From: Greg Kroah-Hartman Date: Sat, 13 Aug 2022 13:55:06 +0000 (+0200) Subject: 5.19-stable patches X-Git-Tag: v5.15.61~167 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1129137a363e41d5b4cee5b74ac4b4728bd5e8ad;p=thirdparty%2Fkernel%2Fstable-queue.git 5.19-stable patches added patches: iio-fix-iio_format_avail_range-printing-for-none-iio_val_int.patch iio-light-isl29028-fix-the-warning-in-isl29028_remove.patch mtd-rawnand-arasan-fix-clock-rate-in-nv-ddr.patch mtd-rawnand-arasan-update-nand-bus-clock-instead-of-system-clock.patch scsi-lpfc-remove-extra-atomic_inc-on-cmd_pending-in-queuecommand-after-vmid.patch scsi-qla2xxx-fix-incorrect-display-of-max-frame-size.patch scsi-qla2xxx-zero-undefined-mailbox-in-registers.patch scsi-sg-allow-waiting-for-commands-to-complete-on-removed-device.patch um-remove-straying-parenthesis.patch um-seed-rng-using-host-os-rng.patch --- diff --git a/queue-5.19/iio-fix-iio_format_avail_range-printing-for-none-iio_val_int.patch b/queue-5.19/iio-fix-iio_format_avail_range-printing-for-none-iio_val_int.patch new file mode 100644 index 00000000000..d0bb3291ecb --- /dev/null +++ b/queue-5.19/iio-fix-iio_format_avail_range-printing-for-none-iio_val_int.patch @@ -0,0 +1,54 @@ +From 5e1f91850365de55ca74945866c002fda8f00331 Mon Sep 17 00:00:00 2001 +From: Fawzi Khaber +Date: Mon, 18 Jul 2022 15:07:06 +0200 +Subject: iio: fix iio_format_avail_range() printing for none IIO_VAL_INT + +From: Fawzi Khaber + +commit 5e1f91850365de55ca74945866c002fda8f00331 upstream. + +iio_format_avail_range() should print range as follow [min, step, max], so +the function was previously calling iio_format_list() with length = 3, +length variable refers to the array size of values not the number of +elements. In case of non IIO_VAL_INT values each element has integer part +and decimal part. With length = 3 this would cause premature end of loop +and result in printing only one element. + +Signed-off-by: Fawzi Khaber +Signed-off-by: Jean-Baptiste Maneyrol +Fixes: eda20ba1e25e ("iio: core: Consolidate iio_format_avail_{list,range}()") +Link: https://lore.kernel.org/r/20220718130706.32571-1-jmaneyrol@invensense.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/industrialio-core.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +--- a/drivers/iio/industrialio-core.c ++++ b/drivers/iio/industrialio-core.c +@@ -835,7 +835,23 @@ static ssize_t iio_format_avail_list(cha + + static ssize_t iio_format_avail_range(char *buf, const int *vals, int type) + { +- return iio_format_list(buf, vals, type, 3, "[", "]"); ++ int length; ++ ++ /* ++ * length refers to the array size , not the number of elements. ++ * The purpose is to print the range [min , step ,max] so length should ++ * be 3 in case of int, and 6 for other types. ++ */ ++ switch (type) { ++ case IIO_VAL_INT: ++ length = 3; ++ break; ++ default: ++ length = 6; ++ break; ++ } ++ ++ return iio_format_list(buf, vals, type, length, "[", "]"); + } + + static ssize_t iio_read_channel_info_avail(struct device *dev, diff --git a/queue-5.19/iio-light-isl29028-fix-the-warning-in-isl29028_remove.patch b/queue-5.19/iio-light-isl29028-fix-the-warning-in-isl29028_remove.patch new file mode 100644 index 00000000000..c527e860396 --- /dev/null +++ b/queue-5.19/iio-light-isl29028-fix-the-warning-in-isl29028_remove.patch @@ -0,0 +1,49 @@ +From 06674fc7c003b9d0aa1d37fef7ab2c24802cc6ad Mon Sep 17 00:00:00 2001 +From: Zheyu Ma +Date: Sun, 17 Jul 2022 08:42:41 +0800 +Subject: iio: light: isl29028: Fix the warning in isl29028_remove() + +From: Zheyu Ma + +commit 