--- /dev/null
+From 72d00e560d10665e6139c9431956a87ded6e9880 Mon Sep 17 00:00:00 2001
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Date: Mon, 7 Aug 2023 10:47:44 +0200
+Subject: clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz
+
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+
+commit 72d00e560d10665e6139c9431956a87ded6e9880 upstream.
+
+Since commit b09c68dc57c9 ("clk: imx: pll14xx: Support dynamic rates"),
+the driver has the ability to dynamically compute PLL parameters to
+approximate the requested rates. This is not always used, because the
+logic is as follows:
+
+ - Check if the target rate is hardcoded in the frequency table
+ - Check if varying only kdiv is possible, so switch over is glitch free
+ - Compute rate dynamically by iterating over pdiv range
+
+If we skip the frequency table for the 1443x PLL, we find that the
+computed values differ to the hardcoded ones. This can be valid if the
+hardcoded values guarantee for example an earlier lock-in or if the
+divisors are chosen, so that other important rates are more likely to
+be reached glitch-free.
+
+For rates (393216000 and 361267200, this doesn't seem to be the case:
+They are only approximated by existing parameters (393215995 and
+361267196 Hz, respectively) and they aren't reachable glitch-free from
+other hardcoded frequencies. Dropping them from the table allows us
+to lock-in to these frequencies exactly.
+
+This is immediately noticeable because they are the assigned-clock-rates
+for IMX8MN_AUDIO_PLL1 and IMX8MN_AUDIO_PLL2, respectively and a look
+into clk_summary so far showed that they were a few Hz short of the target:
+
+imx8mn-board:~# grep audio_pll[12]_out /sys/kernel/debug/clk/clk_summary
+audio_pll2_out 0 0 0 361267196 0 0 50000 N
+audio_pll1_out 1 1 0 393215995 0 0 50000 Y
+
+and afterwards:
+
+imx8mn-board:~# grep audio_pll[12]_out /sys/kernel/debug/clk/clk_summary
+audio_pll2_out 0 0 0 361267200 0 0 50000 N
+audio_pll1_out 1 1 0 393216000 0 0 50000 Y
+
+This change is equivalent to adding following hardcoded values:
+
+ /* rate mdiv pdiv sdiv kdiv */
+ PLL_1443X_RATE(393216000, 655, 5, 3, 23593),
+ PLL_1443X_RATE(361267200, 497, 33, 0, -16882),
+
+Fixes: 053a4ffe2988 ("clk: imx: imx8mm: fix audio pll setting")
+Cc: stable@vger.kernel.org # v5.18+
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Link: https://lore.kernel.org/r/20230807084744.1184791-2-m.felsch@pengutronix.de
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/imx/clk-pll14xx.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/clk/imx/clk-pll14xx.c
++++ b/drivers/clk/imx/clk-pll14xx.c
+@@ -60,8 +60,6 @@ static const struct imx_pll14xx_rate_tab
+ PLL_1443X_RATE(650000000U, 325, 3, 2, 0),
+ PLL_1443X_RATE(594000000U, 198, 2, 2, 0),
+ PLL_1443X_RATE(519750000U, 173, 2, 2, 16384),
+- PLL_1443X_RATE(393216000U, 262, 2, 3, 9437),
+- PLL_1443X_RATE(361267200U, 361, 3, 3, 17511),
+ };
+
+ struct imx_pll14xx_clk imx_1443x_pll = {
--- /dev/null
+From 1583694bb4eaf186f17131dbc1b83d6057d2749b Mon Sep 17 00:00:00 2001
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Date: Sat, 13 May 2023 00:17:23 +0300
+Subject: clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+commit 1583694bb4eaf186f17131dbc1b83d6057d2749b upstream.
+
+The pll0_vote clock definitely should have pll0 as a parent (instead of
+pll8).
