From: Sasha Levin Date: Sat, 9 Dec 2023 06:02:27 +0000 (-0500) Subject: Fixes for 5.10 X-Git-Tag: v6.6.6~45 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0cfdb6ef1b633f25f287c641bc39d535e7cd0c94;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/arm-dts-imx7-declare-timers-compatible-with-fsl-imx6.patch b/queue-5.10/arm-dts-imx7-declare-timers-compatible-with-fsl-imx6.patch new file mode 100644 index 00000000000..97d392400fc --- /dev/null +++ b/queue-5.10/arm-dts-imx7-declare-timers-compatible-with-fsl-imx6.patch @@ -0,0 +1,65 @@ +From acfe44270643ef0af938e094f3a1ce94716951bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 17:05:01 +0100 +Subject: ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt + +From: Philipp Zabel + +[ Upstream commit 397caf68e2d36532054cb14ae8995537f27f8b61 ] + +The timer nodes declare compatibility with "fsl,imx6sx-gpt", which +itself is compatible with "fsl,imx6dl-gpt". Switch the fallback +compatible from "fsl,imx6sx-gpt" to "fsl,imx6dl-gpt". + +Fixes: 949673450291 ("ARM: dts: add imx7d soc dtsi file") +Signed-off-by: Philipp Zabel +Signed-off-by: Roland Hieber +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx7s.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi +index 854c380cccea4..03bde2fb9bb11 100644 +--- a/arch/arm/boot/dts/imx7s.dtsi ++++ b/arch/arm/boot/dts/imx7s.dtsi +@@ -437,7 +437,7 @@ + }; + + gpt1: timer@302d0000 { +- compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; ++ compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; + reg = <0x302d0000 0x10000>; + interrupts = ; + clocks = <&clks IMX7D_GPT1_ROOT_CLK>, +@@ -446,7 +446,7 @@ + }; + + gpt2: timer@302e0000 { +- compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; ++ compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; + reg = <0x302e0000 0x10000>; + interrupts = ; + clocks = <&clks IMX7D_GPT2_ROOT_CLK>, +@@ -456,7 +456,7 @@ + }; + + gpt3: timer@302f0000 { +- compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; ++ compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; + reg = <0x302f0000 0x10000>; + interrupts = ; + clocks = <&clks IMX7D_GPT3_ROOT_CLK>, +@@ -466,7 +466,7 @@ + }; + + gpt4: timer@30300000 { +- compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; ++ compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; + reg = <0x30300000 0x10000>; + interrupts = ; + clocks = <&clks IMX7D_GPT4_ROOT_CLK>, +-- +2.42.0 + diff --git a/queue-5.10/arm-imx-check-return-value-of-devm_kasprintf-in-imx_.patch b/queue-5.10/arm-imx-check-return-value-of-devm_kasprintf-in-imx_.patch new file mode 100644 index 00000000000..4b4c5af0867 --- /dev/null +++ b/queue-5.10/arm-imx-check-return-value-of-devm_kasprintf-in-imx_.patch @@ -0,0 +1,55 @@ +From 821a8040d79dd1a2dd4b385a8bd0a203d66dede1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 14:46:36 +0800 +Subject: ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init + +From: Kunwu Chan + +[ Upstream commit 1c2b1049af3f86545fcc5fae0fc725fb64b3a09e ] + +devm_kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. Ensure the allocation was successful +by checking the pointer validity. + +Release the id allocated in 'mmdc_pmu_init' when 'devm_kasprintf' +return NULL + +Suggested-by: Ahmad Fatoum +Fixes: e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver") +Signed-off-by: Kunwu Chan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/mmdc.