From: Sasha Levin Date: Thu, 13 Jul 2023 02:10:04 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v6.1.39~107 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0bcaf9aeddeda3d92a5321fca58d81f0c863941b;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/add-module_firmware-for-firmware_tg357766.patch b/queue-5.10/add-module_firmware-for-firmware_tg357766.patch new file mode 100644 index 00000000000..2cde604c9e1 --- /dev/null +++ b/queue-5.10/add-module_firmware-for-firmware_tg357766.patch @@ -0,0 +1,37 @@ +From 5005bbef55c3425fc8bd9a808e24298096e7dedf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 02:13:32 +0200 +Subject: Add MODULE_FIRMWARE() for FIRMWARE_TG357766. + +From: Tobias Heider + +[ Upstream commit 046f753da6143ee16452966915087ec8b0de3c70 ] + +Fixes a bug where on the M1 mac mini initramfs-tools fails to +include the necessary firmware into the initrd. + +Fixes: c4dab50697ff ("tg3: Download 57766 EEE service patch firmware") +Signed-off-by: Tobias Heider +Reviewed-by: Michael Chan +Link: https://lore.kernel.org/r/ZJt7LKzjdz8+dClx@tobhe.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index 613ca6124e3ce..d14f37be1eb3e 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -224,6 +224,7 @@ MODULE_AUTHOR("David S. Miller (davem@redhat.com) and Jeff Garzik (jgarzik@pobox + MODULE_DESCRIPTION("Broadcom Tigon3 ethernet driver"); + MODULE_LICENSE("GPL"); + MODULE_FIRMWARE(FIRMWARE_TG3); ++MODULE_FIRMWARE(FIRMWARE_TG357766); + MODULE_FIRMWARE(FIRMWARE_TG3TSO); + MODULE_FIRMWARE(FIRMWARE_TG3TSO5); + +-- +2.39.2 + diff --git a/queue-5.10/apparmor-fix-missing-error-check-for-rhashtable_inse.patch b/queue-5.10/apparmor-fix-missing-error-check-for-rhashtable_inse.patch new file mode 100644 index 00000000000..bb2b0630546 --- /dev/null +++ b/queue-5.10/apparmor-fix-missing-error-check-for-rhashtable_inse.patch @@ -0,0 +1,47 @@ +From 83648bdd4f9ee3aa360ef100d1de10c6f6a9df47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 19:05:49 +0000 +Subject: apparmor: fix missing error check for rhashtable_insert_fast + +From: Danila Chernetsov + +[ Upstream commit 000518bc5aef25d3f703592a0296d578c98b1517 ] + + rhashtable_insert_fast() could return err value when memory allocation is + failed. but unpack_profile() do not check values and this always returns + success value. This patch just adds error check code. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: e025be0f26d5 ("apparmor: support querying extended trusted helper extra data") + +Signed-off-by: Danila Chernetsov +Signed-off-by: John Johansen +Signed-off-by: Sasha Levin +--- + security/apparmor/policy_unpack.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c +index 519656e685822..10896d69c442a 100644 +--- a/security/apparmor/policy_unpack.c ++++ b/security/apparmor/policy_unpack.c +@@ -909,8 +909,13 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) + goto fail; + } + +- rhashtable_insert_fast(profile->data, &data->head, +- profile->data->p); ++ if (rhashtable_insert_fast(profile->data, &data->head, ++ profile->data->p)) { ++ kfree_sensitive(data->key); ++ kfree_sensitive(data); ++ info = "failed to insert data to table"; ++ goto fail; ++ } + } + + if (!unpack_nameX(e, AA_STRUCTEND, NULL)) { +-- +2.39.2 + diff --git a/queue-5.10/clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch b/queue-5.10/clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch new file mode 100644 index 00000000000..bcb1aaf0621 --- /dev/null +++ b/queue-5.10/clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch @@ -0,0 +1,37 @@ +From 616a9b481908c95aa72b527b8960b589d3571e81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 12:11:49 +0300 +Subject: clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks + +From: Mantas Pucka + +[ Upstream commit 56e5ae0116aef87273cf1812d608645b076e4f02 ] + +SDCC clocks must be rounded down to avoid overclocking the controller. + +Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support") +Signed-off-by: Mantas Pucka +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1682413909-24927-1-git-send-email-mantas@8devices.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq6018.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c +index 3f9c2f61a5d93..5c5d1b04ea7af 100644 +--- a/drivers/clk/qcom/gcc-ipq6018.c ++++ b/drivers/clk/qcom/gcc-ipq6018.c +@@ -1654,7 +1654,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = { + .name = "sdcc1_apps_clk_src", + .parent_data = gcc_xo_gpll0_gpll2_gpll0_out_main_div2, + .num_parents = 4, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_floor_ops, + }, + }; + +-- +2.39.2 + diff --git a/queue-5.10/clk-qcom-ipq6018-fix-networking-resets.patch b/queue-5.10/clk-qcom-ipq6018-fix-networking-resets.patch new file mode 100644 index 00000000000..94ca0e7b142 --- /dev/null +++ b/queue-5.10/clk-qcom-ipq6018-fix-networking-resets.patch @@ -0,0 +1,72 @@ +From 30c3209f3b0dcecdbf0f87eebc3da1f038037201 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 May 2023 21:08:55 +0200 +Subject: clk: qcom: ipq6018: fix networking resets + +From: Robert Marko + +[ Upstream commit 349b5bed539b491b7894a5186a895751fd8ba6c7 ] + +Networking resets in IPQ6018 all use bitmask as they require multiple +bits to be set and cleared instead of a single bit. + +So, current networking resets have the same register and bit 0 set which +is clearly incorrect. + +Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230526190855.2941291-2-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq6018.c | 32 ++++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c +index 5c5d1b04ea7af..cde62a11f5736 100644 +--- a/drivers/clk/qcom/gcc-ipq6018.c ++++ b/drivers/clk/qcom/gcc-ipq6018.c +@@ -4517,24 +4517,24 @@ static const struct qcom_reset_map gcc_ipq6018_resets[] = { + [GCC_PCIE0_AHB_ARES] = { 0x75040, 5 }, + [GCC_PCIE0_AXI_MASTER_STICKY_ARES] = { 0x75040, 6 }, + [GCC_PCIE0_AXI_SLAVE_STICKY_ARES] = { 0x75040, 7 }, +- [GCC_PPE_FULL_RESET] = { 0x68014, 0 }, +- [GCC_UNIPHY0_SOFT_RESET] = { 0x56004, 0 }, ++ [GCC_PPE_FULL_RESET] = { .reg = 0x68014, .bitmask = 0xf0000 }, ++ [GCC_UNIPHY0_SOFT_RESET] = { .reg = 0x56004, .bitmask = 0x3ff2 }, + [GCC_UNIPHY0_XPCS_RESET] = { 0x56004, 2 }, +- [GCC_UNIPHY1_SOFT_RESET] = { 0x56104, 0 }, ++ [GCC_UNIPHY1_SOFT_RESET] = { .reg = 0x56104, .bitmask = 0x32 }, + [GCC_UNIPHY1_XPCS_RESET] = { 0x56104, 2 }, +- [GCC_EDMA_HW_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT1_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT2_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT3_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT4_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT5_RESET] = { 0x68014, 0 }, +- [GCC_UNIPHY0_PORT1_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT2_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT3_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT4_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT5_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT_4_5_RESET] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT_4_RESET] = { 0x56004, 0 }, ++ [GCC_EDMA_HW_RESET] = { .reg = 0x68014, .bitmask = 0x300000 }, ++ [GCC_NSSPORT1_RESET] = { .reg = 0x68014, .bitmask = 0x1000003 }, ++ [GCC_NSSPORT2_RESET] = { .reg = 0x68014, .bitmask = 0x200000c }, ++ [GCC_NSSPORT3_RESET] = { .reg = 0x68014, .bitmask = 0x4000030 }, ++ [GCC_NSSPORT4_RESET] = { .reg = 0x68014, .bitmask = 0x8000300 }, ++ [GCC_NSSPORT5_RESET] = { .reg = 0x68014, .bitmask = 0x10000c00 }, ++ [GCC_UNIPHY0_PORT1_ARES] = { .reg = 0x56004, .bitmask = 0x30 }, ++ [GCC_UNIPHY0_PORT2_ARES] = { .reg = 0x56004, .bitmask = 0xc0 }, ++ [GCC_UNIPHY0_PORT3_ARES] = { .reg = 0x56004, .bitmask = 0x300 }, ++ [GCC_UNIPHY0_PORT4_ARES] = { .reg = 0x56004, .bitmask = 0xc00 }, ++ [GCC_UNIPHY0_PORT5_ARES] = { .reg = 0x56004, .bitmask = 0x3000 }, ++ [GCC_UNIPHY0_PORT_4_5_RESET] = { .reg = 0x56004, .bitmask = 0x3c02 }, ++ [GCC_UNIPHY0_PORT_4_RESET] = { .reg = 0x56004, .bitmask = 0xc02 }, + [GCC_LPASS_BCR] = {0x1F000, 0}, + [GCC_UBI32_TBU_BCR] = {0x65000, 0}, + [GCC_LPASS_TBU_BCR] = {0x6C000, 0}, +-- +2.39.2 + diff --git a/queue-5.10/clk-qcom-reset-allow-specifying-custom-reset-delay.patch b/queue-5.10/clk-qcom-reset-allow-specifying-custom-reset-delay.patch new file mode 100644 index 00000000000..05a0527d64b --- /dev/null +++ b/queue-5.10/clk-qcom-reset-allow-specifying-custom-reset-delay.patch @@ -0,0 +1,67 @@ +From a61d6636e9c81471b461bc65293107701b097419 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 15:41:29 +0200 +Subject: clk: qcom: reset: Allow specifying custom reset delay + +From: Stephan Gerhold + +[ Upstream commit 2cb8a39b6781ea23accd1fa93b3ad000d0948aec ] + +The amount of time required between asserting and deasserting the reset +signal can vary depending on the involved hardware component. Sometimes +1 us might not be enough and a larger delay is necessary to conform to +the specifications. + +Usually this is worked around in the consuming drivers, by replacing +reset_control_reset() with a sequence of reset_control_assert(), waiting +for a custom delay, followed by reset_control_deassert(). + +However, in some cases the driver making use of the reset is generic and +can be used with different reset controllers. In this case the reset +time requirement is better handled directly by the reset controller +driver. + +Make this possible by adding an "udelay" field to the qcom_reset_map +that allows setting a different reset delay (in microseconds). + +Signed-off-by: Stephan Gerhold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220706134132.3623415-4-stephan.gerhold@kernkonzept.com +Stable-dep-of: 349b5bed539b ("clk: qcom: ipq6018: fix networking resets") +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/reset.c | 4 +++- + drivers/clk/qcom/reset.h | 1 + + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c +index 819d194be8f7b..2a16adb572d2b 100644 +--- a/drivers/clk/qcom/reset.c ++++ b/drivers/clk/qcom/reset.c +@@ -13,8 +13,10 @@ + + static int qcom_reset(struct reset_controller_dev *rcdev, unsigned long id) + { ++ struct qcom_reset_controller *rst = to_qcom_reset_controller(rcdev); ++ + rcdev->ops->assert(rcdev, id); +- udelay(1); ++ udelay(rst->reset_map[id].udelay ?: 1); /* use 1 us as default */ + rcdev->ops->deassert(rcdev, id); + return 0; + } +diff --git a/drivers/clk/qcom/reset.h b/drivers/clk/qcom/reset.h +index 2a08b5e282c77..b8c113582072b 100644 +--- a/drivers/clk/qcom/reset.h ++++ b/drivers/clk/qcom/reset.h +@@ -11,6 +11,7 @@ + struct qcom_reset_map { + unsigned int reg; + u8 bit; ++ u8 udelay; + }; + + struct regmap; +-- +2.39.2 + diff --git a/queue-5.10/clk-qcom-reset-support-resetting-multiple-bits.patch b/queue-5.10/clk-qcom-reset-support-resetting-multiple-bits.patch new file mode 100644 index 00000000000..a380eba8220 --- /dev/null +++ b/queue-5.10/clk-qcom-reset-support-resetting-multiple-bits.patch @@ -0,0 +1,72 @@ +From a87dfe9a16eb2c2197d067716bc5e4ed5ed3075b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Nov 2022 14:28:59 +0100 +Subject: clk: qcom: reset: support resetting multiple bits + +From: Robert Marko + +[ Upstream commit 4a5210893625f89723ea210d7c630b730abb37ad ] + +This patch adds the support for giving the complete bitmask +in reset structure and reset operation will use this bitmask +for all reset operations. + +Currently, reset structure only takes a single bit for each reset +and then calculates the bitmask by using the BIT() macro. + +However, this is not sufficient anymore for newer SoC-s like IPQ8074, +IPQ6018 and more, since their networking resets require multiple bits +to be asserted in order to properly reset the HW block completely. + +So, in order to allow asserting multiple bits add "bitmask" field to +qcom_reset_map, and then use that bitmask value if its populated in the +driver, if its not populated, then we just default to existing behaviour +and calculate the bitmask on the fly. + +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221107132901.489240-1-robimarko@gmail.com +Stable-dep-of: 349b5bed539b ("clk: qcom: ipq6018: fix networking resets") +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/reset.c | 4 ++-- + drivers/clk/qcom/reset.h | 1 + + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c +index 2a16adb572d2b..0e914ec7aeae1 100644 +--- a/drivers/clk/qcom/reset.c ++++ b/drivers/clk/qcom/reset.c +@@ -30,7 +30,7 @@ qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id) + + rst = to_qcom_reset_controller(rcdev); + map = &rst->reset_map[id]; +- mask = BIT(map->bit); ++ mask = map->bitmask ? map->bitmask : BIT(map->bit); + + return regmap_update_bits(rst->regmap, map->reg, mask, mask); + } +@@ -44,7 +44,7 @@ qcom_reset_deassert(struct reset_controller_dev *rcdev, unsigned long id) + + rst = to_qcom_reset_controller(rcdev); + map = &rst->reset_map[id]; +- mask = BIT(map->bit); ++ mask = map->bitmask ? map->bitmask : BIT(map->bit); + + return regmap_update_bits(rst->regmap, map->reg, mask, 0); + } +diff --git a/drivers/clk/qcom/reset.h b/drivers/clk/qcom/reset.h +index b8c113582072b..9a47c838d9b1b 100644 +--- a/drivers/clk/qcom/reset.h ++++ b/drivers/clk/qcom/reset.h +@@ -12,6 +12,7 @@ struct qcom_reset_map { + unsigned int reg; + u8 bit; + u8 udelay; ++ u32 bitmask; + }; + + struct regmap; +-- +2.39.2 + diff --git a/queue-5.10/coresight-fix-loss-of-connection-info-when-a-module-.patch b/queue-5.10/coresight-fix-loss-of-connection-info-when-a-module-.patch new file mode 100644 index 00000000000..111f544a572 --- /dev/null +++ b/queue-5.10/coresight-fix-loss-of-connection-info-when-a-module-.patch @@ -0,0 +1,69 @@ +From 61f796fd8aa474d8168da226aa04ea505203440b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 15:35:28 +0100 +Subject: coresight: Fix loss of connection info when a module is unloaded + +From: James Clark + +[ Upstream commit c45b2835e7b205783bdfe08cc98fa86a7c5eeb74 ] + +child_fwnode should be a read only property based on the DT or ACPI. If +it's cleared on the parent device when a child is unloaded, then when +the child is loaded again the connection won't be remade. + +child_dev should be cleared instead which signifies that the connection +should be remade when the child_fwnode registers a new coresight_device. + +Similarly the reference count shouldn't be decremented as long as the +parent device exists. The correct place to drop the reference is in +coresight_release_platform_data() which is already done. + +Reproducible on Juno with the following steps: + + # load all coresight modules. + $ cd /sys/bus/coresight/devices/ + $ echo 1 > tmc_etr0/enable_sink + $ echo 1 > etm0/enable_source + # Works fine ^ + + $ echo 0 > etm0/enable_source + $ rmmod coresight-funnel + $ modprobe coresight-funnel + $ echo 1 > etm0/enable_source + -bash: echo: write error: Invalid argument + +Fixes: 37ea1ffddffa ("coresight: Use fwnode handle instead of device names") +Fixes: 2af89ebacf29 ("coresight: Clear the connection field properly") +Tested-by: Suzuki K Poulose +Reviewed-by: Mike Leach +Signed-off-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230425143542.2305069-2-james.clark@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-core.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c +index 5ddc8103503b5..c4b805b045316 100644 +--- a/drivers/hwtracing/coresight/coresight-core.c ++++ b/drivers/hwtracing/coresight/coresight-core.c +@@ -1376,13 +1376,8 @@ static int coresight_remove_match(struct device *dev, void *data) + if (csdev->dev.fwnode == conn->child_fwnode) { + iterator->orphan = true; + coresight_remove_links(iterator, conn); +- /* +- * Drop the reference to the handle for the remote +- * device acquired in parsing the connections from +- * platform data. +- */ +- fwnode_handle_put(conn->child_fwnode); +- conn->child_fwnode = NULL; ++ ++ conn->child_dev = NULL; + /* No need to continue */ + break; + } +-- +2.39.2 + diff --git a/queue-5.10/extcon-fix-kernel-doc-of-property-capability-fields-.patch b/queue-5.10/extcon-fix-kernel-doc-of-property-capability-fields-.patch new file mode 100644 index 00000000000..820267acb2d --- /dev/null +++ b/queue-5.10/extcon-fix-kernel-doc-of-property-capability-fields-.patch @@ -0,0 +1,46 @@ +From d0256185a10ef07d2369178e0bbe9cd76428a72a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 16:39:53 +0200 +Subject: extcon: Fix kernel doc of property capability fields to avoid + warnings + +From: Andy Shevchenko + +[ Upstream commit 73346b9965ebda2feb7fef8629e9b28baee820e3 ] + +Kernel documentation has to be synchronized with a code, otherwise +the validator is not happy: + + Function parameter or member 'usb_bits' not described in 'extcon_cable' + Function parameter or member 'chg_bits' not described in 'extcon_cable' + Function parameter or member 'jack_bits' not described in 'extcon_cable' + Function parameter or member 'disp_bits' not described in 'extcon_cable' + +Describe the fields added in the past. + +Fixes: ceaa98f442cf ("extcon: Add the support for the capability of each property") +Signed-off-by: Andy Shevchenko +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c +index 3bc83feb5a34b..fa08dec389dc1 100644 +--- a/drivers/extcon/extcon.c ++++ b/drivers/extcon/extcon.c +@@ -200,6 +200,10 @@ static const struct __extcon_info { + * @chg_propval: the array of charger connector properties + * @jack_propval: the array of jack connector properties + * @disp_propval: the array of display connector properties ++ * @usb_bits: the bit array of the USB connector property capabilities ++ * @chg_bits: the bit array of the charger connector property capabilities ++ * @jack_bits: the bit array of the jack connector property capabilities ++ * @disp_bits: the bit array of the display connector property capabilities + */ + struct extcon_cable { + struct extcon_dev *edev; +-- +2.39.2 + diff --git a/queue-5.10/extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch b/queue-5.10/extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch new file mode 100644 index 00000000000..95a7ab51ff6 --- /dev/null +++ b/queue-5.10/extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch @@ -0,0 +1,45 @@ +From 39bb19587e6471cc482bc008fbad593413305ddc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 16:39:52 +0200 +Subject: extcon: Fix kernel doc of property fields to avoid warnings + +From: Andy Shevchenko + +[ Upstream commit 7e77e0b7a9f4cdf91cb0950749b40c840ea63efc ] + +Kernel documentation has to be synchronized with a code, otherwise +the validator is not happy: + + Function parameter or member 'usb_propval' not described in 'extcon_cable' + Function parameter or member 'chg_propval' not described in 'extcon_cable' + Function parameter or member 'jack_propval' not described in 'extcon_cable' + Function parameter or member 'disp_propval' not described in 'extcon_cable' + +Describe the fields added in the past. + +Fixes: 067c1652e7a7 ("extcon: Add the support for extcon property according to extcon type") +Signed-off-by: Andy Shevchenko +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c +index 356610404bb40..3bc83feb5a34b 100644 +--- a/drivers/extcon/extcon.c ++++ b/drivers/extcon/extcon.c +@@ -196,6 +196,10 @@ static const struct __extcon_info { + * @attr_name: "name" sysfs entry + * @attr_state: "state" sysfs entry + * @attrs: the array pointing to attr_name and attr_state for attr_g ++ * @usb_propval: the array of USB connector properties ++ * @chg_propval: the array of charger connector properties ++ * @jack_propval: the array of jack connector properties ++ * @disp_propval: the array of display connector properties + */ + struct extcon_cable { + struct extcon_dev *edev; +-- +2.39.2 + diff --git a/queue-5.10/f2fs-fix-error-path-handling-in-truncate_dnode.patch b/queue-5.10/f2fs-fix-error-path-handling-in-truncate_dnode.patch new file mode 100644 index 00000000000..78b13f1d34b --- /dev/null +++ b/queue-5.10/f2fs-fix-error-path-handling-in-truncate_dnode.patch @@ -0,0 +1,39 @@ +From 4bba5c228b9251a0bb28340d8473b289614df26d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 09:41:02 +0800 +Subject: f2fs: fix error path handling in truncate_dnode() + +From: Chao Yu + +[ Upstream commit 0135c482fa97e2fd8245cb462784112a00ed1211 ] + +If truncate_node() fails in truncate_dnode(), it missed to call +f2fs_put_page(), fix it. + +Fixes: 7735730d39d7 ("f2fs: fix to propagate error from __get_meta_page()") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/node.