]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 5.10
authorSasha Levin <sashal@kernel.org>
Sun, 9 Oct 2022 02:12:23 +0000 (22:12 -0400)
committerSasha Levin <sashal@kernel.org>
Sun, 9 Oct 2022 02:12:23 +0000 (22:12 -0400)
Signed-off-by: Sasha Levin <sashal@kernel.org>
17 files changed:
queue-5.10/alsa-hda-hdmi-fix-the-converter-reuse-for-the-silent.patch [new file with mode: 0644]
queue-5.10/arch-um-mark-the-stack-non-executable-to-fix-a-binut.patch [new file with mode: 0644]
queue-5.10/arm-dts-fix-moxa-sdio-compatible-remove-sdhci-misnom.patch [new file with mode: 0644]
queue-5.10/dmaengine-xilinx_dma-cleanup-for-fetching-xlnx-num-f.patch [new file with mode: 0644]
queue-5.10/dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch [new file with mode: 0644]
queue-5.10/dmaengine-xilinx_dma-report-error-in-case-of-dma_set.patch [new file with mode: 0644]
queue-5.10/drm-amd-display-skip-audio-setup-when-audio-stream-i.patch [new file with mode: 0644]
queue-5.10/drm-amd-display-update-gamut-remap-if-plane-has-chan.patch [new file with mode: 0644]
queue-5.10/firmware-arm_scmi-add-scmi-pm-driver-remove-routine.patch [new file with mode: 0644]
queue-5.10/mmc-core-replace-with-already-defined-values-for-rea.patch [new file with mode: 0644]
queue-5.10/mmc-core-terminate-infinite-loop-in-sd-uhs-voltage-s.patch [new file with mode: 0644]
queue-5.10/net-atlantic-fix-potential-memory-leak-in-aq_ndev_cl.patch [new file with mode: 0644]
queue-5.10/net-ieee802154-fix-uninit-value-bug-in-dgram_sendmsg.patch [new file with mode: 0644]
queue-5.10/scsi-qedf-fix-a-uaf-bug-in-__qedf_probe.patch [new file with mode: 0644]
queue-5.10/series
queue-5.10/um-cleanup-compiler-warning-in-arch-x86-um-tls_32.c.patch [new file with mode: 0644]
queue-5.10/um-cleanup-syscall_handler_t-cast-in-syscalls_32.h.patch [new file with mode: 0644]

diff --git a/queue-5.10/alsa-hda-hdmi-fix-the-converter-reuse-for-the-silent.patch b/queue-5.10/alsa-hda-hdmi-fix-the-converter-reuse-for-the-silent.patch
new file mode 100644 (file)
index 0000000..6df9aae
--- /dev/null
@@ -0,0 +1,42 @@
+From bd089833b832a6329c5a77e7efefb526749b5279 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Sep 2022 09:02:16 +0200
+Subject: ALSA: hda/hdmi: Fix the converter reuse for the silent stream
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+[ Upstream commit 5f80d6bd2b01de4cafac3302f58456bf860322fc ]
+
+When the user space pcm stream uses the silent stream converter,
+it is no longer allocated for the silent stream. Clear the appropriate
+flag in the hdmi_pcm_open() function. The silent stream setup may
+be applied in hdmi_pcm_close() (and the error path - open fcn) again.
+
+If the flag is not cleared, the reuse conditions for the silent
+stream converter in hdmi_choose_cvt() may improperly share
+this converter.
+
+Cc: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Link: https://lore.kernel.org/r/20220913070216.3233974-1-perex@perex.cz
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index e6f261e8c5ae..c3fcf478037f 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1269,6 +1269,7 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo,
+       set_bit(pcm_idx, &spec->pcm_in_use);
+       per_pin = get_pin(spec, pin_idx);
+       per_pin->cvt_nid = per_cvt->cvt_nid;
++      per_pin->silent_stream = false;
+       hinfo->nid = per_cvt->cvt_nid;
+       /* flip stripe flag for the assigned stream if supported */
+-- 
+2.35.1
+
diff --git a/queue-5.10/arch-um-mark-the-stack-non-executable-to-fix-a-binut.patch b/queue-5.10/arch-um-mark-the-stack-non-executable-to-fix-a-binut.patch
new file mode 100644 (file)
index 0000000..cac8716
--- /dev/null
@@ -0,0 +1,85 @@
+From 1450a533f39ca7a2e6c27874f47deefb4d6db39d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Sep 2022 14:48:55 +0800
+Subject: arch: um: Mark the stack non-executable to fix a binutils warning
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit bd71558d585ac61cfd799db7f25e78dca404dd7a ]
+
+Since binutils 2.39, ld will print a warning if any stack section is
+executable, which is the default for stack sections on files without a
+.note.GNU-stack section.
+
+This was fixed for x86 in commit ffcf9c5700e4 ("x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments"),
+but remained broken for UML, resulting in several warnings:
+
+/usr/bin/ld: warning: arch/x86/um/vdso/vdso.o: missing .note.GNU-stack section implies executable stack
+/usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
+/usr/bin/ld: warning: .tmp_vmlinux.kallsyms1 has a LOAD segment with RWX permissions
+/usr/bin/ld: warning: .tmp_vmlinux.kallsyms1.o: missing .note.GNU-stack section implies executable stack
+/usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
+/usr/bin/ld: warning: .tmp_vmlinux.kallsyms2 has a LOAD segment with RWX permissions
+/usr/bin/ld: warning: .tmp_vmlinux.kallsyms2.o: missing .note.GNU-stack section implies executable stack
+/usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
+/usr/bin/ld: warning: vmlinux has a LOAD segment with RWX permissions
+
+Link both the VDSO and vmlinux with -z noexecstack, fixing the warnings
+about .note.GNU-stack sections. In addition, pass --no-warn-rwx-segments
+to dodge the remaining warnings about LOAD segments with RWX permissions
+in the kallsyms objects. (Note that this flag is apparently not
+available on lld, so hide it behind a test for BFD, which is what the
+x86 patch does.)
