From: Sasha Levin Date: Sat, 4 Nov 2023 03:00:40 +0000 (-0400) Subject: Fixes for 6.1 X-Git-Tag: v4.14.329~47 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=048652fcc6bc5769a86c79309b2c398361e38eaf;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/asoc-codecs-tas2780-fix-log-of-failed-reset-via-i2c.patch b/queue-6.1/asoc-codecs-tas2780-fix-log-of-failed-reset-via-i2c.patch new file mode 100644 index 00000000000..701b171d8a8 --- /dev/null +++ b/queue-6.1/asoc-codecs-tas2780-fix-log-of-failed-reset-via-i2c.patch @@ -0,0 +1,35 @@ +From 5f55affde77dfe701e3a9648a3aab6a4c5ba0e6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Oct 2023 13:02:39 +0200 +Subject: ASoC: codecs: tas2780: Fix log of failed reset via I2C. + +From: Roy Chateau + +[ Upstream commit 4e9a429ae80657bdc502d3f5078e2073656ec5fd ] + +Correctly log failures of reset via I2C. + +Signed-off-by: Roy Chateau +Link: https://lore.kernel.org/r/20231013110239.473123-1-roy.chateau@mep-info.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2780.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/tas2780.c b/sound/soc/codecs/tas2780.c +index afdf0c863aa10..a2d27410bbefa 100644 +--- a/sound/soc/codecs/tas2780.c ++++ b/sound/soc/codecs/tas2780.c +@@ -39,7 +39,7 @@ static void tas2780_reset(struct tas2780_priv *tas2780) + usleep_range(2000, 2050); + } + +- snd_soc_component_write(tas2780->component, TAS2780_SW_RST, ++ ret = snd_soc_component_write(tas2780->component, TAS2780_SW_RST, + TAS2780_RST); + if (ret) + dev_err(tas2780->dev, "%s:errCode:0x%x Reset error!\n", +-- +2.42.0 + diff --git a/queue-6.1/asoc-rt5650-fix-the-wrong-result-of-key-button.patch b/queue-6.1/asoc-rt5650-fix-the-wrong-result-of-key-button.patch new file mode 100644 index 00000000000..578edcf4cc8 --- /dev/null +++ b/queue-6.1/asoc-rt5650-fix-the-wrong-result-of-key-button.patch @@ -0,0 +1,35 @@ +From 2cc16c97685e6055236622b236bf1cd51f8cef7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Oct 2023 17:45:25 +0800 +Subject: ASoC: rt5650: fix the wrong result of key button + +From: Shuming Fan + +[ Upstream commit f88dfbf333b3661faff996bb03af2024d907b76a ] + +The RT5650 should enable a power setting for button detection to avoid the wrong result. + +Signed-off-by: Shuming Fan +Link: https://lore.kernel.org/r/20231013094525.715518-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5645.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index 620ecbfa4a7a8..f86fc7cd104d4 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -3251,6 +3251,8 @@ int rt5645_set_jack_detect(struct snd_soc_component *component, + RT5645_GP1_PIN_IRQ, RT5645_GP1_PIN_IRQ); + regmap_update_bits(rt5645->regmap, RT5645_GEN_CTRL1, + RT5645_DIG_GATE_CTRL, RT5645_DIG_GATE_CTRL); ++ regmap_update_bits(rt5645->regmap, RT5645_DEPOP_M1, ++ RT5645_HP_CB_MASK, RT5645_HP_CB_PU); + } + rt5645_irq(0, rt5645); + +-- +2.42.0 + diff --git a/queue-6.1/asoc-simple-card-fixup-asoc_simple_probe-error-handl.patch b/queue-6.1/asoc-simple-card-fixup-asoc_simple_probe-error-handl.patch new file mode 100644 index 00000000000..48fb9912b56 --- /dev/null +++ b/queue-6.1/asoc-simple-card-fixup-asoc_simple_probe-error-handl.patch @@ -0,0 +1,85 @@ +From 62d3a4e113dae91d2fdfda8b33cbe7703dc86423 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Sep 2023 05:34:18 +0000 +Subject: ASoC: simple-card: fixup asoc_simple_probe() error handling + +From: Kuninori Morimoto + +[ Upstream commit 41bae58df411f9accf01ea660730649b2fab1dab ] + +asoc_simple_probe() is used for both "DT probe" (A) and "platform probe" +(B). It uses "goto err" when error case, but it is not needed for +"platform probe" case (B). Thus it is using "return" directly there. + + static int asoc_simple_probe(...) + { + ^ if (...) { + | ... +(A) if (ret < 0) + | goto err; + v } else { + ^ ... + | if (ret < 0) +(B) return -Exxx; + v } + + ... + ^ if (ret < 0) +(C) goto err; + v ... + + err: +(D) simple_util_clean_reference(card); + + return ret; + } + +Both case are using (C) part, and it calls (D) when err case. +But (D) will do nothing for (B) case. +Because of these behavior, current code itself is not wrong, +but is confusable, and more, static analyzing tool will warning on +(B) part (should use goto err). + +To avoid static analyzing tool warning, this patch uses "goto err" +on (B) part. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87o7hy7mlh.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/generic/simple-card.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c +index fbb682747f598..a8bc4e45816df 100644 +--- a/sound/soc/generic/simple-card.c ++++ b/sound/soc/generic/simple-card.c +@@ -678,10 +678,12 @@ static int asoc_simple_probe(struct platform_device *pdev) + struct snd_soc_dai_link *dai_link = priv->dai_link; + struct simple_dai_props *dai_props = priv->dai_props; + ++ ret = -EINVAL; ++ + cinfo = dev->platform_data; + if (!cinfo) { + dev_err(dev, "no info for asoc-simple-card\n"); +- return -EINVAL; ++ goto err; + } + + if (!cinfo->name || +@@ -690,7 +692,7 @@ static int asoc_simple_probe(struct platform_device *pdev) + !cinfo->platform || + !cinfo->cpu_dai.name) { + dev_err(dev, "insufficient asoc_simple_card_info settings\n"); +- return -EINVAL; ++ goto err; + } + + cpus = dai_link->cpus; +-- +2.42.0 + diff --git a/queue-6.1/asoc-tlv320adc3xxx-bug-correct-micbias-setting.patch b/queue-6.1/asoc-tlv320adc3xxx-bug-correct-micbias-setting.patch new file mode 100644 index 00000000000..fbaa8a2d292 --- /dev/null +++ b/queue-6.1/asoc-tlv320adc3xxx-bug-correct-micbias-setting.patch @@ -0,0 +1,45 @@ +From 9f5c263b2ead90e60140f1011e7302b691cc4eee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Sep 2023 15:01:17 +0200 +Subject: ASoC: tlv320adc3xxx: BUG: Correct micbias setting + +From: Antoine Gennart + +[ Upstream commit e930bea4124b8a4a47ba4092d99da30099b9242d ] + +The micbias setting for tlv320adc can also have the value '3' which +means that the micbias ouput pin is connected to the input pin AVDD. + +Signed-off-by: Antoine Gennart +Link: https://lore.kernel.org/r/20230929130117.77661-1-gennartan@disroot.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tlv320adc3xxx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/tlv320adc3xxx.c b/sound/soc/codecs/tlv320adc3xxx.c +index 52bb557247244..6bd6da01aafac 100644 +--- a/sound/soc/codecs/tlv320adc3xxx.c ++++ b/sound/soc/codecs/tlv320adc3xxx.c +@@ -293,7 +293,7 @@ + #define ADC3XXX_BYPASS_RPGA 0x80 + + /* MICBIAS control bits */ +-#define ADC3XXX_MICBIAS_MASK 0x2 ++#define ADC3XXX_MICBIAS_MASK 0x3 + #define ADC3XXX_MICBIAS1_SHIFT 5 + #define ADC3XXX_MICBIAS2_SHIFT 3 + +@@ -1099,7 +1099,7 @@ static int adc3xxx_parse_dt_micbias(struct adc3xxx *adc3xxx, + unsigned int val; + + if (!of_property_read_u32(np, propname, &val)) { +- if (val >= ADC3XXX_MICBIAS_AVDD) { ++ if (val > ADC3XXX_MICBIAS_AVDD) { + dev_err(dev, "Invalid property value for '%s'\n", propname); + return -EINVAL; + } +-- +2.42.0 + diff --git a/queue-6.1/ceph_wait_on_conflict_unlink-grab-reference-before-d.patch b/queue-6.1/ceph_wait_on_conflict_unlink-grab-reference-before-d.patch new file mode 100644 index 00000000000..8f76038456e --- /dev/null +++ b/queue-6.1/ceph_wait_on_conflict_unlink-grab-reference-before-d.patch @@ -0,0 +1,37 @@ +From bc27300161bb5295ddd43e48ce3d23bb4d620337 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Sep 2023 21:55:29 -0400 +Subject: ceph_wait_on_conflict_unlink(): grab reference before dropping + ->d_lock + +From: Al Viro + +[ Upstream commit dc32464a5fe4946fe1a4d8f8e29961dc411933c5 ] + +Use of dget() after we'd dropped ->d_lock is too late - dentry might +be gone by that point. + +Reviewed-by: Jeff Layton +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/ceph/mds_client.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c +index f6a7fd47efd7a..82874be945248 100644 +--- a/fs/ceph/mds_client.c ++++ b/fs/ceph/mds_client.c +@@ -709,8 +709,8 @@ int ceph_wait_on_conflict_unlink(struct dentry *dentry) + if (!d_same_name(udentry, pdentry, &dname)) + goto next; + ++ found = dget_dlock(udentry); + spin_unlock(&udentry->d_lock); +- found = dget(udentry); + break; + next: + spin_unlock(&udentry->d_lock); +-- +2.42.0 + diff --git a/queue-6.1/coresight-tmc-etr-disable-warnings-for-allocation-fa.patch b/queue-6.1/coresight-tmc-etr-disable-warnings-for-allocation-fa.patch new file mode 100644 index 00000000000..621c7cf9f3c --- /dev/null +++ b/queue-6.1/coresight-tmc-etr-disable-warnings-for-allocation-fa.patch @@ -0,0 +1,82 @@ +From 472d405e4b67f40c1a9a5fbc3e26a37395994787 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Aug 2023 17:19:51 +0100 +Subject: coresight: tmc-etr: Disable warnings for allocation failures + +From: Suzuki K Poulose + +[ Upstream commit e5028011885a85032aa3c1b7e3e493bcdacb4a0a ] + +Running the following command on Juno triggers the warning: + + $ perf record -e cs_etm// -m ,128M ... + + ------------[ cut here ]------------ + WARNING: CPU: 1 PID: 412 at mm/page_alloc.c:4453 __alloc_pages+0x334/0x1420 + CPU: 1 PID: 412 Comm: perf Not tainted 6.5.0-rc3+ #181 + Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Feb 1 2019 + pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : __alloc_pages+0x334/0x1420 + lr : dma_common_alloc_pages+0x108/0x138 + sp : ffffffc087fb7440 + x29: ffffffc087fb7440 x28: 0000000000000000 x27: ffffffc07e48fba0 + x26: 0000000000000001 x25: 000000000000000f x24: ffffffc081f24880 + x23: 0000000000000cc0 x22: ffffff88012b6f08 x21: 0000000008000000 + x20: ffffff8801433000 x19: 0000000000000000 x18: 0000000000000000 + x17: ffffffc080316e5c x16: ffffffc07e46406c x15: ffffffc0803af580 + x14: ffffffc08036b460 x13: ffffffc080025cbc x12: ffffffb8108c3fc4 + x11: 1ffffff8108c3fc3 x10: 1ffffff810ff6eac x9 : 00000000f204f204 + x8 : 000000000000f204 x7 : 00000000f2f2f2f2 x6 : 00000000f3f3f3f3 + x5 : 0000000000000001 x4 : 0000000000000000 x3 : 0000000000000000 + x2 : 0000000000000cc0 x1 : 0000000000000000 x0 : ffffffc085333000 + Call trace: + __alloc_pages+0x334/0x1420 + dma_common_alloc_pages+0x108/0x138 + __dma_alloc_pages+0xf4/0x108 + dma_alloc_pages+0x18/0x30 + tmc_etr_alloc_flat_buf+0xa0/0x190 [coresight_tmc] + tmc_alloc_etr_buf.constprop.0+0x124/0x298 [coresight_tmc] + alloc_etr_buf.constprop.0.isra.0+0x88/0xc8 [coresight_tmc] + tmc_alloc_etr_buffer+0x164/0x2f0 [coresight_tmc] + etm_setup_aux+0x32c/0x520 [coresight] + rb_alloc_aux+0x29c/0x3f8 + perf_mmap+0x59c/0xce0 + mmap_region+0x340/0x10e0 + do_mmap+0x48c/0x580 + vm_mmap_pgoff+0x160/0x248 + ksys_mmap_pgoff+0x1e8/0x278 + __arm64_sys_mmap+0x8c/0xb8 + +With the flat mode, we only attempt to allocate large memory if there is an IOMMU +connected to the ETR. If the allocation fails, we always have a fallback path +and return an error if nothing else worked. So, suppress the warning for flat +mode allocations. + +Cc: Mike Leach +Cc: James Clark +Cc: Anshuman Khandual +Signed-off-by: Suzuki K Poulose +Reviewed-by: James Clark +Link: https://lore.kernel.org/r/20230817161951.658534-1-suzuki.poulose@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-tmc-etr.