147@google.com/T/
+Signed-off-by: Chen Ridong <chenridong@huawei.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/keys/keyring.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/security/keys/keyring.c b/security/keys/keyring.c
+index 14abfe765b7e7..9f0fc81a3a7b9 100644
+--- a/security/keys/keyring.c
++++ b/security/keys/keyring.c
+@@ -772,8 +772,11 @@ static bool search_nested_keyrings(struct key *keyring,
+ for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
+ ptr = READ_ONCE(node->slots[slot]);
+
+- if (assoc_array_ptr_is_meta(ptr) && node->back_pointer)
+- goto descend_to_node;
++ if (assoc_array_ptr_is_meta(ptr)) {
++ if (node->back_pointer ||
++ assoc_array_ptr_is_shortcut(ptr))
++ goto descend_to_node;
++ }
+
+ if (!keyring_ptr_is_keyring(ptr))
+ continue;
+--
+2.43.0
+
+arm64-dts-rockchip-fix-rt5651-compatible-value-on-rk.patch
+arm64-dts-rockchip-remove-hdmi-s-2nd-interrupt-on-rk.patch
+arm64-dts-rockchip-fix-bluetooth-properties-on-rock9.patch
+arm64-dts-rockchip-remove-cooling-cells-from-fan-on-.patch
+arm64-dts-rockchip-fix-led-triggers-on-rk3308-roc-cc.patch
+arm64-dts-imx8mp-correct-sdhc-ipg-clk.patch
+arm-dts-rockchip-fix-rk3036-acodec-node.patch
+arm-dts-rockchip-drop-grf-reference-from-rk3036-hdmi.patch
+arm-dts-rockchip-fix-the-spi-controller-on-rk3036.patch
+arm-dts-rockchip-fix-the-realtek-audio-codec-on-rk30.patch
+hid-core-zero-initialize-the-report-buffer.patch
+security-keys-fix-slab-out-of-bounds-in-key_task_per.patch
+net-enetc-set-mac-address-to-the-vf-net_device.patch
+sctp-properly-validate-chunk-size-in-sctp_sf_ootb.patch
+can-c_can-fix-rx-tx-_errors-statistics.patch
+net-hns3-fix-kernel-crash-when-uninstalling-driver.patch
+net-phy-export-phy_error-and-phy_trigger_machine.patch
+net-phy-ti-implement-generic-.handle_interrupt-callb.patch
+net-phy-ti-add-phy_rst_after_clk_en-flag.patch
+net-arc-fix-the-device-for-dma_map_single-dma_unmap_.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
