5.15-stable patches

added patches:
	misc-rtsx-fix-some-platforms-can-not-boot-and-move-the-l1ss-judgment-to-probe.patch
	nilfs2-fix-potential-use-after-free-in-nilfs_gccache_submit_read_data.patch
	revert-tty-n_gsm-fix-uaf-in-gsm_cleanup_mux.patch
	serial-8250_port-check-irq-data-before-use.patch
	x86-srso-add-srso-mitigation-for-hygon-processors.patch

diff --git a/queue-5.15/misc-rtsx-fix-some-platforms-can-not-boot-and-move-the-l1ss-judgment-to-probe.patch b/queue-5.15/misc-rtsx-fix-some-platforms-can-not-boot-and-move-the-l1ss-judgment-to-probe.patch
new file mode 100644 (file)
index 0000000..df3269f
--- /dev/null
+++ b/queue-5.15/misc-rtsx-fix-some-platforms-can-not-boot-and-move-the-l1ss-judgment-to-probe.patch
@@ -0,0 +1,517 @@
+From 0e4cac557531a4c93de108d9ff11329fcad482ff Mon Sep 17 00:00:00 2001
+From: Ricky WU <ricky_wu@realtek.com>
+Date: Wed, 20 Sep 2023 09:11:19 +0000
+Subject: misc: rtsx: Fix some platforms can not boot and move the l1ss judgment to probe
+
+From: Ricky WU <ricky_wu@realtek.com>
+
+commit 0e4cac557531a4c93de108d9ff11329fcad482ff upstream.
+
+commit 101bd907b424 ("misc: rtsx: judge ASPM Mode to set PETXCFG Reg")
+some readers no longer force #CLKREQ to low
+when the system need to enter ASPM.
+But some platform maybe not implement complete ASPM?
+it causes some platforms can not boot
+
+Like in the past only the platform support L1ss we release the #CLKREQ.
+Move the judgment (L1ss) to probe,
+we think read config space one time when the driver start is enough
+
+Fixes: 101bd907b424 ("misc: rtsx: judge ASPM Mode to set PETXCFG Reg")
+Cc: stable <stable@kernel.org>
+Reported-by: Paul Grandperrin <paul.grandperrin@gmail.com>
+Signed-off-by: Ricky Wu <ricky_wu@realtek.com>
+Tested-By: Jade Lovelace <lists@jade.fyi>
+Link: https://lore.kernel.org/r/37b1afb997f14946a8784c73d1f9a4f5@realtek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/cardreader/rts5227.c  |   55 +++--------------------------------
+ drivers/misc/cardreader/rts5228.c  |   57 +++++++++++--------------------------
+ drivers/misc/cardreader/rts5249.c  |   56 ++++--------------------------------
+ drivers/misc/cardreader/rts5260.c  |   43 ++++++++-------------------
+ drivers/misc/cardreader/rts5261.c  |   52 ++++++++-------------------------
+ drivers/misc/cardreader/rtsx_pcr.c |   51 +++++++++++++++++++++++++++++----
+ 6 files changed, 102 insertions(+), 212 deletions(-)
+
+--- a/drivers/misc/cardreader/rts5227.c
++++ b/drivers/misc/cardreader/rts5227.c
+@@ -81,63 +81,20 @@ static void rts5227_fetch_vendor_setting
+ 
+ static void rts5227_init_from_cfg(struct rtsx_pcr *pcr)
+ {
+-      struct pci_dev *pdev = pcr->pci;
+-      int l1ss;
+-      u32 lval;
+       struct rtsx_cr_option *option = &pcr->option;
+ 
+-      l1ss = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_L1SS);
+-      if (!l1ss)
+-              return;
+-
+-      pci_read_config_dword(pdev, l1ss + PCI_L1SS_CTL1, &lval);
+-
+       if (CHK_PCI_PID(pcr, 0x522A)) {
+-              if (0 == (lval & 0x0F))
+-                      rtsx_pci_enable_oobs_polling(pcr);
+-              else
++              if (rtsx_check_dev_flag(pcr, ASPM_L1_1_EN | ASPM_L1_2_EN
++                              | PM_L1_1_EN | PM_L1_2_EN))
+                       rtsx_pci_disable_oobs_polling(pcr);
++              else
++                      rtsx_pci_enable_oobs_polling(pcr);
+       }
+ 
+-      if (lval & PCI_L1SS_CTL1_ASPM_L1_1)
+-              rtsx_set_dev_flag(pcr, ASPM_L1_1_EN);
+-      else
+-              rtsx_clear_dev_flag(pcr, ASPM_L1_1_EN);
+-
+-      if (lval & PCI_L1SS_CTL1_ASPM_L1_2)
+-              rtsx_set_dev_flag(pcr, ASPM_L1_2_EN);
+-      else
+-              rtsx_clear_dev_flag(pcr, ASPM_L1_2_EN);
+-
+-      if (lval & PCI_L1SS_CTL1_PCIPM_L1_1)
+-              rtsx_set_dev_flag(pcr, PM_L1_1_EN);
+-      else
+-              rtsx_clear_dev_flag(pcr, PM_L1_1_EN);
+-
+-      if (lval & PCI_L1SS_CTL1_PCIPM_L1_2)
+-              rtsx_set_dev_flag(pcr, PM_L1_2_EN);
+-      else