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index c63274d4b74b0..02cb1c806c3ed 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -884,8 +884,10 @@ static int truncate_dnode(struct dnode_of_data *dn) + dn->ofs_in_node = 0; + f2fs_truncate_data_blocks(dn); + err = truncate_node(dn); +- if (err) ++ if (err) { ++ f2fs_put_page(page, 1); + return err; ++ } + + return 1; + } +-- +2.39.2 + diff --git a/queue-5.10/i2c-xiic-defer-xiic_wakeup-and-__xiic_start_xfer-in-.patch b/queue-5.10/i2c-xiic-defer-xiic_wakeup-and-__xiic_start_xfer-in-.patch new file mode 100644 index 00000000000..7940b906d1a --- /dev/null +++ b/queue-5.10/i2c-xiic-defer-xiic_wakeup-and-__xiic_start_xfer-in-.patch @@ -0,0 +1,112 @@ +From 76c2ad598eae18e59b499f84abc748ad2b4dcee8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Aug 2021 23:41:42 +0200 +Subject: i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in + xiic_process() + +From: Marek Vasut + +[ Upstream commit 743e227a895923c37a333eb2ebf3e391f00c406d ] + +The __xiic_start_xfer() manipulates the interrupt flags, xiic_wakeup() +may result in return from xiic_xfer() early. Defer both to the end of +the xiic_process() interrupt thread, so that they are executed after +all the other interrupt bits handling completed and once it completely +safe to perform changes to the interrupt bits in the hardware. + +Signed-off-by: Marek Vasut +Acked-by: Michal Simek +Signed-off-by: Wolfram Sang +Stable-dep-of: cb6e45c9a0ad ("i2c: xiic: Don't try to handle more interrupt events after error") +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-xiic.c | 37 ++++++++++++++++++++++++----------- + 1 file changed, 26 insertions(+), 11 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 3b564e68130b5..8b93c22f3c400 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -375,6 +375,9 @@ static irqreturn_t xiic_process(int irq, void *dev_id) + struct xiic_i2c *i2c = dev_id; + u32 pend, isr, ier; + u32 clr = 0; ++ int xfer_more = 0; ++ int wakeup_req = 0; ++ int wakeup_code = 0; + + /* Get the interrupt Status from the IPIF. There is no clearing of + * interrupts in the IPIF. Interrupts must be cleared at the source. +@@ -411,10 +414,14 @@ static irqreturn_t xiic_process(int irq, void *dev_id) + */ + xiic_reinit(i2c); + +- if (i2c->rx_msg) +- xiic_wakeup(i2c, STATE_ERROR); +- if (i2c->tx_msg) +- xiic_wakeup(i2c, STATE_ERROR); ++ if (i2c->rx_msg) { ++ wakeup_req = 1; ++ wakeup_code = STATE_ERROR; ++ } ++ if (i2c->tx_msg) { ++ wakeup_req = 1; ++ wakeup_code = STATE_ERROR; ++ } + } + if (pend & XIIC_INTR_RX_FULL_MASK) { + /* Receive register/FIFO is full */ +@@ -448,8 +455,7 @@ static irqreturn_t xiic_process(int irq, void *dev_id) + i2c->tx_msg++; + dev_dbg(i2c->adap.dev.parent, + "%s will start next...\n", __func__); +- +- __xiic_start_xfer(i2c); ++ xfer_more = 1; + } + } + } +@@ -463,11 +469,13 @@ static irqreturn_t xiic_process(int irq, void *dev_id) + if (!i2c->tx_msg) + goto out; + +- if ((i2c->nmsgs == 1) && !i2c->rx_msg && +- xiic_tx_space(i2c) == 0) +- xiic_wakeup(i2c, STATE_DONE); ++ wakeup_req = 1; ++ ++ if (i2c->nmsgs == 1 && !i2c->rx_msg && ++ xiic_tx_space(i2c) == 0) ++ wakeup_code = STATE_DONE; + else +- xiic_wakeup(i2c, STATE_ERROR); ++ wakeup_code = STATE_ERROR; + } + if (pend & (XIIC_INTR_TX_EMPTY_MASK | XIIC_INTR_TX_HALF_MASK)) { + /* Transmit register/FIFO is empty or ½ empty */ +@@ -491,7 +499,7 @@ static irqreturn_t xiic_process(int irq, void *dev_id) + if (i2c->nmsgs > 1) { + i2c->nmsgs--; + i2c->tx_msg++; +- __xiic_start_xfer(i2c); ++ xfer_more = 1; + } else { + xiic_irq_dis(i2c, XIIC_INTR_TX_HALF_MASK); + +@@ -509,6 +517,13 @@ static irqreturn_t xiic_process(int irq, void *dev_id) + dev_dbg(i2c->adap.dev.parent, "%s clr: 0x%x\n", __func__, clr); + + xiic_setreg32(i2c, XIIC_IISR_OFFSET, clr); ++ if (xfer_more) ++ __xiic_start_xfer(i2c); ++ if (wakeup_req) ++ xiic_wakeup(i2c, wakeup_code); ++ ++ WARN_ON(xfer_more && wakeup_req); ++ + mutex_unlock(&i2c->lock); + return IRQ_HANDLED; + } +-- +2.39.2 + diff --git a/queue-5.10/i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch b/queue-5.10/i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch new file mode 100644 index 00000000000..e8c9b2e71f1 --- /dev/null +++ b/queue-5.10/i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch @@ -0,0 +1,60 @@ +From 513d8061c71348ce38424f08942004a1c7dca1bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 12:25:58 -0600 +Subject: i2c: xiic: Don't try to handle more interrupt events after error + +From: Robert Hancock + +[ Upstream commit cb6e45c9a0ad9e0f8664fd06db0227d185dc76ab ] + +In xiic_process, it is possible that error events such as arbitration +lost or TX error can be raised in conjunction with other interrupt flags +such as TX FIFO empty or bus not busy. Error events result in the +controller being reset and the error returned to the calling request, +but the function could potentially try to keep handling the other +events, such as by writing more messages into the TX FIFO. Since the +transaction has already failed, this is not helpful and will just cause +issues. + +This problem has been present ever since: + +commit 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr") + +which allowed non-error events to be handled after errors, but became +more obvious after: + +commit 743e227a8959 ("i2c: xiic: Defer xiic_wakeup() and +__xiic_start_xfer() in xiic_process()") + +which reworked the code to add a WARN_ON which triggers if both the +xfer_more and wakeup_req flags were set, since this combination is +not supposed to happen, but was occurring in this scenario. + +Skip further interrupt handling after error flags are detected to avoid +this problem. + +Fixes: 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr") +Signed-off-by: Robert Hancock +Acked-by: Andi Shyti +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-xiic.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 8b93c22f3c400..568e97c3896d1 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -422,6 +422,8 @@ static irqreturn_t xiic_process(int irq, void *dev_id) + wakeup_req = 1; + wakeup_code = STATE_ERROR; + } ++ /* don't try to handle other events */ ++ goto out; + } + if (pend & XIIC_INTR_RX_FULL_MASK) { + /* Receive register/FIFO is full */ +-- +2.39.2 + diff --git a/queue-5.10/kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch b/queue-5.10/kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch new file mode 100644 index 00000000000..95f8bb0c774 --- /dev/null +++ b/queue-5.10/kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch @@ -0,0 +1,39 @@ +From 85f37765b34fefa7c7fa4b3b2a210c953058985f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 10:40:17 +0800 +Subject: kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR + +From: Muchun Song + +[ Upstream commit 30480b988f88c279752f3202a26b6fee5f586aef ] + +The root->ino_idr is supposed to be protected by kernfs_idr_lock, fix +it. + +Fixes: 488dee96bb62 ("kernfs: allow creating kernfs objects with arbitrary uid/gid") +Signed-off-by: Muchun Song +Acked-by: Tejun Heo +Link: https://lore.kernel.org/r/20230523024017.24851-1-songmuchun@bytedance.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + fs/kernfs/dir.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c +index 8b3c86a502daa..c91ee05cce74f 100644 +--- a/fs/kernfs/dir.c ++++ b/fs/kernfs/dir.c +@@ -679,7 +679,9 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, + return kn; + + err_out3: ++ spin_lock(&kernfs_idr_lock); + idr_remove(&root->ino_idr, (u32)kernfs_ino(kn)); ++ spin_unlock(&kernfs_idr_lock); + err_out2: + kmem_cache_free(kernfs_node_cache, kn); + err_out1: +-- +2.39.2 + diff --git a/queue-5.10/kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch b/queue-5.10/kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch new file mode 100644 index 00000000000..7c89ba5fea6 --- /dev/null +++ b/queue-5.10/kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch @@ -0,0 +1,74 @@ +From f23a34647b05c14ae2a46511c53c8ac0d9274a38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 15:54:23 +0100 +Subject: KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes + +From: Nico Boehr + +[ Upstream commit 285cff4c0454340a4dc53f46e67f2cb1c293bd74 ] + +The KVM_S390_GET_CMMA_BITS ioctl may return incorrect values when userspace +specifies a start_gfn outside of memslots. + +This can occur when a VM has multiple memslots with a hole in between: + ++-----+----------+--------+--------+ +| ... | Slot N-1 | | Slot N | ++-----+----------+--------+--------+ + ^ ^ ^ ^ + | | | | +GFN A A+B | | + A+B+C | + A+B+C+D + +When userspace specifies a GFN in [A+B, A+B+C), it would expect to get the +CMMA values of the first dirty page in Slot N. However, userspace may get a +start_gfn of A+B+C+D with a count of 0, hence completely skipping over any +dirty pages in slot N. + +The error is in kvm_s390_next_dirty_cmma(), which assumes +gfn_to_memslot_approx() will return the memslot _below_ the specified GFN +when the specified GFN lies outside a memslot. In reality it may return +either the memslot below or above the specified GFN. + +When a memslot above the specified GFN is returned this happens: + +- ofs is calculated, but since the memslot's base_gfn is larger than the + specified cur_gfn, ofs will underflow to a huge number. +- ofs is passed to find_next_bit(). Since ofs will exceed the memslot's + number of pages, the number of pages in the memslot is returned, + completely skipping over all bits in the memslot userspace would be + interested in. + +Fix this by resetting ofs to zero when a memslot _above_ cur_gfn is +returned (cur_gfn < ms->base_gfn). + +Signed-off-by: Nico Boehr +Reviewed-by: Claudio Imbrenda +Fixes: afdad61615cc ("KVM: s390: Fix storage attributes migration with memory slots") +Message-Id: <20230324145424.293889-2-nrb@linux.ibm.com> +Signed-off-by: Claudio Imbrenda +Signed-off-by: Janosch Frank +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/kvm-s390.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 7ffc73ba220fb..7a326d03087ab 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -2005,6 +2005,10 @@ static unsigned long kvm_s390_next_dirty_cmma(struct kvm_memslots *slots, + ms = slots->memslots + slotidx; + ofs = 0; + } ++ ++ if (cur_gfn < ms->base_gfn) ++ ofs = 0; ++ + ofs = find_next_bit(kvm_second_dirty_bitmap(ms), ms->npages, ofs); + while ((slotidx > 0) && (ofs >= ms->npages)) { + slotidx--; +-- +2.39.2 + diff --git a/queue-5.10/kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch b/queue-5.10/kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch new file mode 100644 index 00000000000..721cdbd7e30 --- /dev/null +++ b/queue-5.10/kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch @@ -0,0 +1,52 @@ +From f97c4c8574cf7668e778f8caad7b0f8b83e75af4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 May 2023 17:42:58 +0200 +Subject: KVM: s390: vsie: fix the length of APCB bitmap + +From: Pierre Morel + +[ Upstream commit 246be7d2720ea9a795b576067ecc5e5c7a1e7848 ] + +bit_and() uses the count of bits as the woking length. +Fix the previous implementation and effectively use +the right bitmap size. + +Fixes: 19fd83a64718 ("KVM: s390: vsie: allow CRYCB FORMAT-1") +Fixes: 56019f9aca22 ("KVM: s390: vsie: Allow CRYCB FORMAT-2") + +Signed-off-by: Pierre Morel +Reviewed-by: Janosch Frank +Link: https://lore.kernel.org/kvm/20230511094719.9691-1-pmorel@linux.ibm.com/ +Signed-off-by: Janosch Frank +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/vsie.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c +index ff58decfef5e8..192eacc8fbb7a 100644 +--- a/arch/s390/kvm/vsie.c ++++ b/arch/s390/kvm/vsie.c +@@ -168,7 +168,8 @@ static int setup_apcb00(struct kvm_vcpu *vcpu, unsigned long *apcb_s, + sizeof(struct kvm_s390_apcb0))) + return -EFAULT; + +- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb0)); ++ bitmap_and(apcb_s, apcb_s, apcb_h, ++ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb0)); + + return 0; + } +@@ -190,7 +191,8 @@ static int setup_apcb11(struct kvm_vcpu *vcpu, unsigned long *apcb_s, + sizeof(struct kvm_s390_apcb1))) + return -EFAULT; + +- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb1)); ++ bitmap_and(apcb_s, apcb_s, apcb_h, ++ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb1)); + + return 0; + } +-- +2.39.2 + diff --git a/queue-5.10/mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch b/queue-5.10/mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch new file mode 100644 index 00000000000..8598c820556 --- /dev/null +++ b/queue-5.10/mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch @@ -0,0 +1,75 @@ +From fa372120604ab979ca8e1579a6a76715f8d63feb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 20:00:22 -0500 +Subject: mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 + +From: Nishanth Menon + +[ Upstream commit 1b712f18c461bd75f018033a15cf381e712806b5 ] + +Sec proxy/message manager data buffer is 60 bytes with the last of the +registers indicating transmission completion. This however poses a bit +of a challenge. + +The backing memory for sec_proxy / message manager is regular memory, +and all sec proxy does is to trigger a burst of all 60 bytes of data +over to the target thread backing ring accelerator. It doesn't do a +memory scrub when it moves data out in the burst. When we transmit +multiple messages, remnants of previous message is also transmitted +which results in some random data being set in TISCI fields of +messages that have been expanded forward. + +The entire concept of backward compatibility hinges on the fact that +the unused message fields remain 0x0 allowing for 0x0 value to be +specially considered when backward compatibility of message extension +is done. + +So, instead of just writing the completion register, we continue +to fill the message buffer up with 0x0 (note: for partial message +involving completion, we already do this). + +This allows us to scale and introduce ABI changes back also work with +other boot stages that may have left data in the internal memory. + +While at this, be consistent and explicit with the data_reg pointer +increment. + +Fixes: aace66b170ce ("mailbox: Introduce TI message manager driver") +Signed-off-by: Nishanth Menon +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/ti-msgmgr.