+
+Fixes: 7792a8d6713c ("clk: mdm9615: Add support for MDM9615 Clock Controllers")
+Cc: stable@kernel.org
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230512211727.3445575-7-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/gcc-mdm9615.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/gcc-mdm9615.c
++++ b/drivers/clk/qcom/gcc-mdm9615.c
+@@ -58,7 +58,7 @@ static struct clk_regmap pll0_vote = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "pll0_vote",
+- .parent_names = (const char *[]){ "pll8" },
++ .parent_names = (const char *[]){ "pll0" },
+ .num_parents = 1,
+ .ops = &clk_pll_vote_ops,
+ },
--- /dev/null
+From 4cfe75f0f14f044dae66ad0e6eea812d038465d9 Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Wed, 21 Jun 2023 14:53:35 +0200
+Subject: drm/ast: Fix DRAM init on AST2200
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit 4cfe75f0f14f044dae66ad0e6eea812d038465d9 upstream.
+
+Fix the test for the AST2200 in the DRAM initialization. The value
+in ast->chip has to be compared against an enum constant instead of
+a numerical value.
+
+This bug got introduced when the driver was first imported into the
+kernel.
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Fixes: 312fec1405dd ("drm: Initial KMS driver for AST (ASpeed Technologies) 2000 series (v2)")
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v3.5+
+Reviewed-by: Sui Jingfeng <suijingfeng@loongson.cn>
+Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
+Tested-by: Jocelyn Falempe <jfalempe@redhat.com> # AST2600
+Link: https://patchwork.freedesktop.org/patch/msgid/20230621130032.3568-2-tzimmermann@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/ast/ast_post.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/ast/ast_post.c
++++ b/drivers/gpu/drm/ast/ast_post.c
+@@ -290,7 +290,7 @@ static void ast_init_dram_reg(struct drm
+ ;
+ } while (ast_read32(ast, 0x10100) != 0xa8);
+ } else {/* AST2100/1100 */
+- if (ast->chip == AST2100 || ast->chip == 2200)
++ if (ast->chip == AST2100 || ast->chip == AST2200)
+ dram_reg_info = ast2100_dram_table_data;
+ else
+ dram_reg_info = ast1100_dram_table_data;
--- /dev/null
+From 172044e30b00977784269e8ab72132a48293c654 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Fri, 28 Jul 2023 18:59:23 +0200
+Subject: dt-bindings: clock: xlnx,versal-clk: drop select:false
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 172044e30b00977784269e8ab72132a48293c654 upstream.
+
+select:false makes the schema basically ignored and not effective, which
+is clearly not what we want for a device binding.
+
+Fixes: 352546805a44 ("dt-bindings: clock: Add bindings for versal clock driver")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20230728165923.108589-1-krzysztof.kozlowski@linaro.org
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Reviewed-by: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/clock/xlnx,versal-clk.yaml | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/Documentation/devicetree/bindings/clock/xlnx,versal-clk.yaml
++++ b/Documentation/devicetree/bindings/clock/xlnx,versal-clk.yaml
+@@ -16,8 +16,6 @@ description: |
+ reads required input clock frequencies from the devicetree and acts as clock
+ provider for all clock consumers of PS clocks.
+
+-select: false
+-
+ properties:
+ compatible:
+ const: xlnx,versal-clk
--- /dev/null
+From f90a0e5265b60cdd3c77990e8105f79aa2fac994 Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Tue, 13 Jun 2023 13:06:49 +0200
+Subject: fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit f90a0e5265b60cdd3c77990e8105f79aa2fac994 upstream.
+
+Do not assing the Linux device to struct fb_info.dev. The call to
+register_framebuffer() initializes the field to the fbdev device.
+Drivers should not override its value.
+
+Fixes a bug where the driver incorrectly decreases the hardware
+device's reference counter and leaks the fbdev device.
+
+v2:
+ * add Fixes tag (Dan)
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Fixes: 88017bda96a5 ("ep93xx video driver")
+Cc: <stable@vger.kernel.org> # v2.6.32+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230613110953.24176-15-tzimmermann@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/ep93xx-fb.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/video/fbdev/ep93xx-fb.c
++++ b/drivers/video/fbdev/ep93xx-fb.c
+@@ -474,7 +474,6 @@ static int ep93xxfb_probe(struct platfor
+ if (!info)
+ return -ENOMEM;
+
+- info->dev = &pdev->dev;
+ platform_set_drvdata(pdev, info);
+ fbi = info->par;
+ fbi->mach_info = mach_info;
--- /dev/null
+From efb78fa86e95832b78ca0ba60f3706788a818938 Mon Sep 17 00:00:00 2001
+From: Andrew Donnellan <ajd@linux.ibm.com>
+Date: Fri, 14 Jul 2023 11:52:38 +1000
+Subject: lib/test_meminit: allocate pages up to order MAX_ORDER
+
+From: Andrew Donnellan <ajd@linux.ibm.com>
+
+commit efb78fa86e95832b78ca0ba60f3706788a818938 upstream.