+-              rtsx_clear_dev_flag(pcr, PM_L1_2_EN);
+-
+       if (option->ltr_en) {
+-              u16 val;
+-
+-              pcie_capability_read_word(pcr->pci, PCI_EXP_DEVCTL2, &val);
+-              if (val & PCI_EXP_DEVCTL2_LTR_EN) {
+-                      option->ltr_enabled = true;
+-                      option->ltr_active = true;
++              if (option->ltr_enabled)
+                       rtsx_set_ltr_latency(pcr, option->ltr_active_latency);
+-              } else {
+-                      option->ltr_enabled = false;
+-              }
+       }
+-
+-      if (rtsx_check_dev_flag(pcr, ASPM_L1_1_EN | ASPM_L1_2_EN
+-                              | PM_L1_1_EN | PM_L1_2_EN))
+-              option->force_clkreq_0 = false;
+-      else
+-              option->force_clkreq_0 = true;
+-
+ }
+ 
+ static int rts5227_extra_init_hw(struct rtsx_pcr *pcr)
+@@ -171,7 +128,7 @@ static int rts5227_extra_init_hw(struct
+       else
+               rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, PETXCFG, 0x30, 0x00);
+ 
+-      if (option->force_clkreq_0 && pcr->aspm_mode == ASPM_MODE_CFG)
++      if (option->force_clkreq_0)
+               rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, PETXCFG,
+                               FORCE_CLKREQ_DELINK_MASK, FORCE_CLKREQ_LOW);
+       else
+--- a/drivers/misc/cardreader/rts5228.c
++++ b/drivers/misc/cardreader/rts5228.c
+@@ -378,59 +378,25 @@ static void rts5228_process_ocp(struct r
+ 
+ static void rts5228_init_from_cfg(struct rtsx_pcr *pcr)
+ {
+-      struct pci_dev *pdev = pcr->pci;
+-      int l1ss;
+-      u32 lval;
+       struct rtsx_cr_option *option = &pcr->option;
+ 
+-      l1ss = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_L1SS);
+-      if (!l1ss)
+-              return;
+-
+-      pci_read_config_dword(pdev, l1ss + PCI_L1SS_CTL1, &lval);
+-
+-      if (0 == (lval & 0x0F))
+-              rtsx_pci_enable_oobs_polling(pcr);
+-      else
++      if (rtsx_check_dev_flag(pcr, ASPM_L1_1_EN | ASPM_L1_2_EN
++                              | PM_L1_1_EN | PM_L1_2_EN))
+               rtsx_pci_disable_oobs_polling(pcr);
+-
+-      if (lval & PCI_L1SS_CTL1_ASPM_L1_1)
+-              rtsx_set_dev_flag(pcr, ASPM_L1_1_EN);
+-      else
+-              rtsx_clear_dev_flag(pcr, ASPM_L1_1_EN);
+-
+-      if (lval & PCI_L1SS_CTL1_ASPM_L1_2)
+-              rtsx_set_dev_flag(pcr, ASPM_L1_2_EN);
+-      else
+-              rtsx_clear_dev_flag(pcr, ASPM_L1_2_EN);
+-
+-      if (lval & PCI_L1SS_CTL1_PCIPM_L1_1)
+-              rtsx_set_dev_flag(pcr, PM_L1_1_EN);
+       else
+-              rtsx_clear_dev_flag(pcr, PM_L1_1_EN);
+-
+-      if (lval & PCI_L1SS_CTL1_PCIPM_L1_2)
+-              rtsx_set_dev_flag(pcr, PM_L1_2_EN);
+-      else
+-              rtsx_clear_dev_flag(pcr, PM_L1_2_EN);
++              rtsx_pci_enable_oobs_polling(pcr);
+ 
+       rtsx_pci_write_register(pcr, ASPM_FORCE_CTL, 0xFF, 0);
+-      if (option->ltr_en) {
+-              u16 val;
+ 
+-              pcie_capability_read_word(pcr->pci, PCI_EXP_DEVCTL2, &val);
+-              if (val & PCI_EXP_DEVCTL2_LTR_EN) {
+-                      option->ltr_enabled = true;
+-                      option->ltr_active = true;
++      if (option->ltr_en) {
++              if (option->ltr_enabled)
+                       rtsx_set_ltr_latency(pcr, option->ltr_active_latency);
+-              } else {
+-                      option->ltr_enabled = false;
+-              }
+       }
+ }
+ 
+ static int rts5228_extra_init_hw(struct rtsx_pcr *pcr)
+ {
++      struct rtsx_cr_option *option = &pcr->option;
+ 
+       rtsx_pci_write_register(pcr, RTS5228_AUTOLOAD_CFG1,
+                       CD_RESUME_EN_MASK, CD_RESUME_EN_MASK);
+@@ -461,6 +427,17 @@ static int rts5228_extra_init_hw(struct
+       else
+               rtsx_pci_write_register(pcr, PETXCFG, 0x30, 0x00);
+ 
++      /*
++       * If u_force_clkreq_0 is enabled, CLKREQ# PIN will be forced
++       * to drive low, and we forcibly request clock.