+
+Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ffcf9c5700e49c0aee42dcba9a12ba21338e8136
+Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107
+Signed-off-by: David Gow <davidgow@google.com>
+Reviewed-by: Lukas Straub <lukasstraub2@web.de>
+Tested-by: Lukas Straub <lukasstraub2@web.de>
+Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/Makefile          | 8 ++++++++
+ arch/x86/um/vdso/Makefile | 2 +-
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/arch/um/Makefile b/arch/um/Makefile
+index 1cea46ff9bb7..775615141339 100644
+--- a/arch/um/Makefile
++++ b/arch/um/Makefile
+@@ -131,10 +131,18 @@ export LDS_ELF_FORMAT := $(ELF_FORMAT)
+ # The wrappers will select whether using "malloc" or the kernel allocator.
+ LINK_WRAPS = -Wl,--wrap,malloc -Wl,--wrap,free -Wl,--wrap,calloc
++# Avoid binutils 2.39+ warnings by marking the stack non-executable and
++# ignorning warnings for the kallsyms sections.
++LDFLAGS_EXECSTACK = -z noexecstack
++ifeq ($(CONFIG_LD_IS_BFD),y)
++LDFLAGS_EXECSTACK += $(call ld-option,--no-warn-rwx-segments)
++endif
++
+ LD_FLAGS_CMDLINE = $(foreach opt,$(KBUILD_LDFLAGS),-Wl,$(opt))
+ # Used by link-vmlinux.sh which has special support for um link
+ export CFLAGS_vmlinux := $(LINK-y) $(LINK_WRAPS) $(LD_FLAGS_CMDLINE)
++export LDFLAGS_vmlinux := $(LDFLAGS_EXECSTACK)
+ # When cleaning we don't include .config, so we don't include
+ # TT or skas makefiles and don't clean skas_ptregs.h.
+diff --git a/arch/x86/um/vdso/Makefile b/arch/x86/um/vdso/Makefile
+index 5943387e3f35..5ca366e15c76 100644
+--- a/arch/x86/um/vdso/Makefile
++++ b/arch/x86/um/vdso/Makefile
+@@ -62,7 +62,7 @@ quiet_cmd_vdso = VDSO    $@
+                      -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
+                sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
+-VDSO_LDFLAGS = -fPIC -shared -Wl,--hash-style=sysv
++VDSO_LDFLAGS = -fPIC -shared -Wl,--hash-style=sysv -z noexecstack
+ GCOV_PROFILE := n
+ #
+-- 
+2.35.1
+
diff --git a/queue-5.10/arm-dts-fix-moxa-sdio-compatible-remove-sdhci-misnom.patch b/queue-5.10/arm-dts-fix-moxa-sdio-compatible-remove-sdhci-misnom.patch
new file mode 100644 (file)
index 0000000..3f243c4
--- /dev/null
@@ -0,0 +1,77 @@
+From a723c86c4e725dd6f9d93b1d9bd809af29a52077 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Sep 2022 20:53:41 +0300
+Subject: ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer
+
+From: Sergei Antonov <saproj@gmail.com>
+
+[ Upstream commit 02181e68275d28cab3c3f755852770367f1bc229 ]
+
+Driver moxart-mmc.c has .compatible = "moxa,moxart-mmc".
+
+But moxart .dts/.dtsi and the documentation file moxa,moxart-dma.txt
+contain compatible = "moxa,moxart-sdhci".
+
+Change moxart .dts/.dtsi files and moxa,moxart-dma.txt to match the driver.
+
+Replace 'sdhci' with 'mmc' in names too, since SDHCI is a different
+controller from FTSDC010.
+
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sergei Antonov <saproj@gmail.com>
+Cc: Jonas Jensen <jonas.jensen@gmail.com>
+Link: https://lore.kernel.org/r/20220907175341.1477383-1-saproj@gmail.com'
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt | 4 ++--
+ arch/arm/boot/dts/moxart-uc7112lx.dts                     | 2 +-
+ arch/arm/boot/dts/moxart.dtsi                             | 4 ++--
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt b/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt
+index 8a9f3559335b..7e14e26676ec 100644
+--- a/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt
++++ b/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt
+@@ -34,8 +34,8 @@ Example:
+ Use specific request line passing from dma
+ For example, MMC request line is 5
+-      sdhci: sdhci@98e00000 {
+-              compatible = "moxa,moxart-sdhci";
++      mmc: mmc@98e00000 {
++              compatible = "moxa,moxart-mmc";
+               reg = <0x98e00000 0x5C>;
+               interrupts = <5 0>;
+               clocks = <&clk_apb>;
+diff --git a/arch/arm/boot/dts/moxart-uc7112lx.dts b/arch/arm/boot/dts/moxart-uc7112lx.dts
+index eb5291b0ee3a..e07b807b4cec 100644
+--- a/arch/arm/boot/dts/moxart-uc7112lx.dts
++++ b/arch/arm/boot/dts/moxart-uc7112lx.dts
+@@ -79,7 +79,7 @@ &clk_pll {
+       clocks = <&ref12>;
+ };
+-&sdhci {
++&mmc {
+       status = "okay";
+ };
+diff --git a/arch/arm/boot/dts/moxart.dtsi b/arch/arm/boot/dts/moxart.dtsi
+index f5f070a87482..764832ddfa78 100644
+--- a/arch/arm/boot/dts/moxart.dtsi
++++ b/arch/arm/boot/dts/moxart.dtsi
+@@ -93,8 +93,8 @@ watchdog: watchdog@98500000 {
+                       clock-names = "PCLK";
+               };
+-              sdhci: sdhci@98e00000 {
+-                      compatible = "moxa,moxart-sdhci";
++              mmc: mmc@98e00000 {
++                      compatible = "moxa,moxart-mmc";
+                       reg = <0x98e00000 0x5C>;
+                       interrupts = <5 IRQ_TYPE_LEVEL_HIGH>;
+                       clocks = <&clk_apb>;
+-- 
+2.35.1
+
diff --git a/queue-5.10/dmaengine-xilinx_dma-cleanup-for-fetching-xlnx-num-f.patch b/queue-5.10/dmaengine-xilinx_dma-cleanup-for-fetching-xlnx-num-f.patch
new file mode 100644 (file)
index 0000000..5eac676
--- /dev/null
@@ -0,0 +1,35 @@
+From c694a4ee7dcd5f4b65ab2a09bd0e806a13516cec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Aug 2022 11:41:24 +0530
+Subject: dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property
+
+From: Swati Agarwal <swati.agarwal@xilinx.com>
+
+[ Upstream commit 462bce790e6a7e68620a4ce260cc38f7ed0255d5 ]
+
+Free the allocated resources for missing xlnx,num-fstores property.