+
+test_pages() tests the page allocator by calling alloc_pages() with
+different orders up to order 10.
+
+However, different architectures and platforms support different maximum
+contiguous allocation sizes. The default maximum allocation order
+(MAX_ORDER) is 10, but architectures can use CONFIG_ARCH_FORCE_MAX_ORDER
+to override this. On platforms where this is less than 10, test_meminit()
+will blow up with a WARN(). This is expected, so let's not do that.
+
+Replace the hardcoded "10" with the MAX_ORDER macro so that we test
+allocations up to the expected platform limit.
+
+Link: https://lkml.kernel.org/r/20230714015238.47931-1-ajd@linux.ibm.com
+Fixes: 5015a300a522 ("lib: introduce test_meminit module")
+Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com>
+Reviewed-by: Alexander Potapenko <glider@google.com>
+Cc: Xiaoke Wang <xkernel.wang@foxmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/test_meminit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/test_meminit.c
++++ b/lib/test_meminit.c
+@@ -86,7 +86,7 @@ static int __init test_pages(int *total_
+ int failures = 0, num_tests = 0;
+ int i;
+
+- for (i = 0; i < 10; i++)
++ for (i = 0; i <= MAX_ORDER; i++)
+ num_tests += do_alloc_pages_order(i, &failures);
+
+ REPORT_FAILURES_IN_FN();
--- /dev/null
+From 88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Sat, 19 Aug 2023 17:22:14 -0400
+Subject: NFS: Fix a potential data corruption
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit 88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4 upstream.
+
+We must ensure that the subrequests are joined back into the head before
+we can retransmit a request. If the head was not on the commit lists,
+because the server wrote it synchronously, we still need to add it back
+to the retransmission list.
+Add a call that mirrors the effect of nfs_cancel_remove_inode() for
+O_DIRECT.
+
+Fixes: ed5d588fe47f ("NFS: Try to join page groups before an O_DIRECT retransmission")
+Cc: stable@vger.kernel.org
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/direct.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -509,13 +509,31 @@ out:
+ return result;
+ }
+
++static void nfs_direct_add_page_head(struct list_head *list,
++ struct nfs_page *req)
++{
++ struct nfs_page *head = req->wb_head;
++
++ if (!list_empty(&head->wb_list) || !nfs_lock_request(head))
++ return;
++ if (!list_empty(&head->wb_list)) {
++ nfs_unlock_request(head);
++ return;
++ }
++ list_add(&head->wb_list, list);
++ kref_get(&head->wb_kref);
++ kref_get(&head->wb_kref);
++}
++
+ static void nfs_direct_join_group(struct list_head *list, struct inode *inode)
+ {
+ struct nfs_page *req, *subreq;
+
+ list_for_each_entry(req, list, wb_list) {
+- if (req->wb_head != req)
++ if (req->wb_head != req) {
++ nfs_direct_add_page_head(&req->wb_list, req);
+ continue;
++ }
+ subreq = req->wb_this_page;
+ if (subreq == req)
+ continue;
--- /dev/null
+From 96562c45af5c31b89a197af28f79bfa838fb8391 Mon Sep 17 00:00:00 2001
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+Date: Thu, 20 Jul 2023 18:37:51 +0300
+Subject: NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+commit 96562c45af5c31b89a197af28f79bfa838fb8391 upstream.
+
+It is an almost improbable error case but when page allocating loop in
+nfs4_get_device_info() fails then we should only free the already
+allocated pages, as __free_page() can't deal with NULL arguments.
+
+Found by Linux Verification Center (linuxtesting.org).