06674fc7c003b9d0aa1d37fef7ab2c24802cc6ad upstream. + +The driver use the non-managed form of the register function in +isl29028_remove(). To keep the release order as mirroring the ordering +in probe, the driver should use non-managed form in probe, too. + +The following log reveals it: + +[ 32.374955] isl29028 0-0010: remove +[ 32.376861] general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI +[ 32.377676] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] +[ 32.379432] RIP: 0010:kernfs_find_and_get_ns+0x28/0xe0 +[ 32.385461] Call Trace: +[ 32.385807] sysfs_unmerge_group+0x59/0x110 +[ 32.386110] dpm_sysfs_remove+0x58/0xc0 +[ 32.386391] device_del+0x296/0xe50 +[ 32.386959] cdev_device_del+0x1d/0xd0 +[ 32.387231] devm_iio_device_unreg+0x27/0xb0 +[ 32.387542] devres_release_group+0x319/0x3d0 +[ 32.388162] i2c_device_remove+0x93/0x1f0 + +Fixes: 2db5054ac28d ("staging: iio: isl29028: add runtime power management support") +Signed-off-by: Zheyu Ma +Link: https://lore.kernel.org/r/20220717004241.2281028-1-zheyuma97@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/isl29028.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/light/isl29028.c ++++ b/drivers/iio/light/isl29028.c +@@ -625,7 +625,7 @@ static int isl29028_probe(struct i2c_cli + ISL29028_POWER_OFF_DELAY_MS); + pm_runtime_use_autosuspend(&client->dev); + +- ret = devm_iio_device_register(indio_dev->dev.parent, indio_dev); ++ ret = iio_device_register(indio_dev); + if (ret < 0) { + dev_err(&client->dev, + "%s(): iio registration failed with error %d\n", diff --git a/queue-5.19/mtd-rawnand-arasan-fix-clock-rate-in-nv-ddr.patch b/queue-5.19/mtd-rawnand-arasan-fix-clock-rate-in-nv-ddr.patch new file mode 100644 index 00000000000..7987a526531 --- /dev/null +++ b/queue-5.19/mtd-rawnand-arasan-fix-clock-rate-in-nv-ddr.patch @@ -0,0 +1,46 @@ +From e16eceea863b417fd328588b1be1a79de0bc937f Mon Sep 17 00:00:00 2001 +From: Olga Kitaina +Date: Tue, 28 Jun 2022 21:18:24 +0530 +Subject: mtd: rawnand: arasan: Fix clock rate in NV-DDR + +From: Olga Kitaina + +commit e16eceea863b417fd328588b1be1a79de0bc937f upstream. + +According to the Arasan NAND controller spec, the flash clock rate for SDR +must be <= 100 MHz, while for NV-DDR it must be the same as the rate of the +CLK line for the mode. The driver previously always set 100 MHz for NV-DDR, +which would result in incorrect behavior for NV-DDR modes 0-4. + +The appropriate clock rate can be calculated from the NV-DDR timing +parameters as 1/tCK, or for rates measured in picoseconds, +10^12 / nand_nvddr_timings->tCK_min. + +Fixes: 197b88fecc50 ("mtd: rawnand: arasan: Add new Arasan NAND controller") +CC: stable@vger.kernel.org # 5.8+ +Signed-off-by: Olga Kitaina +Signed-off-by: Amit Kumar Mahapatra +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220628154824.12222-3-amit.kumar-mahapatra@xilinx.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/arasan-nand-controller.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/nand/raw/arasan-nand-controller.c ++++ b/drivers/mtd/nand/raw/arasan-nand-controller.c +@@ -1043,7 +1043,13 @@ static int anfc_setup_interface(struct n + DQS_BUFF_SEL_OUT(dqs_mode); + } + +- anand->clk = ANFC_XLNX_SDR_DFLT_CORE_CLK; ++ if (nand_interface_is_sdr(conf)) { ++ anand->clk = ANFC_XLNX_SDR_DFLT_CORE_CLK; ++ } else { ++ /* ONFI timings are defined in picoseconds */ ++ anand->clk = div_u64((u64)NSEC_PER_SEC * 1000, ++ conf->timings.nvddr.tCK_min); ++ } + + /* + * Due to a hardware bug in the ZynqMP SoC, SDR timing modes 0-1 work diff --git