+
+Signed-off-by: Swati Agarwal <swati.agarwal@xilinx.com>
+Link: https://lore.kernel.org/r/20220817061125.4720-3-swati.agarwal@xilinx.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/xilinx/xilinx_dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index 36801126312e..b91378fb891c 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -3051,7 +3051,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+               if (err < 0) {
+                       dev_err(xdev->dev,
+                               "missing xlnx,num-fstores property\n");
+-                      return err;
++                      goto disable_clks;
+               }
+               err = of_property_read_u32(node, "xlnx,flush-fsync",
+-- 
+2.35.1
+
diff --git a/queue-5.10/dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch b/queue-5.10/dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch
new file mode 100644 (file)
index 0000000..5ef929b
--- /dev/null
@@ -0,0 +1,67 @@
+From 41a6dd1fa24d5a4f5dbcb0c75a69ac4b45273d15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Aug 2022 11:41:23 +0530
+Subject: dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error
+ handling
+
+From: Swati Agarwal <swati.agarwal@xilinx.com>
+
+[ Upstream commit 91df7751eb890e970afc08f50b8f0fa5ea39e03d ]
+
+Add missing cleanup in devm_platform_ioremap_resource().
+When probe fails remove dma channel resources and disable clocks in
+accordance with the order of resources allocated .
+
+Signed-off-by: Swati Agarwal <swati.agarwal@xilinx.com>
+Link: https://lore.kernel.org/r/20220817061125.4720-2-swati.agarwal@xilinx.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/xilinx/xilinx_dma.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index cab4719e4cf9..36801126312e 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -3020,9 +3020,10 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+       /* Request and map I/O memory */
+       xdev->regs = devm_platform_ioremap_resource(pdev, 0);
+-      if (IS_ERR(xdev->regs))
+-              return PTR_ERR(xdev->regs);
+-
++      if (IS_ERR(xdev->regs)) {
++              err = PTR_ERR(xdev->regs);
++              goto disable_clks;
++      }
+       /* Retrieve the DMA engine properties from the device tree */
+       xdev->max_buffer_len = GENMASK(XILINX_DMA_MAX_TRANS_LEN_MAX - 1, 0);
+       xdev->s2mm_chan_id = xdev->dma_config->max_channels / 2;
+@@ -3115,7 +3116,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+       for_each_child_of_node(node, child) {
+               err = xilinx_dma_child_probe(xdev, child);
+               if (err < 0)
+-                      goto disable_clks;
++                      goto error;
+       }
+       if (xdev->dma_config->dmatype == XDMA_TYPE_VDMA) {
+@@ -3150,12 +3151,12 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+       return 0;
+-disable_clks:
+-      xdma_disable_allclks(xdev);
+ error:
+       for (i = 0; i < xdev->dma_config->max_channels; i++)
+               if (xdev->chan[i])
+                       xilinx_dma_chan_remove(xdev->chan[i]);
++disable_clks:
++      xdma_disable_allclks(xdev);
+       return err;
+ }
+-- 
+2.35.1
+
diff --git a/queue-5.10/dmaengine-xilinx_dma-report-error-in-case-of-dma_set.patch b/queue-5.10/dmaengine-xilinx_dma-report-error-in-case-of-dma_set.patch
new file mode 100644 (file)
index 0000000..2bf15cb
--- /dev/null
@@ -0,0 +1,47 @@
+From 19115799350e05271f76d16ba29827984f4e4068 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Aug 2022 11:41:25 +0530
+Subject: dmaengine: xilinx_dma: Report error in case of
+ dma_set_mask_and_coherent API failure
+
+From: Swati Agarwal <swati.agarwal@xilinx.com>
+
+[ Upstream commit 8f2b6bc79c32f0fa60df000ae387a790ec80eae9 ]
+
+The driver does not handle the failure case while calling
+dma_set_mask_and_coherent API.
+
+In case of failure, capture the return value of API and then report an
+error.
+
+Addresses-coverity: Unchecked return value (CHECKED_RETURN)
+
+Signed-off-by: Swati Agarwal <swati.agarwal@xilinx.com>
+Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
+Link: https://lore.kernel.org/r/20220817061125.4720-4-swati.agarwal@xilinx.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/xilinx/xilinx_dma.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index b91378fb891c..e76adc31ab66 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -3071,7 +3071,11 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+               xdev->ext_addr = false;
+       /* Set the dma mask bits */
+-      dma_set_mask_and_coherent(xdev->dev, DMA_BIT_MASK(addr_width));
++      err = dma_set_mask_and_coherent(xdev->dev, DMA_BIT_MASK(addr_width));
++      if (err < 0) {
++              dev_err(xdev->dev, "DMA mask error %d\n", err);
++              goto disable_clks;
++      }
+       /* Initialize the DMA engine */
+       xdev->common.dev = &pdev->dev;
+-- 
+2.35.1
+
diff --git a/queue-5.10/drm-amd-display-skip-audio-setup-when-audio-stream-i.patch b/queue-5.10/drm-amd-display-skip-audio-setup-when-audio-stream-i.patch
new file mode 100644 (file)
index 0000000..a3657b3
--- /dev/null
@@ -0,0 +1,54 @@
+From e67f3cdeaf9d9c61ec3f38c686771c7e316233c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Aug 2022 19:44:50 +0800
+Subject: drm/amd/display: skip audio setup when audio stream is enabled
+
+From: zhikzhai <zhikai.zhai@amd.com>
+
+[ Upstream commit 65fbfb02c2734cacffec5e3f492e1b4f1dabcf98 ]
+
+[why]
+We have minimal pipe split transition method to avoid pipe
+allocation outage.However, this method will invoke audio setup
+which cause audio output stuck once pipe reallocate.