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c +index 1be0e5e0e80b2..c88a6afb29512 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c +@@ -610,7 +610,8 @@ static int tmc_etr_alloc_flat_buf(struct tmc_drvdata *drvdata, + + flat_buf->vaddr = dma_alloc_noncoherent(real_dev, etr_buf->size, + &flat_buf->daddr, +- DMA_FROM_DEVICE, GFP_KERNEL); ++ DMA_FROM_DEVICE, ++ GFP_KERNEL | __GFP_NOWARN); + if (!flat_buf->vaddr) { + kfree(flat_buf); + return -ENOMEM; +-- +2.42.0 + diff --git a/queue-6.1/dmaengine-ste_dma40-fix-pm-disable-depth-imbalance-i.patch b/queue-6.1/dmaengine-ste_dma40-fix-pm-disable-depth-imbalance-i.patch new file mode 100644 index 00000000000..6e4d54c5109 --- /dev/null +++ b/queue-6.1/dmaengine-ste_dma40-fix-pm-disable-depth-imbalance-i.patch @@ -0,0 +1,38 @@ +From 11f815c8a4bf5a8b0a9e3b817503c9637e3ad235 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Oct 2023 22:28:35 +0800 +Subject: dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe + +From: Zhang Shurong + +[ Upstream commit 0618c077a8c20e8c81e367988f70f7e32bb5a717 ] + +The pm_runtime_enable will increase power disable depth. Thus +a pairing decrement is needed on the error handling path to +keep it balanced according to context. +We fix it by calling pm_runtime_disable when error returns. + +Signed-off-by: Zhang Shurong +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/tencent_DD2D371DB5925B4B602B1E1D0A5FA88F1208@qq.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ste_dma40.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c +index 3b09fdc507e04..594b016e76efc 100644 +--- a/drivers/dma/ste_dma40.c ++++ b/drivers/dma/ste_dma40.c +@@ -3697,6 +3697,7 @@ static int __init d40_probe(struct platform_device *pdev) + regulator_disable(base->lcpa_regulator); + regulator_put(base->lcpa_regulator); + } ++ pm_runtime_disable(base->dev); + + kfree(base->lcla_pool.alloc_map); + kfree(base->lookup_log_chans); +-- +2.42.0 + diff --git a/queue-6.1/drm-amdgpu-reserve-fences-for-vm-update.patch b/queue-6.1/drm-amdgpu-reserve-fences-for-vm-update.patch new file mode 100644 index 00000000000..e0425726a13 --- /dev/null +++ b/queue-6.1/drm-amdgpu-reserve-fences-for-vm-update.patch @@ -0,0 +1,43 @@ +From b12c1dc583df742183c645e062fb5aeb52b46dc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:28:52 -0400 +Subject: drm/amdgpu: Reserve fences for VM update +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Felix Kuehling + +[ Upstream commit 316baf09d355aec1179981b6dfe28eba50c5ee5b ] + +In amdgpu_dma_buf_move_notify reserve fences for the page table updates +in amdgpu_vm_clear_freed and amdgpu_vm_handle_moved. This fixes a BUG_ON +in dma_resv_add_fence when using SDMA for page table updates. + +Signed-off-by: Felix Kuehling +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c +index 7bd8e33b14be5..e8b3e9520cf6e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c +@@ -400,7 +400,10 @@ amdgpu_dma_buf_move_notify(struct dma_buf_attachment *attach) + continue; + } + +- r = amdgpu_vm_clear_freed(adev, vm, NULL); ++ /* Reserve fences for two SDMA page table updates */ ++ r = dma_resv_reserve_fences(resv, 2); ++ if (!r) ++ r = amdgpu_vm_clear_freed(adev, vm, NULL); + if (!r) + r = amdgpu_vm_handle_moved(adev, vm); + +-- +2.42.0 + diff --git a/queue-6.1/drm-amdgpu-unset-context-priority-is-now-invalid.patch b/queue-6.1/drm-amdgpu-unset-context-priority-is-now-invalid.patch new file mode 100644 index 00000000000..3311a089dd4 --- /dev/null +++ b/queue-6.1/drm-amdgpu-unset-context-priority-is-now-invalid.patch @@ -0,0 +1,50 @@ +From ec4507ea16de29009b303d39f6808f90f428f1f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Oct 2023 22:24:39 -0400 +Subject: drm/amdgpu: Unset context priority is now invalid +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luben Tuikov + +[ Upstream commit eab0261967aeab528db4d0a51806df8209aec179 ] + +A context priority value of AMD_CTX_PRIORITY_UNSET is now invalid--instead of +carrying it around and passing it to the Direct Rendering Manager--and it +becomes AMD_CTX_PRIORITY_NORMAL in amdgpu_ctx_ioctl(), the gateway to context +creation. + +Cc: Alex Deucher +Cc: Christian König +Signed-off-by: Luben Tuikov +Acked-by: Alex Deucher +Link: https://lore.kernel.org/r/20231017035656.8211-1-luben.tuikov@amd.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c +index d2139ac121595..fdbeafda4e80a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c +@@ -47,7 +47,6 @@ const unsigned int amdgpu_ctx_num_entities[AMDGPU_HW_IP_NUM] = { + bool amdgpu_ctx_priority_is_valid(int32_t ctx_prio) + { + switch (ctx_prio) { +- case AMDGPU_CTX_PRIORITY_UNSET: + case AMDGPU_CTX_PRIORITY_VERY_LOW: + case AMDGPU_CTX_PRIORITY_LOW: + case AMDGPU_CTX_PRIORITY_NORMAL: +@@ -55,6 +54,7 @@ bool amdgpu_ctx_priority_is_valid(int32_t ctx_prio) + case AMDGPU_CTX_PRIORITY_VERY_HIGH: + return true; + default: ++ case AMDGPU_CTX_PRIORITY_UNSET: + return false; + } + } +-- +2.42.0 + diff --git a/queue-6.1/drm-ttm-reorder-sys-manager-cleanup-step.patch b/queue-6.1/drm-ttm-reorder-sys-manager-cleanup-step.patch new file mode 100644 index 00000000000..845654ce0c8 --- /dev/null +++ b/queue-6.1/drm-ttm-reorder-sys-manager-cleanup-step.patch @@ -0,0 +1,59 @@ +From 38e9863d6a269212b72a14c87c3597f7436676bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Oct 2023 14:15:25 +0200 +Subject: drm/ttm: Reorder sys manager cleanup step +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Karolina Stolarek + +[ Upstream commit 3b401e30c249849d803de6c332dad2a595a58658 ] + +With the current cleanup flow, we could trigger a NULL pointer +dereference if there is a delayed destruction of a BO with a +system resource that gets executed on drain_workqueue() call, +as we attempt to free a resource using an already released +resource manager. + +Remove the device from the device list and drain its workqueue +before releasing the system domain manager in ttm_device_fini(). + +Signed-off-by: Karolina Stolarek +Reviewed-by: Christian König +Link: https://patchwork.freedesktop.org/patch/msgid/20231016121525.2237838-1-karolina.stolarek@intel.com +Signed-off-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/ttm_device.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/ttm/ttm_device.c b/drivers/gpu/drm/ttm/ttm_device.c +index b84f74807ca13..ec9ddaad56a05 100644 +--- a/drivers/gpu/drm/ttm/ttm_device.c ++++ b/drivers/gpu/drm/ttm/ttm_device.c +@@ -239,10 +239,6 @@ void ttm_device_fini(struct ttm_device *bdev) + struct ttm_resource_manager *man; + unsigned i; + +- man = ttm_manager_type(bdev, TTM_PL_SYSTEM); +- ttm_resource_manager_set_used(man, false); +- ttm_set_driver_manager(bdev, TTM_PL_SYSTEM, NULL); +- + mutex_lock(&ttm_global_mutex); + list_del(&bdev->device_list); + mutex_unlock(&ttm_global_mutex); +@@ -252,6 +248,10 @@ void ttm_device_fini(struct ttm_device *bdev) + if (ttm_bo_delayed_delete(bdev, true)) + pr_debug("Delayed destroy list was clean\n"); + ++ man = ttm_manager_type(bdev, TTM_PL_SYSTEM); ++ ttm_resource_manager_set_used(man, false); ++ ttm_set_driver_manager(bdev, TTM_PL_SYSTEM, NULL); ++ + spin_lock(&bdev->lru_lock); + for (i = 0; i < TTM_MAX_BO_PRIORITY; ++i) + if (list_empty(&man->lru[0])) +-- +2.42.0 + diff --git a/queue-6.1/efi-fix-memory-leak-in-krealloc-failure-handling.patch b/queue-6.1/efi-fix-memory-leak-in-krealloc-failure-handling.patch new file mode 100644 index 00000000000..95dbbe67704 --- /dev/null +++ b/queue-6.1/efi-fix-memory-leak-in-krealloc-failure-handling.patch @@ -0,0 +1,46 @@ +From 10251b36ada9bab401bead67e0cd1b72403fa327 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Sep 2023 22:26:33 +0800 +Subject: efi: fix memory leak in krealloc failure handling + +From: Kuan-Wei Chiu + +[ Upstream commit 0d3ad1917996839a5042d18f04e41915cfa1b74a ] + +In the previous code, there was a memory leak issue where the +previously allocated memory was not freed upon a failed krealloc +operation. This patch addresses the problem by releasing the old memory +before setting the pointer to NULL in case of a krealloc failure. This +ensures that memory is properly managed and avoids potential memory +leaks. + +Signed-off-by: Kuan-Wei Chiu +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/efi.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c +index b43e5e6ddaf6e..b7c0e8cc0764f 100644 +--- a/drivers/firmware/efi/efi.c ++++ b/drivers/firmware/efi/efi.c +@@ -245,9 +245,13 @@ static __init int efivar_ssdt_load(void) + if (status == EFI_NOT_FOUND) { + break; + } else if (status == EFI_BUFFER_TOO_SMALL) { +- name = krealloc(name, name_size, GFP_KERNEL); +- if (!name) ++ efi_char16_t *name_tmp = ++ krealloc(name, name_size, GFP_KERNEL); ++ if (!name_tmp) { ++ kfree(name); + return -ENOMEM; ++ } ++ name = name_tmp; + continue; + } + +-- +2.42.0 + diff --git a/queue-6.1/fbdev-atyfb-only-use-ioremap_uc-on-i386-and-ia64.patch b/queue-6.1/fbdev-atyfb-only-use-ioremap_uc-on-i386-and-ia64.patch new file mode 100644 index 00000000000..bef84754d43 --- /dev/null +++ b/queue-6.1/fbdev-atyfb-only-use-ioremap_uc-on-i386-and-ia64.patch @@ -0,0 +1,58 @@ +From c2a51dff1aa734c413248b7329df885defd7f406 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Sep 2023 19:04:21 +0800 +Subject: fbdev: atyfb: only use ioremap_uc() on i386 and ia64 + +From: Arnd Bergmann + +[ Upstream commit c1a8d1d0edb71dec15c9649cb56866c71c1ecd9e ] + +ioremap_uc() is only meaningful on old x86-32 systems with the PAT +extension, and on ia64 with its slightly unconventional ioremap() +behavior, everywhere else this is the same as ioremap() anyway. + +Change the only driver that still references ioremap_uc() to only do so +on x86-32/ia64 in order to allow removing that interface at some +point in the future for the other architectures. + +On some architectures, ioremap_uc() just returns NULL, changing +the driver to call ioremap() means that they now have a chance +of working correctly. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Baoquan He +Reviewed-by: Luis Chamberlain +Cc: Helge Deller +Cc: Thomas Zimmermann +Cc: Christophe Leroy +Cc: linux-fbdev@vger.kernel.org +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/aty/atyfb_base.