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/mailbox/ti-msgmgr.c b/drivers/mailbox/ti-msgmgr.c +index 0130628f4d9db..535fe73ce3109 100644 +--- a/drivers/mailbox/ti-msgmgr.c ++++ b/drivers/mailbox/ti-msgmgr.c +@@ -385,14 +385,20 @@ static int ti_msgmgr_send_data(struct mbox_chan *chan, void *data) + /* Ensure all unused data is 0 */ + data_trail &= 0xFFFFFFFF >> (8 * (sizeof(u32) - trail_bytes)); + writel(data_trail, data_reg); +- data_reg++; ++ data_reg += sizeof(u32); + } ++ + /* + * 'data_reg' indicates next register to write. If we did not already + * write on tx complete reg(last reg), we must do so for transmit ++ * In addition, we also need to make sure all intermediate data ++ * registers(if any required), are reset to 0 for TISCI backward ++ * compatibility to be maintained. + */ +- if (data_reg <= qinst->queue_buff_end) +- writel(0, qinst->queue_buff_end); ++ while (data_reg <= qinst->queue_buff_end) { ++ writel(0, data_reg); ++ data_reg += sizeof(u32); ++ } + + return 0; + } +-- +2.39.2 + diff --git a/queue-5.10/media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch b/queue-5.10/media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch new file mode 100644 index 00000000000..90baded7799 --- /dev/null +++ b/queue-5.10/media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch @@ -0,0 +1,42 @@ +From 24f37a094cda6fdd619038c997a39f2bd01ef57b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 May 2023 12:53:23 +0100 +Subject: media: atomisp: gmin_platform: fix out_len in + gmin_get_config_dsm_var() + +From: Dan Carpenter + +[ Upstream commit 1657f2934daf89e8d9fa4b2697008909eb22c73e ] + +Ideally, strlen(cur->string.pointer) and strlen(out) would be the same. +But this code is using strscpy() to avoid a potential buffer overflow. +So in the same way we should take the strlen() of the smaller string to +avoid a buffer overflow in the caller, gmin_get_var_int(). + +Link: https://lore.kernel.org/r/26124bcd-8132-4483-9d67-225c87d424e8@kili.mountain + +Fixes: 387041cda44e ("media: atomisp: improve sensor detection code to use _DSM table") +Signed-off-by: Dan Carpenter +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c +index c9ee85037644f..f0387486eb174 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c +@@ -1198,7 +1198,7 @@ static int gmin_get_config_dsm_var(struct device *dev, + dev_info(dev, "found _DSM entry for '%s': %s\n", var, + cur->string.pointer); + strscpy(out, cur->string.pointer, *out_len); +- *out_len = strlen(cur->string.pointer); ++ *out_len = strlen(out); + + ACPI_FREE(obj); + return 0; +-- +2.39.2 + diff --git a/queue-5.10/media-cec-i2c-ch7322-also-select-regmap.patch b/queue-5.10/media-cec-i2c-ch7322-also-select-regmap.patch new file mode 100644 index 00000000000..0972bc6866e --- /dev/null +++ b/queue-5.10/media-cec-i2c-ch7322-also-select-regmap.patch @@ -0,0 +1,69 @@ +From 5e051363fb7b1b7787d0243ced8a391a95c0a79a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 04:54:35 +0200 +Subject: media: cec: i2c: ch7322: also select REGMAP + +From: Randy Dunlap + +[ Upstream commit 29f96ac23648b2259f42d40703c47dd18fd172ca ] + +Selecting only REGMAP_I2C can leave REGMAP unset, causing build errors, +so also select REGMAP to prevent the build errors. + +../drivers/media/cec/i2c/ch7322.c:158:21: error: variable 'ch7322_regmap' has initializer but incomplete type + 158 | static const struct regmap_config ch7322_regmap = { +../drivers/media/cec/i2c/ch7322.c:159:10: error: 'const struct regmap_config' has no member named 'reg_bits' + 159 | .reg_bits = 8, +../drivers/media/cec/i2c/ch7322.c:159:21: warning: excess elements in struct initializer + 159 | .reg_bits = 8, +../drivers/media/cec/i2c/ch7322.c:160:10: error: 'const struct regmap_config' has no member named 'val_bits' + 160 | .val_bits = 8, +../drivers/media/cec/i2c/ch7322.c:160:21: warning: excess elements in struct initializer + 160 | .val_bits = 8, +../drivers/media/cec/i2c/ch7322.c:161:10: error: 'const struct regmap_config' has no member named 'max_register' + 161 | .max_register = 0x7f, +../drivers/media/cec/i2c/ch7322.c:161:25: warning: excess elements in struct initializer + 161 | .max_register = 0x7f, +../drivers/media/cec/i2c/ch7322.c:162:10: error: 'const struct regmap_config' has no member named 'disable_locking' + 162 | .disable_locking = true, +../drivers/media/cec/i2c/ch7322.c:162:28: warning: excess elements in struct initializer + 162 | .disable_locking = true, +../drivers/media/cec/i2c/ch7322.c: In function 'ch7322_probe': +../drivers/media/cec/i2c/ch7322.c:468:26: error: implicit declaration of function 'devm_regmap_init_i2c' [-Werror=implicit-function-declaration] + 468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap); +../drivers/media/cec/i2c/ch7322.c:468:24: warning: assignment to 'struct regmap *' from 'int' makes pointer from integer without a cast [-Wint-conversion] + 468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap); +../drivers/media/cec/i2c/ch7322.c: At top level: +../drivers/media/cec/i2c/ch7322.c:158:35: error: storage size of 'ch7322_regmap' isn't known + 158 | static const struct regmap_config ch7322_regmap = { + +Link: https://lore.kernel.org/linux-media/20230608025435.29249-1-rdunlap@infradead.org +Fixes: 21b9a47e0ec7 ("media: cec: i2c: ch7322: Add ch7322 CEC controller driver") +Signed-off-by: Randy Dunlap +Cc: Jeff Chase +Cc: Hans Verkuil +Cc: Joe Tessler +Cc: Arnd Bergmann +Cc: Mark Brown +Cc: Masahiro Yamada +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/i2c/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/cec/i2c/Kconfig b/drivers/media/cec/i2c/Kconfig +index 70432a1d69186..d912d143fb312 100644 +--- a/drivers/media/cec/i2c/Kconfig ++++ b/drivers/media/cec/i2c/Kconfig +@@ -5,6 +5,7 @@ + config CEC_CH7322 + tristate "Chrontel CH7322 CEC controller" + depends on I2C ++ select REGMAP + select REGMAP_I2C + select CEC_CORE + help +-- +2.39.2 + diff --git a/queue-5.10/media-usb-check-az6007_read-return-value.patch b/queue-5.10/media-usb-check-az6007_read-return-value.patch new file mode 100644 index 00000000000..41c8c1dd90d --- /dev/null +++ b/queue-5.10/media-usb-check-az6007_read-return-value.patch @@ -0,0 +1,38 @@ +From c6af9662d3d6edf3d2bbc10fa5c62fdba365f6b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 10:04:49 -0700 +Subject: media: usb: Check az6007_read() return value + +From: Daniil Dulov + +[ Upstream commit fdaca63186f59fc664b346c45b76576624b48e57 ] + +If az6007_read() returns error, there is no sence to continue. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 3af2f4f15a61 ("[media] az6007: Change the az6007 read/write routine parameter") +Signed-off-by: Daniil Dulov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb-v2/az6007.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c +index 62ee09f28a0bc..7524c90f5da61 100644 +--- a/drivers/media/usb/dvb-usb-v2/az6007.c ++++ b/drivers/media/usb/dvb-usb-v2/az6007.c +@@ -202,7 +202,8 @@ static int az6007_rc_query(struct dvb_usb_device *d) + unsigned code; + enum rc_proto proto; + +- az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10); ++ if (az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10) < 0) ++ return -EIO; + + if (st->data[1] == 0x44) + return 0; +-- +2.39.2 + diff --git a/queue-5.10/media-usb-siano-fix-warning-due-to-null-work_func_t-.patch b/queue-5.10/media-usb-siano-fix-warning-due-to-null-work_func_t-.patch new file mode 100644 index 00000000000..ec9c1794267 --- /dev/null +++ b/queue-5.10/media-usb-siano-fix-warning-due-to-null-work_func_t-.patch @@ -0,0 +1,83 @@ +From eef4166ddd9baaece342e36420631e4910a5914b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 07:59:32 +0800 +Subject: media: usb: siano: Fix warning due to null work_func_t function + pointer + +From: Duoming Zhou + +[ Upstream commit 6f489a966fbeb0da63d45c2c66a8957eab604bf6 ] + +The previous commit ebad8e731c1c ("media: usb: siano: Fix use after +free bugs caused by do_submit_urb") adds cancel_work_sync() in +smsusb_stop_streaming(). But smsusb_stop_streaming() may be called, +even if the work_struct surb->wq has not been initialized. As a result, +the warning will occur. One of the processes that could lead to warning +is shown below: + +smsusb_probe() + smsusb_init_device() + if (!dev->in_ep || !dev->out_ep || align < 0) { + smsusb_term_device(intf); + smsusb_stop_streaming() + cancel_work_sync(&dev->surbs[i].wq); + __cancel_work_timer() + __flush_work() + if (WARN_ON(!work->func)) // work->func is null + +The log reported by syzbot is shown below: + +WARNING: CPU: 0 PID: 897 at kernel/workqueue.c:3066 __flush_work+0x798/0xa80 kernel/workqueue.c:3063 +Modules linked in: +CPU: 0 PID: 897 Comm: kworker/0:2 Not tainted 6.2.0-rc1-syzkaller #0 +RIP: 0010:__flush_work+0x798/0xa80 kernel/workqueue.c:3066 +... +RSP: 0018:ffffc9000464ebf8 EFLAGS: 00010246 +RAX: 1ffff11002dbb420 RBX: 0000000000000021 RCX: 1ffffffff204fa4e +RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff888016dda0e8 +RBP: ffffc9000464ed98 R08: 0000000000000001 R09: ffffffff90253b2f +R10: 0000000000000001 R11: 0000000000000000 R12: ffff888016dda0e8 +R13: ffff888016dda0e8 R14: ffff888016dda100 R15: 0000000000000001 +FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007ffd4331efe8 CR3: 000000000b48e000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + __cancel_work_timer+0x315/0x460 kernel/workqueue.c:3160 + smsusb_stop_streaming drivers/media/usb/siano/smsusb.c:182 [inline] + smsusb_term_device+0xda/0x2d0 drivers/media/usb/siano/smsusb.c:344 + smsusb_init_device+0x400/0x9ce drivers/media/usb/siano/smsusb.c:419 + smsusb_probe+0xbbd/0xc55 drivers/media/usb/siano/smsusb.c:567 +... + +This patch adds check before cancel_work_sync(). If surb->wq has not +been initialized, the cancel_work_sync() will not be executed. + +Reported-by: syzbot+27b0b464864741b18b99@syzkaller.appspotmail.com +Fixes: ebad8e731c1c ("media: usb: siano: Fix use after free bugs caused by do_submit_urb") +Signed-off-by: Duoming Zhou +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/siano/smsusb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c +index 1babfe6e2c361..5c223b5498b4b 100644 +--- a/drivers/media/usb/siano/smsusb.c ++++ b/drivers/media/usb/siano/smsusb.c +@@ -179,7 +179,8 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev) + + for (i = 0; i < MAX_URBS; i++) { + usb_kill_urb(&dev->surbs[i].urb); +- cancel_work_sync(&dev->surbs[i].wq); ++ if (dev->surbs[i].wq.func) ++ cancel_work_sync(&dev->surbs[i].wq); + + if (dev->surbs[i].cb) { + smscore_putbuffer(dev->coredev, dev->surbs[i].cb); +-- +2.39.2 + diff --git a/queue-5.10/media-venus-helpers-fix-align-of-non-power-of-two.patch b/queue-5.10/media-venus-helpers-fix-align-of-non-power-of-two.patch new file mode 100644 index 00000000000..2a7922550b6 --- /dev/null +++ b/queue-5.10/media-venus-helpers-fix-align-of-non-power-of-two.patch @@ -0,0 +1,51 @@ +From 68795b78a6685f75fa9962152a32f9bac8065db6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Sep 2020 20:03:01 +0100 +Subject: media: venus: helpers: Fix ALIGN() of non power of two + +From: Rikard Falkeborn + +[ Upstream commit 927e78ac8bc58155316cf6f46026e1912bbbbcfc ] + +ALIGN() expects its second argument to be a power of 2, otherwise +incorrect results are produced for some inputs. The output can be +both larger or smaller than what is expected. + +For example, ALIGN(304, 192) equals 320 instead of 384, and +ALIGN(65, 192) equals 256 instead of 192. + +However, nestling two ALIGN() as is done in this case seem to only +produce results equal to or bigger than the expected result if ALIGN() +had handled non powers of two, and that in turn results in framesizes +that are either the correct size or too large. + +Fortunately, since 192 * 4 / 3 equals 256, it turns out that one ALIGN() +is sufficient. + +Fixes: ab1eda449c6e ("media: venus: vdec: handle 10bit bitstreams") +Signed-off-by: Rikard Falkeborn +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/helpers.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c +index 5ca3920237c5a..5fdce5f07364e 100644 +--- a/drivers/media/platform/qcom/venus/helpers.c ++++ b/drivers/media/platform/qcom/venus/helpers.c +@@ -917,8 +917,8 @@ static u32 get_framesize_raw_yuv420_tp10_ubwc(u32 width, u32 height) + u32 extradata = SZ_16K; + u32 size; + +- y_stride = ALIGN(ALIGN(width, 192) * 4 / 3, 256); +- uv_stride = ALIGN(ALIGN(width, 192) * 4 / 3, 256); ++ y_stride = ALIGN(width * 4 / 3, 256); ++ uv_stride = ALIGN(width * 4 / 3, 256); + y_sclines = ALIGN(height, 16); + uv_sclines = ALIGN((height + 1) >> 1, 16); + +-- +2.39.2 + diff --git a/queue-5.10/media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch b/queue-5.10/media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch new file mode 100644 index 00000000000..2eef8376c66 --- /dev/null +++ b/queue-5.10/media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch @@ -0,0 +1,62 @@ +From 5587bb26600eadc5dcc5590b653d602fe4a3ba24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 15:36:49 +0200 +Subject: media: videodev2.h: Fix struct v4l2_input tuner index comment + +From: Marek Vasut + +[ Upstream commit 26ae58f65e64fa7ba61d64bae752e59e08380c6a ] + +VIDIOC_ENUMINPUT documentation describes the tuner field of +struct v4l2_input as index: + +Documentation/userspace-api/media/v4l/vidioc-enuminput.rst +" +* - __u32 + - ``tuner`` + - Capture devices can have zero or more tuners (RF demodulators). + When the ``type`` is set to ``V4L2_INPUT_TYPE_TUNER`` this is an + RF connector and this field identifies the tuner. It corresponds + to struct :c:type:`v4l2_tuner` field ``index``. For + details on tuners see :ref:`tuner`. +" + +Drivers I could find also use the 'tuner' field as an index, e.g.: +drivers/media/pci/bt8xx/bttv-driver.c bttv_enum_input() +drivers/media/usb/go7007/go7007-v4l2.c vidioc_enum_input() + +However, the UAPI comment claims this field is 'enum v4l2_tuner_type': +include/uapi/linux/videodev2.h + +This field being 'enum v4l2_tuner_type' is unlikely as it seems to be +never used that way in drivers, and documentation confirms it. It seem +this comment got in accidentally in the commit which this patch fixes. +Fix the UAPI comment to stop confusion. + +This was pointed out by Dmitry while reviewing VIDIOC_ENUMINPUT +support for strace. + +Fixes: 6016af82eafc ("[media] v4l2: use __u32 rather than enums in ioctl() structs") +Signed-off-by: Marek Vasut +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + include/uapi/linux/videodev2.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h +index b28817c59fdf2..55b8c4b824797 100644 +--- a/include/uapi/linux/videodev2.h ++++ b/include/uapi/linux/videodev2.h +@@ -1644,7 +1644,7 @@ struct v4l2_input { + __u8 name[32]; /* Label */ + __u32 type; /* Type of input */ + __u32 audioset; /* Associated audios (bitfield) */ +- __u32 tuner; /* enum v4l2_tuner_type */ ++ __u32 tuner; /* Tuner index */ + v4l2_std_id std; + __u32 status; + __u32 capabilities; +-- +2.39.2 + diff --git a/queue-5.10/mfd-intel-lpss-add-missing-check-for-platform_get_re.patch b/queue-5.10/mfd-intel-lpss-add-missing-check-for-platform_get_re.patch new file mode 100644 index 00000000000..4e687db21f7 --- /dev/null +++ b/queue-5.10/mfd-intel-lpss-add-missing-check-for-platform_get_re.patch @@ -0,0 +1,38 @@ +From d404583f6cd336dbfd1430dc204f1eb214fffb12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 09:48:18 +0800 +Subject: mfd: intel-lpss: Add missing check for platform_get_resource + +From: Jiasheng Jiang + +[ Upstream commit d918e0d5824495a75d00b879118b098fcab36fdb ] + +Add the missing check for platform_get_resource and return error +if it fails. + +Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20230609014818.28475-1-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/mfd/intel-lpss-acpi.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/mfd/intel-lpss-acpi.c b/drivers/mfd/intel-lpss-acpi.c +index 045cbf0cbe53a..993e305a232c5 100644 +--- a/drivers/mfd/intel-lpss-acpi.c ++++ b/drivers/mfd/intel-lpss-acpi.c +@@ -114,6 +114,9 @@ static int intel_lpss_acpi_probe(struct platform_device *pdev) + return -ENOMEM; + + info->mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!info->mem) ++ return -ENODEV; ++ + info->irq = platform_get_irq(pdev, 0); + + ret = intel_lpss_probe(&pdev->dev, info); +-- +2.39.2 + diff --git a/queue-5.10/mfd-rt5033-drop-rt5033-battery-sub-device.patch b/queue-5.10/mfd-rt5033-drop-rt5033-battery-sub-device.patch new file mode 100644 index 00000000000..bfa37de550a --- /dev/null +++ b/queue-5.10/mfd-rt5033-drop-rt5033-battery-sub-device.patch @@ -0,0 +1,41 @@ +From 5b2a92f9c5a87bb052b40b8e0c6a51e7c0bed49a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 22:57:10 +0200 +Subject: mfd: rt5033: Drop rt5033-battery sub-device + +From: Stephan Gerhold + +[ Upstream commit 43db1344e0f8c1eb687a1d6cd5b0de3009ab66cb ] + +The fuel gauge in the RT5033 PMIC (rt5033-battery) has its own I2C bus +and interrupt lines. Therefore, it is not part of the MFD device +and needs to be specified separately in the device tree. + +Fixes: 0b271258544b ("mfd: rt5033: Add Richtek RT5033 driver core.") +Signed-off-by: Stephan Gerhold +Signed-off-by: Jakob Hauser +Reviewed-by: Linus Walleij +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/6a8a19bc67b5be3732882e8131ad2ffcb546ac03.1684182964.git.jahau@rocketmail.com +Signed-off-by: Sasha Levin +--- + drivers/mfd/rt5033.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/mfd/rt5033.c b/drivers/mfd/rt5033.c +index 48381d9bf7403..302115dabff4b 100644 +--- a/drivers/mfd/rt5033.c ++++ b/drivers/mfd/rt5033.c +@@ -41,9 +41,6 @@ static const struct mfd_cell rt5033_devs[] = { + { + .name = "rt5033-charger", + .of_compatible = "richtek,rt5033-charger", +- }, { +- .name = "rt5033-battery", +- .of_compatible = "richtek,rt5033-battery", + }, { + .name = "rt5033-led", + .of_compatible = "richtek,rt5033-led", +-- +2.39.2 + diff --git a/queue-5.10/mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch b/queue-5.10/mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch new file mode 100644 index 00000000000..339546b9595 --- /dev/null +++ b/queue-5.10/mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch @@ -0,0 +1,38 @@ +From df6968cf625def84233379d22cf75bf1e74df765 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 11:28:03 +0200 +Subject: mfd: stmfx: Fix error path in stmfx_chip_init + +From: Amelie Delaunay + +[ Upstream commit f592cf624531286f8b52e40dcfc157a5a7fb115c ] + +In error path, disable vdd regulator if it exists, but don't overload ret. +Because if regulator_disable() is successful, stmfx_chip_init will exit +successfully while chip init failed. + +Fixes: 06252ade9156 ("mfd: Add ST Multi-Function eXpander (STMFX) core driver") +Signed-off-by: Amelie Delaunay +Link: https://lore.kernel.org/r/20230609092804.793100-1-amelie.delaunay@foss.st.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/stmfx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c +index 988e2ba6dd0f3..41e74b5dd9901 100644 +--- a/drivers/mfd/stmfx.c ++++ b/drivers/mfd/stmfx.c +@@ -387,7 +387,7 @@ static int stmfx_chip_init(struct i2c_client *client) + + err: + if (stmfx->vdd) +- return regulator_disable(stmfx->vdd); ++ regulator_disable(stmfx->vdd); + + return ret; + } +-- +2.39.2 + diff --git a/queue-5.10/mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch b/queue-5.10/mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch new file mode 100644 index 00000000000..4a1da4642e6 --- /dev/null +++ b/queue-5.10/mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch @@ -0,0 +1,41 @@ +From f98af3b172ee75a7ec19d3f8a42bc0ee525221b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 11:28:04 +0200 +Subject: mfd: stmfx: Nullify stmfx->vdd in case of error + +From: Amelie Delaunay + +[ Upstream commit 7c81582c0bccb4757186176f0ee12834597066ad ] + +Nullify stmfx->vdd in case devm_regulator_get_optional() returns an error. +And simplify code by returning an error only if return code is not -ENODEV, +which means there is no vdd regulator and it is not an issue. + +Fixes: d75846ed08e6 ("mfd: stmfx: Fix dev_err_probe() call in stmfx_chip_init()") +Signed-off-by: Amelie Delaunay +Link: https://lore.kernel.org/r/20230609092804.793100-2-amelie.delaunay@foss.st.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/stmfx.