+
+[how]
+skip audio setup for pipelines which audio stream has been enabled
+
+Reviewed-by: Charlene Liu <Charlene.Liu@amd.com>
+Acked-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: zhikzhai <zhikai.zhai@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+index 3ac6c7b65a45..e33fe0207b9e 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+@@ -2047,7 +2047,8 @@ static void dce110_setup_audio_dto(
+                       continue;
+               if (pipe_ctx->stream->signal != SIGNAL_TYPE_HDMI_TYPE_A)
+                       continue;
+-              if (pipe_ctx->stream_res.audio != NULL) {
++              if (pipe_ctx->stream_res.audio != NULL &&
++                      pipe_ctx->stream_res.audio->enabled == false) {
+                       struct audio_output audio_output;
+                       build_audio_output(context, pipe_ctx, &audio_output);
+@@ -2075,7 +2076,8 @@ static void dce110_setup_audio_dto(
+                       if (!dc_is_dp_signal(pipe_ctx->stream->signal))
+                               continue;
+-                      if (pipe_ctx->stream_res.audio != NULL) {
++                      if (pipe_ctx->stream_res.audio != NULL &&
++                              pipe_ctx->stream_res.audio->enabled == false) {
+                               struct audio_output audio_output;
+                               build_audio_output(context, pipe_ctx, &audio_output);
+-- 
+2.35.1
+
diff --git a/queue-5.10/drm-amd-display-update-gamut-remap-if-plane-has-chan.patch b/queue-5.10/drm-amd-display-update-gamut-remap-if-plane-has-chan.patch
new file mode 100644 (file)
index 0000000..1e799bd
--- /dev/null
@@ -0,0 +1,43 @@
+From 336c1ca22dd2c5b9779c1fdcf6110d9f655a2596 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Sep 2022 10:08:35 +0800
+Subject: drm/amd/display: update gamut remap if plane has changed
+
+From: Hugo Hu <hugo.hu@amd.com>
+
+[ Upstream commit 52bb21499cf54fa65b56d97cd0d68579c90207dd ]
+
+[Why]
+The desktop plane and full-screen game plane may have different
+gamut remap coefficients, if switching between desktop and
+full-screen game without updating the gamut remap will cause
+incorrect color.
+
+[How]
+Update gamut remap if planes change.
+
+Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Acked-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Hugo Hu <hugo.hu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+index 3d778760a3b5..8f66eef0c683 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+@@ -1481,6 +1481,7 @@ static void dcn20_update_dchubp_dpp(
+       /* Any updates are handled in dc interface, just need
+        * to apply existing for plane enable / opp change */
+       if (pipe_ctx->update_flags.bits.enable || pipe_ctx->update_flags.bits.opp_changed
++                      || pipe_ctx->update_flags.bits.plane_changed
+                       || pipe_ctx->stream->update_flags.bits.gamut_remap
+                       || pipe_ctx->stream->update_flags.bits.out_csc) {
+ #if defined(CONFIG_DRM_AMD_DC_DCN3_0)
+-- 
+2.35.1
+
diff --git a/queue-5.10/firmware-arm_scmi-add-scmi-pm-driver-remove-routine.patch b/queue-5.10/firmware-arm_scmi-add-scmi-pm-driver-remove-routine.patch
new file mode 100644 (file)
index 0000000..cf00f27
--- /dev/null
@@ -0,0 +1,81 @@
+From 4d8be2c61505f909c27a38fde7474690c42a3ff9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Aug 2022 18:27:31 +0100
+Subject: firmware: arm_scmi: Add SCMI PM driver remove routine
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit dea796fcab0a219830831c070b8dc367d7e0f708 ]
+
+Currently, when removing the SCMI PM driver not all the resources
+registered with genpd subsystem are properly de-registered.
+
+As a side effect of this after a driver unload/load cycle you get a
+splat with a few warnings like this:
+
+ | debugfs: Directory 'BIG_CPU0' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'BIG_CPU1' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'LITTLE_CPU0' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'LITTLE_CPU1' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'LITTLE_CPU2' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'LITTLE_CPU3' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'BIG_SSTOP' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'LITTLE_SSTOP' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'DBGSYS' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'GPUTOP' with parent 'pm_genpd' already present!
+
+Add a proper scmi_pm_domain_remove callback to the driver in order to
+take care of all the needed cleanups not handled by devres framework.
+
+Link: https://lore.kernel.org/r/20220817172731.1185305-7-cristian.marussi@arm.com
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/scmi_pm_domain.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c
+index a4e4aa9a3542..af74e521f89f 100644
+--- a/drivers/firmware/arm_scmi/scmi_pm_domain.c
++++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c
+@@ -106,9 +106,28 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev)
+       scmi_pd_data->domains = domains;
+       scmi_pd_data->num_domains = num_domains;
++      dev_set_drvdata(dev, scmi_pd_data);
++
+       return of_genpd_add_provider_onecell(np, scmi_pd_data);
+ }
++static void scmi_pm_domain_remove(struct scmi_device *sdev)
++{
++      int i;
++      struct genpd_onecell_data *scmi_pd_data;
++      struct device *dev = &sdev->dev;
++      struct device_node *np = dev->of_node;
++
++      of_genpd_del_provider(np);
++
++      scmi_pd_data = dev_get_drvdata(dev);
++      for (i = 0; i < scmi_pd_data->num_domains; i++) {
++              if (!scmi_pd_data->domains[i])
++                      continue;
++              pm_genpd_remove(scmi_pd_data->domains[i]);
++      }
++}
++
+ static const struct scmi_device_id scmi_id_table[] = {
+       { SCMI_PROTOCOL_POWER, "genpd" },
+       { },
+@@ -118,6 +137,7 @@ MODULE_DEVICE_TABLE(scmi, scmi_id_table);
+ static struct scmi_driver scmi_power_domain_driver = {
+       .name = "scmi-power-domain",
+       .probe = scmi_pm_domain_probe,
++      .remove = scmi_pm_domain_remove,
+       .id_table = scmi_id_table,
+ };
+ module_scmi_driver(scmi_power_domain_driver);
+-- 
+2.35.1
+
diff --git a/queue-5.10/mmc-core-replace-with-already-defined-values-for-rea.patch b/queue-5.10/mmc-core-replace-with-already-defined-values-for-rea.patch
new file mode 100644 (file)
index 0000000..f2cdf6c
--- /dev/null
@@ -0,0 +1,38 @@
+From 2c3f88ac732cf5350d7302faa741b9d7832131c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jul 2022 09:48:40 +0900
+Subject: mmc: core: Replace with already defined values for readability
+
+From: ChanWoo Lee <cw9316.lee@samsung.com>
+
+[ Upstream commit e427266460826bea21b70f9b2bb29decfb2c2620 ]
+
+SD_ROCR_S18A is already defined and is used to check the rocr value, so
+let's replace with already defined values for readability.