++       */
++      if (option->force_clkreq_0)
++              rtsx_pci_write_register(pcr, PETXCFG,
++                               FORCE_CLKREQ_DELINK_MASK, FORCE_CLKREQ_LOW);
++      else
++              rtsx_pci_write_register(pcr, PETXCFG,
++                               FORCE_CLKREQ_DELINK_MASK, FORCE_CLKREQ_HIGH);
++
+       rtsx_pci_write_register(pcr, PWD_SUSPEND_EN, 0xFF, 0xFB);
+       rtsx_pci_write_register(pcr, pcr->reg_pm_ctrl3, 0x10, 0x00);
+       rtsx_pci_write_register(pcr, RTS5228_REG_PME_FORCE_CTL,
+--- a/drivers/misc/cardreader/rts5249.c
++++ b/drivers/misc/cardreader/rts5249.c
+@@ -85,64 +85,22 @@ static void rtsx_base_fetch_vendor_setti
+ 
+ static void rts5249_init_from_cfg(struct rtsx_pcr *pcr)
+ {
+-      struct pci_dev *pdev = pcr->pci;
+-      int l1ss;
+       struct rtsx_cr_option *option = &(pcr->option);
+-      u32 lval;
+-
+-      l1ss = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_L1SS);
+-      if (!l1ss)
+-              return;
+-
+-      pci_read_config_dword(pdev, l1ss + PCI_L1SS_CTL1, &lval);
+ 
+       if (CHK_PCI_PID(pcr, PID_524A) || CHK_PCI_PID(pcr, PID_525A)) {
+-              if (0 == (lval & 0x0F))
+-                      rtsx_pci_enable_oobs_polling(pcr);
+-              else
++              if (rtsx_check_dev_flag(pcr, ASPM_L1_1_EN | ASPM_L1_2_EN
++                              | PM_L1_1_EN | PM_L1_2_EN))
+                       rtsx_pci_disable_oobs_polling(pcr);
++              else
++                      rtsx_pci_enable_oobs_polling(pcr);
+       }
+ 
+-
+-      if (lval & PCI_L1SS_CTL1_ASPM_L1_1)
+-              rtsx_set_dev_flag(pcr, ASPM_L1_1_EN);
+-
+-      if (lval & PCI_L1SS_CTL1_ASPM_L1_2)
+-              rtsx_set_dev_flag(pcr, ASPM_L1_2_EN);
+-
+-      if (lval & PCI_L1SS_CTL1_PCIPM_L1_1)
+-              rtsx_set_dev_flag(pcr, PM_L1_1_EN);
+-
+-      if (lval & PCI_L1SS_CTL1_PCIPM_L1_2)
+-              rtsx_set_dev_flag(pcr, PM_L1_2_EN);
+-
+       if (option->ltr_en) {
+-              u16 val;
+-
+-              pcie_capability_read_word(pdev, PCI_EXP_DEVCTL2, &val);
+-              if (val & PCI_EXP_DEVCTL2_LTR_EN) {
+-                      option->ltr_enabled = true;
+-                      option->ltr_active = true;
++              if (option->ltr_enabled)
+                       rtsx_set_ltr_latency(pcr, option->ltr_active_latency);
+-              } else {
+-                      option->ltr_enabled = false;
+-              }
+       }
+ }
+ 
+-static int rts5249_init_from_hw(struct rtsx_pcr *pcr)
+-{
+-      struct rtsx_cr_option *option = &(pcr->option);
+-
+-      if (rtsx_check_dev_flag(pcr, ASPM_L1_1_EN | ASPM_L1_2_EN
+-                              | PM_L1_1_EN | PM_L1_2_EN))
+-              option->force_clkreq_0 = false;
+-      else
+-              option->force_clkreq_0 = true;
+-
+-      return 0;
+-}
+-
+ static void rts52xa_save_content_from_efuse(struct rtsx_pcr *pcr)
+ {
+       u8 cnt, sv;
+@@ -254,7 +212,6 @@ static int rts5249_extra_init_hw(struct
+       struct rtsx_cr_option *option = &(pcr->option);
+ 
+       rts5249_init_from_cfg(pcr);
+-      rts5249_init_from_hw(pcr);
+ 
+       rtsx_pci_init_cmd(pcr);
+ 
+@@ -302,11 +259,12 @@ static int rts5249_extra_init_hw(struct
+               }
+       }
+ 
++
+       /*
+        * If u_force_clkreq_0 is enabled, CLKREQ# PIN will be forced
+        * to drive low, and we forcibly request clock.