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c +index b3463d1371520..faaa64fa5dfe9 100644 +--- a/drivers/video/fbdev/aty/atyfb_base.c ++++ b/drivers/video/fbdev/aty/atyfb_base.c +@@ -3447,11 +3447,15 @@ static int atyfb_setup_generic(struct pci_dev *pdev, struct fb_info *info, + } + + info->fix.mmio_start = raddr; ++#if defined(__i386__) || defined(__ia64__) + /* + * By using strong UC we force the MTRR to never have an + * effect on the MMIO region on both non-PAT and PAT systems. + */ + par->ati_regbase = ioremap_uc(info->fix.mmio_start, 0x1000); ++#else ++ par->ati_regbase = ioremap(info->fix.mmio_start, 0x1000); ++#endif + if (par->ati_regbase == NULL) + return -ENOMEM; + +-- +2.42.0 + diff --git a/queue-6.1/fbdev-omapfb-fix-some-error-codes.patch b/queue-6.1/fbdev-omapfb-fix-some-error-codes.patch new file mode 100644 index 00000000000..56d53aeef6f --- /dev/null +++ b/queue-6.1/fbdev-omapfb-fix-some-error-codes.patch @@ -0,0 +1,41 @@ +From 55322384849ac2baeb973715eeb0d7af07e7937d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Oct 2023 14:19:52 +0300 +Subject: fbdev: omapfb: fix some error codes + +From: Dan Carpenter + +[ Upstream commit dc608db793731426938baa2f0e75a4a3cce5f5cf ] + +Return negative -ENXIO instead of positive ENXIO. + +Signed-off-by: Dan Carpenter +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/omap/omapfb_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c +index 17cda57656838..5ea7c52baa5a8 100644 +--- a/drivers/video/fbdev/omap/omapfb_main.c ++++ b/drivers/video/fbdev/omap/omapfb_main.c +@@ -1643,13 +1643,13 @@ static int omapfb_do_probe(struct platform_device *pdev, + } + fbdev->int_irq = platform_get_irq(pdev, 0); + if (fbdev->int_irq < 0) { +- r = ENXIO; ++ r = -ENXIO; + goto cleanup; + } + + fbdev->ext_irq = platform_get_irq(pdev, 1); + if (fbdev->ext_irq < 0) { +- r = ENXIO; ++ r = -ENXIO; + goto cleanup; + } + +-- +2.42.0 + diff --git a/queue-6.1/fbdev-uvesafb-call-cn_del_callback-at-the-end-of-uve.patch b/queue-6.1/fbdev-uvesafb-call-cn_del_callback-at-the-end-of-uve.patch new file mode 100644 index 00000000000..36b9edd9499 --- /dev/null +++ b/queue-6.1/fbdev-uvesafb-call-cn_del_callback-at-the-end-of-uve.patch @@ -0,0 +1,41 @@ +From 7f6f5d5c3f1c5994b1a27e6ed3845fe7a70c0c5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Oct 2023 17:43:47 -0300 +Subject: fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit() + +From: Jorge Maidana + +[ Upstream commit 1022e7e2f40574c74ed32c3811b03d26b0b81daf ] + +Delete the v86d netlink only after all the VBE tasks have been +completed. + +Fixes initial state restore on module unload: +uvesafb: VBE state restore call failed (eax=0x4f04, err=-19) + +Signed-off-by: Jorge Maidana +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/uvesafb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c +index 0e3cabbec4b40..a85463db9f986 100644 +--- a/drivers/video/fbdev/uvesafb.c ++++ b/drivers/video/fbdev/uvesafb.c +@@ -1935,10 +1935,10 @@ static void uvesafb_exit(void) + } + } + +- cn_del_callback(&uvesafb_cn_id); + driver_remove_file(&uvesafb_driver.driver, &driver_attr_v86d); + platform_device_unregister(uvesafb_device); + platform_driver_unregister(&uvesafb_driver); ++ cn_del_callback(&uvesafb_cn_id); + } + + module_exit(uvesafb_exit); +-- +2.42.0 + diff --git a/queue-6.1/fs-ntfs3-add-ckeck-in-ni_update_parent.patch b/queue-6.1/fs-ntfs3-add-ckeck-in-ni_update_parent.patch new file mode 100644 index 00000000000..8ffcc89ffb8 --- /dev/null +++ b/queue-6.1/fs-ntfs3-add-ckeck-in-ni_update_parent.patch @@ -0,0 +1,37 @@ +From 359abc1880f6adda2019462c80a2c49d78c84f45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 15:52:19 +0400 +Subject: fs/ntfs3: Add ckeck in ni_update_parent() + +From: Konstantin Komarov + +[ Upstream commit 87d1888aa40f25773fa0b948bcb2545f97e2cb15 ] + +Check simple case when parent inode equals current inode. + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/frecord.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c +index dda13e1f1b330..166c3c49530ec 100644 +--- a/fs/ntfs3/frecord.c ++++ b/fs/ntfs3/frecord.c +@@ -3198,6 +3198,12 @@ static bool ni_update_parent(struct ntfs_inode *ni, struct NTFS_DUP_INFO *dup, + if (!fname || !memcmp(&fname->dup, dup, sizeof(fname->dup))) + continue; + ++ /* Check simple case when parent inode equals current inode. */ ++ if (ino_get(&fname->home) == ni->vfs_inode.i_ino) { ++ ntfs_set_state(sbi, NTFS_DIRTY_ERROR); ++ continue; ++ } ++ + /* ntfs_iget5 may sleep. */ + dir = ntfs_iget5(sb, &fname->home, NULL); + if (IS_ERR(dir)) { +-- +2.42.0 + diff --git a/queue-6.1/fs-ntfs3-avoid-possible-memory-leak.patch b/queue-6.1/fs-ntfs3-avoid-possible-memory-leak.patch new file mode 100644 index 00000000000..710e0c0c66b --- /dev/null +++ b/queue-6.1/fs-ntfs3-avoid-possible-memory-leak.patch @@ -0,0 +1,41 @@ +From e99ce7e376e848f31053e3419cd88f90b40ef502 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Sep 2023 12:48:07 +0800 +Subject: fs/ntfs3: Avoid possible memory leak + +From: Su Hui + +[ Upstream commit e4494770a5cad3c9d1d2a65ed15d07656c0d9b82 ] + +smatch warn: +fs/ntfs3/fslog.c:2172 last_log_lsn() warn: possible memory leak of 'page_bufs' +Jump to label 'out' to free 'page_bufs' and is more consistent with +other code. + +Signed-off-by: Su Hui +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fslog.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c +index 00faf41d8f97d..710cb5aa5a65b 100644 +--- a/fs/ntfs3/fslog.c ++++ b/fs/ntfs3/fslog.c +@@ -2169,8 +2169,10 @@ static int last_log_lsn(struct ntfs_log *log) + + if (!page) { + page = kmalloc(log->page_size, GFP_NOFS); +- if (!page) +- return -ENOMEM; ++ if (!page) { ++ err = -ENOMEM; ++ goto out; ++ } + } + + /* +-- +2.42.0 + diff --git a/queue-6.1/fs-ntfs3-fix-directory-element-type-detection.patch b/queue-6.1/fs-ntfs3-fix-directory-element-type-detection.patch new file mode 100644 index 00000000000..ed85974ca27 --- /dev/null +++ b/queue-6.1/fs-ntfs3-fix-directory-element-type-detection.patch @@ -0,0 +1,44 @@ +From 718d4a2a5a87a7d68ed0d4c1c8f1c50b4f0848be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Sep 2023 21:50:32 -0700 +Subject: fs/ntfs3: Fix directory element type detection + +From: Gabriel Marcano + +[ Upstream commit 85a4780dc96ed9dd643bbadf236552b3320fae26 ] + +Calling stat() from userspace correctly identified junctions in an NTFS +partition as symlinks, but using readdir() and iterating through the +directory containing the same junction did not identify the junction +as a symlink. + +When emitting directory contents, check FILE_ATTRIBUTE_REPARSE_POINT +attribute to detect junctions and report them as links. + +Signed-off-by: Gabriel Marcano +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/dir.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c +index fb438d6040409..d4d9f4ffb6d9a 100644 +--- a/fs/ntfs3/dir.c ++++ b/fs/ntfs3/dir.c +@@ -309,7 +309,11 @@ static inline int ntfs_filldir(struct ntfs_sb_info *sbi, struct ntfs_inode *ni, + return 0; + } + +- dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG; ++ /* NTFS: symlinks are "dir + reparse" or "file + reparse" */ ++ if (fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT) ++ dt_type = DT_LNK; ++ else ++ dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG; + + return !dir_emit(ctx, (s8 *)name, name_len, ino, dt_type); + } +-- +2.42.0 + diff --git a/queue-6.1/fs-ntfs3-fix-null-pointer-dereference-on-error-in-at.patch b/queue-6.1/fs-ntfs3-fix-null-pointer-dereference-on-error-in-at.patch new file mode 100644 index 00000000000..48f2530f395 --- /dev/null +++ b/queue-6.1/fs-ntfs3-fix-null-pointer-dereference-on-error-in-at.patch @@ -0,0 +1,36 @@ +From a1a19da1f0c9a64854616aee5678e109e7bde15c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Sep 2023 11:28:11 +0300 +Subject: fs/ntfs3: Fix NULL pointer dereference on error in + attr_allocate_frame() + +From: Konstantin Komarov + +[ Upstream commit 9c689c8dc86f8ca99bf91c05f24c8bab38fe7d5f ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 63169529b52c4..2215179c925b3 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -1658,10 +1658,8 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size, + le_b = NULL; + attr_b = ni_find_attr(ni, NULL, &le_b, ATTR_DATA, NULL, + 0, NULL, &mi_b); +- if (!attr_b) { +- err = -ENOENT; +- goto out; +- } ++ if (!attr_b) ++ return -ENOENT; + + attr = attr_b; + le = le_b; +-- +2.42.0 + diff --git a/queue-6.1/fs-ntfs3-fix-possible-null-ptr-deref-in-ni_readpage_.patch b/queue-6.1/fs-ntfs3-fix-possible-null-ptr-deref-in-ni_readpage_.patch new file mode 100644 index 00000000000..f672e32e6a7 --- /dev/null +++ b/queue-6.1/fs-ntfs3-fix-possible-null-ptr-deref-in-ni_readpage_.patch @@ -0,0 +1,31 @@ +From 0fd10ddae05594b565fd05c60f8d112d42ce6ed1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Sep 2023 11:19:08 +0300 +Subject: fs/ntfs3: Fix possible NULL-ptr-deref in ni_readpage_cmpr() + +From: Konstantin Komarov + +[ Upstream commit 32e9212256b88f35466642f9c939bb40cfb2c2de ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/frecord.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c +index 166c3c49530ec..bb7e33c240737 100644 +--- a/fs/ntfs3/frecord.c ++++ b/fs/ntfs3/frecord.c +@@ -2149,7 +2149,7 @@ int ni_readpage_cmpr(struct ntfs_inode *ni, struct page *page) + + for (i = 0; i < pages_per_frame; i++) { + pg = pages[i]; +- if (i == idx) ++ if (i == idx || !pg) + continue; + unlock_page(pg); + put_page(pg); +-- +2.42.0 + diff --git a/queue-6.1/fs-ntfs3-use-kvmalloc-instead-of-kmalloc-.-__gfp_now.patch b/queue-6.1/fs-ntfs3-use-kvmalloc-instead-of-kmalloc-.-__gfp_now.patch new file mode 100644 index 00000000000..463de1fce6f --- /dev/null +++ b/queue-6.1/fs-ntfs3-use-kvmalloc-instead-of-kmalloc-.-__gfp_now.patch @@ -0,0 +1,80 @@ +From e707ee9da0f79c05aa0b925ce0b5216f4d78f252 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 16:12:58 +0400 +Subject: fs/ntfs3: Use kvmalloc instead of kmalloc(... __GFP_NOWARN) + +From: Konstantin Komarov + +[ Upstream commit fc471e39e38fea6677017cbdd6d928088a59fc67 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrlist.c | 15 +++++++++++++-- + fs/ntfs3/bitmap.c | 3 ++- + fs/ntfs3/super.c | 2 +- + 3 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c +index 81c22df27c725..0c6a68e71e7d4 100644 +--- a/fs/ntfs3/attrlist.c ++++ b/fs/ntfs3/attrlist.c +@@ -52,7 +52,8 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + + if (!attr->non_res) { + lsize = le32_to_cpu(attr->res.data_size); +- le = kmalloc(al_aligned(lsize), GFP_NOFS | __GFP_NOWARN); ++ /* attr is resident: lsize < record_size (1K or 4K) */ ++ le = kvmalloc(al_aligned(lsize), GFP_KERNEL); + if (!le) { + err = -ENOMEM; + goto out; +@@ -80,7 +81,17 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + if (err < 0) + goto out; + +- le = kmalloc(al_aligned(lsize), GFP_NOFS | __GFP_NOWARN); ++ /* attr is nonresident. ++ * The worst case: ++ * 1T (2^40) extremely fragmented file. ++ * cluster = 4K (2^12) => 2^28 fragments ++ * 2^9 fragments per one record => 2^19 records ++ * 2^5 bytes of ATTR_LIST_ENTRY per one record => 2^24 bytes. ++ * ++ * the result is 16M bytes per attribute list. ++ * Use kvmalloc to allocate in range [several Kbytes - dozen Mbytes] ++ */ ++ le = kvmalloc(al_aligned(lsize), GFP_KERNEL); + if (!le) { + err = -ENOMEM; + goto out; +diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c +index e0cdc91d88a85..c055bbdfe0f7c 100644 +--- a/fs/ntfs3/bitmap.c ++++ b/fs/ntfs3/bitmap.c +@@ -662,7 +662,8 @@ int wnd_init(struct wnd_bitmap *wnd, struct super_block *sb, size_t nbits) + wnd->bits_last = wbits; + + wnd->free_bits = +- kcalloc(wnd->nwnd, sizeof(u16), GFP_NOFS | __GFP_NOWARN); ++ kvmalloc_array(wnd->nwnd, sizeof(u16), GFP_KERNEL | __GFP_ZERO); ++ + if (!wnd->free_bits) + return -ENOMEM; + +diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c +index 8e2fe0f69203b..6066eea3f61cb 100644 +--- a/fs/ntfs3/super.c ++++ b/fs/ntfs3/super.c +@@ -1141,7 +1141,7 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc) + goto put_inode_out; + } + bytes = inode->i_size; +- sbi->def_table = t = kmalloc(bytes, GFP_NOFS | __GFP_NOWARN); ++ sbi->def_table = t = kvmalloc(bytes, GFP_KERNEL); + if (!t) { + err = -ENOMEM; + goto put_inode_out; +-- +2.42.0 + diff --git a/queue-6.1/fs-ntfs3-write-immediately-updated-ntfs-state.patch b/queue-6.1/fs-ntfs3-write-immediately-updated-ntfs-state.patch new file mode 100644 index 00000000000..532b0c6ac98 --- /dev/null +++ b/queue-6.1/fs-ntfs3-write-immediately-updated-ntfs-state.patch @@ -0,0 +1,44 @@ +From 5ad679dc956a2de9def84859ed2c6e0508d115b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 15:57:19 +0400 +Subject: fs/ntfs3: Write immediately updated ntfs state + +From: Konstantin Komarov + +[ Upstream commit 06ccfb00645990a9fcc14249e6d1c25921ecb836 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fsntfs.c | 13 +++---------- + 1 file changed, 3 insertions(+), 10 deletions(-) + +diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c +index 9c0fc3a29d0c9..873b1434a9989 100644 +--- a/fs/ntfs3/fsntfs.c ++++ b/fs/ntfs3/fsntfs.c +@@ -953,18 +953,11 @@ int ntfs_set_state(struct ntfs_sb_info *sbi, enum NTFS_DIRTY_FLAGS dirty) + if (err) + return err; + +- mark_inode_dirty(&ni->vfs_inode); ++ mark_inode_dirty_sync(&ni->vfs_inode); + /* verify(!ntfs_update_mftmirr()); */ + +- /* +- * If we used wait=1, sync_inode_metadata waits for the io for the +- * inode to finish. It hangs when media is removed. +- * So wait=0 is sent down to sync_inode_metadata +- * and filemap_fdatawrite is used for the data blocks. +- */ +- err = sync_inode_metadata(&ni->vfs_inode, 0); +- if (!err) +- err = filemap_fdatawrite(ni->vfs_inode.i_mapping); ++ /* write mft record on disk. */ ++ err = _ni_write_inode(&ni->vfs_inode, 1); + + return err; + } +-- +2.42.0 + diff --git a/queue-6.1/gpu-drm-eliminate-drm_sched_priority_unset.patch b/queue-6.1/gpu-drm-eliminate-drm_sched_priority_unset.patch new file mode 100644 index 00000000000..863fd7337c2 --- /dev/null +++ b/queue-6.1/gpu-drm-eliminate-drm_sched_priority_unset.patch @@ -0,0 +1,59 @@ +From 5dc31e59e56b903257914af0d1338b4a2ec26bb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Oct 2023 22:48:56 -0400 +Subject: gpu/drm: Eliminate DRM_SCHED_PRIORITY_UNSET +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luben Tuikov + +[ Upstream commit fa8391ad68c16716e2c06ada397e99ceed2fb647 ] + +Eliminate DRM_SCHED_PRIORITY_UNSET, value of -2, whose only user was +amdgpu. Furthermore, eliminate an index bug, in that when amdgpu boots, it +calls drm_sched_entity_init() with DRM_SCHED_PRIORITY_UNSET, which uses it to +index sched->sched_rq[]. + +Cc: Alex Deucher +Cc: Christian König +Signed-off-by: Luben Tuikov +Acked-by: Alex Deucher +Link: https://lore.kernel.org/r/20231017035656.8211-2-luben.tuikov@amd.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 3 ++- + include/drm/gpu_scheduler.h | 3 +-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c +index fdbeafda4e80a..1ed2142a6e7bf 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c +@@ -64,7 +64,8 @@ amdgpu_ctx_to_drm_sched_prio(int32_t ctx_prio) + { + switch (ctx_prio) { + case AMDGPU_CTX_PRIORITY_UNSET: +- return DRM_SCHED_PRIORITY_UNSET; ++ pr_warn_once("AMD-->DRM context priority value UNSET-->NORMAL"); ++ return DRM_SCHED_PRIORITY_NORMAL; + + case AMDGPU_CTX_PRIORITY_VERY_LOW: + return DRM_SCHED_PRIORITY_MIN; +diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h +index 2ae4fd62e01c4..17e7e3145a058 100644 +--- a/include/drm/gpu_scheduler.h ++++ b/include/drm/gpu_scheduler.h +@@ -55,8 +55,7 @@ enum drm_sched_priority { + DRM_SCHED_PRIORITY_HIGH, + DRM_SCHED_PRIORITY_KERNEL, + +- DRM_SCHED_PRIORITY_COUNT, +- DRM_SCHED_PRIORITY_UNSET = -2 ++ DRM_SCHED_PRIORITY_COUNT + }; + + /** +-- +2.42.0 + diff --git a/queue-6.1/input-synaptics-rmi4-handle-reset-delay-when-using-s.patch b/queue-6.1/input-synaptics-rmi4-handle-reset-delay-when-using-s.patch new file mode 100644 index 00000000000..9ead45ab56c --- /dev/null +++ b/queue-6.1/input-synaptics-rmi4-handle-reset-delay-when-using-s.patch @@ -0,0 +1,135 @@ +From 101bff8ef24f52aebb1d31da12238ab074809078 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Oct 2023 17:29:57 -0700 +Subject: Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport + +From: Dmitry Torokhov + +[ Upstream commit 5030b2fe6aab37fe42d14f31842ea38be7c55c57 ] + +Touch controllers need some time after receiving reset command for the +firmware to finish re-initializing and be ready to respond to commands +from the host. The driver already had handling for the post-reset delay +for I2C and SPI transports, this change adds the handling to +SMBus-connected devices. + +SMBus devices are peculiar because they implement legacy PS/2 +compatibility mode, so reset is actually issued by psmouse driver on the +associated serio port, after which the control is passed to the RMI4 +driver with SMBus companion device. + +Note that originally the delay was added to psmouse driver in +92e24e0e57f7 ("Input: psmouse - add delay when deactivating for SMBus +mode"), but that resulted in an unwanted delay in "fast" reconnect +handler for the serio port, so it was decided to revert the patch and +have the delay being handled in the RMI4 driver, similar to the other +transports. + +Tested-by: Jeffery Miller +Link: https://lore.kernel.org/r/ZR1yUFJ8a9Zt606N@penguin +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/synaptics.c | 1 + + drivers/input/rmi4/rmi_smbus.c | 50 ++++++++++++++++++--------------- + 2 files changed, 29 insertions(+), 22 deletions(-) + +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index d2c9f4cbd00c6..e43e93ac2798a 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -1753,6 +1753,7 @@ static int synaptics_create_intertouch(struct psmouse *psmouse, + psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids) && + !SYN_CAP_EXT_BUTTONS_STICK(info->ext_cap_10); + const struct rmi_device_platform_data pdata = { ++ .reset_delay_ms = 30, + .sensor_pdata = { + .sensor_type = rmi_sensor_touchpad, + .axis_align.flip_y = true, +diff --git a/drivers/input/rmi4/rmi_smbus.c b/drivers/input/rmi4/rmi_smbus.c +index c130468541b7d..7080c2ddbaf2b 100644 +--- a/drivers/input/rmi4/rmi_smbus.c ++++ b/drivers/input/rmi4/rmi_smbus.c +@@ -235,12 +235,29 @@ static void rmi_smb_clear_state(struct rmi_smb_xport *rmi_smb) + + static int rmi_smb_enable_smbus_mode(struct rmi_smb_xport *rmi_smb) + { +- int retval; ++ struct i2c_client *client = rmi_smb->client; ++ int smbus_version; ++ ++ /* ++ * psmouse driver resets the controller, we only need to wait ++ * to give the firmware chance to fully reinitialize. ++ */ ++ if (rmi_smb->xport.pdata.reset_delay_ms) ++ msleep(rmi_smb->xport.pdata.reset_delay_ms); + + /* we need to get the smbus version to activate the touchpad */ +- retval = rmi_smb_get_version(rmi_smb); +- if (retval < 0) +- return retval; ++ smbus_version = rmi_smb_get_version(rmi_smb); ++ if (smbus_version < 0) ++ return smbus_version; ++ ++ rmi_dbg(RMI_DEBUG_XPORT, &client->dev, "Smbus version is %d", ++ smbus_version); ++ ++ if (smbus_version != 2 && smbus_version != 3) { ++ dev_err(&client->dev, "Unrecognized SMB version %d\n", ++ smbus_version); ++ return -ENODEV; ++ } + + return 0; + } +@@ -253,11 +270,10 @@ static int rmi_smb_reset(struct rmi_transport_dev *xport, u16 reset_addr) + rmi_smb_clear_state(rmi_smb); + + /* +- * we do not call the actual reset command, it has to be handled in +- * PS/2 or there will be races between PS/2 and SMBus. +- * PS/2 should ensure that a psmouse_reset is called before +- * intializing the device and after it has been removed to be in a known +- * state. ++ * We do not call the actual reset command, it has to be handled in ++ * PS/2 or there will be races between PS/2 and SMBus. PS/2 should ++ * ensure that a psmouse_reset is called before initializing the ++ * device and after it has been removed to be in a known state. + */ + return rmi_smb_enable_smbus_mode(rmi_smb); + } +@@ -273,7 +289,6 @@ static int rmi_smb_probe(struct i2c_client *client, + { + struct rmi_device_platform_data *pdata = dev_get_platdata(&client->dev); + struct rmi_smb_xport *rmi_smb; +- int smbus_version; + int error; + + if (!pdata) { +@@ -312,18 +327,9 @@ static int rmi_smb_probe(struct i2c_client *client, + rmi_smb->xport.proto_name = "smb"; + rmi_smb->xport.ops = &rmi_smb_ops; + +- smbus_version = rmi_smb_get_version(rmi_smb); +- if (smbus_version < 0) +- return smbus_version; +- +- rmi_dbg(RMI_DEBUG_XPORT, &client->dev, "Smbus version is %d", +- smbus_version); +- +- if (smbus_version != 2 && smbus_version != 3) { +- dev_err(&client->dev, "Unrecognized SMB version %d\n", +- smbus_version); +- return -ENODEV; +- } ++ error = rmi_smb_enable_smbus_mode(rmi_smb); ++ if (error) ++ return error; + + i2c_set_clientdata(client, rmi_smb); + +-- +2.42.0 + diff --git a/queue-6.1/io_uring-kiocb_done-should-not-trust-ki_pos-if-read-.patch b/queue-6.1/io_uring-kiocb_done-should-not-trust-ki_pos-if-read-.patch new file mode 100644 index 00000000000..5356c5fbb84 --- /dev/null +++ b/queue-6.1/io_uring-kiocb_done-should-not-trust-ki_pos-if-read-.patch @@ -0,0 +1,42 @@ +From 1bc54909c18d857c48133fcef575fae9d88dc9fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Aug 2023 18:47:31 -0400 +Subject: io_uring: kiocb_done() should *not* trust ->ki_pos if + ->{read,write}_iter() failed + +From: Al Viro + +[ Upstream commit 1939316bf988f3e49a07d9c4dd6f660bf4daa53d ] + +->ki_pos value is unreliable in such cases. For an obvious example, +consider O_DSYNC write - we feed the data to page cache and start IO, +then we make sure it's completed. Update of ->ki_pos is dealt with +by the first part; failure in the second ends up with negative value +returned _and_ ->ki_pos left advanced as if sync had been successful. +In the same situation write(2) does not advance the file position +at all. + +Reviewed-by: Christian Brauner +Reviewed-by: Jens Axboe +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + io_uring/rw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/io_uring/rw.c b/io_uring/rw.c +index 0218fae12eddc..0133db648d8e9 100644 +--- a/io_uring/rw.c ++++ b/io_uring/rw.c +@@ -326,7 +326,7 @@ static int kiocb_done(struct io_kiocb *req, ssize_t ret, + struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw); + unsigned final_ret = io_fixup_rw_res(req, ret); + +- if (req->flags & REQ_F_CUR_POS) ++ if (ret >= 0 && req->flags & REQ_F_CUR_POS) + req->file->f_pos = rw->kiocb.ki_pos; + if (ret >= 0 && (rw->kiocb.ki_complete == io_complete_rw)) { + if (!__io_complete_rw_common(req, ret)) { +-- +2.42.0 + diff --git a/queue-6.1/irqchip-riscv-intc-mark-all-intc-nodes-as-initialize.patch b/queue-6.1/irqchip-riscv-intc-mark-all-intc-nodes-as-initialize.patch new file mode 100644 index 00000000000..d54b88b45c5 --- /dev/null +++ b/queue-6.1/irqchip-riscv-intc-mark-all-intc-nodes-as-initialize.patch @@ -0,0 +1,54 @@ +From bc4bbe9dd327cfd448c323137650c7d18199cb4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Oct 2023 10:13:51 +0530 +Subject: irqchip/riscv-intc: Mark all INTC nodes as initialized + +From: Anup Patel + +[ Upstream commit e13cd66bd821be417c498a34928652db4ac6b436 ] + +The RISC-V INTC local interrupts are per-HART (or per-CPU) so we +create INTC IRQ domain only for the INTC node belonging to the boot +HART. This means only the boot HART INTC node will be marked as +initialized and other INTC nodes won't be marked which results +downstream interrupt controllers (such as PLIC, IMSIC and APLIC +direct-mode) not being probed due to missing device suppliers. + +To address this issue, we mark all INTC node for which we don't +create IRQ domain as initialized. + +Reported-by: Dmitry Dunaev +Signed-off-by: Anup Patel +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230926102801.1591126-1-dunaev@tecon.ru +Link: https://lore.kernel.org/r/20231003044403.1974628-4-apatel@ventanamicro.