+
+Signed-off-by: ChanWoo Lee <cw9316.lee@samsung.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20220706004840.24812-1-cw9316.lee@samsung.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Stable-dep-of: e9233917a7e5 ("mmc: core: Terminate infinite loop in SD-UHS voltage switch")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/sd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
+index 899768ed1688..e2c34aa390f1 100644
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -853,7 +853,7 @@ int mmc_sd_get_cid(struct mmc_host *host, u32 ocr, u32 *cid, u32 *rocr)
+        * the CCS bit is set as well. We deliberately deviate from the spec in
+        * regards to this, which allows UHS-I to be supported for SDSC cards.
+        */
+-      if (!mmc_host_is_spi(host) && rocr && (*rocr & 0x01000000)) {
++      if (!mmc_host_is_spi(host) && rocr && (*rocr & SD_ROCR_S18A)) {
+               err = mmc_set_uhs_voltage(host, pocr);
+               if (err == -EAGAIN) {
+                       retries--;
+-- 
+2.35.1
+
diff --git a/queue-5.10/mmc-core-terminate-infinite-loop-in-sd-uhs-voltage-s.patch b/queue-5.10/mmc-core-terminate-infinite-loop-in-sd-uhs-voltage-s.patch
new file mode 100644 (file)
index 0000000..cc00569
--- /dev/null
@@ -0,0 +1,68 @@
+From 73216cdc1cf8dad439cfe91e6b9487f3484c9153 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Sep 2022 18:40:10 -0700
+Subject: mmc: core: Terminate infinite loop in SD-UHS voltage switch
+
+From: Brian Norris <briannorris@chromium.org>
+
+[ Upstream commit e9233917a7e53980664efbc565888163c0a33c3f ]
+
+This loop intends to retry a max of 10 times, with some implicit
+termination based on the SD_{R,}OCR_S18A bit. Unfortunately, the
+termination condition depends on the value reported by the SD card
+(*rocr), which may or may not correctly reflect what we asked it to do.
+
+Needless to say, it's not wise to rely on the card doing what we expect;
+we should at least terminate the loop regardless. So, check both the
+input and output values, so we ensure we will terminate regardless of
+the SD card behavior.
+
+Note that SDIO learned a similar retry loop in commit 0797e5f1453b
+("mmc: core: Fixup signal voltage switch"), but that used the 'ocr'
+result, and so the current pre-terminating condition looks like:
+
+    rocr & ocr & R4_18V_PRESENT
+
+(i.e., it doesn't have the same bug.)
+
+This addresses a number of crash reports seen on ChromeOS that look
+like the following:
+
+    ... // lots of repeated: ...
+    <4>[13142.846061] mmc1: Skipping voltage switch
+    <4>[13143.406087] mmc1: Skipping voltage switch
+    <4>[13143.964724] mmc1: Skipping voltage switch
+    <4>[13144.526089] mmc1: Skipping voltage switch
+    <4>[13145.086088] mmc1: Skipping voltage switch
+    <4>[13145.645941] mmc1: Skipping voltage switch
+    <3>[13146.153969] INFO: task halt:30352 blocked for more than 122 seconds.
+    ...
+
+Fixes: f2119df6b764 ("mmc: sd: add support for signal voltage switch procedure")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20220914014010.2076169-1-briannorris@chromium.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/sd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
+index e2c34aa390f1..868b121ce4f3 100644
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -853,7 +853,8 @@ int mmc_sd_get_cid(struct mmc_host *host, u32 ocr, u32 *cid, u32 *rocr)
+        * the CCS bit is set as well. We deliberately deviate from the spec in
+        * regards to this, which allows UHS-I to be supported for SDSC cards.
+        */
+-      if (!mmc_host_is_spi(host) && rocr && (*rocr & SD_ROCR_S18A)) {
++      if (!mmc_host_is_spi(host) && (ocr & SD_OCR_S18R) &&
++          rocr && (*rocr & SD_ROCR_S18A)) {
+               err = mmc_set_uhs_voltage(host, pocr);
+               if (err == -EAGAIN) {
+                       retries--;
+-- 
+2.35.1
+
diff --git a/queue-5.10/net-atlantic-fix-potential-memory-leak-in-aq_ndev_cl.patch b/queue-5.10/net-atlantic-fix-potential-memory-leak-in-aq_ndev_cl.patch
new file mode 100644 (file)
index 0000000..47eca7e
--- /dev/null
@@ -0,0 +1,42 @@
+From 810157b814766afde451473f1df832c72622ea5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Sep 2022 09:42:38 +0800
+Subject: net: atlantic: fix potential memory leak in aq_ndev_close()
+
+From: Jianglei Nie <niejianglei2021@163.com>
+
+[ Upstream commit 65e5d27df61283e5390f04b09dc79cd832f95607 ]
+
+If aq_nic_stop() fails, aq_ndev_close() returns err without calling
+aq_nic_deinit() to release the relevant memory and resource, which
+will lead to a memory leak.
+
+We can fix it by deleting the if condition judgment and goto statement to
+call aq_nic_deinit() directly after aq_nic_stop() to fix the memory leak.