+        */
+-      if (option->force_clkreq_0 && pcr->aspm_mode == ASPM_MODE_CFG)
++      if (option->force_clkreq_0)
+               rtsx_pci_write_register(pcr, PETXCFG,
+                       FORCE_CLKREQ_DELINK_MASK, FORCE_CLKREQ_LOW);
+       else
+--- a/drivers/misc/cardreader/rts5260.c
++++ b/drivers/misc/cardreader/rts5260.c
+@@ -480,47 +480,19 @@ static void rts5260_pwr_saving_setting(s
+ 
+ static void rts5260_init_from_cfg(struct rtsx_pcr *pcr)
+ {
+-      struct pci_dev *pdev = pcr->pci;
+-      int l1ss;
+       struct rtsx_cr_option *option = &pcr->option;
+-      u32 lval;
+-
+-      l1ss = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_L1SS);
+-      if (!l1ss)
+-              return;
+-
+-      pci_read_config_dword(pdev, l1ss + PCI_L1SS_CTL1, &lval);
+-
+-      if (lval & PCI_L1SS_CTL1_ASPM_L1_1)
+-              rtsx_set_dev_flag(pcr, ASPM_L1_1_EN);
+-
+-      if (lval & PCI_L1SS_CTL1_ASPM_L1_2)
+-              rtsx_set_dev_flag(pcr, ASPM_L1_2_EN);
+-
+-      if (lval & PCI_L1SS_CTL1_PCIPM_L1_1)
+-              rtsx_set_dev_flag(pcr, PM_L1_1_EN);
+-
+-      if (lval & PCI_L1SS_CTL1_PCIPM_L1_2)
+-              rtsx_set_dev_flag(pcr, PM_L1_2_EN);
+ 
+       rts5260_pwr_saving_setting(pcr);
+ 
+       if (option->ltr_en) {
+-              u16 val;
+-
+-              pcie_capability_read_word(pdev, PCI_EXP_DEVCTL2, &val);
+-              if (val & PCI_EXP_DEVCTL2_LTR_EN) {
+-                      option->ltr_enabled = true;
+-                      option->ltr_active = true;
++              if (option->ltr_enabled)
+                       rtsx_set_ltr_latency(pcr, option->ltr_active_latency);
+-              } else {
+-                      option->ltr_enabled = false;
+-              }
+       }
+ }
+ 
+ static int rts5260_extra_init_hw(struct rtsx_pcr *pcr)
+ {
++      struct rtsx_cr_option *option = &pcr->option;
+ 
+       /* Set mcu_cnt to 7 to ensure data can be sampled properly */
+       rtsx_pci_write_register(pcr, 0xFC03, 0x7F, 0x07);
+@@ -539,6 +511,17 @@ static int rts5260_extra_init_hw(struct
+ 
+       rts5260_init_hw(pcr);
+ 
++      /*
++       * If u_force_clkreq_0 is enabled, CLKREQ# PIN will be forced
++       * to drive low, and we forcibly request clock.