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c +index 41e74b5dd9901..b45d7b0b842c5 100644 +--- a/drivers/mfd/stmfx.c ++++ b/drivers/mfd/stmfx.c +@@ -330,9 +330,8 @@ static int stmfx_chip_init(struct i2c_client *client) + stmfx->vdd = devm_regulator_get_optional(&client->dev, "vdd"); + ret = PTR_ERR_OR_ZERO(stmfx->vdd); + if (ret) { +- if (ret == -ENODEV) +- stmfx->vdd = NULL; +- else ++ stmfx->vdd = NULL; ++ if (ret != -ENODEV) + return dev_err_probe(&client->dev, ret, "Failed to get VDD regulator\n"); + } + +-- +2.39.2 + diff --git a/queue-5.10/mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch b/queue-5.10/mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch new file mode 100644 index 00000000000..ff5f89ff3cd --- /dev/null +++ b/queue-5.10/mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch @@ -0,0 +1,45 @@ +From 7ec1dce25fc5e8d18cc84cc256ba978368c5ac15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jun 2023 12:43:16 +0200 +Subject: mfd: stmpe: Only disable the regulators if they are enabled + +From: Christophe JAILLET + +[ Upstream commit 104d32bd81f620bb9f67fbf7d1159c414e89f05f ] + +In stmpe_probe(), if some regulator_enable() calls fail, probing continues +and there is only a dev_warn(). + +So, if stmpe_probe() is called the regulator may not be enabled. It is +cleaner to test it before calling regulator_disable() in the remove +function. + +Fixes: 9c9e321455fb ("mfd: stmpe: add optional regulators") +Signed-off-by: Christophe JAILLET +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/8de3aaf297931d655b9ad6aed548f4de8b85425a.1686998575.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/stmpe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c +index 508349399f8af..7f758fb60c1fa 100644 +--- a/drivers/mfd/stmpe.c ++++ b/drivers/mfd/stmpe.c +@@ -1494,9 +1494,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum) + + int stmpe_remove(struct stmpe *stmpe) + { +- if (!IS_ERR(stmpe->vio)) ++ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio)) + regulator_disable(stmpe->vio); +- if (!IS_ERR(stmpe->vcc)) ++ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc)) + regulator_disable(stmpe->vcc); + + __stmpe_disable(stmpe, STMPE_BLOCK_ADC); +-- +2.39.2 + diff --git a/queue-5.10/net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch b/queue-5.10/net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch new file mode 100644 index 00000000000..6017c4fb8ca --- /dev/null +++ b/queue-5.10/net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch @@ -0,0 +1,198 @@ +From 03d40a655ae7abb7e0093c64f3728edb3b15c053 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 19:41:18 +0300 +Subject: net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode + +From: Vladimir Oltean + +[ Upstream commit 6ca3c005d0604e8d2b439366e3923ea58db99641 ] + +According to the synchronization rules for .ndo_get_stats() as seen in +Documentation/networking/netdevices.rst, acquiring a plain spin_lock() +should not be illegal, but the bridge driver implementation makes it so. + +After running these commands, I am being faced with the following +lockdep splat: + +$ ip link add link swp0 name macsec0 type macsec encrypt on && ip link set swp0 up +$ ip link add dev br0 type bridge vlan_filtering 1 && ip link set br0 up +$ ip link set macsec0 master br0 && ip link set macsec0 up + + ======================================================== + WARNING: possible irq lock inversion dependency detected + 6.4.0-04295-g31b577b4bd4a #603 Not tainted + -------------------------------------------------------- + swapper/1/0 just changed the state of lock: + ffff6bd348724cd8 (&br->lock){+.-.}-{3:3}, at: br_forward_delay_timer_expired+0x34/0x198 + but this lock took another, SOFTIRQ-unsafe lock in the past: + (&ocelot->stats_lock){+.+.}-{3:3} + + and interrupts could create inverse lock ordering between them. + + other info that might help us debug this: + Chain exists of: + &br->lock --> &br->hash_lock --> &ocelot->stats_lock + + Possible interrupt unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&ocelot->stats_lock); + local_irq_disable(); + lock(&br->lock); + lock(&br->hash_lock); + + lock(&br->lock); + + *** DEADLOCK *** + +(details about the 3 locks skipped) + +swp0 is instantiated by drivers/net/dsa/ocelot/felix.c, and this +only matters to the extent that its .ndo_get_stats64() method calls +spin_lock(&ocelot->stats_lock). + +Documentation/locking/lockdep-design.rst says: + +| A lock is irq-safe means it was ever used in an irq context, while a lock +| is irq-unsafe means it was ever acquired with irq enabled. + +(...) + +| Furthermore, the following usage based lock dependencies are not allowed +| between any two lock-classes:: +| +| -> +| -> + +Lockdep marks br->hash_lock as softirq-safe, because it is sometimes +taken in softirq context (for example br_fdb_update() which runs in +NET_RX softirq), and when it's not in softirq context it blocks softirqs +by using spin_lock_bh(). + +Lockdep marks ocelot->stats_lock as softirq-unsafe, because it never +blocks softirqs from running, and it is never taken from softirq +context. So it can always be interrupted by softirqs. + +There is a call path through which a function that holds br->hash_lock: +fdb_add_hw_addr() will call a function that acquires ocelot->stats_lock: +ocelot_port_get_stats64(). This can be seen below: + +ocelot_port_get_stats64+0x3c/0x1e0 +felix_get_stats64+0x20/0x38 +dsa_slave_get_stats64+0x3c/0x60 +dev_get_stats+0x74/0x2c8 +rtnl_fill_stats+0x4c/0x150 +rtnl_fill_ifinfo+0x5cc/0x7b8 +rtmsg_ifinfo_build_skb+0xe4/0x150 +rtmsg_ifinfo+0x5c/0xb0 +__dev_notify_flags+0x58/0x200 +__dev_set_promiscuity+0xa0/0x1f8 +dev_set_promiscuity+0x30/0x70 +macsec_dev_change_rx_flags+0x68/0x88 +__dev_set_promiscuity+0x1a8/0x1f8 +__dev_set_rx_mode+0x74/0xa8 +dev_uc_add+0x74/0xa0 +fdb_add_hw_addr+0x68/0xd8 +fdb_add_local+0xc4/0x110 +br_fdb_add_local+0x54/0x88 +br_add_if+0x338/0x4a0 +br_add_slave+0x20/0x38 +do_setlink+0x3a4/0xcb8 +rtnl_newlink+0x758/0x9d0 +rtnetlink_rcv_msg+0x2f0/0x550 +netlink_rcv_skb+0x128/0x148 +rtnetlink_rcv+0x24/0x38 + +the plain English explanation for it is: + +The macsec0 bridge port is created without p->flags & BR_PROMISC, +because it is what br_manage_promisc() decides for a VLAN filtering +bridge with a single auto port. + +As part of the br_add_if() procedure, br_fdb_add_local() is called for +the MAC address of the device, and this results in a call to +dev_uc_add() for macsec0 while the softirq-safe br->hash_lock is taken. + +Because macsec0 does not have IFF_UNICAST_FLT, dev_uc_add() ends up +calling __dev_set_promiscuity() for macsec0, which is propagated by its +implementation, macsec_dev_change_rx_flags(), to the lower device: swp0. +This triggers the call path: + +dev_set_promiscuity(swp0) +-> rtmsg_ifinfo() + -> dev_get_stats() + -> ocelot_port_get_stats64() + +with a calling context that lockdep doesn't like (br->hash_lock held). + +Normally we don't see this, because even though many drivers that can be +bridge ports don't support IFF_UNICAST_FLT, we need a driver that + +(a) doesn't support IFF_UNICAST_FLT, *and* +(b) it forwards the IFF_PROMISC flag to another driver, and +(c) *that* driver implements ndo_get_stats64() using a softirq-unsafe + spinlock. + +Condition (b) is necessary because the first __dev_set_rx_mode() calls +__dev_set_promiscuity() with "bool notify=false", and thus, the +rtmsg_ifinfo() code path won't be entered. + +The same criteria also hold true for DSA switches which don't report +IFF_UNICAST_FLT. When the DSA master uses a spin_lock() in its +ndo_get_stats64() method, the same lockdep splat can be seen. + +I think the deadlock possibility is real, even though I didn't reproduce +it, and I'm thinking of the following situation to support that claim: + +fdb_add_hw_addr() runs on a CPU A, in a context with softirqs locally +disabled and br->hash_lock held, and may end up attempting to acquire +ocelot->stats_lock. + +In parallel, ocelot->stats_lock is currently held by a thread B (say, +ocelot_check_stats_work()), which is interrupted while holding it by a +softirq which attempts to lock br->hash_lock. + +Thread B cannot make progress because br->hash_lock is held by A. Whereas +thread A cannot make progress because ocelot->stats_lock is held by B. + +When taking the issue at face value, the bridge can avoid that problem +by simply making the ports promiscuous from a code path with a saner +calling context (br->hash_lock not held). A bridge port without +IFF_UNICAST_FLT is going to become promiscuous as soon as we call +dev_uc_add() on it (which we do unconditionally), so why not be +preemptive and make it promiscuous right from the beginning, so as to +not be taken by surprise. + +With this, we've broken the links between code that holds br->hash_lock +or br->lock and code that calls into the ndo_change_rx_flags() or +ndo_get_stats64() ops of the bridge port. + +Fixes: 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode.") +Signed-off-by: Vladimir Oltean +Reviewed-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_if.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c +index 1d87bf51f3840..e35488fde9c85 100644 +--- a/net/bridge/br_if.c ++++ b/net/bridge/br_if.c +@@ -157,8 +157,9 @@ void br_manage_promisc(struct net_bridge *br) + * This lets us disable promiscuous mode and write + * this config to hw. + */ +- if (br->auto_cnt == 0 || +- (br->auto_cnt == 1 && br_auto_port(p))) ++ if ((p->dev->priv_flags & IFF_UNICAST_FLT) && ++ (br->auto_cnt == 0 || ++ (br->auto_cnt == 1 && br_auto_port(p)))) + br_port_clear_promisc(p); + else + br_port_set_promisc(p); +-- +2.39.2 + diff --git a/queue-5.10/net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch b/queue-5.10/net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch new file mode 100644 index 00000000000..c212146e6a6 --- /dev/null +++ b/queue-5.10/net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch @@ -0,0 +1,46 @@ +From 12c6d660a05c41a708a70408521a91b7812f553f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 01:05:44 +0300 +Subject: net: dsa: tag_sja1105: fix MAC DA patching from meta frames + +From: Vladimir Oltean + +[ Upstream commit 1dcf6efd5f0c1f4496b3ef7ec5a7db104a53b38c ] + +The SJA1105 manual says that at offset 4 into the meta frame payload we +have "MAC destination byte 2" and at offset 5 we have "MAC destination +byte 1". These are counted from the LSB, so byte 1 is h_dest[ETH_HLEN-2] +aka h_dest[4] and byte 2 is h_dest[ETH_HLEN-3] aka h_dest[3]. + +The sja1105_meta_unpack() function decodes these the other way around, +so a frame with MAC DA 01:80:c2:11:22:33 is received by the network +stack as having 01:80:c2:22:11:33. + +Fixes: e53e18a6fe4d ("net: dsa: sja1105: Receive and decode meta frames") +Signed-off-by: Vladimir Oltean +Reviewed-by: Simon Horman +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dsa/tag_sja1105.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c +index 50496013cdb7f..07876160edd2b 100644 +--- a/net/dsa/tag_sja1105.c ++++ b/net/dsa/tag_sja1105.c +@@ -48,8 +48,8 @@ static void sja1105_meta_unpack(const struct sk_buff *skb, + * a unified unpacking command for both device series. + */ + packing(buf, &meta->tstamp, 31, 0, 4, UNPACK, 0); +- packing(buf + 4, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0); +- packing(buf + 5, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0); ++ packing(buf + 4, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0); ++ packing(buf + 5, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0); + packing(buf + 6, &meta->source_port, 7, 0, 1, UNPACK, 0); + packing(buf + 7, &meta->switch_id, 7, 0, 1, UNPACK, 0); + } +-- +2.39.2 + diff --git a/queue-5.10/net-dsa-vsc73xx-fix-mtu-configuration.patch b/queue-5.10/net-dsa-vsc73xx-fix-mtu-configuration.patch new file mode 100644 index 00000000000..c50e5d54260 --- /dev/null +++ b/queue-5.10/net-dsa-vsc73xx-fix-mtu-configuration.patch @@ -0,0 +1,54 @@ +From 3985b7a568cad244f30ac210a9af01ff58c280f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 21:43:27 +0200 +Subject: net: dsa: vsc73xx: fix MTU configuration + +From: Pawel Dembicki + +[ Upstream commit 3cf62c8177adb0db9e15c8b898c44f997acf3ebf ] + +Switch in MAXLEN register stores the maximum size of a data frame. +The MTU size is 18 bytes smaller than the frame size. + +The current settings are causing problems with packet forwarding. +This patch fixes the MTU settings to proper values. + +Fixes: fb77ffc6ec86 ("net: dsa: vsc73xx: make the MTU configurable") +Reviewed-by: Linus Walleij +Signed-off-by: Pawel Dembicki +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20230628194327.1765644-1-paweldembicki@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/vitesse-vsc73xx-core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c +index 19ce4aa0973b4..80eadf509c0a9 100644 +--- a/drivers/net/dsa/vitesse-vsc73xx-core.c ++++ b/drivers/net/dsa/vitesse-vsc73xx-core.c +@@ -1025,17 +1025,17 @@ static int vsc73xx_change_mtu(struct dsa_switch *ds, int port, int new_mtu) + struct vsc73xx *vsc = ds->priv; + + return vsc73xx_write(vsc, VSC73XX_BLOCK_MAC, port, +- VSC73XX_MAXLEN, new_mtu); ++ VSC73XX_MAXLEN, new_mtu + ETH_HLEN + ETH_FCS_LEN); + } + + /* According to application not "VSC7398 Jumbo Frames" setting +- * up the MTU to 9.6 KB does not affect the performance on standard ++ * up the frame size to 9.6 KB does not affect the performance on standard + * frames. It is clear from the application note that + * "9.6 kilobytes" == 9600 bytes. + */ + static int vsc73xx_get_max_mtu(struct dsa_switch *ds, int port) + { +- return 9600; ++ return 9600 - ETH_HLEN - ETH_FCS_LEN; + } + + static const struct dsa_switch_ops vsc73xx_ds_ops = { +-- +2.39.2 + diff --git a/queue-5.10/net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch b/queue-5.10/net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch new file mode 100644 index 00000000000..d89d82ca997 --- /dev/null +++ b/queue-5.10/net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch @@ -0,0 +1,57 @@ +From e1a0c6f3b277986e3b359681e7e6609ebc1a156c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 19:08:42 +0800 +Subject: net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX + +From: Lin Ma + +[ Upstream commit 30c45b5361d39b4b793780ffac5538090b9e2eb1 ] + +The attribute TCA_PEDIT_PARMS_EX is not be included in pedit_policy and +one malicious user could fake a TCA_PEDIT_PARMS_EX whose length is +smaller than the intended sizeof(struct tc_pedit). Hence, the +dereference in tcf_pedit_init() could access dirty heap data. + +static int tcf_pedit_init(...) +{ + // ... + pattr = tb[TCA_PEDIT_PARMS]; // TCA_PEDIT_PARMS is included + if (!pattr) + pattr = tb[TCA_PEDIT_PARMS_EX]; // but this is not + + // ... + parm = nla_data(pattr); + + index = parm->index; // parm is able to be smaller than 4 bytes + // and this dereference gets dirty skb_buff + // data created in netlink_sendmsg +} + +This commit adds TCA_PEDIT_PARMS_EX length in pedit_policy which avoid +the above case, just like the TCA_PEDIT_PARMS. + +Fixes: 71d0ed7079df ("net/act_pedit: Support using offset relative to the conventional network headers") +Signed-off-by: Lin Ma +Reviewed-by: Pedro Tammela +Link: https://lore.kernel.org/r/20230703110842.590282-1-linma@zju.edu.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sched/act_pedit.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c +index db0d3bff19eba..a44101b2f4419 100644 +--- a/net/sched/act_pedit.c ++++ b/net/sched/act_pedit.c +@@ -26,6 +26,7 @@ static struct tc_action_ops act_pedit_ops; + + static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = { + [TCA_PEDIT_PARMS] = { .len = sizeof(struct tc_pedit) }, ++ [TCA_PEDIT_PARMS_EX] = { .len = sizeof(struct tc_pedit) }, + [TCA_PEDIT_KEYS_EX] = { .type = NLA_NESTED }, + }; + +-- +2.39.2 + diff --git a/queue-5.10/octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch b/queue-5.10/octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch new file mode 100644 index 00000000000..a3d7dcff016 --- /dev/null +++ b/queue-5.10/octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch @@ -0,0 +1,74 @@ +From bb16ae2faa353f02be59aff76b3e99415779429e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 11:58:43 +0530 +Subject: octeontx2-af: Fix mapping for NIX block from CGX connection + +From: Hariprasad Kelam + +[ Upstream commit 2e7bc57b976bb016c6569a54d95c1b8d88f9450a ] + +Firmware configures NIX block mapping for all MAC blocks. +The current implementation reads the configuration and +creates the mapping between RVU PF and NIX blocks. But +this configuration is only valid for silicons that support +multiple blocks. For all other silicons, all MAC blocks +map to NIX0. + +This patch corrects the mapping by adding a check for the same. + +Fixes: c5a73b632b90 ("octeontx2-af: Map NIX block from CGX connection") +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Goutham +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 11 +++++++++++ + drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 +- + 2 files changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +index fc6d785b98ddd..ec9a291e866c7 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +@@ -20,6 +20,7 @@ + #define PCI_DEVID_OCTEONTX2_RVU_AF 0xA065 + + /* Subsystem Device ID */ ++#define PCI_SUBSYS_DEVID_98XX 0xB100 + #define PCI_SUBSYS_DEVID_96XX 0xB200 + + /* PCI BAR nos */ +@@ -403,6 +404,16 @@ static inline bool is_rvu_96xx_B0(struct rvu *rvu) + (pdev->subsystem_device == PCI_SUBSYS_DEVID_96XX); + } + ++static inline bool is_rvu_supports_nix1(struct rvu *rvu) ++{ ++ struct pci_dev *pdev = rvu->pdev; ++ ++ if (pdev->subsystem_device == PCI_SUBSYS_DEVID_98XX) ++ return true; ++ ++ return false; ++} ++ + /* Function Prototypes + * RVU + */ +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +index 6c6b411e78fd8..83743e15326d7 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +@@ -84,7 +84,7 @@ static void rvu_map_cgx_nix_block(struct rvu *rvu, int pf, + p2x = cgx_lmac_get_p2x(cgx_id, lmac_id); + /* Firmware sets P2X_SELECT as either NIX0 or NIX1 */ + pfvf->nix_blkaddr = BLKADDR_NIX0; +- if (p2x == CMR_P2X_SEL_NIX1) ++ if (is_rvu_supports_nix1(rvu) && p2x == CMR_P2X_SEL_NIX1) + pfvf->nix_blkaddr = BLKADDR_NIX1; + } + +-- +2.39.2 + diff --git a/queue-5.10/phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch b/queue-5.10/phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch new file mode 100644 index 00000000000..a96836cf494 --- /dev/null +++ b/queue-5.10/phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch @@ -0,0 +1,40 @@ +From 9152640949d6706d102e5bf745dfee50d395f878 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 10:39:50 +0300 +Subject: phy: tegra: xusb: check return value of devm_kzalloc() + +From: Claudiu Beznea + +[ Upstream commit 44faada0f38fc333d392af04c343b0e23f8f5d81 ] + +devm_kzalloc() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: f67213cee2b3 ("phy: tegra: xusb: Add usb-role-switch support") +Signed-off-by: Claudiu Beznea +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20230531073950.145339-1-claudiu.beznea@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/tegra/xusb.