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/pnfs_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfs/pnfs_dev.c
++++ b/fs/nfs/pnfs_dev.c
+@@ -152,7 +152,7 @@ nfs4_get_device_info(struct nfs_server *
+ set_bit(NFS_DEVICEID_NOCACHE, &d->flags);
+
+ out_free_pages:
+- for (i = 0; i < max_pages; i++)
++ while (--i >= 0)
+ __free_page(pages[i]);
+ kfree(pages);
+ out_free_pdev:
--- /dev/null
+From 4db89524b084f712a887256391fc19d9f66c8e55 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sun, 27 Aug 2023 13:46:11 +0200
+Subject: parisc: led: Fix LAN receive and transmit LEDs
+
+From: Helge Deller <deller@gmx.de>
+
+commit 4db89524b084f712a887256391fc19d9f66c8e55 upstream.
+
+Fix the LAN receive and LAN transmit LEDs, which where swapped
+up to now.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/parisc/include/asm/led.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/parisc/include/asm/led.h
++++ b/arch/parisc/include/asm/led.h
+@@ -11,8 +11,8 @@
+ #define LED1 0x02
+ #define LED0 0x01 /* bottom (or furthest left) LED */
+
+-#define LED_LAN_TX LED0 /* for LAN transmit activity */
+-#define LED_LAN_RCV LED1 /* for LAN receive activity */
++#define LED_LAN_RCV LED0 /* for LAN receive activity */
++#define LED_LAN_TX LED1 /* for LAN transmit activity */
+ #define LED_DISK_IO LED2 /* for disk activity */
+ #define LED_HEARTBEAT LED3 /* heartbeat */
+
--- /dev/null
+From 358ad816e52d4253b38c2f312e6b1cbd89e0dbf7 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Fri, 25 Aug 2023 17:46:39 +0200
+Subject: parisc: led: Reduce CPU overhead for disk & lan LED computation
+
+From: Helge Deller <deller@gmx.de>
+
+commit 358ad816e52d4253b38c2f312e6b1cbd89e0dbf7 upstream.
+
+Older PA-RISC machines have LEDs which show the disk- and LAN-activity.
+The computation is done in software and takes quite some time, e.g. on a
+J6500 this may take up to 60% time of one CPU if the machine is loaded
+via network traffic.
+
+Since most people don't care about the LEDs, start with LEDs disabled and
+just show a CPU heartbeat LED. The disk and LAN LEDs can be turned on
+manually via /proc/pdc/led.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/parisc/led.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/parisc/led.c
++++ b/drivers/parisc/led.c
+@@ -56,8 +56,8 @@
+ static int led_type __read_mostly = -1;
+ static unsigned char lastleds; /* LED state from most recent update */
+ static unsigned int led_heartbeat __read_mostly = 1;
+-static unsigned int led_diskio __read_mostly = 1;
+-static unsigned int led_lanrxtx __read_mostly = 1;
++static unsigned int led_diskio __read_mostly;
++static unsigned int led_lanrxtx __read_mostly;
+ static char lcd_text[32] __read_mostly;
+ static char lcd_text_default[32] __read_mostly;
+ static int lcd_no_led_support __read_mostly = 0; /* KittyHawk doesn't support LED on its LCD */
--- /dev/null
+From d5301c90716a8e20bc961a348182daca00c8e8f0 Mon Sep 17 00:00:00 2001
+From: Raag Jadav <raag.jadav@intel.com>
+Date: Tue, 22 Aug 2023 12:53:40 +0530
+Subject: pinctrl: cherryview: fix address_space_handler() argument
+
+From: Raag Jadav <raag.jadav@intel.com>
+
+commit d5301c90716a8e20bc961a348182daca00c8e8f0 upstream.
+
+First argument of acpi_*_address_space_handler() APIs is acpi_handle of
+the device, which is incorrectly passed in driver ->remove() path here.
+Fix it by passing the appropriate argument and while at it, make both
+API calls consistent using ACPI_HANDLE().