++       */
++      if (option->force_clkreq_0)
++              rtsx_pci_write_register(pcr, PETXCFG,
++                               FORCE_CLKREQ_DELINK_MASK, FORCE_CLKREQ_LOW);
++      else
++              rtsx_pci_write_register(pcr, PETXCFG,
++                               FORCE_CLKREQ_DELINK_MASK, FORCE_CLKREQ_HIGH);
++
+       rtsx_pci_write_register(pcr, pcr->reg_pm_ctrl3, 0x10, 0x00);
+ 
+       return 0;
+--- a/drivers/misc/cardreader/rts5261.c
++++ b/drivers/misc/cardreader/rts5261.c
+@@ -424,54 +424,17 @@ static int rts5261_init_from_hw(struct r
+ 
+ static void rts5261_init_from_cfg(struct rtsx_pcr *pcr)
+ {
+-      struct pci_dev *pdev = pcr->pci;
+-      int l1ss;
+-      u32 lval;
+       struct rtsx_cr_option *option = &pcr->option;
+ 
+-      l1ss = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_L1SS);
+-      if (!l1ss)
+-              return;
+-
+-      pci_read_config_dword(pdev, l1ss + PCI_L1SS_CTL1, &lval);
+-
+-      if (lval & PCI_L1SS_CTL1_ASPM_L1_1)
+-              rtsx_set_dev_flag(pcr, ASPM_L1_1_EN);
+-      else
+-              rtsx_clear_dev_flag(pcr, ASPM_L1_1_EN);
+-
+-      if (lval & PCI_L1SS_CTL1_ASPM_L1_2)
+-              rtsx_set_dev_flag(pcr, ASPM_L1_2_EN);
+-      else
+-              rtsx_clear_dev_flag(pcr, ASPM_L1_2_EN);
+-
+-      if (lval & PCI_L1SS_CTL1_PCIPM_L1_1)
+-              rtsx_set_dev_flag(pcr, PM_L1_1_EN);
+-      else
+-              rtsx_clear_dev_flag(pcr, PM_L1_1_EN);
+-
+-      if (lval & PCI_L1SS_CTL1_PCIPM_L1_2)
+-              rtsx_set_dev_flag(pcr, PM_L1_2_EN);
+-      else
+-              rtsx_clear_dev_flag(pcr, PM_L1_2_EN);
+-
+-      rtsx_pci_write_register(pcr, ASPM_FORCE_CTL, 0xFF, 0);
+       if (option->ltr_en) {
+-              u16 val;
+-
+-              pcie_capability_read_word(pdev, PCI_EXP_DEVCTL2, &val);
+-              if (val & PCI_EXP_DEVCTL2_LTR_EN) {
+-                      option->ltr_enabled = true;
+-                      option->ltr_active = true;
++              if (option->ltr_enabled)
+                       rtsx_set_ltr_latency(pcr, option->ltr_active_latency);
+-              } else {
+-                      option->ltr_enabled = false;
+-              }
+       }
+ }
+ 
+ static int rts5261_extra_init_hw(struct rtsx_pcr *pcr)
+ {
++      struct rtsx_cr_option *option = &pcr->option;
+       u32 val;
+ 
+       rtsx_pci_write_register(pcr, RTS5261_AUTOLOAD_CFG1,
+@@ -517,6 +480,17 @@ static int rts5261_extra_init_hw(struct
+       else
+               rtsx_pci_write_register(pcr, PETXCFG, 0x30, 0x00);
+ 
++      /*
++       * If u_force_clkreq_0 is enabled, CLKREQ# PIN will be forced
++       * to drive low, and we forcibly request clock.
++       */
++      if (option->force_clkreq_0)
++              rtsx_pci_write_register(pcr, PETXCFG,
++                               FORCE_CLKREQ_DELINK_MASK, FORCE_CLKREQ_LOW);
++      else
++              rtsx_pci_write_register(pcr, PETXCFG,
++                               FORCE_CLKREQ_DELINK_MASK, FORCE_CLKREQ_HIGH);
++
+       rtsx_pci_write_register(pcr, PWD_SUSPEND_EN, 0xFF, 0xFB);
+       rtsx_pci_write_register(pcr, pcr->reg_pm_ctrl3, 0x10, 0x00);
+       rtsx_pci_write_register(pcr, RTS5261_REG_PME_FORCE_CTL,
+--- a/drivers/misc/cardreader/rtsx_pcr.c
++++ b/drivers/misc/cardreader/rtsx_pcr.c
+@@ -1400,11 +1400,8 @@ static int rtsx_pci_init_hw(struct rtsx_
+                       return err;
+       }
+ 
+-      if (pcr->aspm_mode == ASPM_MODE_REG) {
++      if (pcr->aspm_mode == ASPM_MODE_REG)
+               rtsx_pci_write_register(pcr, ASPM_FORCE_CTL, 0x30, 0x30);
+-              rtsx_pci_write_register(pcr, PETXCFG,
+-                              FORCE_CLKREQ_DELINK_MASK, FORCE_CLKREQ_HIGH);
+-      }
+ 
+       /* No CD interrupt if probing driver with card inserted.
+        * So we need to initialize pcr->card_exist here.