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c +index b9efe9da06e0b..3d76e8c28c51d 100644 +--- a/arch/arm/mach-imx/mmdc.c ++++ b/arch/arm/mach-imx/mmdc.c +@@ -502,6 +502,10 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b + + name = devm_kasprintf(&pdev->dev, + GFP_KERNEL, "mmdc%d", ret); ++ if (!name) { ++ ret = -ENOMEM; ++ goto pmu_release_id; ++ } + + pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; + pmu_mmdc->devtype_data = (struct fsl_mmdc_devtype_data *)of_id->data; +@@ -524,9 +528,10 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b + + pmu_register_err: + pr_warn("MMDC Perf PMU failed (%d), disabled\n", ret); +- ida_simple_remove(&mmdc_ida, pmu_mmdc->id); + cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node); + hrtimer_cancel(&pmu_mmdc->hrtimer); ++pmu_release_id: ++ ida_simple_remove(&mmdc_ida, pmu_mmdc->id); + pmu_free: + kfree(pmu_mmdc); + return ret; +-- +2.42.0 + diff --git a/queue-5.10/arm64-dts-rockchip-expand-reg-size-of-vdec-node-for-.patch b/queue-5.10/arm64-dts-rockchip-expand-reg-size-of-vdec-node-for-.patch new file mode 100644 index 00000000000..0182880c6b2 --- /dev/null +++ b/queue-5.10/arm64-dts-rockchip-expand-reg-size-of-vdec-node-for-.patch @@ -0,0 +1,50 @@ +From a1585814a1dc99bc1a9408e39ef5db1efb2599ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Nov 2023 23:36:16 +0000 +Subject: arm64: dts: rockchip: Expand reg size of vdec node for RK3399 + +From: Alex Bee + +[ Upstream commit 35938c18291b5da7422b2fac6dac0af11aa8d0d7 ] + +Expand the reg size for the vdec node to include cache/performance +registers the rkvdec driver writes to. Also add missing clocks to the +related power-domain. + +Fixes: cbd7214402ec ("arm64: dts: rockchip: Define the rockchip Video Decoder node on rk3399") +Signed-off-by: Alex Bee +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20231105233630.3927502-10-jonas@kwiboo.se +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399.dtsi | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +index c5f3d4f8f4d21..3180f576ed02e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +@@ -1022,7 +1022,9 @@ + power-domain@RK3399_PD_VDU { + reg = ; + clocks = <&cru ACLK_VDU>, +- <&cru HCLK_VDU>; ++ <&cru HCLK_VDU>, ++ <&cru SCLK_VDU_CA>, ++ <&cru SCLK_VDU_CORE>; + pm_qos = <&qos_video_m1_r>, + <&qos_video_m1_w>; + }; +@@ -1276,7 +1278,7 @@ + + vdec: video-codec@ff660000 { + compatible = "rockchip,rk3399-vdec"; +- reg = <0x0 0xff660000 0x0 0x400>; ++ reg = <0x0 0xff660000 0x0 0x480>; + interrupts = ; + clocks = <&cru ACLK_VDU>, <&cru HCLK_VDU>, + <&cru SCLK_VDU_CA>, <&cru SCLK_VDU_CORE>; +-- +2.42.0 + diff --git a/queue-5.10/asoc-wm_adsp-fix-memleak-in-wm_adsp_buffer_populate.patch b/queue-5.10/asoc-wm_adsp-fix-memleak-in-wm_adsp_buffer_populate.patch new file mode 100644 index 00000000000..106573d28c7 --- /dev/null +++ b/queue-5.10/asoc-wm_adsp-fix-memleak-in-wm_adsp_buffer_populate.patch @@ -0,0 +1,57 @@ +From 9310f25dfbbde7eefd1be6167cc59de8632b6cd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 15:41:56 +0800 +Subject: ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate + +From: Dinghao Liu + +[ Upstream commit 29046a78a3c0a1f8fa0427f164caa222f003cf5b ] + +When wm_adsp_buffer_read() fails, we should free buf->regions. +Otherwise, the callers of wm_adsp_buffer_populate() will +directly free buf on failure, which makes buf->regions a leaked +memory. + +Fixes: a792af69b08f ("ASoC: wm_adsp: Refactor compress stream initialisation") +Signed-off-by: Dinghao Liu +Reviewed-by: Richard Fitzgerald +Link: https://lore.kernel.org/r/20231204074158.12026-1-dinghao.liu@zju.edu.