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c +index f93be3c4a4a6e..8f11b293c48d1 100644 +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -663,6 +663,9 @@ static int tegra_xusb_setup_usb_role_switch(struct tegra_xusb_port *port) + port->dev.driver = devm_kzalloc(&port->dev, + sizeof(struct device_driver), + GFP_KERNEL); ++ if (!port->dev.driver) ++ return -ENOMEM; ++ + port->dev.driver->owner = THIS_MODULE; + + port->usb_role_sw = usb_role_switch_register(&port->dev, +-- +2.39.2 + diff --git a/queue-5.10/powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch b/queue-5.10/powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch new file mode 100644 index 00000000000..29871f2950d --- /dev/null +++ b/queue-5.10/powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch @@ -0,0 +1,46 @@ +From 0f240778bab757a888333add6ecfa11edfa1d07d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 22:47:12 -0700 +Subject: powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randy Dunlap + +[ Upstream commit 39f49684036d24af800ff194c33c7b2653c591d7 ] + +In a randconfig with CONFIG_SERIAL_CPM=m and +CONFIG_PPC_EARLY_DEBUG_CPM=y, there is a build error: +ERROR: modpost: "udbg_putc" [drivers/tty/serial/cpm_uart/cpm_uart.ko] undefined! + +Prevent the build error by allowing PPC_EARLY_DEBUG_CPM only when +SERIAL_CPM=y. + +Fixes: c374e00e17f1 ("[POWERPC] Add early debug console for CPM serial ports.") +Signed-off-by: Randy Dunlap +Reviewed-by: Pali Rohár +Reviewed-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230701054714.30512-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/Kconfig.debug | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug +index 52abca88b5b2b..e03fb91544206 100644 +--- a/arch/powerpc/Kconfig.debug ++++ b/arch/powerpc/Kconfig.debug +@@ -234,7 +234,7 @@ config PPC_EARLY_DEBUG_40x + + config PPC_EARLY_DEBUG_CPM + bool "Early serial debugging for Freescale CPM-based serial ports" +- depends on SERIAL_CPM ++ depends on SERIAL_CPM=y + help + Select this to enable early debugging for Freescale chips + using a CPM-based serial port. This assumes that the bootwrapper +-- +2.39.2 + diff --git a/queue-5.10/pptp-fix-fib-lookup-calls.patch b/queue-5.10/pptp-fix-fib-lookup-calls.patch new file mode 100644 index 00000000000..c99f814b79a --- /dev/null +++ b/queue-5.10/pptp-fix-fib-lookup-calls.patch @@ -0,0 +1,116 @@ +From 1b82f8063aceae2163cf6b762c67068e8ba9b803 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 19:14:46 +0200 +Subject: pptp: Fix fib lookup calls. + +From: Guillaume Nault + +[ Upstream commit 84bef5b6037c15180ef88ac4216dc621d16df1a6 ] + +PPTP uses pppox sockets (struct pppox_sock). These sockets don't embed +an inet_sock structure, so it's invalid to call inet_sk() on them. + +Therefore, the ip_route_output_ports() call in pptp_connect() has two +problems: + + * The tos variable is set with RT_CONN_FLAGS(sk), which calls + inet_sk() on the pppox socket. + + * ip_route_output_ports() tries to retrieve routing flags using + inet_sk_flowi_flags(), which is also going to call inet_sk() on the + pppox socket. + +While PPTP doesn't use inet sockets, it's actually really layered on +top of IP and therefore needs a proper way to do fib lookups. So let's +define pptp_route_output() to get a struct rtable from a pptp socket. +Let's also replace the ip_route_output_ports() call of pptp_xmit() for +consistency. + +In practice, this means that: + + * pptp_connect() sets ->flowi4_tos and ->flowi4_flags to zero instead + of using bits of unrelated struct pppox_sock fields. + + * pptp_xmit() now respects ->sk_mark and ->sk_uid. + + * pptp_xmit() now calls the security_sk_classify_flow() security + hook, thus allowing to set ->flowic_secid. + + * pptp_xmit() now passes the pppox socket to xfrm_lookup_route(). + +Found by code inspection. + +Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)") +Signed-off-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ppp/pptp.c | 31 ++++++++++++++++++++----------- + 1 file changed, 20 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c +index ee5058445d06e..05a75b5a8b680 100644 +--- a/drivers/net/ppp/pptp.c ++++ b/drivers/net/ppp/pptp.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -128,6 +129,23 @@ static void del_chan(struct pppox_sock *sock) + spin_unlock(&chan_lock); + } + ++static struct rtable *pptp_route_output(struct pppox_sock *po, ++ struct flowi4 *fl4) ++{ ++ struct sock *sk = &po->sk; ++ struct net *net; ++ ++ net = sock_net(sk); ++ flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark, 0, ++ RT_SCOPE_UNIVERSE, IPPROTO_GRE, 0, ++ po->proto.pptp.dst_addr.sin_addr.s_addr, ++ po->proto.pptp.src_addr.sin_addr.s_addr, ++ 0, 0, sock_net_uid(net, sk)); ++ security_sk_classify_flow(sk, flowi4_to_flowi_common(fl4)); ++ ++ return ip_route_output_flow(net, fl4, sk); ++} ++ + static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb) + { + struct sock *sk = (struct sock *) chan->private; +@@ -151,11 +169,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb) + if (sk_pppox(po)->sk_state & PPPOX_DEAD) + goto tx_error; + +- rt = ip_route_output_ports(net, &fl4, NULL, +- opt->dst_addr.sin_addr.s_addr, +- opt->src_addr.sin_addr.s_addr, +- 0, 0, IPPROTO_GRE, +- RT_TOS(0), sk->sk_bound_dev_if); ++ rt = pptp_route_output(po, &fl4); + if (IS_ERR(rt)) + goto tx_error; + +@@ -440,12 +454,7 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr, + po->chan.private = sk; + po->chan.ops = &pptp_chan_ops; + +- rt = ip_route_output_ports(sock_net(sk), &fl4, sk, +- opt->dst_addr.sin_addr.s_addr, +- opt->src_addr.sin_addr.s_addr, +- 0, 0, +- IPPROTO_GRE, RT_CONN_FLAGS(sk), +- sk->sk_bound_dev_if); ++ rt = pptp_route_output(po, &fl4); + if (IS_ERR(rt)) { + error = -EHOSTUNREACH; + goto end; +-- +2.39.2 + diff --git a/queue-5.10/pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch b/queue-5.10/pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch new file mode 100644 index 00000000000..d158516bfeb --- /dev/null +++ b/queue-5.10/pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch @@ -0,0 +1,48 @@ +From 4592e1dab1571866f9190655b7b95d5e4b005f8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 14:58:39 +0800 +Subject: pwm: imx-tpm: force 'real_period' to be zero in suspend +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fancy Fang + +[ Upstream commit 661dfb7f46298e53f6c3deaa772fa527aae86193 ] + +During suspend, all the tpm registers will lose values. +So the 'real_period' value of struct 'imx_tpm_pwm_chip' +should be forced to be zero to force the period update +code can be executed after system resume back. + +Signed-off-by: Fancy Fang +Signed-off-by: Clark Wang +Acked-by: Uwe Kleine-König +Fixes: 738a1cfec2ed ("pwm: Add i.MX TPM PWM driver support") +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-imx-tpm.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/pwm/pwm-imx-tpm.c b/drivers/pwm/pwm-imx-tpm.c +index fcdf6befb8389..871527b78aa46 100644 +--- a/drivers/pwm/pwm-imx-tpm.c ++++ b/drivers/pwm/pwm-imx-tpm.c +@@ -403,6 +403,13 @@ static int __maybe_unused pwm_imx_tpm_suspend(struct device *dev) + if (tpm->enable_count > 0) + return -EBUSY; + ++ /* ++ * Force 'real_period' to be zero to force period update code ++ * can be executed after system resume back, since suspend causes ++ * the period related registers to become their reset values. ++ */ ++ tpm->real_period = 0; ++ + clk_disable_unprepare(tpm->clk); + + return 0; +-- +2.39.2 + diff --git a/queue-5.10/pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch b/queue-5.10/pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch new file mode 100644 index 00000000000..36c31b4906b --- /dev/null +++ b/queue-5.10/pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch @@ -0,0 +1,90 @@ +From d56d21af6bf877d438e82645843f9c44de95ebea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 18:47:36 +0200 +Subject: pwm: sysfs: Do not apply state to already disabled PWMs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Vasut + +[ Upstream commit 38ba83598633373f47951384cfc389181c8d1bed ] + +If the PWM is exported but not enabled, do not call pwm_class_apply_state(). +First of all, in this case, period may still be unconfigured and this would +make pwm_class_apply_state() return -EINVAL, and then suspend would fail. +Second, it makes little sense to apply state onto PWM that is not enabled +before suspend. + +Failing case: +" +$ echo 1 > /sys/class/pwm/pwmchip4/export +$ echo mem > /sys/power/state +... +pwm pwmchip4: PM: dpm_run_callback(): pwm_class_suspend+0x1/0xa8 returns -22 +pwm pwmchip4: PM: failed to suspend: error -22 +PM: Some devices failed to suspend, or early wake event detected +" + +Working case: +" +$ echo 1 > /sys/class/pwm/pwmchip4/export +$ echo 100 > /sys/class/pwm/pwmchip4/pwm1/period +$ echo 10 > /sys/class/pwm/pwmchip4/pwm1/duty_cycle +$ echo mem > /sys/power/state +... +" + +Do not call pwm_class_apply_state() in case the PWM is disabled +to fix this issue. + +Fixes: 7fd4edc57bbae ("pwm: sysfs: Add suspend/resume support") +Signed-off-by: Marek Vasut +Fixes: ef2bf4997f7d ("pwm: Improve args checking in pwm_apply_state()") +Reviewed-by: Brian Norris +Reviewed-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/sysfs.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c +index 9903c3a7ecedc..b8417a8d2ef97 100644 +--- a/drivers/pwm/sysfs.c ++++ b/drivers/pwm/sysfs.c +@@ -424,6 +424,13 @@ static int pwm_class_resume_npwm(struct device *parent, unsigned int npwm) + if (!export) + continue; + ++ /* If pwmchip was not enabled before suspend, do nothing. */ ++ if (!export->suspend.enabled) { ++ /* release lock taken in pwm_class_get_state */ ++ mutex_unlock(&export->lock); ++ continue; ++ } ++ + state.enabled = export->suspend.enabled; + ret = pwm_class_apply_state(export, pwm, &state); + if (ret < 0) +@@ -448,7 +455,17 @@ static int __maybe_unused pwm_class_suspend(struct device *parent) + if (!export) + continue; + ++ /* ++ * If pwmchip was not enabled before suspend, save ++ * state for resume time and do nothing else. ++ */ + export->suspend = state; ++ if (!state.enabled) { ++ /* release lock taken in pwm_class_get_state */ ++ mutex_unlock(&export->lock); ++ continue; ++ } ++ + state.enabled = false; + ret = pwm_class_apply_state(export, pwm, &state); + if (ret < 0) { +-- +2.39.2 + diff --git a/queue-5.10/revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch b/queue-5.10/revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch new file mode 100644 index 00000000000..74894f2ad38 --- /dev/null +++ b/queue-5.10/revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch @@ -0,0 +1,98 @@ +From 5378cc17c09e9dfef20e89a34d6051dbc80a0651 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 11:30:35 +0200 +Subject: Revert "usb: common: usb-conn-gpio: Set last role to unknown before + initial detection" + +From: Greg Kroah-Hartman + +[ Upstream commit df49f2a0ac4a34c0cb4b5c233fcfa0add644c43c ] + +This reverts commit edd60d24bd858cef165274e4cd6cab43bdc58d15. + +Heikki reports that this should not be a global flag just to work around +one broken driver and should be fixed differently, so revert it. + +Reported-by: Heikki Krogerus +Fixes: edd60d24bd85 ("usb: common: usb-conn-gpio: Set last role to unknown before initial detection") +Link: https://lore.kernel.org/r/ZImE4L3YgABnCIsP@kuha.fi.intel.com +Cc: Prashanth K +Cc: AngeloGioacchino Del Regno +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/cdns3/core.c | 2 -- + drivers/usb/common/usb-conn-gpio.c | 3 --- + drivers/usb/musb/jz4740.c | 2 -- + drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 -- + include/linux/usb/role.h | 1 - + 5 files changed, 10 deletions(-) + +diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c +index e5fe640b2bb01..8fe7420de033d 100644 +--- a/drivers/usb/cdns3/core.c ++++ b/drivers/usb/cdns3/core.c +@@ -243,8 +243,6 @@ static enum usb_role cdns3_hw_role_state_machine(struct cdns3 *cdns) + if (!vbus) + role = USB_ROLE_NONE; + break; +- default: +- break; + } + + dev_dbg(cdns->dev, "role %d -> %d\n", cdns->role, role); +diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c +index 5754e467c16a8..c9545a4eff664 100644 +--- a/drivers/usb/common/usb-conn-gpio.c ++++ b/drivers/usb/common/usb-conn-gpio.c +@@ -276,9 +276,6 @@ static int usb_conn_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, info); + +- /* Set last role to unknown before performing the initial detection */ +- info->last_role = USB_ROLE_UNKNOWN; +- + /* Perform initial detection */ + usb_conn_queue_dwork(info, 0); + +diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c +index f283629091ec4..c4fe1f4cd17a3 100644 +--- a/drivers/usb/musb/jz4740.c ++++ b/drivers/usb/musb/jz4740.c +@@ -91,8 +91,6 @@ static int jz4740_musb_role_switch_set(struct usb_role_switch *sw, + case USB_ROLE_HOST: + atomic_notifier_call_chain(&phy->notifier, USB_EVENT_ID, phy); + break; +- default: +- break; + } + + return 0; +diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c +index 4d6a3dd06e011..5c96e929acea0 100644 +--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c ++++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c +@@ -97,8 +97,6 @@ static int intel_xhci_usb_set_role(struct usb_role_switch *sw, + val |= SW_VBUS_VALID; + drd_config = DRD_CONFIG_STATIC_DEVICE; + break; +- default: +- break; + } + val |= SW_IDPIN_EN; + if (data->enable_sw_switch) { +diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h +index aecfce46d3544..b9ccaeb8a4aef 100644 +--- a/include/linux/usb/role.h ++++ b/include/linux/usb/role.h +@@ -11,7 +11,6 @@ enum usb_role { + USB_ROLE_NONE, + USB_ROLE_HOST, + USB_ROLE_DEVICE, +- USB_ROLE_UNKNOWN, + }; + + typedef int (*usb_role_switch_set_t)(struct usb_role_switch *sw, +-- +2.39.2 + diff --git a/queue-5.10/rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch b/queue-5.10/rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch new file mode 100644 index 00000000000..3dd0e8dfc8c --- /dev/null +++ b/queue-5.10/rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch @@ -0,0 +1,40 @@ +From 4b0af61a4ee065f767f031ad661c1d87dfca9472 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 21:11:42 +0200 +Subject: rtc: st-lpc: Release some resources in st_rtc_probe() in case of + error + +From: Christophe JAILLET + +[ Upstream commit 06c6e1b01d9261f03629cefd1f3553503291e6cf ] + +If an error occurs after clk_get(), the corresponding resources should be +released. + +Use devm_clk_get() to fix it. + +Fixes: b5b2bdfc2893 ("rtc: st: Add new driver for ST's LPC RTC") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/866af6adbc7454a7b4505eb6c28fbdc86ccff39e.1686251455.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-st-lpc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-st-lpc.c b/drivers/rtc/rtc-st-lpc.c +index 7d53f7e2febcc..c4ea3f3f08844 100644 +--- a/drivers/rtc/rtc-st-lpc.c ++++ b/drivers/rtc/rtc-st-lpc.c +@@ -228,7 +228,7 @@ static int st_rtc_probe(struct platform_device *pdev) + enable_irq_wake(rtc->irq); + disable_irq(rtc->irq); + +- rtc->clk = clk_get(&pdev->dev, NULL); ++ rtc->clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(rtc->clk)) { + dev_err(&pdev->dev, "Unable to request clock\n"); + return PTR_ERR(rtc->clk); +-- +2.39.2 + diff --git a/queue-5.10/s390-qeth-fix-vipa-deletion.patch b/queue-5.10/s390-qeth-fix-vipa-deletion.patch new file mode 100644 index 00000000000..44be9c0530e --- /dev/null +++ b/queue-5.10/s390-qeth-fix-vipa-deletion.patch @@ -0,0 +1,42 @@ +From a23164cf3031718aad56a1992d2079b9551e1e6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 16:41:21 +0200 +Subject: s390/qeth: Fix vipa deletion + +From: Thorsten Winkler + +[ Upstream commit 80de809bd35e2a8999edf9f5aaa2d8de18921f11 ] + +Change boolean parameter of function "qeth_l3_vipa_store" inside the +"qeth_l3_dev_vipa_del4_store" function from "true" to "false" because +"true" is used for adding a virtual ip address and "false" for deleting. + +Fixes: 2390166a6b45 ("s390/qeth: clean up L3 sysfs code") + +Reviewed-by: Alexandra Winter +Reviewed-by: Wenjia Zhang +Signed-off-by: Thorsten Winkler +Signed-off-by: Alexandra Winter +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/s390/net/qeth_l3_sys.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c +index 997fbb7006a7c..316f8622f3ccb 100644 +--- a/drivers/s390/net/qeth_l3_sys.c ++++ b/drivers/s390/net/qeth_l3_sys.c +@@ -652,7 +652,7 @@ static QETH_DEVICE_ATTR(vipa_add4, add4, 0644, + static ssize_t qeth_l3_dev_vipa_del4_store(struct device *dev, + struct device_attribute *attr, const char *buf, size_t count) + { +- return qeth_l3_vipa_store(dev, buf, true, count, QETH_PROT_IPV4); ++ return qeth_l3_vipa_store(dev, buf, false, count, QETH_PROT_IPV4); + } + + static QETH_DEVICE_ATTR(vipa_del4, del4, 0200, NULL, +-- +2.39.2 + diff --git a/queue-5.10/sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch b/queue-5.10/sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch new file mode 100644 index 00000000000..6e346dbaee8 --- /dev/null +++ b/queue-5.10/sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch @@ -0,0 +1,57 @@ +From 1cc4ab56e1d27a0d6137a81c1e74445de942045f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 12:03:40 +0000 +Subject: sctp: fix potential deadlock on &net->sctp.addr_wq_lock + +From: Chengfeng Ye + +[ Upstream commit 6feb37b3b06e9049e20dcf7e23998f92c9c5be9a ] + +As &net->sctp.addr_wq_lock is also acquired by the timer +sctp_addr_wq_timeout_handler() in protocal.c, the same lock acquisition +at sctp_auto_asconf_init() seems should disable irq since it is called +from sctp_accept() under process context. + +Possible deadlock scenario: +sctp_accept() + -> sctp_sock_migrate() + -> sctp_auto_asconf_init() + -> spin_lock(&net->sctp.addr_wq_lock) + + -> sctp_addr_wq_timeout_handler() + -> spin_lock_bh(&net->sctp.addr_wq_lock); (deadlock here) + +This flaw was found using an experimental static analysis tool we are +developing for irq-related deadlock. + +The tentative patch fix the potential deadlock by spin_lock_bh(). + +Signed-off-by: Chengfeng Ye +Fixes: 34e5b0118685 ("sctp: delay auto_asconf init until binding the first addr") +Acked-by: Xin Long +Link: https://lore.kernel.org/r/20230627120340.19432-1-dg573847474@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sctp/socket.