+@@ -1419,7 +1416,9 @@ static int rtsx_pci_init_hw(struct rtsx_
+ 
+ static int rtsx_pci_init_chip(struct rtsx_pcr *pcr)
+ {
+-      int err;
++      struct rtsx_cr_option *option = &(pcr->option);
++      int err, l1ss;
++      u32 lval;
+       u16 cfg_val;
+       u8 val;
+ 
+@@ -1504,6 +1503,48 @@ static int rtsx_pci_init_chip(struct rts
+                       pcr->aspm_enabled = true;
+       }
+ 
++      l1ss = pci_find_ext_capability(pcr->pci, PCI_EXT_CAP_ID_L1SS);
++      if (l1ss) {
++              pci_read_config_dword(pcr->pci, l1ss + PCI_L1SS_CTL1, &lval);
++
++              if (lval & PCI_L1SS_CTL1_ASPM_L1_1)
++                      rtsx_set_dev_flag(pcr, ASPM_L1_1_EN);
++              else
++                      rtsx_clear_dev_flag(pcr, ASPM_L1_1_EN);
++
++              if (lval & PCI_L1SS_CTL1_ASPM_L1_2)
++                      rtsx_set_dev_flag(pcr, ASPM_L1_2_EN);
++              else
++                      rtsx_clear_dev_flag(pcr, ASPM_L1_2_EN);
++
++              if (lval & PCI_L1SS_CTL1_PCIPM_L1_1)
++                      rtsx_set_dev_flag(pcr, PM_L1_1_EN);
++              else
++                      rtsx_clear_dev_flag(pcr, PM_L1_1_EN);
++
++              if (lval & PCI_L1SS_CTL1_PCIPM_L1_2)
++                      rtsx_set_dev_flag(pcr, PM_L1_2_EN);
++              else
++                      rtsx_clear_dev_flag(pcr, PM_L1_2_EN);
++
++              pcie_capability_read_word(pcr->pci, PCI_EXP_DEVCTL2, &cfg_val);
++              if (cfg_val & PCI_EXP_DEVCTL2_LTR_EN) {
++                      option->ltr_enabled = true;
++                      option->ltr_active = true;
++              } else {
++                      option->ltr_enabled = false;
++              }
++
++              if (rtsx_check_dev_flag(pcr, ASPM_L1_1_EN | ASPM_L1_2_EN
++                              | PM_L1_1_EN | PM_L1_2_EN))
++                      option->force_clkreq_0 = false;
++              else
++                      option->force_clkreq_0 = true;
++      } else {
++              option->ltr_enabled = false;
++              option->force_clkreq_0 = true;
++      }
++
+       if (pcr->ops->fetch_vendor_settings)
+               pcr->ops->fetch_vendor_settings(pcr);
+ 

diff --git a/queue-5.15/nilfs2-fix-potential-use-after-free-in-nilfs_gccache_submit_read_data.patch b/queue-5.15/nilfs2-fix-potential-use-after-free-in-nilfs_gccache_submit_read_data.patch
new file mode 100644 (file)
index 0000000..095d33a
--- /dev/null
+++ b/queue-5.15/nilfs2-fix-potential-use-after-free-in-nilfs_gccache_submit_read_data.patch
@@ -0,0 +1,61 @@
+From 7ee29facd8a9c5a26079148e36bcf07141b3a6bc Mon Sep 17 00:00:00 2001
+From: Pan Bian <bianpan2016@163.com>
+Date: Thu, 21 Sep 2023 23:17:31 +0900
+Subject: nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
+
+From: Pan Bian <bianpan2016@163.com>
+
+commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream.
+
+In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the
+reference count of bh when the call to nilfs_dat_translate() fails.  If
+the reference count hits 0 and its owner page gets unlocked, bh may be
+freed.  However, bh->b_page is dereferenced to put the page after that,
+which may result in a use-after-free bug.  This patch moves the release
+operation after unlocking and putting the page.
+
+NOTE: The function in question is only called in GC, and in combination
+with current userland tools, address translation using DAT does not occur
+in that function, so the code path that causes this issue will not be
+executed.  However, it is possible to run that code path by intentionally
+modifying the userland GC library or by calling the GC ioctl directly.