a/queue-5.19/mtd-rawnand-arasan-update-nand-bus-clock-instead-of-system-clock.patch b/queue-5.19/mtd-rawnand-arasan-update-nand-bus-clock-instead-of-system-clock.patch new file mode 100644 index 00000000000..4835a421dea --- /dev/null +++ b/queue-5.19/mtd-rawnand-arasan-update-nand-bus-clock-instead-of-system-clock.patch @@ -0,0 +1,50 @@ +From 7499bfeedb47efc1ee4dc793b92c610d46e6d6a6 Mon Sep 17 00:00:00 2001 +From: Amit Kumar Mahapatra +Date: Tue, 28 Jun 2022 21:18:23 +0530 +Subject: mtd: rawnand: arasan: Update NAND bus clock instead of system clock + +From: Amit Kumar Mahapatra + +commit 7499bfeedb47efc1ee4dc793b92c610d46e6d6a6 upstream. + +In current implementation the Arasan NAND driver is updating the +system clock(i.e., anand->clk) in accordance to the timing modes +(i.e., SDR or NVDDR). But as per the Arasan NAND controller spec the +flash clock or the NAND bus clock(i.e., nfc->bus_clk), need to be +updated instead. This patch keeps the system clock unchanged and updates +the NAND bus clock as per the timing modes. + +Fixes: 197b88fecc50 ("mtd: rawnand: arasan: Add new Arasan NAND controller") +CC: stable@vger.kernel.org # 5.8+ +Signed-off-by: Amit Kumar Mahapatra +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220628154824.12222-2-amit.kumar-mahapatra@xilinx.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/arasan-nand-controller.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/mtd/nand/raw/arasan-nand-controller.c ++++ b/drivers/mtd/nand/raw/arasan-nand-controller.c +@@ -347,17 +347,17 @@ static int anfc_select_target(struct nan + + /* Update clock frequency */ + if (nfc->cur_clk != anand->clk) { +- clk_disable_unprepare(nfc->controller_clk); +- ret = clk_set_rate(nfc->controller_clk, anand->clk); ++ clk_disable_unprepare(nfc->bus_clk); ++ ret = clk_set_rate(nfc->bus_clk, anand->clk); + if (ret) { + dev_err(nfc->dev, "Failed to change clock rate\n"); + return ret; + } + +- ret = clk_prepare_enable(nfc->controller_clk); ++ ret = clk_prepare_enable(nfc->bus_clk); + if (ret) { + dev_err(nfc->dev, +- "Failed to re-enable the controller clock\n"); ++ "Failed to re-enable the bus clock\n"); + return ret; + } + diff --git a/queue-5.19/scsi-lpfc-remove-extra-atomic_inc-on-cmd_pending-in-queuecommand-after-vmid.patch b/queue-5.19/scsi-lpfc-remove-extra-atomic_inc-on-cmd_pending-in-queuecommand-after-vmid.patch new file mode 100644 index 00000000000..0890f33e1cd --- /dev/null +++ b/queue-5.19/scsi-lpfc-remove-extra-atomic_inc-on-cmd_pending-in-queuecommand-after-vmid.patch @@ -0,0 +1,34 @@ +From 0948a9c5386095baae4012190a6b65aba684a907 Mon Sep 17 00:00:00 2001 +From: James Smart +Date: Fri, 1 Jul 2022 14:14:17 -0700 +Subject: scsi: lpfc: Remove extra atomic_inc on cmd_pending in queuecommand after VMID + +From: James Smart + +commit 0948a9c5386095baae4012190a6b65aba684a907 upstream. + +VMID introduced an extra increment of cmd_pending, causing double-counting +of the I/O. The normal increment ios performed in lpfc_get_scsi_buf. + +Link: https://lore.kernel.org/r/20220701211425.2708-5-jsmart2021@gmail.com +Fixes: 33c79741deaf ("scsi: lpfc: vmid: Introduce VMID in I/O path") +Cc: # v5.14+ +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/lpfc/lpfc_scsi.