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm_adsp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c +index 10189f44af28f..ef7936fce7a23 100644 +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -3763,12 +3763,12 @@ static int wm_adsp_buffer_populate(struct wm_adsp_compr_buf *buf) + ret = wm_adsp_buffer_read(buf, caps->region_defs[i].base_offset, + ®ion->base_addr); + if (ret < 0) +- return ret; ++ goto err; + + ret = wm_adsp_buffer_read(buf, caps->region_defs[i].size_offset, + &offset); + if (ret < 0) +- return ret; ++ goto err; + + region->cumulative_size = offset; + +@@ -3779,6 +3779,10 @@ static int wm_adsp_buffer_populate(struct wm_adsp_compr_buf *buf) + } + + return 0; ++ ++err: ++ kfree(buf->regions); ++ return ret; + } + + static void wm_adsp_buffer_clear(struct wm_adsp_compr_buf *buf) +-- +2.42.0 + diff --git a/queue-5.10/hwmon-acpi_power_meter-fix-4.29-mw-bug.patch b/queue-5.10/hwmon-acpi_power_meter-fix-4.29-mw-bug.patch new file mode 100644 index 00000000000..c27e61f22e4 --- /dev/null +++ b/queue-5.10/hwmon-acpi_power_meter-fix-4.29-mw-bug.patch @@ -0,0 +1,55 @@ +From f2dcda07d2f619e65224a5681d600d7f6a742725 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 19:27:47 +0100 +Subject: hwmon: (acpi_power_meter) Fix 4.29 MW bug + +From: Armin Wolf + +[ Upstream commit 1fefca6c57fb928d2131ff365270cbf863d89c88 ] + +The ACPI specification says: + +"If an error occurs while obtaining the meter reading or if the value +is not available then an Integer with all bits set is returned" + +Since the "integer" is 32 bits in case of the ACPI power meter, +userspace will get a power reading of 2^32 * 1000 miliwatts (~4.29 MW) +in case of such an error. This was discovered due to a lm_sensors +bugreport (https://github.com/lm-sensors/lm-sensors/issues/460). +Fix this by returning -ENODATA instead. + +Tested-by: +Fixes: de584afa5e18 ("hwmon driver for ACPI 4.0 power meters") +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20231124182747.13956-1-W_Armin@gmx.de +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/acpi_power_meter.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c +index a270b975e90bb..5794d44538e9c 100644 +--- a/drivers/hwmon/acpi_power_meter.c ++++ b/drivers/hwmon/acpi_power_meter.c +@@ -32,6 +32,7 @@ ACPI_MODULE_NAME(ACPI_POWER_METER_NAME); + #define POWER_METER_CAN_NOTIFY (1 << 3) + #define POWER_METER_IS_BATTERY (1 << 8) + #define UNKNOWN_HYSTERESIS 0xFFFFFFFF ++#define UNKNOWN_POWER 0xFFFFFFFF + + #define METER_NOTIFY_CONFIG 0x80 + #define METER_NOTIFY_TRIP 0x81 +@@ -343,6 +344,9 @@ static ssize_t show_power(struct device *dev, + update_meter(resource); + mutex_unlock(&resource->lock); + ++ if (resource->power == UNKNOWN_POWER) ++ return -ENODATA; ++ + return sprintf(buf, "%llu\n", resource->power * 1000); + } + +-- +2.42.0 + diff --git a/queue-5.10/rdma-bnxt_re-correct-module-description-string.patch b/queue-5.10/rdma-bnxt_re-correct-module-description-string.patch new file mode 100644 index 00000000000..353becc4c4b --- /dev/null +++ b/queue-5.10/rdma-bnxt_re-correct-module-description-string.patch @@ -0,0 +1,38 @@ +From c85093a1ace01cc4baf3929f28eb424df626a00d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Nov 2023 00:29:47 -0800 +Subject: RDMA/bnxt_re: Correct module description string + +From: Kalesh AP + +[ Upstream commit 422b19f7f006e813ee0865aadce6a62b3c263c42 ] + +The word "Driver" is repeated twice in the "modinfo bnxt_re" +output description. Fix it. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Signed-off-by: Kalesh AP +Signed-off-by: Selvin Xavier +Link: https://lore.kernel.org/r/1700555387-6277-1-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c +index 8a618769915d5..76030eac49a37 100644 +--- a/drivers/infiniband/hw/bnxt_re/main.c ++++ b/drivers/infiniband/hw/bnxt_re/main.c +@@ -70,7 +70,7 @@ static char version[] = + BNXT_RE_DESC "\n"; + + MODULE_AUTHOR("Eddie Wai "); +-MODULE_DESCRIPTION(BNXT_RE_DESC " Driver"); ++MODULE_DESCRIPTION(BNXT_RE_DESC); + MODULE_LICENSE("Dual BSD/GPL"); + + /* globals */ +-- +2.42.0 + diff --git a/queue-5.10/rdma-rtrs-clt-remove-the-warnings-for-req-in_use-che.patch b/queue-5.10/rdma-rtrs-clt-remove-the-warnings-for-req-in_use-che.patch new file mode 100644 index 00000000000..3cf2dd82065 --- /dev/null +++ b/queue-5.10/rdma-rtrs-clt-remove-the-warnings-for-req-in_use-che.patch @@ -0,0 +1,42 @@ +From e32c544e58913c01b8d48b9ce9eb0efaafdf3d80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 16:41:44 +0100 +Subject: RDMA/rtrs-clt: Remove the warnings for req in_use check + +From: Jack Wang + +[ Upstream commit 0c8bb6eb70ca41031f663b4481aac9ac78b53bc6 ] + +As we chain the WR during write request: memory registration, +rdma write, local invalidate, if only the last WR fail to send due +to send queue overrun, the server can send back the reply, while +client mark the req->in_use to false in case of error in rtrs_clt_req +when error out from rtrs_post_rdma_write_sg. + +Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality") +Signed-off-by: Jack Wang +Reviewed-by: Md Haris Iqbal +Signed-off-by: Grzegorz Prajsner +Link: https://lore.kernel.org/r/20231120154146.920486-8-haris.iqbal@ionos.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index 1a5805260778b..e8b2b58cc9bc6 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -387,7 +387,7 @@ static void complete_rdma_req(struct rtrs_clt_io_req *req, int errno, + struct rtrs_clt_sess *sess; + int err; + +- if (WARN_ON(!req->in_use)) ++ if (!req->in_use) + return; + if (WARN_ON(!req->con)) + return; +-- +2.42.0 + diff --git a/queue-5.10/riscv-fix-misaligned-access-handling-of-c.swsp-and-c.patch b/queue-5.10/riscv-fix-misaligned-access-handling-of-c.swsp-and-c.patch new file mode 100644 index 00000000000..5ae6bf636c5 --- /dev/null +++ b/queue-5.10/riscv-fix-misaligned-access-handling-of-c.swsp-and-c.patch @@ -0,0 +1,56 @@ +From e1bb199d3575ede0dd74974c7d5b5f73239b9b1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Nov 2023 10:02:23 +0100 +Subject: riscv: fix misaligned access handling of C.SWSP and C.SDSP +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Léger + +[ Upstream commit 22e0eb04837a63af111fae35a92f7577676b9bc8 ] + +This is a backport of a fix that was done in OpenSBI: ec0559eb315b +("lib: sbi_misaligned_ldst: Fix handling of C.SWSP and C.SDSP"). + +Unlike C.LWSP/C.LDSP, these encodings can be used with the zero +register, so checking that the rs2 field is non-zero is unnecessary. + +Additionally, the previous check was incorrect since it was checking +the immediate field of the instruction instead of the rs2 field. + +Fixes: 956d705dd279 ("riscv: Unaligned load/store handling for M_MODE") +Signed-off-by: Clément Léger +Link: https://lore.kernel.org/r/20231103090223.702340-1-cleger@rivosinc.