+
+[konishi.ryusuke@gmail.com: NOTE added to the commit log]
+Link: https://lkml.kernel.org/r/1543201709-53191-1-git-send-email-bianpan2016@163.com
+Link: https://lkml.kernel.org/r/20230921141731.10073-1-konishi.ryusuke@gmail.com
+Fixes: a3d93f709e89 ("nilfs2: block cache for garbage collection")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reported-by: Ferry Meng <mengferry@linux.alibaba.com>
+Closes: https://lkml.kernel.org/r/20230818092022.111054-1-mengferry@linux.alibaba.com
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nilfs2/gcinode.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/nilfs2/gcinode.c
++++ b/fs/nilfs2/gcinode.c
+@@ -73,10 +73,8 @@ int nilfs_gccache_submit_read_data(struc
+               struct the_nilfs *nilfs = inode->i_sb->s_fs_info;
+ 
+               err = nilfs_dat_translate(nilfs->ns_dat, vbn, &pbn);
+-              if (unlikely(err)) { /* -EIO, -ENOMEM, -ENOENT */
+-                      brelse(bh);
++              if (unlikely(err)) /* -EIO, -ENOMEM, -ENOENT */
+                       goto failed;
+-              }
+       }
+ 
+       lock_buffer(bh);
+@@ -102,6 +100,8 @@ int nilfs_gccache_submit_read_data(struc
+  failed:
+       unlock_page(bh->b_page);
+       put_page(bh->b_page);
++      if (unlikely(err))
++              brelse(bh);
+       return err;
+ }
+ 

diff --git a/queue-5.15/revert-tty-n_gsm-fix-uaf-in-gsm_cleanup_mux.patch b/queue-5.15/revert-tty-n_gsm-fix-uaf-in-gsm_cleanup_mux.patch
new file mode 100644 (file)
index 0000000..251227c
--- /dev/null
+++ b/queue-5.15/revert-tty-n_gsm-fix-uaf-in-gsm_cleanup_mux.patch
@@ -0,0 +1,68 @@
+From 29346e217b8ab8a52889b88f00b268278d6b7668 Mon Sep 17 00:00:00 2001
+From: Daniel Starke <daniel.starke@siemens.com>
+Date: Thu, 14 Sep 2023 07:15:07 +0200
+Subject: Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"
+
+From: Daniel Starke <daniel.starke@siemens.com>
+
+commit 29346e217b8ab8a52889b88f00b268278d6b7668 upstream.
+
+This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239.
+
+The commit above is reverted as it did not solve the original issue.
+
+gsm_cleanup_mux() tries to free up the virtual ttys by calling
+gsm_dlci_release() for each available DLCI. There, dlci_put() is called to
+decrease the reference counter for the DLCI via tty_port_put() which
+finally calls gsm_dlci_free(). This already clears the pointer which is
+being checked in gsm_cleanup_mux() before calling gsm_dlci_release().
+Therefore, it is not necessary to clear this pointer in gsm_cleanup_mux()
+as done in the reverted commit. The commit introduces a null pointer
+dereference:
+ <TASK>
+ ? __die+0x1f/0x70
+ ? page_fault_oops+0x156/0x420
+ ? search_exception_tables+0x37/0x50
+ ? fixup_exception+0x21/0x310
+ ? exc_page_fault+0x69/0x150
+ ? asm_exc_page_fault+0x26/0x30
+ ? tty_port_put+0x19/0xa0
+ gsmtty_cleanup+0x29/0x80 [n_gsm]
+ release_one_tty+0x37/0xe0
+ process_one_work+0x1e6/0x3e0
+ worker_thread+0x4c/0x3d0
+ ? __pfx_worker_thread+0x10/0x10
+ kthread+0xe1/0x110
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork+0x2f/0x50
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork_asm+0x1b/0x30
+ </TASK>
+
+The actual issue is that nothing guards dlci_put() from being called
+multiple times while the tty driver was triggered but did not yet finished
+calling gsm_dlci_free().
+
+Fixes: 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
+Link: https://lore.kernel.org/r/20230914051507.3240-1-daniel.starke@siemens.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/n_gsm.c |    4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -2412,10 +2412,8 @@ static void gsm_cleanup_mux(struct gsm_m
+               gsm->has_devices = false;
+       }
+       for (i = NUM_DLCI - 1; i >= 0; i--)
+-              if (gsm->dlci[i]) {
++              if (gsm->dlci[i])
+                       gsm_dlci_release(gsm->dlci[i]);
+-                      gsm->dlci[i] = NULL;
+-              }
+       mutex_unlock(&gsm->mutex);
+       /* Now wipe the queues */
+       tty_ldisc_flush(gsm->tty);

diff --git a/queue-5.15/serial-8250_port-check-irq-data-before-use.patch b/queue-5.15/serial-8250_port-check-irq-data-before-use.patch
new file mode 100644 (file)
index 0000000..c1c0aef
--- /dev/null
+++ b/queue-5.15/serial-8250_port-check-irq-data-before-use.patch
@@ -0,0 +1,49 @@
+From cce7fc8b29961b64fadb1ce398dc5ff32a79643b Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Fri, 1 Sep 2023 01:25:55 +0300
+Subject: serial: 8250_port: Check IRQ data before use
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit cce7fc8b29961b64fadb1ce398dc5ff32a79643b upstream.