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -5456,7 +5456,6 @@ lpfc_queuecommand(struct Scsi_Host *shos + cur_iocbq->cmd_flag |= LPFC_IO_VMID; + } + } +- atomic_inc(&ndlp->cmd_pending); + + #ifdef CONFIG_SCSI_LPFC_DEBUG_FS + if (unlikely(phba->hdwqstat_on & LPFC_CHECK_SCSI_IO)) diff --git a/queue-5.19/scsi-qla2xxx-fix-incorrect-display-of-max-frame-size.patch b/queue-5.19/scsi-qla2xxx-fix-incorrect-display-of-max-frame-size.patch new file mode 100644 index 00000000000..fdec174bbff --- /dev/null +++ b/queue-5.19/scsi-qla2xxx-fix-incorrect-display-of-max-frame-size.patch @@ -0,0 +1,99 @@ +From cf3b4fb655796674e605268bd4bfb47a47c8bce6 Mon Sep 17 00:00:00 2001 +From: Bikash Hazarika +Date: Tue, 12 Jul 2022 22:20:37 -0700 +Subject: scsi: qla2xxx: Fix incorrect display of max frame size + +From: Bikash Hazarika + +commit cf3b4fb655796674e605268bd4bfb47a47c8bce6 upstream. + +Replace display field with the correct field. + +Link: https://lore.kernel.org/r/20220713052045.10683-3-njavali@marvell.com +Fixes: 8777e4314d39 ("scsi: qla2xxx: Migrate NVME N2N handling into state machine") +Cc: stable@vger.kernel.org +Reviewed-by: Himanshu Madhani +Signed-off-by: Bikash Hazarika +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qla2xxx/qla_def.h | 1 + + drivers/scsi/qla2xxx/qla_gs.c | 9 +++------ + drivers/scsi/qla2xxx/qla_init.c | 2 ++ + drivers/scsi/qla2xxx/qla_isr.c | 4 +--- + 4 files changed, 7 insertions(+), 9 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -3975,6 +3975,7 @@ struct qla_hw_data { + /* SRB cache. */ + #define SRB_MIN_REQ 128 + mempool_t *srb_mempool; ++ u8 port_name[WWN_SIZE]; + + volatile struct { + uint32_t mbox_int :1; +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -1596,7 +1596,6 @@ qla2x00_hba_attributes(scsi_qla_host_t * + unsigned int callopt) + { + struct qla_hw_data *ha = vha->hw; +- struct init_cb_24xx *icb24 = (void *)ha->init_cb; + struct new_utsname *p_sysid = utsname(); + struct ct_fdmi_hba_attr *eiter; + uint16_t alen; +@@ -1758,8 +1757,8 @@ qla2x00_hba_attributes(scsi_qla_host_t * + /* MAX CT Payload Length */ + eiter = entries + size; + eiter->type = cpu_to_be16(FDMI_HBA_MAXIMUM_CT_PAYLOAD_LENGTH); +- eiter->a.max_ct_len = cpu_to_be32(le16_to_cpu(IS_FWI2_CAPABLE(ha) ? +- icb24->frame_payload_size : ha->init_cb->frame_payload_size)); ++ eiter->a.max_ct_len = cpu_to_be32(ha->frame_payload_size >> 2); ++ + alen = sizeof(eiter->a.max_ct_len); + alen += FDMI_ATTR_TYPELEN(eiter); + eiter->len = cpu_to_be16(alen); +@@ -1851,7 +1850,6 @@ qla2x00_port_attributes(scsi_qla_host_t + unsigned int callopt) + { + struct qla_hw_data *ha = vha->hw; +- struct init_cb_24xx *icb24 = (void *)ha->init_cb; + struct new_utsname *p_sysid = utsname(); + char *hostname = p_sysid ? + p_sysid->nodename : fc_host_system_hostname(vha->host); +@@ -1903,8 +1901,7 @@ qla2x00_port_attributes(scsi_qla_host_t + /* Max frame size. */ + eiter = entries + size; + eiter->type = cpu_to_be16(FDMI_PORT_MAX_FRAME_SIZE); +- eiter->a.max_frame_size = cpu_to_be32(le16_to_cpu(IS_FWI2_CAPABLE(ha) ? +- icb24->frame_payload_size : ha->init_cb->frame_payload_size)); ++ eiter->a.max_frame_size = cpu_to_be32(ha->frame_payload_size); + alen = sizeof(eiter->a.max_frame_size); + alen += FDMI_ATTR_TYPELEN(eiter); + eiter->len = cpu_to_be16(alen); +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -4509,6 +4509,8 @@ qla2x00_init_rings(scsi_qla_host_t *vha) + BIT_6) != 0; + ql_dbg(ql_dbg_init, vha, 0x00bc, "FA-WWPN Support: %s.