+
+Fixes: a0b028597d59 ("pinctrl: cherryview: Add support for GMMR GPIO opregion")
+Cc: stable@vger.kernel.org
+Signed-off-by: Raag Jadav <raag.jadav@intel.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/intel/pinctrl-cherryview.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -1625,7 +1625,6 @@ static int chv_pinctrl_probe(struct plat
+ const struct intel_pinctrl_soc_data *soc_data;
+ struct intel_community *community;
+ struct device *dev = &pdev->dev;
+- struct acpi_device *adev = ACPI_COMPANION(dev);
+ struct intel_pinctrl *pctrl;
+ acpi_status status;
+ int ret, irq;
+@@ -1688,7 +1687,7 @@ static int chv_pinctrl_probe(struct plat
+ if (ret)
+ return ret;
+
+- status = acpi_install_address_space_handler(adev->handle,
++ status = acpi_install_address_space_handler(ACPI_HANDLE(dev),
+ community->acpi_space_id,
+ chv_pinctrl_mmio_access_handler,
+ NULL, pctrl);
+@@ -1705,7 +1704,7 @@ static int chv_pinctrl_remove(struct pla
+ struct intel_pinctrl *pctrl = platform_get_drvdata(pdev);
+ const struct intel_community *community = &pctrl->communities[0];
+
+- acpi_remove_address_space_handler(ACPI_COMPANION(&pdev->dev),
++ acpi_remove_address_space_handler(ACPI_HANDLE(&pdev->dev),
+ community->acpi_space_id,
+ chv_pinctrl_mmio_access_handler);
+
scsi-qla2xxx-fix-erroneous-link-up-failure.patch
scsi-qla2xxx-turn-off-noisy-message-log.patch
scsi-qla2xxx-remove-unsupported-ql2xenabledif-option.patch
+fbdev-ep93xx-fb-do-not-assign-to-struct-fb_info.dev.patch
+drm-ast-fix-dram-init-on-ast2200.patch
+lib-test_meminit-allocate-pages-up-to-order-max_order.patch
+parisc-led-fix-lan-receive-and-transmit-leds.patch
+parisc-led-reduce-cpu-overhead-for-disk-lan-led-computation.patch
+pinctrl-cherryview-fix-address_space_handler-argument.patch
+dt-bindings-clock-xlnx-versal-clk-drop-select-false.patch
+clk-imx-pll14xx-dynamically-configure-pll-for-393216000-361267200hz.patch
+clk-qcom-gcc-mdm9615-use-proper-parent-for-pll0_vote-clock.patch
+soc-qcom-qmi_encdec-restrict-string-length-in-decode.patch
+nfs-fix-a-potential-data-corruption.patch
+nfsv4-pnfs-minor-fix-for-cleanup-path-in-nfs4_get_device_info.patch
--- /dev/null
+From 8d207400fd6b79c92aeb2f33bb79f62dff904ea2 Mon Sep 17 00:00:00 2001
+From: Chris Lew <quic_clew@quicinc.com>
+Date: Tue, 1 Aug 2023 12:17:12 +0530
+Subject: soc: qcom: qmi_encdec: Restrict string length in decode
+
+From: Chris Lew <quic_clew@quicinc.com>
+
+commit 8d207400fd6b79c92aeb2f33bb79f62dff904ea2 upstream.
+
+The QMI TLV value for strings in a lot of qmi element info structures
+account for null terminated strings with MAX_LEN + 1. If a string is
+actually MAX_LEN + 1 length, this will cause an out of bounds access
+when the NULL character is appended in decoding.
+
+Fixes: 9b8a11e82615 ("soc: qcom: Introduce QMI encoder/decoder")
+Cc: stable@vger.kernel.org
+Signed-off-by: Chris Lew <quic_clew@quicinc.com>
+Signed-off-by: Praveenkumar I <quic_ipkumar@quicinc.com>
+Link: https://lore.kernel.org/r/20230801064712.3590128-1-quic_ipkumar@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/qcom/qmi_encdec.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/soc/qcom/qmi_encdec.c
++++ b/drivers/soc/qcom/qmi_encdec.c
+@@ -534,8 +534,8 @@ static int qmi_decode_string_elem(struct
+ decoded_bytes += rc;
+ }
+
+- if (string_len > temp_ei->elem_len) {
+- pr_err("%s: String len %d > Max Len %d\n",
++ if (string_len >= temp_ei->elem_len) {
++ pr_err("%s: String len %d >= Max Len %d\n",
+ __func__, string_len, temp_ei->elem_len);
+ return -ETOOSMALL;
+ } else if (string_len > tlv_len) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