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-riscv-intc.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-riscv-intc.c b/drivers/irqchip/irq-riscv-intc.c +index 499e5f81b3fe3..4b66850978e6e 100644 +--- a/drivers/irqchip/irq-riscv-intc.c ++++ b/drivers/irqchip/irq-riscv-intc.c +@@ -110,8 +110,16 @@ static int __init riscv_intc_init(struct device_node *node, + * for each INTC DT node. We only need to do INTC initialization + * for the INTC DT node belonging to boot CPU (or boot HART). + */ +- if (riscv_hartid_to_cpuid(hartid) != smp_processor_id()) ++ if (riscv_hartid_to_cpuid(hartid) != smp_processor_id()) { ++ /* ++ * The INTC nodes of each CPU are suppliers for downstream ++ * interrupt controllers (such as PLIC, IMSIC and APLIC ++ * direct-mode) so we should mark an INTC node as initialized ++ * if we are not creating IRQ domain for it. ++ */ ++ fwnode_dev_initialized(of_fwnode_handle(node), true); + return 0; ++ } + + intc_domain = irq_domain_add_linear(node, BITS_PER_LONG, + &riscv_intc_domain_ops, NULL); +-- +2.42.0 + diff --git a/queue-6.1/irqchip-stm32-exti-add-missing-dt-irq-flag-translati.patch b/queue-6.1/irqchip-stm32-exti-add-missing-dt-irq-flag-translati.patch new file mode 100644 index 00000000000..cdd846c2cf5 --- /dev/null +++ b/queue-6.1/irqchip-stm32-exti-add-missing-dt-irq-flag-translati.patch @@ -0,0 +1,37 @@ +From 716da56b9ca0ab56a2a0ec63df16c79c501391d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Oct 2023 12:20:03 -0400 +Subject: irqchip/stm32-exti: add missing DT IRQ flag translation + +From: Ben Wolsieffer + +[ Upstream commit 8554cba1d6dbd3c74e0549e28ddbaccbb1d6b30a ] + +The STM32F4/7 EXTI driver was missing the xlate callback, so IRQ trigger +flags specified in the device tree were being ignored. This was +preventing the RTC alarm interrupt from working, because it must be set +to trigger on the rising edge to function correctly. + +Signed-off-by: Ben Wolsieffer +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20231003162003.1649967-1-ben.wolsieffer@hefring.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-stm32-exti.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c +index 8bbb2b114636c..dc6f67decb022 100644 +--- a/drivers/irqchip/irq-stm32-exti.c ++++ b/drivers/irqchip/irq-stm32-exti.c +@@ -458,6 +458,7 @@ static const struct irq_domain_ops irq_exti_domain_ops = { + .map = irq_map_generic_chip, + .alloc = stm32_exti_alloc, + .free = stm32_exti_free, ++ .xlate = irq_domain_xlate_twocell, + }; + + static void stm32_irq_ack(struct irq_data *d) +-- +2.42.0 + diff --git a/queue-6.1/loongarch-export-symbol-invalid_pud_table-for-module.patch b/queue-6.1/loongarch-export-symbol-invalid_pud_table-for-module.patch new file mode 100644 index 00000000000..087a9371a41 --- /dev/null +++ b/queue-6.1/loongarch-export-symbol-invalid_pud_table-for-module.patch @@ -0,0 +1,39 @@ +From 5374cd52398c5c53ddcc1850a80b34b0b70d0a55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Oct 2023 08:42:52 +0800 +Subject: LoongArch: Export symbol invalid_pud_table for modules building + +From: Huacai Chen + +[ Upstream commit 449c2756c2323c9e32b2a2fa9c8b59ce91b5819d ] + +Export symbol invalid_pud_table for modules building (such as the KVM +module) if 4-level page tables enabled. Otherwise we get: + +ERROR: modpost: "invalid_pud_table" [arch/loongarch/kvm/kvm.ko] undefined! + +Reported-by: Randy Dunlap +Acked-by: Randy Dunlap +Tested-by: Randy Dunlap +Signed-off-by: Tianrui Zhao +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/mm/init.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/loongarch/mm/init.c b/arch/loongarch/mm/init.c +index c7e9c96719fa3..c74da7770e39e 100644 +--- a/arch/loongarch/mm/init.c ++++ b/arch/loongarch/mm/init.c +@@ -228,6 +228,7 @@ pgd_t swapper_pg_dir[_PTRS_PER_PGD] __section(".bss..swapper_pg_dir"); + pgd_t invalid_pg_dir[_PTRS_PER_PGD] __page_aligned_bss; + #ifndef __PAGETABLE_PUD_FOLDED + pud_t invalid_pud_table[PTRS_PER_PUD] __page_aligned_bss; ++EXPORT_SYMBOL(invalid_pud_table); + #endif + #ifndef __PAGETABLE_PMD_FOLDED + pmd_t invalid_pmd_table[PTRS_PER_PMD] __page_aligned_bss; +-- +2.42.0 + diff --git a/queue-6.1/loongarch-replace-kmap_atomic-with-kmap_local_page-i.patch b/queue-6.1/loongarch-replace-kmap_atomic-with-kmap_local_page-i.patch new file mode 100644 index 00000000000..53d86fa82e2 --- /dev/null +++ b/queue-6.1/loongarch-replace-kmap_atomic-with-kmap_local_page-i.patch @@ -0,0 +1,46 @@ +From ab81980ade9ef98a1b0dfca0cf4a44b7e0ff891d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Oct 2023 08:42:52 +0800 +Subject: LoongArch: Replace kmap_atomic() with kmap_local_page() in + copy_user_highpage() + +From: Huacai Chen + +[ Upstream commit 477a0ebec101359f49d92796e3b609857d564b52 ] + +Replace kmap_atomic()/kunmap_atomic() calls with kmap_local_page()/ +kunmap_local() in copy_user_highpage() which can be invoked from both +preemptible and atomic context [1]. + +[1] https://lore.kernel.org/all/20201029222652.302358281@linutronix.de/ + +Suggested-by: Deepak R Varma +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/mm/init.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/loongarch/mm/init.c b/arch/loongarch/mm/init.c +index c74da7770e39e..f42a3be5f28d7 100644 +--- a/arch/loongarch/mm/init.c ++++ b/arch/loongarch/mm/init.c +@@ -68,11 +68,11 @@ void copy_user_highpage(struct page *to, struct page *from, + { + void *vfrom, *vto; + +- vto = kmap_atomic(to); +- vfrom = kmap_atomic(from); ++ vfrom = kmap_local_page(from); ++ vto = kmap_local_page(to); + copy_page(vto, vfrom); +- kunmap_atomic(vfrom); +- kunmap_atomic(vto); ++ kunmap_local(vfrom); ++ kunmap_local(vto); + /* Make sure this page is cleared on other CPU's too before using it */ + smp_wmb(); + } +-- +2.42.0 + diff --git a/queue-6.1/net-chelsio-cxgb4-add-an-error-code-check-in-t4_load.patch b/queue-6.1/net-chelsio-cxgb4-add-an-error-code-check-in-t4_load.patch new file mode 100644 index 00000000000..e914224067b --- /dev/null +++ b/queue-6.1/net-chelsio-cxgb4-add-an-error-code-check-in-t4_load.patch @@ -0,0 +1,35 @@ +From 2c51146e4d999c83949e75f98bd34ebe814e29f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 17:27:59 +0800 +Subject: net: chelsio: cxgb4: add an error code check in t4_load_phy_fw + +From: Su Hui + +[ Upstream commit 9f771493da935299c6393ad3563b581255d01a37 ] + +t4_set_params_timeout() can return -EINVAL if failed, add check +for this. + +Signed-off-by: Su Hui +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +index 8d719f82854a9..76de55306c4d0 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -3816,6 +3816,8 @@ int t4_load_phy_fw(struct adapter *adap, int win, + FW_PARAMS_PARAM_Z_V(FW_PARAMS_PARAM_DEV_PHYFW_DOWNLOAD)); + ret = t4_set_params_timeout(adap, adap->mbox, adap->pf, 0, 1, + ¶m, &val, 30000); ++ if (ret) ++ return ret; + + /* If we have version number support, then check to see that the new + * firmware got loaded properly. +-- +2.42.0 + diff --git a/queue-6.1/net-sched-cls_u32-fix-allocation-size-in-u32_init.patch b/queue-6.1/net-sched-cls_u32-fix-allocation-size-in-u32_init.patch new file mode 100644 index 00000000000..106be38ccdb --- /dev/null +++ b/queue-6.1/net-sched-cls_u32-fix-allocation-size-in-u32_init.patch @@ -0,0 +1,105 @@ +From dfeffffaf453f6e39ea91abb198b44d216c5c095 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Oct 2023 15:19:37 +0200 +Subject: net: sched: cls_u32: Fix allocation size in u32_init() + +From: Gustavo A. R. Silva + +[ Upstream commit c4d49196ceec80e30e8d981410d73331b49b7850 ] + +commit d61491a51f7e ("net/sched: cls_u32: Replace one-element array +with flexible-array member") incorrecly replaced an instance of +`sizeof(*tp_c)` with `struct_size(tp_c, hlist->ht, 1)`. This results +in a an over-allocation of 8 bytes. + +This change is wrong because `hlist` in `struct tc_u_common` is a +pointer: + +net/sched/cls_u32.c: +struct tc_u_common { + struct tc_u_hnode __rcu *hlist; + void *ptr; + int refcnt; + struct idr handle_idr; + struct hlist_node hnode; + long knodes; +}; + +So, the use of `struct_size()` makes no sense: we don't need to allocate +any extra space for a flexible-array member. `sizeof(*tp_c)` is just fine. + +So, `struct_size(tp_c, hlist->ht, 1)` translates to: + +sizeof(*tp_c) + sizeof(tp_c->hlist->ht) == +sizeof(struct tc_u_common) + sizeof(struct tc_u_knode *) == + 144 + 8 == 0x98 (byes) + ^^^ + | + unnecessary extra + allocation size + +$ pahole -C tc_u_common net/sched/cls_u32.o +struct tc_u_common { + struct tc_u_hnode * hlist; /* 0 8 */ + void * ptr; /* 8 8 */ + int refcnt; /* 16 4 */ + + /* XXX 4 bytes hole, try to pack */ + + struct idr handle_idr; /* 24 96 */ + /* --- cacheline 1 boundary (64 bytes) was 56 bytes ago --- */ + struct hlist_node hnode; /* 120 16 */ + /* --- cacheline 2 boundary (128 bytes) was 8 bytes ago --- */ + long int knodes; /* 136 8 */ + + /* size: 144, cachelines: 3, members: 6 */ + /* sum members: 140, holes: 1, sum holes: 4 */ + /* last cacheline: 16 bytes */ +}; + +And with `sizeof(*tp_c)`, we have: + + sizeof(*tp_c) == sizeof(struct tc_u_common) == 144 == 0x90 (bytes) + +which is the correct and original allocation size. + +Fix this issue by replacing `struct_size(tp_c, hlist->ht, 1)` with +`sizeof(*tp_c)`, and avoid allocating 8 too many bytes. + +The following difference in binary output is expected and reflects the +desired change: + +| net/sched/cls_u32.o +| @@ -6148,7 +6148,7 @@ +| include/linux/slab.h:599 +| 2cf5: mov 0x0(%rip),%rdi # 2cfc +| 2cf8: R_X86_64_PC32 kmalloc_caches+0xc +|- 2cfc: mov $0x98,%edx +|+ 2cfc: mov $0x90,%edx + +Reported-by: Alejandro Colomar +Closes: https://lore.kernel.org/lkml/09b4a2ce-da74-3a19-6961-67883f634d98@kernel.org/ +Signed-off-by: Gustavo A. R. Silva +Acked-by: Jamal Hadi Salim +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/cls_u32.