\n", + (ha->flags.fawwpn_enabled) ? "enabled" : "disabled"); ++ /* Init_cb will be reused for other command(s). Save a backup copy of port_name */ ++ memcpy(ha->port_name, ha->init_cb->port_name, WWN_SIZE); + } + + /* ELS pass through payload is limit by frame size. */ +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -1354,9 +1354,7 @@ skip_rio: + if (!vha->vp_idx) { + if (ha->flags.fawwpn_enabled && + (ha->current_topology == ISP_CFG_F)) { +- void *wwpn = ha->init_cb->port_name; +- +- memcpy(vha->port_name, wwpn, WWN_SIZE); ++ memcpy(vha->port_name, ha->port_name, WWN_SIZE); + fc_host_port_name(vha->host) = + wwn_to_u64(vha->port_name); + ql_dbg(ql_dbg_init + ql_dbg_verbose, diff --git a/queue-5.19/scsi-qla2xxx-zero-undefined-mailbox-in-registers.patch b/queue-5.19/scsi-qla2xxx-zero-undefined-mailbox-in-registers.patch new file mode 100644 index 00000000000..6ab9bc98319 --- /dev/null +++ b/queue-5.19/scsi-qla2xxx-zero-undefined-mailbox-in-registers.patch @@ -0,0 +1,36 @@ +From 6c96a3c7d49593ef15805f5e497601c87695abc9 Mon Sep 17 00:00:00 2001 +From: Bikash Hazarika +Date: Tue, 12 Jul 2022 22:20:38 -0700 +Subject: scsi: qla2xxx: Zero undefined mailbox IN registers + +From: Bikash Hazarika + +commit 6c96a3c7d49593ef15805f5e497601c87695abc9 upstream. + +While requesting a new mailbox command, driver does not write any data to +unused registers. Initialize the unused register value to zero while +requesting a new mailbox command to prevent stale entry access by firmware. + +Link: https://lore.kernel.org/r/20220713052045.10683-4-njavali@marvell.com +Cc: stable@vger.kernel.org +Reviewed-by: Himanshu Madhani +Signed-off-by: Bikash Hazarika +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qla2xxx/qla_mbx.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -238,6 +238,8 @@ qla2x00_mailbox_command(scsi_qla_host_t + ql_dbg(ql_dbg_mbx, vha, 0x1112, + "mbox[%d]<-0x%04x\n", cnt, *iptr); + wrt_reg_word(optr, *iptr); ++ } else { ++ wrt_reg_word(optr, 0); + } + + mboxes >>= 1; diff --git a/queue-5.19/scsi-sg-allow-waiting-for-commands-to-complete-on-removed-device.patch b/queue-5.19/scsi-sg-allow-waiting-for-commands-to-complete-on-removed-device.patch new file mode 100644 index 00000000000..fa8f45d743c --- /dev/null +++ b/queue-5.19/scsi-sg-allow-waiting-for-commands-to-complete-on-removed-device.patch @@ -0,0 +1,142 @@ +From 3455607fd7be10b449f5135c00dc306b85dc0d21 Mon Sep 17 00:00:00 2001 +From: Tony Battersby +Date: Mon, 11 Jul 2022 10:51:32 -0400 +Subject: scsi: sg: Allow waiting for commands to complete on removed device + +From: Tony Battersby + +commit 3455607fd7be10b449f5135c00dc306b85dc0d21 upstream. + +When a SCSI device is removed while in active use, currently sg will +immediately return -ENODEV on any attempt to wait for active commands that +were sent before the removal. This is problematic for commands that use +SG_FLAG_DIRECT_IO since the data buffer may still be in use by the kernel +when userspace frees or reuses it after getting ENODEV, leading to +corrupted userspace memory (in the case of READ-type commands) or corrupted +data being sent to the device (in the case of WRITE-type commands). This +has been seen in practice when logging out of a iscsi_tcp session, where +the iSCSI driver may still be processing commands after the device has been +marked for removal. + +Change the policy to allow userspace to wait for active sg commands even +when the device is being removed. Return -ENODEV only when there are no +more responses to read. + +Link: https://lore.kernel.org/r/5ebea46f-fe83-2d0b-233d-d0dcb362dd0a@cybernetics.com +Cc: +Acked-by: Douglas Gilbert +Signed-off-by: Tony Battersby +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/sg.c | 53 +++++++++++++++++++++++++++++++++-------------------- + 1 file changed, 33 insertions(+), 20 deletions(-) + +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -195,7 +195,7 @@ static void sg_link_reserve(Sg_fd * sfp, + static void sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp); + static Sg_fd *sg_add_sfp(Sg_device * sdp); + static void sg_remove_sfp(struct kref *); +-static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id); ++static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id, bool *busy); + static Sg_request *sg_add_request(Sg_fd * sfp); + static int sg_remove_request(Sg_fd * sfp, Sg_request * srp); + static Sg_device *sg_get_dev(int dev); +@@ -444,6 +444,7 @@ sg_read(struct file *filp, char __user * + Sg_fd *sfp; + Sg_request *srp; + int req_pack_id = -1; ++ bool busy; + sg_io_hdr_t *hp; + struct sg_header *old_hdr; + int retval; +@@ -466,20 +467,16 @@ sg_read(struct file *filp, char __user * + if (retval) + return retval; + +- srp = sg_get_rq_mark(sfp, req_pack_id); ++ srp = sg_get_rq_mark(sfp, req_pack_id, &busy); + if (!srp) { /* now wait on packet to arrive */ +- if (atomic_read(&sdp->detaching)) +- return -ENODEV; + if (filp->f_flags & O_NONBLOCK) + return -EAGAIN; + retval = wait_event_interruptible(sfp->read_wait, +- (atomic_read(&sdp->detaching) || +- (srp = sg_get_rq_mark(sfp, req_pack_id)))); +- if (atomic_read(&sdp->detaching)) +- return -ENODEV; +- if (retval) +- /* -ERESTARTSYS as signal hit process */ +- return retval; ++ ((srp = sg_get_rq_mark(sfp, req_pack_id, &busy)) || ++ (!busy && atomic_read(&sdp->detaching)))); ++ if (!srp) ++ /* signal or detaching */ ++ return retval ? retval : -ENODEV; + } + if (srp->header.interface_id != '\0') + return sg_new_read(sfp, buf, count, srp); +@@ -940,9 +937,7 @@ sg_ioctl_common(struct file *filp, Sg_de + if (result < 0) + return result; + result = wait_event_interruptible(sfp->read_wait, +- (srp_done(sfp, srp) || atomic_read(&sdp->detaching))); +- if (atomic_read(&sdp->detaching)) +- return -ENODEV; ++ srp_done(sfp, srp)); + write_lock_irq(&sfp->rq_list_lock); + if (srp->done) { + srp->done = 2; +@@ -2079,19 +2074,28 @@ sg_unlink_reserve(Sg_fd * sfp, Sg_reques + } + + static Sg_request * +-sg_get_rq_mark(Sg_fd * sfp, int pack_id) ++sg_get_rq_mark(Sg_fd * sfp, int pack_id, bool *busy) + { + Sg_request *resp; + unsigned long iflags; + ++ *busy = false; + write_lock_irqsave(&sfp->rq_list_lock, iflags); + list_for_each_entry(resp, &sfp->rq_list, entry) { +- /* look for requests that are ready + not SG_IO owned */ +- if ((1 == resp->done) && (!resp->sg_io_owned) && ++ /* look for requests that are not SG_IO owned */ ++ if ((!resp->sg_io_owned) && + ((-1 == pack_id) || (resp->header.pack_id == pack_id))) { +- resp->done = 2; /* guard against other readers */ +- write_unlock_irqrestore(&sfp->rq_list_lock, iflags); +- return resp; ++ switch (resp->done) { ++ case 0: /* request active */ ++ *busy = true; ++ break; ++ case 1: /* request done; response ready to return */ ++ resp->done = 2; /* guard against other readers */ ++ write_unlock_irqrestore(&sfp->rq_list_lock, iflags); ++ return resp; ++ case 2: /* response already being returned */ ++ break; ++ } + } + } + write_unlock_irqrestore(&sfp->rq_list_lock, iflags); +@@ -2145,6 +2149,15 @@ sg_remove_request(Sg_fd * sfp, Sg_reques + res = 1; + } + write_unlock_irqrestore(&sfp->rq_list_lock, iflags); ++ ++ /* ++ * If the device is detaching, wakeup any readers in case we just ++ * removed the last response, which would leave nothing for them to ++ * return other than -ENODEV. ++ */ ++ if (unlikely(atomic_read(&sfp->parentdp->detaching))) ++ wake_up_interruptible_all(&sfp->read_wait); ++ + return res; + } + diff --git a/queue-5.19/series b/queue-5.19/series index 30e28b9b64a..6a8826e7bca 100644 --- a/queue-5.19/series +++ b/queue-5.19/series @@ -94,3 +94,13 @@ drm-tegra-fix-vmapping-of-prime-buffers.patch drm-amdgpu-check-bo-s-requested-pinning-domains-against-its-preferred_domains.patch bpf-fix-kasan-use-after-free-read-in-compute_effective_progs.patch btrfs-reject-log-replay-if-there-is-unsupported-ro-compat-flag.patch +mtd-rawnand-arasan-fix-clock-rate-in-nv-ddr.patch +mtd-rawnand-arasan-update-nand-bus-clock-instead-of-system-clock.patch +um-remove-straying-parenthesis.patch +um-seed-rng-using-host-os-rng.patch +iio-fix-iio_format_avail_range-printing-for-none-iio_val_int.patch +iio-light-isl29028-fix-the-warning-in-isl29028_remove.patch +scsi-lpfc-remove-extra-atomic_inc-on-cmd_pending-in-queuecommand-after-vmid.patch +scsi-sg-allow-waiting-for-commands-to-complete-on-removed-device.patch +scsi-qla2xxx-fix-incorrect-display-of-max-frame-size.patch +scsi-qla2xxx-zero-undefined-mailbox-in-registers.patch diff --git a/queue-5.19/um-remove-straying-parenthesis.patch b/queue-5.19/um-remove-straying-parenthesis.patch new file mode 100644 index 00000000000..b337c779368 --- /dev/null +++ b/queue-5.19/um-remove-straying-parenthesis.patch @@ -0,0 +1,35 @@ +From c6496e0a4a90d8149203c16323cff3fa46e422e7 Mon Sep 17 00:00:00 2001 +From: Benjamin Beichler +Date: Tue, 31 May 2022 11:17:39 +0000 +Subject: um: Remove straying parenthesis + +From: Benjamin Beichler + +commit c6496e0a4a90d8149203c16323cff3fa46e422e7 upstream. + +Commit e3a33af812c6 ("um: fix and optimize xor select template for CONFIG64 and timetravel mode") +caused a build regression when CONFIG_XOR_BLOCKS and CONFIG_UML_TIME_TRAVEL_SUPPORT +are selected. +Fix it by removing the straying parenthesis. + +Cc: stable@vger.kernel.org +Fixes: e3a33af812c6 ("um: fix and optimize xor select template for CONFIG64 and timetravel mode") +Signed-off-by: Benjamin Beichler +[rw: Added commit message] +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman +--- + arch/um/include/asm/xor.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/um/include/asm/xor.h ++++ b/arch/um/include/asm/xor.h +@@ -18,7 +18,7 @@ + #undef XOR_SELECT_TEMPLATE + /* pick an arbitrary one - measuring isn't possible with inf-cpu */ + #define XOR_SELECT_TEMPLATE(x) \ +- (time_travel_mode == TT_MODE_INFCPU ? TT_CPU_INF_XOR_DEFAULT : x)) ++ (time_travel_mode == TT_MODE_INFCPU ? TT_CPU_INF_XOR_DEFAULT : x) + #endif + + #endif diff --git a/queue-5.19/um-seed-rng-using-host-os-rng.patch b/queue-5.19/um-seed-rng-using-host-os-rng.patch new file mode 100644 index 00000000000..7c520649352 --- /dev/null +++ b/queue-5.19/um-seed-rng-using-host-os-rng.patch @@ -0,0 +1,151 @@ +From 0b9ba6135d7f18b82f3d8bebb55ded725ba88e0e Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Wed, 13 Jul 2022 01:12:21 +0200 +Subject: um: seed rng using host OS rng + +From: Jason A. Donenfeld + +commit 0b9ba6135d7f18b82f3d8bebb55ded725ba88e0e upstream. + +UML generally does not provide access to special CPU instructions like +RDRAND, and execution tends to be rather deterministic, with no real +hardware interrupts, making good randomness really very hard, if not +all together impossible. Not only is this a security eyebrow raiser, but +it's also quite annoying when trying to do various pieces of UML-based +automation that takes a long time to boot, if ever. + +Fix this by trivially calling getrandom() in the host and using that +seed as "bootloader randomness", which initializes the rng immediately +at UML boot. + +The old behavior can be restored the same way as on any other arch, by +way of CONFIG_TRUST_BOOTLOADER_RANDOMNESS=n