+
+Signed-off-by: Jianglei Nie <niejianglei2021@163.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_main.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+index 4af0cd9530de..ff245f75fa3d 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+@@ -89,11 +89,8 @@ static int aq_ndev_close(struct net_device *ndev)
+       int err = 0;
+       err = aq_nic_stop(aq_nic);
+-      if (err < 0)
+-              goto err_exit;
+       aq_nic_deinit(aq_nic, true);
+-err_exit:
+       return err;
+ }
+-- 
+2.35.1
+
diff --git a/queue-5.10/net-ieee802154-fix-uninit-value-bug-in-dgram_sendmsg.patch b/queue-5.10/net-ieee802154-fix-uninit-value-bug-in-dgram_sendmsg.patch
new file mode 100644 (file)
index 0000000..870191e
--- /dev/null
@@ -0,0 +1,173 @@
+From 912ac57650fc1c596cadcc80e9f0adb0428fef40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Sep 2022 20:19:27 +0800
+Subject: net/ieee802154: fix uninit value bug in dgram_sendmsg
+
+From: Haimin Zhang <tcs.kernel@gmail.com>
+
+[ Upstream commit 94160108a70c8af17fa1484a37e05181c0e094af ]
+
+There is uninit value bug in dgram_sendmsg function in
+net/ieee802154/socket.c when the length of valid data pointed by the
+msg->msg_name isn't verified.
+
+We introducing a helper function ieee802154_sockaddr_check_size to
+check namelen. First we check there is addr_type in ieee802154_addr_sa.
+Then, we check namelen according to addr_type.
+
+Also fixed in raw_bind, dgram_bind, dgram_connect.
+
+Signed-off-by: Haimin Zhang <tcs_kernel@tencent.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ieee802154_netdev.h | 37 +++++++++++++++++++++++++++++
+ net/ieee802154/socket.c         | 42 ++++++++++++++++++---------------
+ 2 files changed, 60 insertions(+), 19 deletions(-)
+
+diff --git a/include/net/ieee802154_netdev.h b/include/net/ieee802154_netdev.h
+index d0d188c3294b..a8994f307fc3 100644
+--- a/include/net/ieee802154_netdev.h
++++ b/include/net/ieee802154_netdev.h
+@@ -15,6 +15,22 @@
+ #ifndef IEEE802154_NETDEVICE_H
+ #define IEEE802154_NETDEVICE_H
++#define IEEE802154_REQUIRED_SIZE(struct_type, member) \
++      (offsetof(typeof(struct_type), member) + \
++      sizeof(((typeof(struct_type) *)(NULL))->member))
++
++#define IEEE802154_ADDR_OFFSET \
++      offsetof(typeof(struct sockaddr_ieee802154), addr)
++
++#define IEEE802154_MIN_NAMELEN (IEEE802154_ADDR_OFFSET + \
++      IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, addr_type))
++
++#define IEEE802154_NAMELEN_SHORT (IEEE802154_ADDR_OFFSET + \
++      IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, short_addr))
++
++#define IEEE802154_NAMELEN_LONG (IEEE802154_ADDR_OFFSET + \
++      IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, hwaddr))
++
+ #include <net/af_ieee802154.h>
+ #include <linux/netdevice.h>
+ #include <linux/skbuff.h>
+@@ -165,6 +181,27 @@ static inline void ieee802154_devaddr_to_raw(void *raw, __le64 addr)
+       memcpy(raw, &temp, IEEE802154_ADDR_LEN);
+ }
++static inline int
++ieee802154_sockaddr_check_size(struct sockaddr_ieee802154 *daddr, int len)
++{
++      struct ieee802154_addr_sa *sa;
++
++      sa = &daddr->addr;
++      if (len < IEEE802154_MIN_NAMELEN)
++              return -EINVAL;
++      switch (sa->addr_type) {
++      case IEEE802154_ADDR_SHORT:
++              if (len < IEEE802154_NAMELEN_SHORT)
++                      return -EINVAL;
++              break;
++      case IEEE802154_ADDR_LONG:
++              if (len < IEEE802154_NAMELEN_LONG)
++                      return -EINVAL;
++              break;
++      }
++      return 0;
++}
++
+ static inline void ieee802154_addr_from_sa(struct ieee802154_addr *a,
+                                          const struct ieee802154_addr_sa *sa)
+ {
+diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
+index c25f7617770c..7edec210780a 100644
+--- a/net/ieee802154/socket.c
++++ b/net/ieee802154/socket.c
+@@ -201,8 +201,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *_uaddr, int len)
+       int err = 0;
+       struct net_device *dev = NULL;
+-      if (len < sizeof(*uaddr))
+-              return -EINVAL;
++      err = ieee802154_sockaddr_check_size(uaddr, len);
++      if (err < 0)
++              return err;
+       uaddr = (struct sockaddr_ieee802154 *)_uaddr;
+       if (uaddr->family != AF_IEEE802154)
+@@ -494,7 +495,8 @@ static int dgram_bind(struct sock *sk, struct sockaddr *uaddr, int len)
+       ro->bound = 0;
+-      if (len < sizeof(*addr))
++      err = ieee802154_sockaddr_check_size(addr, len);
++      if (err < 0)
+               goto out;
+       if (addr->family != AF_IEEE802154)
+@@ -565,8 +567,9 @@ static int dgram_connect(struct sock *sk, struct sockaddr *uaddr,
+       struct dgram_sock *ro = dgram_sk(sk);
+       int err = 0;
+-      if (len < sizeof(*addr))
+-              return -EINVAL;
++      err = ieee802154_sockaddr_check_size(addr, len);
++      if (err < 0)
++              return err;
+       if (addr->family != AF_IEEE802154)
+               return -EINVAL;
+@@ -605,6 +608,7 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+       struct ieee802154_mac_cb *cb;
+       struct dgram_sock *ro = dgram_sk(sk);
+       struct ieee802154_addr dst_addr;
++      DECLARE_SOCKADDR(struct sockaddr_ieee802154*, daddr, msg->msg_name);
+       int hlen, tlen;
+       int err;
+@@ -613,10 +617,20 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+               return -EOPNOTSUPP;
+       }
+-      if (!ro->connected && !msg->msg_name)
+-              return -EDESTADDRREQ;
+-      else if (ro->connected && msg->msg_name)
+-              return -EISCONN;
++      if (msg->msg_name) {
++              if (ro->connected)
++                      return -EISCONN;
++              if (msg->msg_namelen < IEEE802154_MIN_NAMELEN)
++                      return -EINVAL;
++              err = ieee802154_sockaddr_check_size(daddr, msg->msg_namelen);
++              if (err < 0)
++                      return err;