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 4a7f811abae4e..534364bb871a3 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -362,9 +362,9 @@ static void sctp_auto_asconf_init(struct sctp_sock *sp) + struct net *net = sock_net(&sp->inet.sk); + + if (net->sctp.default_auto_asconf) { +- spin_lock(&net->sctp.addr_wq_lock); ++ spin_lock_bh(&net->sctp.addr_wq_lock); + list_add_tail(&sp->auto_asconf_list, &net->sctp.auto_asconf_splist); +- spin_unlock(&net->sctp.addr_wq_lock); ++ spin_unlock_bh(&net->sctp.addr_wq_lock); + sp->do_auto_asconf = 1; + } + } +-- +2.39.2 + diff --git a/queue-5.10/serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch b/queue-5.10/serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch new file mode 100644 index 00000000000..7f8fe978d88 --- /dev/null +++ b/queue-5.10/serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch @@ -0,0 +1,39 @@ +From e04546ffa851be423fd130d38c68ef1fb1b77508 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 11:37:54 +0206 +Subject: serial: 8250: lock port for stop_rx() in omap8250_irq() + +From: John Ogness + +[ Upstream commit ca73a892c5bec4b08a2fa22b3015e98ed905abb7 ] + +The uarts_ops stop_rx() callback expects that the port->lock is +taken and interrupts are disabled. + +Fixes: 1fe0e1fa3209 ("serial: 8250_omap: Handle optional overrun-throttle-ms property") +Signed-off-by: John Ogness +Reviewed-by: Tony Lindgren +Link: https://lore.kernel.org/r/20230525093159.223817-4-john.ogness@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 6b255e1633fd4..6043d4fa08cc2 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -655,7 +655,9 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id) + + up->ier = port->serial_in(port, UART_IER); + if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) { ++ spin_lock(&port->lock); + port->ops->stop_rx(port); ++ spin_unlock(&port->lock); + } else { + /* Keep restarting the timer until + * the input overrun subsides. +-- +2.39.2 + diff --git a/queue-5.10/serial-8250-lock-port-for-uart_ier-access-in-omap825.patch b/queue-5.10/serial-8250-lock-port-for-uart_ier-access-in-omap825.patch new file mode 100644 index 00000000000..ddb652ad6fd --- /dev/null +++ b/queue-5.10/serial-8250-lock-port-for-uart_ier-access-in-omap825.patch @@ -0,0 +1,57 @@ +From 1935ecdb4cad47562049cf28d628af768af28a5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 11:37:58 +0206 +Subject: serial: 8250: lock port for UART_IER access in omap8250_irq() + +From: John Ogness + +[ Upstream commit 25614735a647693c1260f253dc3ab32127697806 ] + +omap8250_irq() accesses UART_IER. This register is modified twice +by each console write (serial8250_console_write()) under the port +lock. omap8250_irq() must also take the port lock to guanentee +synchronized access to UART_IER. + +Since the port lock is already being taken for the stop_rx() callback +and since it is safe to call cancel_delayed_work() while holding the +port lock, simply extend the port lock region to include UART_IER +access. + +Fixes: 1fe0e1fa3209 ("serial: 8250_omap: Handle optional overrun-throttle-ms property") +Signed-off-by: John Ogness +Reviewed-by: Tony Lindgren +Link: https://lore.kernel.org/r/20230525093159.223817-8-john.ogness@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 6043d4fa08cc2..af39a2c4c2eee 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -653,17 +653,18 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id) + if ((lsr & UART_LSR_OE) && up->overrun_backoff_time_ms > 0) { + unsigned long delay; + ++ /* Synchronize UART_IER access against the console. */ ++ spin_lock(&port->lock); + up->ier = port->serial_in(port, UART_IER); + if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) { +- spin_lock(&port->lock); + port->ops->stop_rx(port); +- spin_unlock(&port->lock); + } else { + /* Keep restarting the timer until + * the input overrun subsides. + */ + cancel_delayed_work(&up->overrun_backoff); + } ++ spin_unlock(&port->lock); + + delay = msecs_to_jiffies(up->overrun_backoff_time_ms); + schedule_delayed_work(&up->overrun_backoff, delay); +-- +2.39.2 + diff --git a/queue-5.10/serial-8250-omap-fix-freeing-of-resources-on-failed-.patch b/queue-5.10/serial-8250-omap-fix-freeing-of-resources-on-failed-.patch new file mode 100644 index 00000000000..ec56646f61e --- /dev/null +++ b/queue-5.10/serial-8250-omap-fix-freeing-of-resources-on-failed-.patch @@ -0,0 +1,42 @@ +From 1ceb0cfae3f147ed45511758f1bc7e136eee2fdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 11:20:11 +0300 +Subject: serial: 8250: omap: Fix freeing of resources on failed register +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tony Lindgren + +[ Upstream commit b9ab22c2bc8652324a803b3e2be69838920b4025 ] + +If serial8250_register_8250_port() fails, the SoC can hang as the +deferred PMQoS work will still run as is not flushed and removed. + +Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver") +Signed-off-by: Tony Lindgren +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20230508082014.23083-2-tony@atomide.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 483fff3a95c9e..6b255e1633fd4 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -1469,7 +1469,9 @@ static int omap8250_probe(struct platform_device *pdev) + err: + pm_runtime_dont_use_autosuspend(&pdev->dev); + pm_runtime_put_sync(&pdev->dev); ++ flush_work(&priv->qos_work); + pm_runtime_disable(&pdev->dev); ++ cpu_latency_qos_remove_request(&priv->pm_qos_request); + return ret; + } + +-- +2.39.2 + diff --git a/queue-5.10/serial-8250_omap-use-force_suspend-and-resume-for-sy.patch b/queue-5.10/serial-8250_omap-use-force_suspend-and-resume-for-sy.patch new file mode 100644 index 00000000000..e4ac719301e --- /dev/null +++ b/queue-5.10/serial-8250_omap-use-force_suspend-and-resume-for-sy.patch @@ -0,0 +1,78 @@ +From 781c0a0ccf31f9b540f2b9b464dff8229c4ee2d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 07:59:19 +0300 +Subject: serial: 8250_omap: Use force_suspend and resume for system suspend + +From: Tony Lindgren + +[ Upstream commit 20a41a62618df85f3a2981008edec5cadd785e0a ] + +We should not rely on autosuspend timeout for system suspend. Instead, +let's use force_suspend and force_resume functions. Otherwise the serial +port controller device may not be idled on suspend. + +As we are doing a register write on suspend to configure the serial port, +we still need to runtime PM resume the port on suspend. + +While at it, let's switch to pm_runtime_resume_and_get() and check for +errors returned. And let's add the missing line break before return to the +suspend function while at it. + +Fixes: 09d8b2bdbc5c ("serial: 8250: omap: Provide ability to enable/disable UART as wakeup source") +Signed-off-by: Tony Lindgren +Tested-by: Dhruva Gole +Message-ID: <20230614045922.4798-1-tony@atomide.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index af39a2c4c2eee..e26ac3f42e05c 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -1521,25 +1521,35 @@ static int omap8250_suspend(struct device *dev) + { + struct omap8250_priv *priv = dev_get_drvdata(dev); + struct uart_8250_port *up = serial8250_get_port(priv->line); ++ int err; + + serial8250_suspend_port(priv->line); + +- pm_runtime_get_sync(dev); ++ err = pm_runtime_resume_and_get(dev); ++ if (err) ++ return err; + if (!device_may_wakeup(dev)) + priv->wer = 0; + serial_out(up, UART_OMAP_WER, priv->wer); +- pm_runtime_mark_last_busy(dev); +- pm_runtime_put_autosuspend(dev); +- ++ err = pm_runtime_force_suspend(dev); + flush_work(&priv->qos_work); +- return 0; ++ ++ return err; + } + + static int omap8250_resume(struct device *dev) + { + struct omap8250_priv *priv = dev_get_drvdata(dev); ++ int err; + ++ err = pm_runtime_force_resume(dev); ++ if (err) ++ return err; + serial8250_resume_port(priv->line); ++ /* Paired with pm_runtime_resume_and_get() in omap8250_suspend() */ ++ pm_runtime_mark_last_busy(dev); ++ pm_runtime_put_autosuspend(dev); ++ + return 0; + } + #else +-- +2.39.2 + diff --git a/queue-5.10/series b/queue-5.10/series index 42e9094a6fd..9560e04444a 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -218,3 +218,66 @@ phy-tegra-xusb-clear-the-driver-reference-in-usb-phy-dev.patch block-fix-signed-int-overflow-in-amiga-partition-support.patch block-change-all-__u32-annotations-to-__be32-in-affs_hardblocks.h.patch sunrpc-fix-uaf-in-svc_tcp_listen_data_ready.patch +w1-w1_therm-fix-locking-behavior-in-convert_t.patch +w1-fix-loop-in-w1_fini.patch +sh-j2-use-ioremap-to-translate-device-tree-address-i.patch +serial-8250-omap-fix-freeing-of-resources-on-failed-.patch +clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch +media-usb-check-az6007_read-return-value.patch +media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch +media-usb-siano-fix-warning-due-to-null-work_func_t-.patch +clk-qcom-reset-allow-specifying-custom-reset-delay.patch +clk-qcom-reset-support-resetting-multiple-bits.patch +clk-qcom-ipq6018-fix-networking-resets.patch +usb-dwc3-qcom-fix-potential-memory-leak.patch +usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch +extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch +extcon-fix-kernel-doc-of-property-capability-fields-.patch +usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch +usb-hide-unused-usbfs_notify_suspend-resume-function.patch +serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch +serial-8250-lock-port-for-uart_ier-access-in-omap825.patch +kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch +coresight-fix-loss-of-connection-info-when-a-module-.patch +mfd-rt5033-drop-rt5033-battery-sub-device.patch +media-venus-helpers-fix-align-of-non-power-of-two.patch +media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch +kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch +software-node-introduce-device_add_software_node.patch +usb-dwc3-qcom-constify-the-software-node.patch +usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch +usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch +usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch +usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch +mfd-intel-lpss-add-missing-check-for-platform_get_re.patch +revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch +serial-8250_omap-use-force_suspend-and-resume-for-sy.patch +test_firmware-return-enomem-instead-of-enospc-on-fai.patch +mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch +mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch +kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch +mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch +phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch +pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch +pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch +rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch +media-cec-i2c-ch7322-also-select-regmap.patch +sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch +add-module_firmware-for-firmware_tg357766.patch +net-dsa-vsc73xx-fix-mtu-configuration.patch +spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch +mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch +f2fs-fix-error-path-handling-in-truncate_dnode.patch +octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch +powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch +net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch +tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch +xsk-honor-so_bindtodevice-on-bind.patch +net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch +pptp-fix-fib-lookup-calls.patch +net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch +s390-qeth-fix-vipa-deletion.patch +sh-dma-fix-dma-channel-offset-calculation.patch +apparmor-fix-missing-error-check-for-rhashtable_inse.patch +i2c-xiic-defer-xiic_wakeup-and-__xiic_start_xfer-in-.patch +i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch diff --git a/queue-5.10/sh-dma-fix-dma-channel-offset-calculation.patch b/queue-5.10/sh-dma-fix-dma-channel-offset-calculation.patch new file mode 100644 index 00000000000..859e76e0638 --- /dev/null +++ b/queue-5.10/sh-dma-fix-dma-channel-offset-calculation.patch @@ -0,0 +1,103 @@ +From 731a521c132fa62459bfe6c23768a5c7485f3f77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 May 2023 18:44:50 +0200 +Subject: sh: dma: Fix DMA channel offset calculation + +From: Artur Rojek + +[ Upstream commit e82e47584847129a20b8c9f4a1dcde09374fb0e0 ] + +Various SoCs of the SH3, SH4 and SH4A family, which use this driver, +feature a differing number of DMA channels, which can be distributed +between up to two DMAC modules. The existing implementation fails to +correctly accommodate for all those variations, resulting in wrong +channel offset calculations and leading to kernel panics. + +Rewrite dma_base_addr() in order to properly calculate channel offsets +in a DMAC module. Fix dmaor_read_reg() and dmaor_write_reg(), so that +the correct DMAC module base is selected for the DMAOR register. + +Fixes: 7f47c7189b3e8f19 ("sh: dma: More legacy cpu dma chainsawing.") +Signed-off-by: Artur Rojek +Reviewed-by: Geert Uytterhoeven +Reviewed-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20230527164452.64797-2-contact@artur-rojek.eu +Signed-off-by: John Paul Adrian Glaubitz +Signed-off-by: Sasha Levin +--- + arch/sh/drivers/dma/dma-sh.c | 37 +++++++++++++++++++++++------------- + 1 file changed, 24 insertions(+), 13 deletions(-) + +diff --git a/arch/sh/drivers/dma/dma-sh.c b/arch/sh/drivers/dma/dma-sh.c +index 96c626c2cd0a4..306fba1564e5e 100644 +--- a/arch/sh/drivers/dma/dma-sh.c ++++ b/arch/sh/drivers/dma/dma-sh.c +@@ -18,6 +18,18 @@ + #include + #include + ++/* ++ * Some of the SoCs feature two DMAC modules. In such a case, the channels are ++ * distributed equally among them. ++ */ ++#ifdef SH_DMAC_BASE1 ++#define SH_DMAC_NR_MD_CH (CONFIG_NR_ONCHIP_DMA_CHANNELS / 2) ++#else ++#define SH_DMAC_NR_MD_CH CONFIG_NR_ONCHIP_DMA_CHANNELS ++#endif ++ ++#define SH_DMAC_CH_SZ 0x10 ++ + /* + * Define the default configuration for dual address memory-memory transfer. + * The 0x400 value represents auto-request, external->external. +@@ -29,7 +41,7 @@ static unsigned long dma_find_base(unsigned int chan) + unsigned long base = SH_DMAC_BASE0; + + #ifdef SH_DMAC_BASE1 +- if (chan >= 6) ++ if (chan >= SH_DMAC_NR_MD_CH) + base = SH_DMAC_BASE1; + #endif + +@@ -40,13 +52,13 @@ static unsigned long dma_base_addr(unsigned int chan) + { + unsigned long base = dma_find_base(chan); + +- /* Normalize offset calculation */ +- if (chan >= 9) +- chan -= 6; +- if (chan >= 4) +- base += 0x10; ++ chan = (chan % SH_DMAC_NR_MD_CH) * SH_DMAC_CH_SZ; ++ ++ /* DMAOR is placed inside the channel register space. Step over it. */ ++ if (chan >= DMAOR) ++ base += SH_DMAC_CH_SZ; + +- return base + (chan * 0x10); ++ return base + chan; + } + + #ifdef CONFIG_SH_DMA_IRQ_MULTI +@@ -250,12 +262,11 @@ static int sh_dmac_get_dma_residue(struct dma_channel *chan) + #define NR_DMAOR 1 + #endif + +-/* +- * DMAOR bases are broken out amongst channel groups. DMAOR0 manages +- * channels 0 - 5, DMAOR1 6 - 11 (optional). +- */ +-#define dmaor_read_reg(n) __raw_readw(dma_find_base((n)*6)) +-#define dmaor_write_reg(n, data) __raw_writew(data, dma_find_base(n)*6) ++#define dmaor_read_reg(n) __raw_readw(dma_find_base((n) * \ ++ SH_DMAC_NR_MD_CH) + DMAOR) ++#define dmaor_write_reg(n, data) __raw_writew(data, \ ++ dma_find_base((n) * \ ++ SH_DMAC_NR_MD_CH) + DMAOR) + + static inline int dmaor_reset(int no) + { +-- +2.39.2 + diff --git a/queue-5.10/sh-j2-use-ioremap-to-translate-device-tree-address-i.patch b/queue-5.10/sh-j2-use-ioremap-to-translate-device-tree-address-i.patch new file mode 100644 index 00000000000..3b14ba61982 --- /dev/null +++ b/queue-5.10/sh-j2-use-ioremap-to-translate-device-tree-address-i.patch @@ -0,0 +1,44 @@ +From 97fe66e0c7b29b04014c904df6bcdf68cb49dc7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 14:57:41 +0200 +Subject: sh: j2: Use ioremap() to translate device tree address into kernel + memory + +From: John Paul Adrian Glaubitz + +[ Upstream commit bc9d1f0cecd2407cfb2364a7d4be2f52d1d46a9d ] + +Addresses the following warning when building j2_defconfig: + +arch/sh/kernel/cpu/sh2/probe.c: In function 'scan_cache': +arch/sh/kernel/cpu/sh2/probe.c:24:16: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] + 24 | j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node); + | + +Fixes: 5a846abad07f ("sh: add support for J-Core J2 processor") +Reviewed-by: Geert Uytterhoeven +Tested-by: Rob Landley +Signed-off-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20230503125746.331835-1-glaubitz@physik.fu-berlin.de +Signed-off-by: John Paul Adrian Glaubitz +Signed-off-by: Sasha Levin +--- + arch/sh/kernel/cpu/sh2/probe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sh/kernel/cpu/sh2/probe.c b/arch/sh/kernel/cpu/sh2/probe.c +index d342ea08843f6..70a07f4f2142f 100644 +--- a/arch/sh/kernel/cpu/sh2/probe.c ++++ b/arch/sh/kernel/cpu/sh2/probe.c +@@ -21,7 +21,7 @@ static int __init scan_cache(unsigned long node, const char *uname, + if (!of_flat_dt_is_compatible(node, "jcore,cache")) + return 0; + +- j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node); ++ j2_ccr_base = ioremap(of_flat_dt_translate_address(node), 4); + + return 1; + } +-- +2.39.2 + diff --git a/queue-5.10/software-node-introduce-device_add_software_node.patch b/queue-5.10/software-node-introduce-device_add_software_node.patch new file mode 100644 index 00000000000..eebb8ee80b0 --- /dev/null +++ b/queue-5.10/software-node-introduce-device_add_software_node.patch @@ -0,0 +1,135 @@ +From 70ebfaf109149b9931cae59d35f6de74b7d25592 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 12:49:11 +0300 +Subject: software node: Introduce device_add_software_node() + +From: Heikki Krogerus + +[ Upstream commit e68d0119e3284334de5650a1ac42ef4e179f895e ] + +This helper will register a software node and then assign +it to device at the same time. The function will also make +sure that the device can't have more than one software node. + +Acked-by: Felipe Balbi +Signed-off-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20210115094914.88401-2-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 8fd95da2cfb5 ("usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()") +Signed-off-by: Sasha Levin +--- + drivers/base/swnode.c | 71 +++++++++++++++++++++++++++++++++++----- + include/linux/property.h | 3 ++ + 2 files changed, 65 insertions(+), 9 deletions(-) + +diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c +index d2fb3eb5816c3..572a53e6f2e88 100644 +--- a/drivers/base/swnode.c ++++ b/drivers/base/swnode.c +@@ -48,6 +48,19 @@ EXPORT_SYMBOL_GPL(is_software_node); + struct