or +random.trust_bootloader=0. So seen from that perspective, this just +makes UML act like other archs, which is positive in its own right. + +Additionally, wire up arch_get_random_{int,long}() in the same way, so +that reseeds can also make use of the host RNG, controllable by +CONFIG_TRUST_CPU_RANDOMNESS and random.trust_cpu, per usual. + +Cc: stable@vger.kernel.org +Acked-by: Johannes Berg +Acked-By: Anton Ivanov +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + arch/um/include/asm/archrandom.h | 30 ++++++++++++++++++++++++++++++ + arch/um/include/shared/os.h | 7 +++++++ + arch/um/kernel/um_arch.c | 8 ++++++++ + arch/um/os-Linux/util.c | 6 ++++++ + 4 files changed, 51 insertions(+) + create mode 100644 arch/um/include/asm/archrandom.h + +--- /dev/null ++++ b/arch/um/include/asm/archrandom.h +@@ -0,0 +1,30 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef __ASM_UM_ARCHRANDOM_H__ ++#define __ASM_UM_ARCHRANDOM_H__ ++ ++#include ++ ++/* This is from , but better not to #include that in a global header here. */ ++ssize_t os_getrandom(void *buf, size_t len, unsigned int flags); ++ ++static inline bool __must_check arch_get_random_long(unsigned long *v) ++{ ++ return os_getrandom(v, sizeof(*v), 0) == sizeof(*v); ++} ++ ++static inline bool __must_check arch_get_random_int(unsigned int *v) ++{ ++ return os_getrandom(v, sizeof(*v), 0) == sizeof(*v); ++} ++ ++static inline bool __must_check arch_get_random_seed_long(unsigned long *v) ++{ ++ return false; ++} ++ ++static inline bool __must_check arch_get_random_seed_int(unsigned int *v) ++{ ++ return false; ++} ++ ++#endif +--- a/arch/um/include/shared/os.h ++++ b/arch/um/include/shared/os.h +@@ -11,6 +11,12 @@ + #include + #include + #include ++/* This is to get size_t */ ++#ifndef __UM_HOST__ ++#include ++#else ++#include ++#endif + + #define CATCH_EINTR(expr) while ((errno = 0, ((expr) < 0)) && (errno == EINTR)) + +@@ -243,6 +249,7 @@ extern void stack_protections(unsigned l + extern int raw(int fd); + extern void setup_machinename(char *machine_out); + extern void setup_hostinfo(char *buf, int len); ++extern ssize_t os_getrandom(void *buf, size_t len, unsigned int flags); + extern void os_dump_core(void) __attribute__ ((noreturn)); + extern void um_early_printk(const char *s, unsigned int n); + extern void os_fix_helper_signals(void); +--- a/arch/um/kernel/um_arch.c ++++ b/arch/um/kernel/um_arch.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -406,6 +407,8 @@ int __init __weak read_initrd(void) + + void __init setup_arch(char **cmdline_p) + { ++ u8 rng_seed[32]; ++ + stack_protections((unsigned long) &init_thread_info); + setup_physmem(uml_physmem, uml_reserved, physmem_size, highmem); + mem_total_pages(physmem_size, iomem_size, highmem); +@@ -416,6 +419,11 @@ void __init setup_arch(char **cmdline_p) + strlcpy(boot_command_line, command_line, COMMAND_LINE_SIZE); + *cmdline_p = command_line; + setup_hostinfo(host_info, sizeof host_info); ++ ++ if (os_getrandom(rng_seed, sizeof(rng_seed), 0) == sizeof(rng_seed)) { ++ add_bootloader_randomness(rng_seed, sizeof(rng_seed)); ++ memzero_explicit(rng_seed, sizeof(rng_seed)); ++ } + } + + void __init check_bugs(void) +--- a/arch/um/os-Linux/util.c ++++ b/arch/um/os-Linux/util.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -96,6 +97,11 @@ static inline void __attribute__ ((noret + exit(127); + } + ++ssize_t os_getrandom(void *buf, size_t len, unsigned int flags) ++{ ++ return getrandom(buf, len, flags); ++} ++ + /* + * UML helper threads must not handle SIGWINCH/INT/TERM + */