++              ieee802154_addr_from_sa(&dst_addr, &daddr->addr);
++      } else {
++              if (!ro->connected)
++                      return -EDESTADDRREQ;
++              dst_addr = ro->dst_addr;
++      }
+       if (!ro->bound)
+               dev = dev_getfirstbyhwtype(sock_net(sk), ARPHRD_IEEE802154);
+@@ -652,16 +666,6 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+       cb = mac_cb_init(skb);
+       cb->type = IEEE802154_FC_TYPE_DATA;
+       cb->ackreq = ro->want_ack;
+-
+-      if (msg->msg_name) {
+-              DECLARE_SOCKADDR(struct sockaddr_ieee802154*,
+-                               daddr, msg->msg_name);
+-
+-              ieee802154_addr_from_sa(&dst_addr, &daddr->addr);
+-      } else {
+-              dst_addr = ro->dst_addr;
+-      }
+-
+       cb->secen = ro->secen;
+       cb->secen_override = ro->secen_override;
+       cb->seclevel = ro->seclevel;
+-- 
+2.35.1
+
diff --git a/queue-5.10/scsi-qedf-fix-a-uaf-bug-in-__qedf_probe.patch b/queue-5.10/scsi-qedf-fix-a-uaf-bug-in-__qedf_probe.patch
new file mode 100644 (file)
index 0000000..677dad0
--- /dev/null
@@ -0,0 +1,76 @@
+From 455aaf47e012eac7941b746f2587eedae2618190 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Nov 2021 20:06:41 +0800
+Subject: scsi: qedf: Fix a UAF bug in __qedf_probe()
+
+From: Letu Ren <fantasquex@gmail.com>
+
+[ Upstream commit fbfe96869b782364caebae0445763969ddb6ea67 ]
+
+In __qedf_probe(), if qedf->cdev is NULL which means
+qed_ops->common->probe() failed, then the program will goto label err1, and
+scsi_host_put() will free lport->host pointer. Because the memory qedf
+points to is allocated by libfc_host_alloc(), it will be freed by
+scsi_host_put(). However, the if statement below label err0 only checks
+whether qedf is NULL but doesn't check whether the memory has been freed.
+So a UAF bug can occur.
+
+There are two ways to reach the statements below err0. The first one is
+described as before, "qedf" should be set to NULL. The second one is goto
+"err0" directly. In the latter scenario qedf hasn't been changed and it has
+the initial value NULL. As a result the if statement is not reachable in
+any situation.
+
+The KASAN logs are as follows:
+
+[    2.312969] BUG: KASAN: use-after-free in __qedf_probe+0x5dcf/0x6bc0
+[    2.312969]
+[    2.312969] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
+[    2.312969] Call Trace:
+[    2.312969]  dump_stack_lvl+0x59/0x7b
+[    2.312969]  print_address_description+0x7c/0x3b0
+[    2.312969]  ? __qedf_probe+0x5dcf/0x6bc0
+[    2.312969]  __kasan_report+0x160/0x1c0
+[    2.312969]  ? __qedf_probe+0x5dcf/0x6bc0
+[    2.312969]  kasan_report+0x4b/0x70
+[    2.312969]  ? kobject_put+0x25d/0x290
+[    2.312969]  kasan_check_range+0x2ca/0x310
+[    2.312969]  __qedf_probe+0x5dcf/0x6bc0
+[    2.312969]  ? selinux_kernfs_init_security+0xdc/0x5f0
+[    2.312969]  ? trace_rpm_return_int_rcuidle+0x18/0x120
+[    2.312969]  ? rpm_resume+0xa5c/0x16e0
+[    2.312969]  ? qedf_get_generic_tlv_data+0x160/0x160
+[    2.312969]  local_pci_probe+0x13c/0x1f0
+[    2.312969]  pci_device_probe+0x37e/0x6c0
+
+Link: https://lore.kernel.org/r/20211112120641.16073-1-fantasquex@gmail.com
+Reported-by: Zheyu Ma <zheyuma97@gmail.com>
+Acked-by: Saurav Kashyap <skashyap@marvell.com>
+Co-developed-by: Wende Tan <twd2.me@gmail.com>
+Signed-off-by: Wende Tan <twd2.me@gmail.com>
+Signed-off-by: Letu Ren <fantasquex@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedf/qedf_main.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
+index e64457f53da8..de5b6453827c 100644
+--- a/drivers/scsi/qedf/qedf_main.c
++++ b/drivers/scsi/qedf/qedf_main.c
+@@ -3671,11 +3671,6 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
+ err1:
+       scsi_host_put(lport->host);
+ err0:
+-      if (qedf) {
+-              QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_DISC, "Probe done.\n");
+-
+-              clear_bit(QEDF_PROBING, &qedf->flags);
+-      }
+       return rc;
+ }
+-- 
+2.35.1
+
index 93badcde7aa0b02a4e4bab5817908035c61ea136..4de86573b9e71861a2338310e8ec471ab9101681 100644 (file)
@@ -7,3 +7,19 @@ mm-gup-fix-the-fast-gup-race-against-thp-collapse.patch
 powerpc-64s-radix-don-t-need-to-broadcast-ipi-for-radix-pmd-collapse-flush.patch
 wait_on_bit-add-an-acquire-memory-barrier.patch
 provide-arch_test_bit_acquire-for-architectures-that-define-test_bit.patch
+firmware-arm_scmi-add-scmi-pm-driver-remove-routine.patch
+dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch
+dmaengine-xilinx_dma-cleanup-for-fetching-xlnx-num-f.patch
+dmaengine-xilinx_dma-report-error-in-case-of-dma_set.patch
+arm-dts-fix-moxa-sdio-compatible-remove-sdhci-misnom.patch
+scsi-qedf-fix-a-uaf-bug-in-__qedf_probe.patch
+net-ieee802154-fix-uninit-value-bug-in-dgram_sendmsg.patch
+alsa-hda-hdmi-fix-the-converter-reuse-for-the-silent.patch
+um-cleanup-syscall_handler_t-cast-in-syscalls_32.h.patch
+um-cleanup-compiler-warning-in-arch-x86-um-tls_32.c.patch
+arch-um-mark-the-stack-non-executable-to-fix-a-binut.patch
+net-atlantic-fix-potential-memory-leak-in-aq_ndev_cl.patch
+drm-amd-display-update-gamut-remap-if-plane-has-chan.patch
+drm-amd-display-skip-audio-setup-when-audio-stream-i.patch
+mmc-core-replace-with-already-defined-values-for-rea.patch
+mmc-core-terminate-infinite-loop-in-sd-uhs-voltage-s.patch
diff --git a/queue-5.10/um-cleanup-compiler-warning-in-arch-x86-um-tls_32.c.patch b/queue-5.10/um-cleanup-compiler-warning-in-arch-x86-um-tls_32.c.patch
new file mode 100644 (file)
index 0000000..10d355e
--- /dev/null
@@ -0,0 +1,70 @@
+From 7dd0c6f874996d5dc16b3fbb6bc889345eae998e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Aug 2022 15:29:31 +0000
+Subject: um: Cleanup compiler warning in arch/x86/um/tls_32.c
+
+From: Lukas Straub <lukasstraub2@web.de>
+
+[ Upstream commit d27fff3499671dc23a08efd01cdb8b3764a391c4 ]
+
+arch.tls_array is statically allocated so checking for NULL doesn't
+make sense. This causes the compiler warning below.