+
+In case the leaf driver wants to use IRQ polling (irq = 0) and
+IIR register shows that an interrupt happened in the 8250 hardware
+the IRQ data can be NULL. In such a case we need to skip the wake
+event as we came to this path from the timer interrupt and quite
+likely system is already awake.
+
+Without this fix we have got an Oops:
+
+    serial8250: ttyS0 at I/O 0x3f8 (irq = 0, base_baud = 115200) is a 16550A
+    ...
+    BUG: kernel NULL pointer dereference, address: 0000000000000010
+    RIP: 0010:serial8250_handle_irq+0x7c/0x240
+    Call Trace:
+     ? serial8250_handle_irq+0x7c/0x240
+     ? __pfx_serial8250_timeout+0x10/0x10
+
+Fixes: 0ba9e3a13c6a ("serial: 8250: Add missing wakeup event reporting")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://lore.kernel.org/r/20230831222555.614426-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_port.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1930,7 +1930,10 @@ int serial8250_handle_irq(struct uart_po
+               skip_rx = true;
+ 
+       if (status & (UART_LSR_DR | UART_LSR_BI) && !skip_rx) {
+-              if (irqd_is_wakeup_set(irq_get_irq_data(port->irq)))
++              struct irq_data *d;
++
++              d = irq_get_irq_data(port->irq);
++              if (d && irqd_is_wakeup_set(d))
+                       pm_wakeup_event(tport->tty->dev, 0);
+               if (!up->dma || handle_rx_dma(up, iir))
+                       status = serial8250_rx_chars(up, status);

diff --git a/queue-5.15/series b/queue-5.15/series
index 383bcbc335cd815d28d9ed33e5fa35d92f4aec9c..e2eeaebc16f36440ca66d9d72a2fe7852c300a9a 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -155,3 +155,8 @@ smack-record-transmuting-in-smk_transmuted.patch
 smack-retrieve-transmuting-information-in-smack_inod.patch
 smack-use-overlay-inode-label-in-smack_inode_copy_up.patch
 iommu-arm-smmu-v3-fix-soft-lockup-triggered-by-arm_s.patch
+x86-srso-add-srso-mitigation-for-hygon-processors.patch
+misc-rtsx-fix-some-platforms-can-not-boot-and-move-the-l1ss-judgment-to-probe.patch
+revert-tty-n_gsm-fix-uaf-in-gsm_cleanup_mux.patch
+serial-8250_port-check-irq-data-before-use.patch
+nilfs2-fix-potential-use-after-free-in-nilfs_gccache_submit_read_data.patch

diff --git a/queue-5.15/x86-srso-add-srso-mitigation-for-hygon-processors.patch b/queue-5.15/x86-srso-add-srso-mitigation-for-hygon-processors.patch
new file mode 100644 (file)
index 0000000..876895e
--- /dev/null
+++ b/queue-5.15/x86-srso-add-srso-mitigation-for-hygon-processors.patch
@@ -0,0 +1,33 @@
+From a5ef7d68cea1344cf524f04981c2b3f80bedbb0d Mon Sep 17 00:00:00 2001
+From: Pu Wen <puwen@hygon.cn>
+Date: Thu, 28 Sep 2023 14:59:16 +0800
+Subject: x86/srso: Add SRSO mitigation for Hygon processors
+
+From: Pu Wen <puwen@hygon.cn>
+
+commit a5ef7d68cea1344cf524f04981c2b3f80bedbb0d upstream.
+
+Add mitigation for the speculative return stack overflow vulnerability
+which exists on Hygon processors too.
+
+Signed-off-by: Pu Wen <puwen@hygon.cn>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Borislav Petkov (AMD) <bp@alien8.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/tencent_4A14812842F104E93AA722EC939483CEFF05@qq.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/common.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1172,7 +1172,7 @@ static const struct x86_cpu_id cpu_vuln_
+       VULNBL_AMD(0x15, RETBLEED),
+       VULNBL_AMD(0x16, RETBLEED),
+       VULNBL_AMD(0x17, RETBLEED | SMT_RSB | SRSO),
+-      VULNBL_HYGON(0x18, RETBLEED | SMT_RSB),
++      VULNBL_HYGON(0x18, RETBLEED | SMT_RSB | SRSO),
+       VULNBL_AMD(0x19, SRSO),
+       {}
+ };