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/traps_misaligned.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/kernel/traps_misaligned.c b/arch/riscv/kernel/traps_misaligned.c +index 46c4dafe3ba0e..b246c3dc69930 100644 +--- a/arch/riscv/kernel/traps_misaligned.c ++++ b/arch/riscv/kernel/traps_misaligned.c +@@ -344,16 +344,14 @@ int handle_misaligned_store(struct pt_regs *regs) + } else if ((insn & INSN_MASK_C_SD) == INSN_MATCH_C_SD) { + len = 8; + val.data_ulong = GET_RS2S(insn, regs); +- } else if ((insn & INSN_MASK_C_SDSP) == INSN_MATCH_C_SDSP && +- ((insn >> SH_RD) & 0x1f)) { ++ } else if ((insn & INSN_MASK_C_SDSP) == INSN_MATCH_C_SDSP) { + len = 8; + val.data_ulong = GET_RS2C(insn, regs); + #endif + } else if ((insn & INSN_MASK_C_SW) == INSN_MATCH_C_SW) { + len = 4; + val.data_ulong = GET_RS2S(insn, regs); +- } else if ((insn & INSN_MASK_C_SWSP) == INSN_MATCH_C_SWSP && +- ((insn >> SH_RD) & 0x1f)) { ++ } else if ((insn & INSN_MASK_C_SWSP) == INSN_MATCH_C_SWSP) { + len = 4; + val.data_ulong = GET_RS2C(insn, regs); + } else { +-- +2.42.0 + diff --git a/queue-5.10/scsi-be2iscsi-fix-a-memleak-in-beiscsi_init_wrb_hand.patch b/queue-5.10/scsi-be2iscsi-fix-a-memleak-in-beiscsi_init_wrb_hand.patch new file mode 100644 index 00000000000..cef3e00a3fe --- /dev/null +++ b/queue-5.10/scsi-be2iscsi-fix-a-memleak-in-beiscsi_init_wrb_hand.patch @@ -0,0 +1,38 @@ +From ca90b62ae4026ceb7c35a89c841a83b5d36413fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 16:19:41 +0800 +Subject: scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle() + +From: Dinghao Liu + +[ Upstream commit 235f2b548d7f4ac5931d834f05d3f7f5166a2e72 ] + +When an error occurs in the for loop of beiscsi_init_wrb_handle(), we +should free phwi_ctxt->be_wrbq before returning an error code to prevent +potential memleak. + +Fixes: a7909b396ba7 ("[SCSI] be2iscsi: Fix dynamic CID allocation Mechanism in driver") +Signed-off-by: Dinghao Liu +Link: https://lore.kernel.org/r/20231123081941.24854-1-dinghao.liu@zju.edu.cn +Reviewed-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/be2iscsi/be_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c +index b977e039bb789..5e5c359eaf987 100644 +--- a/drivers/scsi/be2iscsi/be_main.c ++++ b/drivers/scsi/be2iscsi/be_main.c +@@ -2694,6 +2694,7 @@ static int beiscsi_init_wrb_handle(struct beiscsi_hba *phba) + kfree(pwrb_context->pwrb_handle_base); + kfree(pwrb_context->pwrb_handle_basestd); + } ++ kfree(phwi_ctxt->be_wrbq); + return -ENOMEM; + } + +-- +2.42.0 + diff --git a/queue-5.10/series b/queue-5.10/series index d059bd616e7..9453b20adb9 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -33,3 +33,14 @@ net-hns-fix-fake-link-up-on-xge-port.patch netfilter-xt_owner-fix-for-unsafe-access-of-sk-sk_so.patch tcp-do-not-accept-ack-of-bytes-we-never-sent.patch bpf-sockmap-updating-the-sg-structure-should-also-up.patch +tee-optee-fix-supplicant-based-device-enumeration.patch +arm64-dts-rockchip-expand-reg-size-of-vdec-node-for-.patch +rdma-rtrs-clt-remove-the-warnings-for-req-in_use-che.patch +rdma-bnxt_re-correct-module-description-string.patch +hwmon-acpi_power_meter-fix-4.29-mw-bug.patch +asoc-wm_adsp-fix-memleak-in-wm_adsp_buffer_populate.patch +tracing-fix-a-warning-when-allocating-buffered-event.patch +scsi-be2iscsi-fix-a-memleak-in-beiscsi_init_wrb_hand.patch +arm-imx-check-return-value-of-devm_kasprintf-in-imx_.patch +arm-dts-imx7-declare-timers-compatible-with-fsl-imx6.patch +riscv-fix-misaligned-access-handling-of-c.swsp-and-c.patch diff --git a/queue-5.10/tee-optee-fix-supplicant-based-device-enumeration.patch b/queue-5.10/tee-optee-fix-supplicant-based-device-enumeration.patch new file mode 100644 index 00000000000..663df358175 --- /dev/null +++ b/queue-5.10/tee-optee-fix-supplicant-based-device-enumeration.patch @@ -0,0 +1,100 @@ +From 3e170fa1865968fd0b2bf131b7d512914b3f88d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Nov 2023 13:00:55 +0530 +Subject: tee: optee: Fix supplicant based device enumeration + +From: Sumit Garg + +[ Upstream commit 7269cba53d906cf257c139d3b3a53ad272176bca ] + +Currently supplicant dependent optee device enumeration only registers +devices whenever tee-supplicant is invoked for the first time. But it +forgets to remove devices when tee-supplicant daemon stops running and +closes its context gracefully. This leads to following error for fTPM +driver during reboot/shutdown: + +[ 73.466791] tpm tpm0: ftpm_tee_tpm_op_send: SUBMIT_COMMAND invoke error: 0xffff3024 + +Fix this by adding an attribute for supplicant dependent devices so that +the user-space service can detect and detach supplicant devices before +closing the supplicant: + +$ for dev in /sys/bus/tee/devices/*; do if [[ -f "$dev/need_supplicant" && -f "$dev/driver/unbind" ]]; \ + then echo $(basename "$dev") > $dev/driver/unbind; fi done + +Reported-by: Jan Kiszka +Closes: https://github.com/OP-TEE/optee_os/issues/6094 +Fixes: 5f178bb71e3a ("optee: enable support for multi-stage bus enumeration") +Signed-off-by: Sumit Garg +Reviewed-by: Ilias Apalodimas +Acked-by: Jerome Forissier +[jw: fixed up Date documentation] +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + .../ABI/testing/sysfs-bus-optee-devices | 9 +++++++++ + drivers/tee/optee/device.c | 17 +++++++++++++++-- + 2 files changed, 24 insertions(+), 2 deletions(-) + +diff --git a/Documentation/ABI/testing/sysfs-bus-optee-devices b/Documentation/ABI/testing/sysfs-bus-optee-devices +index 0f58701367b66..af31e5a22d89f 100644 +--- a/Documentation/ABI/testing/sysfs-bus-optee-devices ++++ b/Documentation/ABI/testing/sysfs-bus-optee-devices +@@ -6,3 +6,12 @@ Description: + OP-TEE bus provides reference to registered drivers under this directory. The + matches Trusted Application (TA) driver and corresponding TA in secure OS. Drivers + are free to create needed API under optee-ta- directory. ++ ++What: /sys/bus/tee/devices/optee-ta-/need_supplicant ++Date: November 2023 ++KernelVersion: 6.7 ++Contact: op-tee@lists.trustedfirmware.org ++Description: ++ Allows to distinguish whether an OP-TEE based TA/device requires user-space ++ tee-supplicant to function properly or not. This attribute will be present for ++ devices which depend on tee-supplicant to be running. +diff --git a/drivers/tee/optee/device.c b/drivers/tee/optee/device.c +index 60ffc54da0033..3cb39f02fae0d 100644 +--- a/drivers/tee/optee/device.c ++++ b/drivers/tee/optee/device.c +@@ -60,7 +60,16 @@ static void optee_release_device(struct device *dev) + kfree(optee_device); + } + +-static int optee_register_device(const uuid_t *device_uuid) ++static ssize_t need_supplicant_show(struct device *dev, ++ struct device_attribute *attr, ++ char *buf) ++{ ++ return 0; ++} ++ ++static DEVICE_ATTR_RO(need_supplicant); ++ ++static int optee_register_device(const uuid_t *device_uuid, u32 func) + { + struct tee_client_device *optee_device = NULL; + int rc; +@@ -83,6 +92,10 @@ static int