+
+Remove the checks to silence these warnings.
+
+../arch/x86/um/tls_32.c: In function 'get_free_idx':
+../arch/x86/um/tls_32.c:68:13: warning: the comparison will always evaluate as 'true' for the address of 'tls_array' will never be NULL [-Waddress]
+   68 |         if (!t->arch.tls_array)
+      |             ^
+In file included from ../arch/x86/um/asm/processor.h:10,
+                 from ../include/linux/rcupdate.h:30,
+                 from ../include/linux/rculist.h:11,
+                 from ../include/linux/pid.h:5,
+                 from ../include/linux/sched.h:14,
+                 from ../arch/x86/um/tls_32.c:7:
+../arch/x86/um/asm/processor_32.h:22:31: note: 'tls_array' declared here
+   22 |         struct uml_tls_struct tls_array[GDT_ENTRY_TLS_ENTRIES];
+      |                               ^~~~~~~~~
+../arch/x86/um/tls_32.c: In function 'get_tls_entry':
+../arch/x86/um/tls_32.c:243:13: warning: the comparison will always evaluate as 'true' for the address of 'tls_array' will never be NULL [-Waddress]
+  243 |         if (!t->arch.tls_array)
+      |             ^
+../arch/x86/um/asm/processor_32.h:22:31: note: 'tls_array' declared here
+   22 |         struct uml_tls_struct tls_array[GDT_ENTRY_TLS_ENTRIES];
+      |                               ^~~~~~~~~
+
+Signed-off-by: Lukas Straub <lukasstraub2@web.de>
+Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/um/tls_32.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/arch/x86/um/tls_32.c b/arch/x86/um/tls_32.c
+index ac8eee093f9c..66162eafd8e8 100644
+--- a/arch/x86/um/tls_32.c
++++ b/arch/x86/um/tls_32.c
+@@ -65,9 +65,6 @@ static int get_free_idx(struct task_struct* task)
+       struct thread_struct *t = &task->thread;
+       int idx;
+-      if (!t->arch.tls_array)
+-              return GDT_ENTRY_TLS_MIN;
+-
+       for (idx = 0; idx < GDT_ENTRY_TLS_ENTRIES; idx++)
+               if (!t->arch.tls_array[idx].present)
+                       return idx + GDT_ENTRY_TLS_MIN;
+@@ -240,9 +237,6 @@ static int get_tls_entry(struct task_struct *task, struct user_desc *info,
+ {
+       struct thread_struct *t = &task->thread;
+-      if (!t->arch.tls_array)
+-              goto clear;
+-
+       if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
+               return -EINVAL;
+-- 
+2.35.1
+
diff --git a/queue-5.10/um-cleanup-syscall_handler_t-cast-in-syscalls_32.h.patch b/queue-5.10/um-cleanup-syscall_handler_t-cast-in-syscalls_32.h.patch
new file mode 100644 (file)
index 0000000..45200df
--- /dev/null
@@ -0,0 +1,41 @@
+From a4aa0317f660c9796ed7aaed1e5ae19b7579b74d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Aug 2022 15:29:27 +0000
+Subject: um: Cleanup syscall_handler_t cast in syscalls_32.h
+
+From: Lukas Straub <lukasstraub2@web.de>
+
+[ Upstream commit 61670b4d270c71219def1fbc9441debc2ac2e6e9 ]
+
+Like in f4f03f299a56ce4d73c5431e0327b3b6cb55ebb9
+"um: Cleanup syscall_handler_t definition/cast, fix warning",
+remove the cast to to fix the compiler warning.
+
+Signed-off-by: Lukas Straub <lukasstraub2@web.de>
+Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/um/shared/sysdep/syscalls_32.h | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/um/shared/sysdep/syscalls_32.h b/arch/x86/um/shared/sysdep/syscalls_32.h
+index 68fd2cf526fd..f6e9f84397e7 100644
+--- a/arch/x86/um/shared/sysdep/syscalls_32.h
++++ b/arch/x86/um/shared/sysdep/syscalls_32.h
+@@ -6,10 +6,9 @@
+ #include <asm/unistd.h>
+ #include <sysdep/ptrace.h>
+-typedef long syscall_handler_t(struct pt_regs);
++typedef long syscall_handler_t(struct syscall_args);
+ extern syscall_handler_t *sys_call_table[];
+ #define EXECUTE_SYSCALL(syscall, regs) \
+-      ((long (*)(struct syscall_args)) \
+-       (*sys_call_table[syscall]))(SYSCALL_ARGS(&regs->regs))
++      ((*sys_call_table[syscall]))(SYSCALL_ARGS(&regs->regs))
+-- 
+2.35.1
+