swnode, fwnode) : NULL; \ + }) + ++static inline struct swnode *dev_to_swnode(struct device *dev) ++{ ++ struct fwnode_handle *fwnode = dev_fwnode(dev); ++ ++ if (!fwnode) ++ return NULL; ++ ++ if (!is_software_node(fwnode)) ++ fwnode = fwnode->secondary; ++ ++ return to_swnode(fwnode); ++} ++ + static struct swnode * + software_node_to_swnode(const struct software_node *node) + { +@@ -850,22 +863,62 @@ void fwnode_remove_software_node(struct fwnode_handle *fwnode) + } + EXPORT_SYMBOL_GPL(fwnode_remove_software_node); + ++/** ++ * device_add_software_node - Assign software node to a device ++ * @dev: The device the software node is meant for. ++ * @swnode: The software node. ++ * ++ * This function will register @swnode and make it the secondary firmware node ++ * pointer of @dev. If @dev has no primary node, then @swnode will become the primary ++ * node. ++ */ ++int device_add_software_node(struct device *dev, const struct software_node *swnode) ++{ ++ int ret; ++ ++ /* Only one software node per device. */ ++ if (dev_to_swnode(dev)) ++ return -EBUSY; ++ ++ ret = software_node_register(swnode); ++ if (ret) ++ return ret; ++ ++ set_secondary_fwnode(dev, software_node_fwnode(swnode)); ++ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(device_add_software_node); ++ ++/** ++ * device_remove_software_node - Remove device's software node ++ * @dev: The device with the software node. ++ * ++ * This function will unregister the software node of @dev. ++ */ ++void device_remove_software_node(struct device *dev) ++{ ++ struct swnode *swnode; ++ ++ swnode = dev_to_swnode(dev); ++ if (!swnode) ++ return; ++ ++ software_node_notify(dev, KOBJ_REMOVE); ++ set_secondary_fwnode(dev, NULL); ++ kobject_put(&swnode->kobj); ++} ++EXPORT_SYMBOL_GPL(device_remove_software_node); ++ + int software_node_notify(struct device *dev, unsigned long action) + { +- struct fwnode_handle *fwnode = dev_fwnode(dev); + struct swnode *swnode; + int ret; + +- if (!fwnode) +- return 0; +- +- if (!is_software_node(fwnode)) +- fwnode = fwnode->secondary; +- if (!is_software_node(fwnode)) ++ swnode = dev_to_swnode(dev); ++ if (!swnode) + return 0; + +- swnode = to_swnode(fwnode); +- + switch (action) { + case KOBJ_ADD: + ret = sysfs_create_link(&dev->kobj, &swnode->kobj, +diff --git a/include/linux/property.h b/include/linux/property.h +index 2d4542629d80b..3b6093f6bd04c 100644 +--- a/include/linux/property.h ++++ b/include/linux/property.h +@@ -485,4 +485,7 @@ fwnode_create_software_node(const struct property_entry *properties, + const struct fwnode_handle *parent); + void fwnode_remove_software_node(struct fwnode_handle *fwnode); + ++int device_add_software_node(struct device *dev, const struct software_node *swnode); ++void device_remove_software_node(struct device *dev); ++ + #endif /* _LINUX_PROPERTY_H_ */ +-- +2.39.2 + diff --git a/queue-5.10/spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch b/queue-5.10/spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch new file mode 100644 index 00000000000..ab8f8f449c9 --- /dev/null +++ b/queue-5.10/spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch @@ -0,0 +1,58 @@ +From a7692e53092aedda2ec73543a8ad9107b6f98caf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 15:43:05 +0200 +Subject: spi: bcm-qspi: return error if neither hif_mspi nor mspi is available + +From: Jonas Gorski + +[ Upstream commit 7c1f23ad34fcdace50275a6aa1e1969b41c6233f ] + +If neither a "hif_mspi" nor "mspi" resource is present, the driver will +just early exit in probe but still return success. Apart from not doing +anything meaningful, this would then also lead to a null pointer access +on removal, as platform_get_drvdata() would return NULL, which it would +then try to dereference when trying to unregister the spi master. + +Fix this by unconditionally calling devm_ioremap_resource(), as it can +handle a NULL res and will then return a viable ERR_PTR() if we get one. + +The "return 0;" was previously a "goto qspi_resource_err;" where then +ret was returned, but since ret was still initialized to 0 at this place +this was a valid conversion in 63c5395bb7a9 ("spi: bcm-qspi: Fix +use-after-free on unbind"). The issue was not introduced by this commit, +only made more obvious. + +Fixes: fa236a7ef240 ("spi: bcm-qspi: Add Broadcom MSPI driver") +Signed-off-by: Jonas Gorski +Reviewed-by: Kamal Dasu +Link: https://lore.kernel.org/r/20230629134306.95823-1-jonas.gorski@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm-qspi.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c +index 766b00350e391..2c734ea0784b7 100644 +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -1369,13 +1369,9 @@ int bcm_qspi_probe(struct platform_device *pdev, + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, + "mspi"); + +- if (res) { +- qspi->base[MSPI] = devm_ioremap_resource(dev, res); +- if (IS_ERR(qspi->base[MSPI])) +- return PTR_ERR(qspi->base[MSPI]); +- } else { +- return 0; +- } ++ qspi->base[MSPI] = devm_ioremap_resource(dev, res); ++ if (IS_ERR(qspi->base[MSPI])) ++ return PTR_ERR(qspi->base[MSPI]); + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi"); + if (res) { +-- +2.39.2 + diff --git a/queue-5.10/tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch b/queue-5.10/tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch new file mode 100644 index 00000000000..2b9b13fd82d --- /dev/null +++ b/queue-5.10/tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch @@ -0,0 +1,55 @@ +From f25d79666df40516251a72a68221c1bfe512a836 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 16:41:50 +0000 +Subject: tcp: annotate data races in __tcp_oow_rate_limited() + +From: Eric Dumazet + +[ Upstream commit 998127cdb4699b9d470a9348ffe9f1154346be5f ] + +request sockets are lockless, __tcp_oow_rate_limited() could be called +on the same object from different cpus. This is harmless. + +Add READ_ONCE()/WRITE_ONCE() annotations to avoid a KCSAN report. + +Fixes: 4ce7e93cb3fe ("tcp: rate limit ACK sent by SYN_RECV request sockets") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index b98b7920c4029..d6dfbb88dcf5b 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -3560,8 +3560,11 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32 + static bool __tcp_oow_rate_limited(struct net *net, int mib_idx, + u32 *last_oow_ack_time) + { +- if (*last_oow_ack_time) { +- s32 elapsed = (s32)(tcp_jiffies32 - *last_oow_ack_time); ++ /* Paired with the WRITE_ONCE() in this function. */ ++ u32 val = READ_ONCE(*last_oow_ack_time); ++ ++ if (val) { ++ s32 elapsed = (s32)(tcp_jiffies32 - val); + + if (0 <= elapsed && + elapsed < READ_ONCE(net->ipv4.sysctl_tcp_invalid_ratelimit)) { +@@ -3570,7 +3573,10 @@ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx, + } + } + +- *last_oow_ack_time = tcp_jiffies32; ++ /* Paired with the prior READ_ONCE() and with itself, ++ * as we might be lockless. ++ */ ++ WRITE_ONCE(*last_oow_ack_time, tcp_jiffies32); + + return false; /* not rate-limited: go ahead, send dupack now! */ + } +-- +2.39.2 + diff --git a/queue-5.10/test_firmware-return-enomem-instead-of-enospc-on-fai.patch b/queue-5.10/test_firmware-return-enomem-instead-of-enospc-on-fai.patch new file mode 100644 index 00000000000..e32ff4ee68e --- /dev/null +++ b/queue-5.10/test_firmware-return-enomem-instead-of-enospc-on-fai.patch @@ -0,0 +1,111 @@ +From 17797b7cf019961cd918bb457acf44a6137aec70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 09:08:10 +0200 +Subject: test_firmware: return ENOMEM instead of ENOSPC on failed memory + allocation + +From: Mirsad Goran Todorovac + +[ Upstream commit 7dae593cd226a0bca61201cf85ceb9335cf63682 ] + +In a couple of situations like + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) + return -ENOSPC; + +the error is not actually "No space left on device", but "Out of memory". + +It is semantically correct to return -ENOMEM in all failed kstrndup() +and kzalloc() cases in this driver, as it is not a problem with disk +space, but with kernel memory allocator failing allocation. + +The semantically correct should be: + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) + return -ENOMEM; + +Cc: Dan Carpenter +Cc: Takashi Iwai +Cc: Kees Cook +Cc: "Luis R. Rodriguez" +Cc: Scott Branden +Cc: Hans de Goede +Cc: Brian Norris +Fixes: c92316bf8e948 ("test_firmware: add batched firmware tests") +Fixes: 0a8adf584759c ("test: add firmware_class loader test") +Fixes: 548193cba2a7d ("test_firmware: add support for firmware_request_platform") +Fixes: eb910947c82f9 ("test: firmware_class: add asynchronous request trigger") +Fixes: 061132d2b9c95 ("test_firmware: add test custom fallback trigger") +Fixes: 7feebfa487b92 ("test_firmware: add support for request_firmware_into_buf") +Signed-off-by: Mirsad Goran Todorovac +Reviewed-by: Dan Carpenter +Message-ID: <20230606070808.9300-1-mirsad.todorovac@alu.unizg.hr> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + lib/test_firmware.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/lib/test_firmware.c b/lib/test_firmware.c +index ed0455a9ded87..25dc9eb6c902b 100644 +--- a/lib/test_firmware.c ++++ b/lib/test_firmware.c +@@ -183,7 +183,7 @@ static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp) + { + *dst = kstrndup(name, count, gfp); + if (!*dst) +- return -ENOSPC; ++ return -ENOMEM; + return count; + } + +@@ -606,7 +606,7 @@ static ssize_t trigger_request_store(struct device *dev, + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) +- return -ENOSPC; ++ return -ENOMEM; + + pr_info("loading '%s'\n", name); + +@@ -654,7 +654,7 @@ static ssize_t trigger_request_platform_store(struct device *dev, + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) +- return -ENOSPC; ++ return -ENOMEM; + + pr_info("inserting test platform fw '%s'\n", name); + efi_embedded_fw.name = name; +@@ -707,7 +707,7 @@ static ssize_t trigger_async_request_store(struct device *dev, + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) +- return -ENOSPC; ++ return -ENOMEM; + + pr_info("loading '%s'\n", name); + +@@ -752,7 +752,7 @@ static ssize_t trigger_custom_fallback_store(struct device *dev, + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) +- return -ENOSPC; ++ return -ENOMEM; + + pr_info("loading '%s' using custom fallback mechanism\n", name); + +@@ -803,7 +803,7 @@ static int test_fw_run_batch_request(void *data) + + test_buf = kzalloc(TEST_FIRMWARE_BUF_SIZE, GFP_KERNEL); + if (!test_buf) +- return -ENOSPC; ++ return -ENOMEM; + + if (test_fw_config->partial) + req->rc = request_partial_firmware_into_buf +-- +2.39.2 + diff --git a/queue-5.10/usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch b/queue-5.10/usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch new file mode 100644 index 00000000000..676a96829f6 --- /dev/null +++ b/queue-5.10/usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch @@ -0,0 +1,104 @@ +From eb8fc2a64847dbcfd11c88be40942375df3c5293 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 20:11:14 +0530 +Subject: usb: common: usb-conn-gpio: Set last role to unknown before initial + detection + +From: Prashanth K + +[ Upstream commit edd60d24bd858cef165274e4cd6cab43bdc58d15 ] + +Currently if we bootup a device without cable connected, then +usb-conn-gpio won't call set_role() since last_role is same as +current role. This happens because during probe last_role gets +initialised to zero. + +To avoid this, added a new constant in enum usb_role, last_role +is set to USB_ROLE_UNKNOWN before performing initial detection. + +While at it, also handle default case for the usb_role switch +in cdns3, intel-xhci-usb-role-switch & musb/jz4740 to avoid +build warnings. + +Fixes: 4602f3bff266 ("usb: common: add USB GPIO based connection detection driver") +Signed-off-by: Prashanth K +Reviewed-by: AngeloGioacchino Del Regno +Message-ID: <1685544074-17337-1-git-send-email-quic_prashk@quicinc.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/cdns3/core.c | 2 ++ + drivers/usb/common/usb-conn-gpio.c | 3 +++ + drivers/usb/musb/jz4740.c | 2 ++ + drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 ++ + include/linux/usb/role.h | 1 + + 5 files changed, 10 insertions(+) + +diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c +index 8fe7420de033d..e5fe640b2bb01 100644 +--- a/drivers/usb/cdns3/core.c ++++ b/drivers/usb/cdns3/core.c +@@ -243,6 +243,8 @@ static enum usb_role cdns3_hw_role_state_machine(struct cdns3 *cdns) + if (!vbus) + role = USB_ROLE_NONE; + break; ++ default: ++ break; + } + + dev_dbg(cdns->dev, "role %d -> %d\n", cdns->role, role); +diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c +index c9545a4eff664..5754e467c16a8 100644 +--- a/drivers/usb/common/usb-conn-gpio.c ++++ b/drivers/usb/common/usb-conn-gpio.c +@@ -276,6 +276,9 @@ static int usb_conn_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, info); + ++ /* Set last role to unknown before performing the initial detection */ ++ info->last_role = USB_ROLE_UNKNOWN; ++ + /* Perform initial detection */ + usb_conn_queue_dwork(info, 0); + +diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c +index c4fe1f4cd17a3..f283629091ec4 100644 +--- a/drivers/usb/musb/jz4740.c ++++ b/drivers/usb/musb/jz4740.c +@@ -91,6 +91,8 @@ static int jz4740_musb_role_switch_set(struct usb_role_switch *sw, + case USB_ROLE_HOST: + atomic_notifier_call_chain(&phy->notifier, USB_EVENT_ID, phy); + break; ++ default: ++ break; + } + + return 0; +diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c +index 5c96e929acea0..4d6a3dd06e011 100644 +--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c ++++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c +@@ -97,6 +97,8 @@ static int intel_xhci_usb_set_role(struct usb_role_switch *sw, + val |= SW_VBUS_VALID; + drd_config = DRD_CONFIG_STATIC_DEVICE; + break; ++ default: ++ break; + } + val |= SW_IDPIN_EN; + if (data->enable_sw_switch) { +diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h +index b9ccaeb8a4aef..aecfce46d3544 100644 +--- a/include/linux/usb/role.h ++++ b/include/linux/usb/role.h +@@ -11,6 +11,7 @@ enum usb_role { + USB_ROLE_NONE, + USB_ROLE_HOST, + USB_ROLE_DEVICE, ++ USB_ROLE_UNKNOWN, + }; + + typedef int (*usb_role_switch_set_t)(struct usb_role_switch *sw, +-- +2.39.2 + diff --git a/queue-5.10/usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch b/queue-5.10/usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch new file mode 100644 index 00000000000..254b380ef19 --- /dev/null +++ b/queue-5.10/usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch @@ -0,0 +1,51 @@ +From fd910a041cf4e6fc1c4440671fb6c4bd11fb9ccd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jun 2023 15:32:52 +0200 +Subject: usb: dwc3-meson-g12a: Fix an error handling path in + dwc3_meson_g12a_probe() + +From: Christophe JAILLET + +[ Upstream commit 01052b91c9808e3c3b068ae2721cb728ec9aa4c0 ] + +If dwc3_meson_g12a_otg_init() fails, resources allocated by the previous +of_platform_populate() call should be released, as already done in the +error handling path. + +Fixes: 1e355f21d3fb ("usb: dwc3: Add Amlogic A1 DWC3 glue") +Signed-off-by: Christophe JAILLET +Reviewed-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Message-ID: <9d28466de1808ccc756b4cc25fc72c482d133d13.1686403934.git.christophe.jaillet@wanadoo.fr> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-meson-g12a.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/dwc3-meson-g12a.c b/drivers/usb/dwc3/dwc3-meson-g12a.c +index d0f9b7c296b0d..69ec06efd7f25 100644 +--- a/drivers/usb/dwc3/dwc3-meson-g12a.c ++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c +@@ -805,7 +805,7 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev) + + ret = dwc3_meson_g12a_otg_init(pdev, priv); + if (ret) +- goto err_phys_power; ++ goto err_plat_depopulate; + + pm_runtime_set_active(dev); + pm_runtime_enable(dev); +@@ -813,6 +813,9 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev) + + return 0; + ++err_plat_depopulate: ++ of_platform_depopulate(dev); ++ + err_phys_power: + for (i = 0 ; i < PHY_COUNT ; ++i) + phy_power_off(priv->phys[i]); +-- +2.39.2 + diff --git a/queue-5.10/usb-dwc3-qcom-constify-the-software-node.patch b/queue-5.10/usb-dwc3-qcom-constify-the-software-node.patch new file mode 100644 index 00000000000..1bf52811765 --- /dev/null +++ b/queue-5.10/usb-dwc3-qcom-constify-the-software-node.patch @@ -0,0 +1,71 @@ +From dc547ccf99a61723e5321c95077dc9e40eeb205e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Feb 2021 17:17:09 +0300 +Subject: usb: dwc3: qcom: Constify the software node + +From: Heikki Krogerus + +[ Upstream commit 8dc6e6dd1bee39cd65a232a17d51240fc65a0f4a ] + +What platform_device_add_properties() does is it allocates +dynamically a software node that will contain the device +properties supplied to it, and then couples that node with +the device. If the properties are constant, the node can be +constant as well. + +Signed-off-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20210204141711.53775-5-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 8fd95da2cfb5 ("usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index 5c66efb05d7f7..d7222c8cb0060 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -592,6 +592,10 @@ static const struct property_entry dwc3_qcom_acpi_properties[] = { + {} + }; + ++static const struct software_node dwc3_qcom_swnode = { ++ .properties = dwc3_qcom_acpi_properties, ++}; ++ + static int dwc3_qcom_acpi_register_core(struct platform_device *pdev) + { + struct dwc3_qcom *qcom = platform_get_drvdata(pdev); +@@ -642,16 +646,17 @@ static int dwc3_qcom_acpi_register_core(struct platform_device *pdev) + goto out; + } + +- ret = platform_device_add_properties(qcom->dwc3, +- dwc3_qcom_acpi_properties); ++ ret = device_add_software_node(&qcom->dwc3->dev, &dwc3_qcom_swnode); + if (ret < 0) { + dev_err(&pdev->dev, "failed to add properties\n"); + goto out; + } + + ret = platform_device_add(qcom->dwc3); +- if (ret) ++ if (ret) { + dev_err(&pdev->dev, "failed to add device\n"); ++ device_remove_software_node(&qcom->dwc3->dev); ++ } + + out: + kfree(child_res); +@@ -872,6 +877,7 @@ static int dwc3_qcom_remove(struct platform_device *pdev) + struct device *dev = &pdev->dev; + int i; + ++ device_remove_software_node(&qcom->dwc3->dev); + of_platform_depopulate(dev); + + for (i = qcom->num_clocks - 1; i >= 0; i--) { +-- +2.39.2 + diff --git a/queue-5.10/usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch b/queue-5.10/usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch new file mode 100644 index 00000000000..be88773beaa --- /dev/null +++ b/queue-5.10/usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch @@ -0,0 +1,43 @@ +From 7dc8d5747ba55a0b0f530c77546a57589a944efd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 16:56:34 +0200 +Subject: usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe() + +From: Christophe JAILLET + +[ Upstream commit 4a944da707123686d372ec01ea60056902fadf35 ] + +If dwc3_qcom_create_urs_usb_platdev() fails, some resources still need to +be released, as already done in the other error handling path of the +probe. + +Fixes: c25c210f590e ("usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot") +Signed-off-by: Christophe JAILLET +Reviewed-by: Andrew Halaney +Message-ID: +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index a699986b56c4b..7cfb2c016f99c 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -791,9 +791,10 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + if (IS_ERR_OR_NULL(qcom->urs_usb)) { + dev_err(dev, "failed to create URS USB platdev\n"); + if (!qcom->urs_usb) +- return -ENODEV; ++ ret = -ENODEV; + else +- return PTR_ERR(qcom->urs_usb); ++ ret = PTR_ERR(qcom->urs_usb); ++ goto clk_disable; + } + } + } +-- +2.39.2 + diff --git a/queue-5.10/usb-dwc3-qcom-fix-potential-memory-leak.patch b/queue-5.10/usb-dwc3-qcom-fix-potential-memory-leak.patch new file mode 100644 index 00000000000..18cf9040852 --- /dev/null +++ b/queue-5.10/usb-dwc3-qcom-fix-potential-memory-leak.patch @@ -0,0 +1,53 @@ +From fb8aa9d3e968fd937733b98fc8e1f4e697d276c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 20:25:18 +0300 +Subject: usb: dwc3: qcom: Fix potential memory leak + +From: Vladislav Efanov + +[ Upstream commit 097fb3ee710d4de83b8d4f5589e8ee13e0f0541e ] + +Function dwc3_qcom_probe() allocates memory for resource structure +which is pointed by parent_res pointer. This memory is not +freed. This leads to memory leak. Use stack memory to prevent +memory leak. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI") +Signed-off-by: Vladislav Efanov +Acked-by: Shawn Guo +Link: https://lore.kernel.org/r/20230517172518.442591-1-VEfanov@ispras.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index dac13fe978110..5c66efb05d7f7 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -722,6 +722,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + struct device *dev = &pdev->dev; + struct dwc3_qcom *qcom; + struct resource *res, *parent_res = NULL; ++ struct resource local_res; + int ret, i; + bool ignore_pipe_clk; + +@@ -772,9 +773,8 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + if (np) { + parent_res = res; + } else { +- parent_res = kmemdup(res, sizeof(struct resource), GFP_KERNEL); +- if (!parent_res) +- return -ENOMEM; ++ memcpy(&local_res, res, sizeof(struct resource)); ++ parent_res = &local_res; + + parent_res->start = res->start + + qcom->acpi_pdata->qscratch_base_offset; +-- +2.39.2 + diff --git a/queue-5.10/usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch b/queue-5.10/usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch new file mode 100644 index 00000000000..01a396d10c7 --- /dev/null +++ b/queue-5.10/usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch @@ -0,0 +1,50 @@ +From 60f2f5faedb22fb1ad6fa5d30d485b819d00dd67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 17:04:37 +0200 +Subject: usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove() + +From: Christophe JAILLET + +[ Upstream commit 8fd95da2cfb5046c4bb5a3cdc9eb7963ba8b10dd ] + +In the probe, some resources are allocated with +dwc3_qcom_of_register_core() or dwc3_qcom_acpi_register_core(). The +corresponding resources are already coorectly freed in the error handling +path of the probe, but not in the remove function. + +Fix it. + +Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI") +Signed-off-by: Christophe JAILLET +Reviewed-by: Andrew Halaney +Message-ID: +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index d7222c8cb0060..a699986b56c4b 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -874,11 +874,15 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + static int dwc3_qcom_remove(struct platform_device *pdev) + { + struct dwc3_qcom *qcom = platform_get_drvdata(pdev); ++ struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + int i; + + device_remove_software_node(&qcom->dwc3->dev); +- of_platform_depopulate(dev); ++ if (np) ++ of_platform_depopulate(&pdev->dev); ++ else ++ platform_device_put(pdev); + + for (i = qcom->num_clocks - 1; i >= 0; i--) { + clk_disable_unprepare(qcom->clks[i]); +-- +2.39.2 + diff --git a/queue-5.10/usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch b/queue-5.10/usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch new file mode 100644 index 00000000000..bedb01098c5 --- /dev/null +++ b/queue-5.10/usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch @@ -0,0 +1,56 @@ +From 9c6603d6c648bb23a9361fded55c17f0d9564702 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 14:48:37 +0530 +Subject: usb: gadget: u_serial: Add null pointer check in gserial_suspend + +From: Prashanth K + +[ Upstream commit 2f6ecb89fe8feb2b60a53325b0eeb9866d88909a ] + +Consider a case where gserial_disconnect has already cleared +gser->ioport. And if gserial_suspend gets called afterwards, +it will lead to accessing of gser->ioport and thus causing +null pointer dereference. + +Avoid this by adding a null pointer check. Added a static +spinlock to prevent gser->ioport from becoming null after +the newly added null pointer check. + +Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks") +Signed-off-by: Prashanth K +Link: https://lore.kernel.org/r/1683278317-11774-1-git-send-email-quic_prashk@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/u_serial.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c +index 7b54e814aefb1..3b5a6430e2418 100644 +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -1421,10 +1421,19 @@ EXPORT_SYMBOL_GPL(gserial_disconnect); + + void gserial_suspend(struct gserial *gser) + { +- struct gs_port *port = gser->ioport; ++ struct gs_port *port; + unsigned long flags; + +- spin_lock_irqsave(&port->port_lock, flags); ++ spin_lock_irqsave(&serial_port_lock, flags); ++ port = gser->ioport; ++ ++ if (!port) { ++ spin_unlock_irqrestore(&serial_port_lock, flags); ++ return; ++ } ++ ++ spin_lock(&port->port_lock); ++ spin_unlock(&serial_port_lock); + port->suspended = true; + spin_unlock_irqrestore(&port->port_lock, flags); + } +-- +2.39.2 + diff --git a/queue-5.10/usb-hide-unused-usbfs_notify_suspend-resume-function.patch b/queue-5.10/usb-hide-unused-usbfs_notify_suspend-resume-function.patch new file mode 100644 index 00000000000..a22eef97a2b --- /dev/null +++ b/queue-5.10/usb-hide-unused-usbfs_notify_suspend-resume-function.patch @@ -0,0 +1,52 @@ +From ea33f695609edcb6ffaa9fcb8469a48a4f6a1dff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 22:17:42 +0200 +Subject: usb: hide unused usbfs_notify_suspend/resume functions + +From: Arnd Bergmann + +[ Upstream commit 8e6bd945e6dde64fbc60ec3fe252164493a8d3a2 ] + +The declaration is in an #ifdef, which causes warnings when building +with 'make W=1' and without CONFIG_PM: + +drivers/usb/core/devio.c:742:6: error: no previous prototype for 'usbfs_notify_suspend' +drivers/usb/core/devio.c:747:6: error: no previous prototype for 'usbfs_notify_resume' + +Use the same #ifdef check around the function definitions to avoid +the warnings and slightly shrink the USB core. + +Fixes: 7794f486ed0b ("usbfs: Add ioctls for runtime power management") +Signed-off-by: Arnd Bergmann +Reviewed-by: Sebastian Reichel +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20230516202103.558301-1-arnd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/core/devio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 2fe29319de441..1b95035d179f3 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -734,6 +734,7 @@ static int driver_resume(struct usb_interface *intf) + return 0; + } + ++#ifdef CONFIG_PM + /* The following routines apply to the entire device, not interfaces */ + void usbfs_notify_suspend(struct usb_device *udev) + { +@@ -752,6 +753,7 @@ void usbfs_notify_resume(struct usb_device *udev) + } + mutex_unlock(&usbfs_mutex); + } ++#endif + + struct usb_driver usbfs_driver = { + .name = "usbfs", +-- +2.39.2 + diff --git a/queue-5.10/usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch b/queue-5.10/usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch new file mode 100644 index 00000000000..c5fe8bb678e --- /dev/null +++ b/queue-5.10/usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch @@ -0,0 +1,43 @@ +From 6b2333021ee64e7c9925f344fb751a65056f36ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 22:08:31 +0800 +Subject: usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() + +From: Li Yang + +[ Upstream commit 342161c11403ea00e9febc16baab1d883d589d04 ] + +Smatch reports: +drivers/usb/phy/phy-tahvo.c: tahvo_usb_probe() +warn: missing unwind goto? + +After geting irq, if ret < 0, it will return without error handling to +free memory. +Just add error handling to fix this problem. + +Fixes: 0d45a1373e66 ("usb: phy: tahvo: add IRQ check") +Signed-off-by: Li Yang +Reviewed-by: Dongliang Mu +Link: https://lore.kernel.org/r/20230420140832.9110-1-lidaxian@hust.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-tahvo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c +index a3e043e3e4aae..d0672b6712985 100644 +--- a/drivers/usb/phy/phy-tahvo.c ++++ b/drivers/usb/phy/phy-tahvo.c +@@ -395,7 +395,7 @@ static int tahvo_usb_probe(struct platform_device *pdev) + + tu->irq = ret = platform_get_irq(pdev, 0); + if (ret < 0) +- return ret; ++ goto err_remove_phy; + ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt, + IRQF_ONESHOT, + "tahvo-vbus", tu); +-- +2.39.2 + diff --git a/queue-5.10/w1-fix-loop-in-w1_fini.patch b/queue-5.10/w1-fix-loop-in-w1_fini.patch new file mode 100644 index 00000000000..05d7f1ff0b7 --- /dev/null +++ b/queue-5.10/w1-fix-loop-in-w1_fini.patch @@ -0,0 +1,43 @@ +From 6bee1697e281acc3d0c4de3284ec3d2472adb45c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 17:17:45 +0300 +Subject: w1: fix loop in w1_fini() + +From: Dan Carpenter + +[ Upstream commit 83f3fcf96fcc7e5405b37d9424c7ef26bfa203f8 ] + +The __w1_remove_master_device() function calls: + + list_del(&dev->w1_master_entry); + +So presumably this can cause an endless loop. + +Fixes: 7785925dd8e0 ("[PATCH] w1: cleanups.") +Signed-off-by: Dan Carpenter +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/w1/w1.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c +index 15842377c8d2c..1c1a9438f4b6b 100644 +--- a/drivers/w1/w1.c ++++ b/drivers/w1/w1.c +@@ -1228,10 +1228,10 @@ static int __init w1_init(void) + + static void __exit w1_fini(void) + { +- struct w1_master *dev; ++ struct w1_master *dev, *n; + + /* Set netlink removal messages and some cleanup */ +- list_for_each_entry(dev, &w1_masters, w1_master_entry) ++ list_for_each_entry_safe(dev, n, &w1_masters, w1_master_entry) + __w1_remove_master_device(dev); + + w1_fini_netlink(); +-- +2.39.2 + diff --git a/queue-5.10/w1-w1_therm-fix-locking-behavior-in-convert_t.patch b/queue-5.10/w1-w1_therm-fix-locking-behavior-in-convert_t.patch new file mode 100644 index 00000000000..f4f473aafba --- /dev/null +++ b/queue-5.10/w1-w1_therm-fix-locking-behavior-in-convert_t.patch @@ -0,0 +1,91 @@ +From 8d664d6b584cd915e2e90b7653d530af1fc89e86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 13:21:52 +0200 +Subject: w1: w1_therm: fix locking behavior in convert_t + +From: Stefan Wahren + +[ Upstream commit dca5480ab7b77a889088ab7cac81934604510ac7 ] + +The commit 67b392f7b8ed ("w1_therm: optimizing temperature read timings") +accidentially inverted the logic for lock handling of the bus mutex. + +Before: + pullup -> release lock before sleep + no pullup -> release lock after sleep + +After: + pullup -> release lock after sleep + no pullup -> release lock before sleep + +This cause spurious measurements of 85 degree (powerup value) on the +Tarragon board with connected 1-w temperature sensor +(w1_therm.w1_strong_pull=0). + +In the meantime a new feature for polling the conversion +completion has been integrated in these branches with +commit 021da53e65fd ("w1: w1_therm: Add sysfs entries to control +conversion time and driver features"). But this feature isn't +available for parasite power mode, so handle this separately. + +Link: https://lore.kernel.org/regressions/2023042645-attentive-amends-7b0b@gregkh/T/ +Fixes: 67b392f7b8ed ("w1_therm: optimizing temperature read timings") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20230427112152.12313-1-stefan.wahren@i2se.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/w1/slaves/w1_therm.c | 31 ++++++++++++++----------------- + 1 file changed, 14 insertions(+), 17 deletions(-) + +diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c +index 6546d029c7fd6..3888643a22f60 100644 +--- a/drivers/w1/slaves/w1_therm.c ++++ b/drivers/w1/slaves/w1_therm.c +@@ -1094,29 +1094,26 @@ static int convert_t(struct w1_slave *sl, struct therm_info *info) + + w1_write_8(dev_master, W1_CONVERT_TEMP); + +- if (strong_pullup) { /*some device need pullup */ ++ if (SLAVE_FEATURES(sl) & W1_THERM_POLL_COMPLETION) { ++ ret = w1_poll_completion(dev_master, W1_POLL_CONVERT_TEMP); ++ if (ret) { ++ dev_dbg(&sl->dev, "%s: Timeout\n", __func__); ++ goto mt_unlock; ++ } ++ mutex_unlock(&dev_master->bus_mutex); ++ } else if (!strong_pullup) { /*no device need pullup */ + sleep_rem = msleep_interruptible(t_conv); + if (sleep_rem != 0) { + ret = -EINTR; + goto mt_unlock; + } + mutex_unlock(&dev_master->bus_mutex); +- } else { /*no device need pullup */ +- if (SLAVE_FEATURES(sl) & W1_THERM_POLL_COMPLETION) { +- ret = w1_poll_completion(dev_master, W1_POLL_CONVERT_TEMP); +- if (ret) { +- dev_dbg(&sl->dev, "%s: Timeout\n", __func__); +- goto mt_unlock; +- } +- mutex_unlock(&dev_master->bus_mutex); +- } else { +- /* Fixed delay */ +- mutex_unlock(&dev_master->bus_mutex); +- sleep_rem = msleep_interruptible(t_conv); +- if (sleep_rem != 0) { +- ret = -EINTR; +- goto dec_refcnt; +- } ++ } else { /*some device need pullup */ ++ mutex_unlock(&dev_master->bus_mutex); ++ sleep_rem = msleep_interruptible(t_conv); ++ if (sleep_rem != 0) { ++ ret = -EINTR; ++ goto dec_refcnt; + } + } + ret = read_scratchpad(sl, info); +-- +2.39.2 + diff --git a/queue-5.10/xsk-honor-so_bindtodevice-on-bind.patch b/queue-5.10/xsk-honor-so_bindtodevice-on-bind.patch new file mode 100644 index 00000000000..77bd72da16f --- /dev/null +++ b/queue-5.10/xsk-honor-so_bindtodevice-on-bind.patch @@ -0,0 +1,101 @@ +From 198b68b22a3059cfd752bbf523e80136a6ac56af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 19:53:29 +0200 +Subject: xsk: Honor SO_BINDTODEVICE on bind + +From: Ilya Maximets + +[ Upstream commit f7306acec9aae9893d15e745c8791124d42ab10a ] + +Initial creation of an AF_XDP socket requires CAP_NET_RAW capability. A +privileged process might create the socket and pass it to a non-privileged +process for later use. However, that process will be able to bind the socket +to any network interface. Even though it will not be able to receive any +traffic without modification of the BPF map, the situation is not ideal. + +Sockets already have a mechanism that can be used to restrict what interface +they can be attached to. That is SO_BINDTODEVICE. + +To change the SO_BINDTODEVICE binding the process will need CAP_NET_RAW. + +Make xsk_bind() honor the SO_BINDTODEVICE in order to allow safer workflow +when non-privileged process is using AF_XDP. + +The intended workflow is following: + + 1. First process creates a bare socket with socket(AF_XDP, ...). + 2. First process loads the XSK program to the interface. + 3. First process adds the socket fd to a BPF map. + 4. First process ties socket fd to a particular interface using + SO_BINDTODEVICE. + 5. First process sends socket fd to a second process. + 6. Second process allocates UMEM. + 7. Second process binds socket to the interface with bind(...). + 8. Second process sends/receives the traffic. + +All the steps above are possible today if the first process is privileged +and the second one has sufficient RLIMIT_MEMLOCK and no capabilities. +However, the second process will be able to bind the socket to any interface +it wants on step 7 and send traffic from it. With the proposed change, the +second process will be able to bind the socket only to a specific interface +chosen by the first process at step 4. + +Fixes: 965a99098443 ("xsk: add support for bind for Rx") +Signed-off-by: Ilya Maximets +Signed-off-by: Daniel Borkmann +Acked-by: Magnus Karlsson +Acked-by: John Fastabend +Acked-by: Jason Wang +Link: https://lore.kernel.org/bpf/20230703175329.3259672-1-i.maximets@ovn.org +Signed-off-by: Sasha Levin +--- + Documentation/networking/af_xdp.rst | 9 +++++++++ + net/xdp/xsk.c | 5 +++++ + 2 files changed, 14 insertions(+) + +diff --git a/Documentation/networking/af_xdp.rst b/Documentation/networking/af_xdp.rst +index 2ccc5644cc98a..70623cb135d3c 100644 +--- a/Documentation/networking/af_xdp.rst ++++ b/Documentation/networking/af_xdp.rst +@@ -433,6 +433,15 @@ start N bytes into the buffer leaving the first N bytes for the + application to use. The final option is the flags field, but it will + be dealt with in separate sections for each UMEM flag. + ++SO_BINDTODEVICE setsockopt ++-------------------------- ++ ++This is a generic SOL_SOCKET option that can be used to tie AF_XDP ++socket to a particular network interface. It is useful when a socket ++is created by a privileged process and passed to a non-privileged one. ++Once the option is set, kernel will refuse attempts to bind that socket ++to a different interface. Updating the value requires CAP_NET_RAW. ++ + XDP_STATISTICS getsockopt + ------------------------- + +diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c +index 691841dc6d334..d04f91f4d09df 100644 +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -667,6 +667,7 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len) + struct sock *sk = sock->sk; + struct xdp_sock *xs = xdp_sk(sk); + struct net_device *dev; ++ int bound_dev_if; + u32 flags, qid; + int err = 0; + +@@ -680,6 +681,10 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len) + XDP_USE_NEED_WAKEUP)) + return -EINVAL; + ++ bound_dev_if = READ_ONCE(sk->sk_bound_dev_if); ++ if (bound_dev_if && bound_dev_if != sxdp->sxdp_ifindex) ++ return -EINVAL; ++ + rtnl_lock(); + mutex_lock(&xs->mutex); + if (xs->state != XSK_READY) { +-- +2.39.2 +