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c +index ba93e2a6bdbb4..04448bfb4d3db 100644 +--- a/net/sched/cls_u32.c ++++ b/net/sched/cls_u32.c +@@ -364,7 +364,7 @@ static int u32_init(struct tcf_proto *tp) + idr_init(&root_ht->handle_idr); + + if (tp_c == NULL) { +- tp_c = kzalloc(struct_size(tp_c, hlist->ht, 1), GFP_KERNEL); ++ tp_c = kzalloc(sizeof(*tp_c), GFP_KERNEL); + if (tp_c == NULL) { + kfree(root_ht); + return -ENOBUFS; +-- +2.42.0 + diff --git a/queue-6.1/netfilter-nf_tables-audit-log-object-reset-once-per-.patch b/queue-6.1/netfilter-nf_tables-audit-log-object-reset-once-per-.patch new file mode 100644 index 00000000000..158693f6e33 --- /dev/null +++ b/queue-6.1/netfilter-nf_tables-audit-log-object-reset-once-per-.patch @@ -0,0 +1,198 @@ +From 959cd15feba4b19c84ba60c844636a5f2b317d30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Oct 2023 17:06:59 +0200 +Subject: netfilter: nf_tables: audit log object reset once per table + +From: Phil Sutter + +[ Upstream commit 1baf0152f7707c6c7e4ea815dcc1f431c0e603f9 ] + +When resetting multiple objects at once (via dump request), emit a log +message per table (or filled skb) and resurrect the 'entries' parameter +to contain the number of objects being logged for. + +To test the skb exhaustion path, perform some bulk counter and quota +adds in the kselftest. + +Signed-off-by: Phil Sutter +Reviewed-by: Richard Guy Briggs +Acked-by: Paul Moore (Audit) +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 50 +++++++++++-------- + .../testing/selftests/netfilter/nft_audit.sh | 46 +++++++++++++++++ + 2 files changed, 74 insertions(+), 22 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 5e3dbe2652dbd..5c783199b4999 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -7324,6 +7324,16 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net, + return -1; + } + ++static void audit_log_obj_reset(const struct nft_table *table, ++ unsigned int base_seq, unsigned int nentries) ++{ ++ char *buf = kasprintf(GFP_ATOMIC, "%s:%u", table->name, base_seq); ++ ++ audit_log_nfcfg(buf, table->family, nentries, ++ AUDIT_NFT_OP_OBJ_RESET, GFP_ATOMIC); ++ kfree(buf); ++} ++ + struct nft_obj_filter { + char *table; + u32 type; +@@ -7338,8 +7348,10 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) + struct net *net = sock_net(skb->sk); + int family = nfmsg->nfgen_family; + struct nftables_pernet *nft_net; ++ unsigned int entries = 0; + struct nft_object *obj; + bool reset = false; ++ int rc = 0; + + if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET) + reset = true; +@@ -7352,6 +7364,7 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) + if (family != NFPROTO_UNSPEC && family != table->family) + continue; + ++ entries = 0; + list_for_each_entry_rcu(obj, &table->objects, list) { + if (!nft_is_active(net, obj)) + goto cont; +@@ -7367,34 +7380,27 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) + filter->type != NFT_OBJECT_UNSPEC && + obj->ops->type->type != filter->type) + goto cont; +- if (reset) { +- char *buf = kasprintf(GFP_ATOMIC, +- "%s:%u", +- table->name, +- nft_net->base_seq); +- +- audit_log_nfcfg(buf, +- family, +- obj->handle, +- AUDIT_NFT_OP_OBJ_RESET, +- GFP_ATOMIC); +- kfree(buf); +- } + +- if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid, +- cb->nlh->nlmsg_seq, +- NFT_MSG_NEWOBJ, +- NLM_F_MULTI | NLM_F_APPEND, +- table->family, table, +- obj, reset) < 0) +- goto done; ++ rc = nf_tables_fill_obj_info(skb, net, ++ NETLINK_CB(cb->skb).portid, ++ cb->nlh->nlmsg_seq, ++ NFT_MSG_NEWOBJ, ++ NLM_F_MULTI | NLM_F_APPEND, ++ table->family, table, ++ obj, reset); ++ if (rc < 0) ++ break; + ++ entries++; + nl_dump_check_consistent(cb, nlmsg_hdr(skb)); + cont: + idx++; + } ++ if (reset && entries) ++ audit_log_obj_reset(table, nft_net->base_seq, entries); ++ if (rc < 0) ++ break; + } +-done: + rcu_read_unlock(); + + cb->args[0] = idx; +@@ -7499,7 +7505,7 @@ static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info, + + audit_log_nfcfg(buf, + family, +- obj->handle, ++ 1, + AUDIT_NFT_OP_OBJ_RESET, + GFP_ATOMIC); + kfree(buf); +diff --git a/tools/testing/selftests/netfilter/nft_audit.sh b/tools/testing/selftests/netfilter/nft_audit.sh +index 5267c88496d51..99ed5bd6e8402 100755 +--- a/tools/testing/selftests/netfilter/nft_audit.sh ++++ b/tools/testing/selftests/netfilter/nft_audit.sh +@@ -99,6 +99,12 @@ do_test 'nft add counter t1 c1' \ + do_test 'nft add counter t2 c1; add counter t2 c2' \ + 'table=t2 family=2 entries=2 op=nft_register_obj' + ++for ((i = 3; i <= 500; i++)); do ++ echo "add counter t2 c$i" ++done >$rulefile ++do_test "nft -f $rulefile" \ ++'table=t2 family=2 entries=498 op=nft_register_obj' ++ + # adding/updating quotas + + do_test 'nft add quota t1 q1 { 10 bytes }' \ +@@ -107,6 +113,12 @@ do_test 'nft add quota t1 q1 { 10 bytes }' \ + do_test 'nft add quota t2 q1 { 10 bytes }; add quota t2 q2 { 10 bytes }' \ + 'table=t2 family=2 entries=2 op=nft_register_obj' + ++for ((i = 3; i <= 500; i++)); do ++ echo "add quota t2 q$i { 10 bytes }" ++done >$rulefile ++do_test "nft -f $rulefile" \ ++'table=t2 family=2 entries=498 op=nft_register_obj' ++ + # changing the quota value triggers obj update path + do_test 'nft add quota t1 q1 { 20 bytes }' \ + 'table=t1 family=2 entries=1 op=nft_register_obj' +@@ -156,6 +168,40 @@ done + do_test 'nft reset set t1 s' \ + 'table=t1 family=2 entries=3 op=nft_reset_setelem' + ++# resetting counters ++ ++do_test 'nft reset counter t1 c1' \ ++'table=t1 family=2 entries=1 op=nft_reset_obj' ++ ++do_test 'nft reset counters t1' \ ++'table=t1 family=2 entries=1 op=nft_reset_obj' ++ ++do_test 'nft reset counters t2' \ ++'table=t2 family=2 entries=342 op=nft_reset_obj ++table=t2 family=2 entries=158 op=nft_reset_obj' ++ ++do_test 'nft reset counters' \ ++'table=t1 family=2 entries=1 op=nft_reset_obj ++table=t2 family=2 entries=341 op=nft_reset_obj ++table=t2 family=2 entries=159 op=nft_reset_obj' ++ ++# resetting quotas ++ ++do_test 'nft reset quota t1 q1' \ ++'table=t1 family=2 entries=1 op=nft_reset_obj' ++ ++do_test 'nft reset quotas t1' \ ++'table=t1 family=2 entries=1 op=nft_reset_obj' ++ ++do_test 'nft reset quotas t2' \ ++'table=t2 family=2 entries=315 op=nft_reset_obj ++table=t2 family=2 entries=185 op=nft_reset_obj' ++ ++do_test 'nft reset quotas' \ ++'table=t1 family=2 entries=1 op=nft_reset_obj ++table=t2 family=2 entries=314 op=nft_reset_obj ++table=t2 family=2 entries=186 op=nft_reset_obj' ++ + # deleting rules + + readarray -t handles < <(nft -a list chain t1 c1 | \ +-- +2.42.0 + diff --git a/queue-6.1/netfilter-nfnetlink_log-silence-bogus-compiler-warni.patch b/queue-6.1/netfilter-nfnetlink_log-silence-bogus-compiler-warni.patch new file mode 100644 index 00000000000..e9a7d923b65 --- /dev/null +++ b/queue-6.1/netfilter-nfnetlink_log-silence-bogus-compiler-warni.patch @@ -0,0 +1,39 @@ +From 274d2575e65df71fe4cd9bb1134f5f9556b7644e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Oct 2023 10:53:08 +0200 +Subject: netfilter: nfnetlink_log: silence bogus compiler warning + +From: Florian Westphal + +[ Upstream commit 2e1d175410972285333193837a4250a74cd472e6 ] + +net/netfilter/nfnetlink_log.c:800:18: warning: variable 'ctinfo' is uninitialized + +The warning is bogus, the variable is only used if ct is non-NULL and +always initialised in that case. Init to 0 too to silence this. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202309100514.ndBFebXN-lkp@intel.com/ +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nfnetlink_log.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c +index d97eb280cb2e8..c5ff699e30469 100644 +--- a/net/netfilter/nfnetlink_log.c ++++ b/net/netfilter/nfnetlink_log.c +@@ -690,8 +690,8 @@ nfulnl_log_packet(struct net *net, + unsigned int plen = 0; + struct nfnl_log_net *log = nfnl_log_pernet(net); + const struct nfnl_ct_hook *nfnl_ct = NULL; ++ enum ip_conntrack_info ctinfo = 0; + struct nf_conn *ct = NULL; +- enum ip_conntrack_info ctinfo; + + if (li_user && li_user->type == NF_LOG_TYPE_ULOG) + li = li_user; +-- +2.42.0 + diff --git a/queue-6.1/platform-mellanox-mlxbf-tmfifo-fix-a-warning-message.patch b/queue-6.1/platform-mellanox-mlxbf-tmfifo-fix-a-warning-message.patch new file mode 100644 index 00000000000..a0a7bd52086 --- /dev/null +++ b/queue-6.1/platform-mellanox-mlxbf-tmfifo-fix-a-warning-message.patch @@ -0,0 +1,65 @@ +From 936aed5b56b2125c1e8f9f57b5e94c5c0d05d507 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Oct 2023 19:02:35 -0400 +Subject: platform/mellanox: mlxbf-tmfifo: Fix a warning message + +From: Liming Sun + +[ Upstream commit 99c09c985e5973c8f0ad976ebae069548dd86f12 ] + +This commit fixes the smatch static checker warning in function +mlxbf_tmfifo_rxtx_word() which complains data not initialized at +line 634 when IS_VRING_DROP() is TRUE. + +Signed-off-by: Liming Sun +Link: https://lore.kernel.org/r/20231012230235.219861-1-limings@nvidia.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-tmfifo.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c +index a04ff89a7ec44..9925a6d94affc 100644 +--- a/drivers/platform/mellanox/mlxbf-tmfifo.c ++++ b/drivers/platform/mellanox/mlxbf-tmfifo.c +@@ -588,24 +588,25 @@ static void mlxbf_tmfifo_rxtx_word(struct mlxbf_tmfifo_vring *vring, + + if (vring->cur_len + sizeof(u64) <= len) { + /* The whole word. */ +- if (!IS_VRING_DROP(vring)) { +- if (is_rx) ++ if (is_rx) { ++ if (!IS_VRING_DROP(vring)) + memcpy(addr + vring->cur_len, &data, + sizeof(u64)); +- else +- memcpy(&data, addr + vring->cur_len, +- sizeof(u64)); ++ } else { ++ memcpy(&data, addr + vring->cur_len, ++ sizeof(u64)); + } + vring->cur_len += sizeof(u64); + } else { + /* Leftover bytes. */ +- if (!IS_VRING_DROP(vring)) { +- if (is_rx) ++ if (is_rx) { ++ if (!IS_VRING_DROP(vring)) + memcpy(addr + vring->cur_len, &data, + len - vring->cur_len); +- else +- memcpy(&data, addr + vring->cur_len, +- len - vring->cur_len); ++ } else { ++ data = 0; ++ memcpy(&data, addr + vring->cur_len, ++ len - vring->cur_len); + } + vring->cur_len = len; + } +-- +2.42.0 + diff --git a/queue-6.1/powerpc-85xx-fix-math-emulation-exception.patch b/queue-6.1/powerpc-85xx-fix-math-emulation-exception.patch new file mode 100644 index 00000000000..ab1f7ea5025 --- /dev/null +++ b/queue-6.1/powerpc-85xx-fix-math-emulation-exception.patch @@ -0,0 +1,47 @@ +From fd9b35864a74fb6db1aba117f76e13d6f42284a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Sep 2023 17:55:51 +0200 +Subject: powerpc/85xx: Fix math emulation exception + +From: Christophe Leroy + +[ Upstream commit 8e8a12ecbc86700b5e1a3596ce2b3c43dafad336 ] + +Booting mpc85xx_defconfig kernel on QEMU leads to: + +Bad trap at PC: fe9bab0, SR: 2d000, vector=800 +awk[82]: unhandled trap (5) at 0 nip fe9bab0 lr fe9e01c code 5 in libc-2.27.so[fe5a000+17a000] +awk[82]: code: 3aa00000 3a800010 4bffe03c 9421fff0 7ca62b78 38a00000 93c10008 83c10008 +awk[82]: code: 38210010 4bffdec8 9421ffc0 7c0802a6 d8010008 4815190d 93810030 +Trace/breakpoint trap +WARNING: no useful console + +This is because allthough CONFIG_MATH_EMULATION is selected, +Exception 800 calls unknown_exception(). + +Call emulation_assist_interrupt() instead. + +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/066caa6d9480365da9b8ed83692d7101e10ac5f8.1695657339.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/head_85xx.