optee_register_device(const uuid_t *device_uuid) + put_device(&optee_device->dev); + } + ++ if (func == PTA_CMD_GET_DEVICES_SUPP) ++ device_create_file(&optee_device->dev, ++ &dev_attr_need_supplicant); ++ + return rc; + } + +@@ -143,7 +156,7 @@ static int __optee_enumerate_devices(u32 func) + num_devices = shm_size / sizeof(uuid_t); + + for (idx = 0; idx < num_devices; idx++) { +- rc = optee_register_device(&device_uuid[idx]); ++ rc = optee_register_device(&device_uuid[idx], func); + if (rc) + goto out_shm; + } +-- +2.42.0 + diff --git a/queue-5.10/tracing-fix-a-warning-when-allocating-buffered-event.patch b/queue-5.10/tracing-fix-a-warning-when-allocating-buffered-event.patch new file mode 100644 index 00000000000..26ca1586e48 --- /dev/null +++ b/queue-5.10/tracing-fix-a-warning-when-allocating-buffered-event.patch @@ -0,0 +1,83 @@ +From dabff7a1a44ef2b7e79d2c69b96db585d63fd5df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 17:17:35 +0100 +Subject: tracing: Fix a warning when allocating buffered events fails + +From: Petr Pavlu + +[ Upstream commit 34209fe83ef8404353f91ab4ea4035dbc9922d04 ] + +Function trace_buffered_event_disable() produces an unexpected warning +when the previous call to trace_buffered_event_enable() fails to +allocate pages for buffered events. + +The situation can occur as follows: + +* The counter trace_buffered_event_ref is at 0. + +* The soft mode gets enabled for some event and + trace_buffered_event_enable() is called. The function increments + trace_buffered_event_ref to 1 and starts allocating event pages. + +* The allocation fails for some page and trace_buffered_event_disable() + is called for cleanup. + +* Function trace_buffered_event_disable() decrements + trace_buffered_event_ref back to 0, recognizes that it was the last + use of buffered events and frees all allocated pages. + +* The control goes back to trace_buffered_event_enable() which returns. + The caller of trace_buffered_event_enable() has no information that + the function actually failed. + +* Some time later, the soft mode is disabled for the same event. + Function trace_buffered_event_disable() is called. It warns on + "WARN_ON_ONCE(!trace_buffered_event_ref)" and returns. + +Buffered events are just an optimization and can handle failures. Make +trace_buffered_event_enable() exit on the first failure and left any +cleanup later to when trace_buffered_event_disable() is called. + +Link: https://lore.kernel.org/all/20231127151248.7232-2-petr.pavlu@suse.com/ +Link: https://lkml.kernel.org/r/20231205161736.19663-3-petr.pavlu@suse.com + +Fixes: 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events") +Signed-off-by: Petr Pavlu +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 89a8bb8e24df2..bcf48ee4f20d7 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -2687,8 +2687,11 @@ void trace_buffered_event_enable(void) + for_each_tracing_cpu(cpu) { + page = alloc_pages_node(cpu_to_node(cpu), + GFP_KERNEL | __GFP_NORETRY, 0); +- if (!page) +- goto failed; ++ /* This is just an optimization and can handle failures */ ++ if (!page) { ++ pr_err("Failed to allocate event buffer\n"); ++ break; ++ } + + event = page_address(page); + memset(event, 0, sizeof(*event)); +@@ -2702,10 +2705,6 @@ void trace_buffered_event_enable(void) + WARN_ON_ONCE(1); + preempt_enable(); + } +- +- return; +- failed: +- trace_buffered_event_disable(); + } + + static void enable_trace_buffered_event(void *data) +-- +2.42.0 +