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/head_85xx.S b/arch/powerpc/kernel/head_85xx.S +index 52c0ab416326a..0e16aea7853b8 100644 +--- a/arch/powerpc/kernel/head_85xx.S ++++ b/arch/powerpc/kernel/head_85xx.S +@@ -394,7 +394,7 @@ interrupt_base: + #ifdef CONFIG_PPC_FPU + FP_UNAVAILABLE_EXCEPTION + #else +- EXCEPTION(0x0800, FP_UNAVAIL, FloatingPointUnavailable, unknown_exception) ++ EXCEPTION(0x0800, FP_UNAVAIL, FloatingPointUnavailable, emulation_assist_interrupt) + #endif + + /* System Call Interrupt */ +-- +2.42.0 + diff --git a/queue-6.1/powerpc-mm-fix-boot-crash-with-flatmem.patch b/queue-6.1/powerpc-mm-fix-boot-crash-with-flatmem.patch new file mode 100644 index 00000000000..fb74a4bee90 --- /dev/null +++ b/queue-6.1/powerpc-mm-fix-boot-crash-with-flatmem.patch @@ -0,0 +1,143 @@ +From 520ff3054abed7ee5bdb55fd76513e664e4de348 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Oct 2023 22:25:00 +1100 +Subject: powerpc/mm: Fix boot crash with FLATMEM + +From: Michael Ellerman + +[ Upstream commit daa9ada2093ed23d52b4c1fe6e13cf78f55cc85f ] + +Erhard reported that his G5 was crashing with v6.6-rc kernels: + + mpic: Setting up HT PICs workarounds for U3/U4 + BUG: Unable to handle kernel data access at 0xfeffbb62ffec65fe + Faulting instruction address: 0xc00000000005dc40 + Oops: Kernel access of bad area, sig: 11 [#1] + BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2 PowerMac + Modules linked in: + CPU: 0 PID: 0 Comm: swapper/0 Tainted: G T 6.6.0-rc3-PMacGS #1 + Hardware name: PowerMac11,2 PPC970MP 0x440101 PowerMac + NIP: c00000000005dc40 LR: c000000000066660 CTR: c000000000007730 + REGS: c0000000022bf510 TRAP: 0380 Tainted: G T (6.6.0-rc3-PMacGS) + MSR: 9000000000001032 CR: 44004242 XER: 00000000 + IRQMASK: 3 + GPR00: 0000000000000000 c0000000022bf7b0 c0000000010c0b00 00000000000001ac + GPR04: 0000000003c80000 0000000000000300 c0000000f20001ae 0000000000000300 + GPR08: 0000000000000006 feffbb62ffec65ff 0000000000000001 0000000000000000 + GPR12: 9000000000001032 c000000002362000 c000000000f76b80 000000000349ecd8 + GPR16: 0000000002367ba8 0000000002367f08 0000000000000006 0000000000000000 + GPR20: 00000000000001ac c000000000f6f920 c0000000022cd985 000000000000000c + GPR24: 0000000000000300 00000003b0a3691d c0003e008030000e 0000000000000000 + GPR28: c00000000000000c c0000000f20001ee feffbb62ffec65fe 00000000000001ac + NIP hash_page_do_lazy_icache+0x50/0x100 + LR __hash_page_4K+0x420/0x590 + Call Trace: + hash_page_mm+0x364/0x6f0 + do_hash_fault+0x114/0x2b0 + data_access_common_virt+0x198/0x1f0 + --- interrupt: 300 at mpic_init+0x4bc/0x10c4 + NIP: c000000002020a5c LR: c000000002020a04 CTR: 0000000000000000 + REGS: c0000000022bf9f0 TRAP: 0300 Tainted: G T (6.6.0-rc3-PMacGS) + MSR: 9000000000001032 CR: 24004248 XER: 00000000 + DAR: c0003e008030000e DSISR: 40000000 IRQMASK: 1 + ... + NIP mpic_init+0x4bc/0x10c4 + LR mpic_init+0x464/0x10c4 + --- interrupt: 300 + pmac_setup_one_mpic+0x258/0x2dc + pmac_pic_init+0x28c/0x3d8 + init_IRQ+0x90/0x140 + start_kernel+0x57c/0x78c + start_here_common+0x1c/0x20 + +A bisect pointed to the breakage beginning with commit 9fee28baa601 ("powerpc: +implement the new page table range API"). + +Analysis of the oops pointed to a struct page with a corrupted +compound_head being loaded via page_folio() -> _compound_head() in +hash_page_do_lazy_icache(). + +The access by the mpic code is to an MMIO address, so the expectation +is that the struct page for that address would be initialised by +init_unavailable_range(), as pointed out by Aneesh. + +Instrumentation showed that was not the case, which eventually lead to +the realisation that pfn_valid() was returning false for that address, +causing the struct page to not be initialised. + +Because the system is using FLATMEM, the version of pfn_valid() in +memory_model.h is used: + +static inline int pfn_valid(unsigned long pfn) +{ + ... + return pfn >= pfn_offset && (pfn - pfn_offset) < max_mapnr; +} + +Which relies on max_mapnr being initialised. Early in boot max_mapnr is +zero meaning no PFNs are valid. + +max_mapnr is initialised in mem_init() called via: + + start_kernel() + mm_core_init() # init/main.c:928 + mem_init() + +But that is too late for the usage in init_unavailable_range() called via: + + start_kernel() + setup_arch() # init/main.c:893 + paging_init() + free_area_init() + init_unavailable_range() + +Although max_mapnr is currently set in mem_init(), the value is actually +already available much earlier, as soon as mem_topology_setup() has +completed, which is also before paging_init() is called. So move the +initialisation there, which causes paging_init() to correctly initialise +the struct page and fixes the bug. + +This bug seems to have been lurking for years, but went unnoticed +because the pre-folio code was inspecting the uninitialised page->flags +but not dereferencing it. + +Thanks to Erhard and Aneesh for help debugging. + +Reported-by: Erhard Furtner +Closes: https://lore.kernel.org/all/20230929132750.3cd98452@yea/ +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20231023112500.1550208-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/setup-common.c | 2 ++ + arch/powerpc/mm/mem.c | 1 - + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c +index efb301a4987ca..59b4ac57bfaf7 100644 +--- a/arch/powerpc/kernel/setup-common.c ++++ b/arch/powerpc/kernel/setup-common.c +@@ -946,6 +946,8 @@ void __init setup_arch(char **cmdline_p) + + /* Parse memory topology */ + mem_topology_setup(); ++ /* Set max_mapnr before paging_init() */ ++ set_max_mapnr(max_pfn); + + /* + * Release secondary cpus out of their spinloops at 0x60 now that +diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c +index 84d171953ba44..c7599b1737099 100644 +--- a/arch/powerpc/mm/mem.c ++++ b/arch/powerpc/mm/mem.c +@@ -288,7 +288,6 @@ void __init mem_init(void) + #endif + + high_memory = (void *) __va(max_low_pfn * PAGE_SIZE); +- set_max_mapnr(max_pfn); + + kasan_late_init(); + +-- +2.42.0 + diff --git a/queue-6.1/r8152-check-for-unplug-in-r8153b_ups_en-r8153c_ups_e.patch b/queue-6.1/r8152-check-for-unplug-in-r8153b_ups_en-r8153c_ups_e.patch new file mode 100644 index 00000000000..2142ce3165f --- /dev/null +++ b/queue-6.1/r8152-check-for-unplug-in-r8153b_ups_en-r8153c_ups_e.patch @@ -0,0 +1,47 @@ +From 645fdf73995d0ff271e847cd8c0d717185fab89b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 14:06:57 -0700 +Subject: r8152: Check for unplug in r8153b_ups_en() / r8153c_ups_en() + +From: Douglas Anderson + +[ Upstream commit bc65cc42af737a5a35f83842408ef2c6c79ba025 ] + +If the adapter is unplugged while we're looping in r8153b_ups_en() / +r8153c_ups_en() we could end up looping for 10 seconds (20 ms * 500 +loops). Add code similar to what's done in other places in the driver +to check for unplug and bail. + +Signed-off-by: Douglas Anderson +Reviewed-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 3cdb7ff25a3bc..345e341d22338 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -3655,6 +3655,8 @@ static void r8153b_ups_en(struct r8152 *tp, bool enable) + int i; + + for (i = 0; i < 500; i++) { ++ if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ return; + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) + break; +@@ -3695,6 +3697,8 @@ static void r8153c_ups_en(struct r8152 *tp, bool enable) + int i; + + for (i = 0; i < 500; i++) { ++ if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ return; + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) + break; +-- +2.42.0 + diff --git a/queue-6.1/r8152-check-for-unplug-in-rtl_phy_patch_request.patch b/queue-6.1/r8152-check-for-unplug-in-rtl_phy_patch_request.patch new file mode 100644 index 00000000000..76e18b84dda --- /dev/null +++ b/queue-6.1/r8152-check-for-unplug-in-rtl_phy_patch_request.patch @@ -0,0 +1,39 @@ +From ba7306a665524d99254804ab05ae8591ceae4a95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 14:06:56 -0700 +Subject: r8152: Check for unplug in rtl_phy_patch_request() + +From: Douglas Anderson + +[ Upstream commit dc90ba37a8c37042407fa6970b9830890cfe6047 ] + +If the adapter is unplugged while we're looping in +rtl_phy_patch_request() we could end up looping for 10 seconds (2 ms * +5000 loops). Add code similar to what's done in other places in the +driver to check for unplug and bail. + +Signed-off-by: Douglas Anderson +Reviewed-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index c34974f7dfd26..3cdb7ff25a3bc 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -4058,6 +4058,9 @@ static int rtl_phy_patch_request(struct r8152 *tp, bool request, bool wait) + for (i = 0; wait && i < 5000; i++) { + u32 ocp_data; + ++ if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ break; ++ + usleep_range(1000, 2000); + ocp_data = ocp_reg_read(tp, OCP_PHY_PATCH_STAT); + if ((ocp_data & PATCH_READY) ^ check) +-- +2.42.0 + diff --git a/queue-6.1/r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch b/queue-6.1/r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch new file mode 100644 index 00000000000..91196a3ff46 --- /dev/null +++ b/queue-6.1/r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch @@ -0,0 +1,457 @@ +From affd72461635cea5a2c3bbfb9ed2e0a14766a4b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 14:06:58 -0700 +Subject: r8152: Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE + +From: Douglas Anderson + +[ Upstream commit 715f67f33af45ce2cc3a5b1ef133cc8c8e7787b0 ] + +Whenever the RTL8152_UNPLUG is set that just tells the driver that all +accesses will fail and we should just immediately bail. A future patch +will use this same concept at a time when the driver hasn't actually +been unplugged but is about to be reset. Rename the flag in +preparation for the future patch. + +This is a no-op change and just a search and replace. + +Signed-off-by: Douglas Anderson +Reviewed-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 96 ++++++++++++++++++++--------------------- + 1 file changed, 48 insertions(+), 48 deletions(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 345e341d22338..76792269222ea 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -763,7 +763,7 @@ enum rtl_register_content { + + /* rtl8152 flags */ + enum rtl8152_flags { +- RTL8152_UNPLUG = 0, ++ RTL8152_INACCESSIBLE = 0, + RTL8152_SET_RX_MODE, + WORK_ENABLE, + RTL8152_LINK_CHG, +@@ -1244,7 +1244,7 @@ int set_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data) + static void rtl_set_unplug(struct r8152 *tp) + { + if (tp->udev->state == USB_STATE_NOTATTACHED) { +- set_bit(RTL8152_UNPLUG, &tp->flags); ++ set_bit(RTL8152_INACCESSIBLE, &tp->flags); + smp_mb__after_atomic(); + } + } +@@ -1255,7 +1255,7 @@ static int generic_ocp_read(struct r8152 *tp, u16 index, u16 size, + u16 limit = 64; + int ret = 0; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + /* both size and indix must be 4 bytes align */ +@@ -1299,7 +1299,7 @@ static int generic_ocp_write(struct r8152 *tp, u16 index, u16 byteen, + u16 byteen_start, byteen_end, byen; + u16 limit = 512; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + /* both size and indix must be 4 bytes align */ +@@ -1529,7 +1529,7 @@ static int read_mii_word(struct net_device *netdev, int phy_id, int reg) + struct r8152 *tp = netdev_priv(netdev); + int ret; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + if (phy_id != R8152_PHY_ID) +@@ -1545,7 +1545,7 @@ void write_mii_word(struct net_device *netdev, int phy_id, int reg, int val) + { + struct r8152 *tp = netdev_priv(netdev); + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (phy_id != R8152_PHY_ID) +@@ -1750,7 +1750,7 @@ static void read_bulk_callback(struct urb *urb) + if (!tp) + return; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (!test_bit(WORK_ENABLE, &tp->flags)) +@@ -1842,7 +1842,7 @@ static void write_bulk_callback(struct urb *urb) + if (!test_bit(WORK_ENABLE, &tp->flags)) + return; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (!skb_queue_empty(&tp->tx_queue)) +@@ -1863,7 +1863,7 @@ static void intr_callback(struct urb *urb) + if (!test_bit(WORK_ENABLE, &tp->flags)) + return; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + switch (status) { +@@ -2607,7 +2607,7 @@ static void bottom_half(struct tasklet_struct *t) + { + struct r8152 *tp = from_tasklet(tp, t, tx_tl); + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (!test_bit(WORK_ENABLE, &tp->flags)) +@@ -2650,7 +2650,7 @@ int r8152_submit_rx(struct r8152 *tp, struct rx_agg *agg, gfp_t mem_flags) + int ret; + + /* The rx would be stopped, so skip submitting */ +- if (test_bit(RTL8152_UNPLUG, &tp->flags) || ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags) || + !test_bit(WORK_ENABLE, &tp->flags) || !netif_carrier_ok(tp->netdev)) + return 0; + +@@ -3050,7 +3050,7 @@ static int rtl_enable(struct r8152 *tp) + + static int rtl8152_enable(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + set_tx_qlen(tp); +@@ -3137,7 +3137,7 @@ static int rtl8153_enable(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + set_tx_qlen(tp); +@@ -3169,7 +3169,7 @@ static void rtl_disable(struct r8152 *tp) + u32 ocp_data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -3623,7 +3623,7 @@ static u16 r8153_phy_status(struct r8152 *tp, u16 desired) + } + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + break; + } + +@@ -3655,7 +3655,7 @@ static void r8153b_ups_en(struct r8152 *tp, bool enable) + int i; + + for (i = 0; i < 500; i++) { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) +@@ -3697,7 +3697,7 @@ static void r8153c_ups_en(struct r8152 *tp, bool enable) + int i; + + for (i = 0; i < 500; i++) { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) +@@ -4062,8 +4062,8 @@ static int rtl_phy_patch_request(struct r8152 *tp, bool request, bool wait) + for (i = 0; wait && i < 5000; i++) { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) +- break; ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ return -ENODEV; + + usleep_range(1000, 2000); + ocp_data = ocp_reg_read(tp, OCP_PHY_PATCH_STAT); +@@ -6026,7 +6026,7 @@ static int rtl8156_enable(struct r8152 *tp) + u32 ocp_data; + u16 speed; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + r8156_fc_parameter(tp); +@@ -6084,7 +6084,7 @@ static int rtl8156b_enable(struct r8152 *tp) + u32 ocp_data; + u16 speed; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + set_tx_qlen(tp); +@@ -6270,7 +6270,7 @@ static int rtl8152_set_speed(struct r8152 *tp, u8 autoneg, u32 speed, u8 duplex, + + static void rtl8152_up(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8152_aldps_en(tp, false); +@@ -6280,7 +6280,7 @@ static void rtl8152_up(struct r8152 *tp) + + static void rtl8152_down(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -6295,7 +6295,7 @@ static void rtl8153_up(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153_u1u2en(tp, false); +@@ -6335,7 +6335,7 @@ static void rtl8153_down(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -6356,7 +6356,7 @@ static void rtl8153b_up(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -6380,7 +6380,7 @@ static void rtl8153b_down(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -6417,7 +6417,7 @@ static void rtl8153c_up(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -6498,7 +6498,7 @@ static void rtl8156_up(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -6571,7 +6571,7 @@ static void rtl8156_down(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -6709,7 +6709,7 @@ static void rtl_work_func_t(struct work_struct *work) + /* If the device is unplugged or !netif_running(), the workqueue + * doesn't need to wake the device, and could return directly. + */ +- if (test_bit(RTL8152_UNPLUG, &tp->flags) || !netif_running(tp->netdev)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags) || !netif_running(tp->netdev)) + return; + + if (usb_autopm_get_interface(tp->intf) < 0) +@@ -6748,7 +6748,7 @@ static void rtl_hw_phy_work_func_t(struct work_struct *work) + { + struct r8152 *tp = container_of(work, struct r8152, hw_phy_work.work); + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (usb_autopm_get_interface(tp->intf) < 0) +@@ -6875,7 +6875,7 @@ static int rtl8152_close(struct net_device *netdev) + netif_stop_queue(netdev); + + res = usb_autopm_get_interface(tp->intf); +- if (res < 0 || test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (res < 0 || test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + rtl_stop_rx(tp); + } else { +@@ -6908,7 +6908,7 @@ static void r8152b_init(struct r8152 *tp) + u32 ocp_data; + u16 data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + data = r8152_mdio_read(tp, MII_BMCR); +@@ -6952,7 +6952,7 @@ static void r8153_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153_u1u2en(tp, false); +@@ -6963,7 +6963,7 @@ static void r8153_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + break; + } + +@@ -7092,7 +7092,7 @@ static void r8153b_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -7103,7 +7103,7 @@ static void r8153b_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + break; + } + +@@ -7174,7 +7174,7 @@ static void r8153c_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -7194,7 +7194,7 @@ static void r8153c_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + } + +@@ -8023,7 +8023,7 @@ static void r8156_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_ECM_OP); +@@ -8044,7 +8044,7 @@ static void r8156_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + } + +@@ -8119,7 +8119,7 @@ static void r8156b_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_ECM_OP); +@@ -8153,7 +8153,7 @@ static void r8156b_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + } + +@@ -9219,7 +9219,7 @@ static int rtl8152_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd) + struct mii_ioctl_data *data = if_mii(rq); + int res; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + res = usb_autopm_get_interface(tp->intf); +@@ -9321,7 +9321,7 @@ static const struct net_device_ops rtl8152_netdev_ops = { + + static void rtl8152_unload(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (tp->version != RTL_VER_01) +@@ -9330,7 +9330,7 @@ static void rtl8152_unload(struct r8152 *tp) + + static void rtl8153_unload(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153_power_cut_en(tp, false); +@@ -9338,7 +9338,7 @@ static void rtl8153_unload(struct r8152 *tp) + + static void rtl8153b_unload(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_power_cut_en(tp, false); +-- +2.42.0 + diff --git a/queue-6.1/scsi-mpt3sas-fix-in-error-path.patch b/queue-6.1/scsi-mpt3sas-fix-in-error-path.patch new file mode 100644 index 00000000000..151dca00f13 --- /dev/null +++ b/queue-6.1/scsi-mpt3sas-fix-in-error-path.patch @@ -0,0 +1,39 @@ +From 245b2baaa37f99b797d9b45729f317204e53a285 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Oct 2023 13:45:29 +0200 +Subject: scsi: mpt3sas: Fix in error path + +From: Tomas Henzl + +[ Upstream commit e40c04ade0e2f3916b78211d747317843b11ce10 ] + +The driver should be deregistered as misc driver after PCI registration +failure. + +Signed-off-by: Tomas Henzl +Link: https://lore.kernel.org/r/20231015114529.10725-1-thenzl@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +index 8e24ebcebfe52..2ea3bdc638177 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -12914,8 +12914,10 @@ _mpt3sas_init(void) + mpt3sas_ctl_init(hbas_to_enumerate); + + error = pci_register_driver(&mpt3sas_driver); +- if (error) ++ if (error) { ++ mpt3sas_ctl_exit(hbas_to_enumerate); + scsih_exit(); ++ } + + return error; + } +-- +2.42.0 + diff --git a/queue-6.1/series b/queue-6.1/series new file mode 100644 index 00000000000..69fa260e9f3 --- /dev/null +++ b/queue-6.1/series @@ -0,0 +1,40 @@ +asoc-simple-card-fixup-asoc_simple_probe-error-handl.patch +coresight-tmc-etr-disable-warnings-for-allocation-fa.patch +asoc-tlv320adc3xxx-bug-correct-micbias-setting.patch +net-sched-cls_u32-fix-allocation-size-in-u32_init.patch +irqchip-riscv-intc-mark-all-intc-nodes-as-initialize.patch +irqchip-stm32-exti-add-missing-dt-irq-flag-translati.patch +dmaengine-ste_dma40-fix-pm-disable-depth-imbalance-i.patch +powerpc-85xx-fix-math-emulation-exception.patch +input-synaptics-rmi4-handle-reset-delay-when-using-s.patch +fbdev-atyfb-only-use-ioremap_uc-on-i386-and-ia64.patch +fs-ntfs3-add-ckeck-in-ni_update_parent.patch +fs-ntfs3-write-immediately-updated-ntfs-state.patch +fs-ntfs3-use-kvmalloc-instead-of-kmalloc-.-__gfp_now.patch +fs-ntfs3-fix-possible-null-ptr-deref-in-ni_readpage_.patch +fs-ntfs3-fix-null-pointer-dereference-on-error-in-at.patch +fs-ntfs3-fix-directory-element-type-detection.patch +fs-ntfs3-avoid-possible-memory-leak.patch +spi-npcm-fiu-fix-uma-reads-when-dummy.nbytes-0.patch +netfilter-nfnetlink_log-silence-bogus-compiler-warni.patch +efi-fix-memory-leak-in-krealloc-failure-handling.patch +asoc-rt5650-fix-the-wrong-result-of-key-button.patch +asoc-codecs-tas2780-fix-log-of-failed-reset-via-i2c.patch +drm-ttm-reorder-sys-manager-cleanup-step.patch +fbdev-omapfb-fix-some-error-codes.patch +fbdev-uvesafb-call-cn_del_callback-at-the-end-of-uve.patch +scsi-mpt3sas-fix-in-error-path.patch +drm-amdgpu-unset-context-priority-is-now-invalid.patch +gpu-drm-eliminate-drm_sched_priority_unset.patch +loongarch-export-symbol-invalid_pud_table-for-module.patch +loongarch-replace-kmap_atomic-with-kmap_local_page-i.patch +netfilter-nf_tables-audit-log-object-reset-once-per-.patch +platform-mellanox-mlxbf-tmfifo-fix-a-warning-message.patch +drm-amdgpu-reserve-fences-for-vm-update.patch +net-chelsio-cxgb4-add-an-error-code-check-in-t4_load.patch +r8152-check-for-unplug-in-rtl_phy_patch_request.patch +r8152-check-for-unplug-in-r8153b_ups_en-r8153c_ups_e.patch +r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch +powerpc-mm-fix-boot-crash-with-flatmem.patch +io_uring-kiocb_done-should-not-trust-ki_pos-if-read-.patch +ceph_wait_on_conflict_unlink-grab-reference-before-d.patch diff --git a/queue-6.1/spi-npcm-fiu-fix-uma-reads-when-dummy.nbytes-0.patch b/queue-6.1/spi-npcm-fiu-fix-uma-reads-when-dummy.nbytes-0.patch new file mode 100644 index 00000000000..bcc389b2274 --- /dev/null +++ b/queue-6.1/spi-npcm-fiu-fix-uma-reads-when-dummy.nbytes-0.patch @@ -0,0 +1,40 @@ +From 7d7e62d4b5c64696088deb511be027794ea39537 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Sep 2023 11:28:12 -0700 +Subject: spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0 + +From: William A. Kennington III + +[ Upstream commit 2ec8b010979036c2fe79a64adb6ecc0bd11e91d1 ] + +We don't want to use the value of ilog2(0) as dummy.buswidth is 0 when +dummy.nbytes is 0. Since we have no dummy bytes, we don't need to +configure the dummy byte bits per clock register value anyway. + +Signed-off-by: "William A. Kennington III" +Link: https://lore.kernel.org/r/20230922182812.2728066-1-william@wkennington.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-npcm-fiu.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-npcm-fiu.c b/drivers/spi/spi-npcm-fiu.c +index 49f6424e35af0..0624f52880705 100644 +--- a/drivers/spi/spi-npcm-fiu.c ++++ b/drivers/spi/spi-npcm-fiu.c +@@ -353,8 +353,9 @@ static int npcm_fiu_uma_read(struct spi_mem *mem, + uma_cfg |= ilog2(op->cmd.buswidth); + uma_cfg |= ilog2(op->addr.buswidth) + << NPCM_FIU_UMA_CFG_ADBPCK_SHIFT; +- uma_cfg |= ilog2(op->dummy.buswidth) +- << NPCM_FIU_UMA_CFG_DBPCK_SHIFT; ++ if (op->dummy.nbytes) ++ uma_cfg |= ilog2(op->dummy.buswidth) ++ << NPCM_FIU_UMA_CFG_DBPCK_SHIFT; + uma_cfg |= ilog2(op->data.buswidth) + << NPCM_FIU_UMA_CFG_RDBPCK_SHIFT; + uma_cfg |= op->dummy.nbytes << NPCM_FIU_UMA_CFG_DBSIZ_SHIFT; +-- +2.42.0 +