From: Sasha Levin Date: Sat, 14 Sep 2024 16:11:54 +0000 (-0400) Subject: Fixes for 6.10 X-Git-Tag: v6.1.111~13 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1f858feeed281b4b5856c1828cf0372809b4fd71;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.10 Signed-off-by: Sasha Levin --- diff --git a/queue-6.10/asoc-codecs-avoid-possible-garbage-value-in-peb2466_.patch b/queue-6.10/asoc-codecs-avoid-possible-garbage-value-in-peb2466_.patch new file mode 100644 index 00000000000..c0763952bb5 --- /dev/null +++ b/queue-6.10/asoc-codecs-avoid-possible-garbage-value-in-peb2466_.patch @@ -0,0 +1,44 @@ +From c9046afa563f37801deb278842e6c2f94960cd11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Sep 2024 19:54:50 +0800 +Subject: ASoC: codecs: avoid possible garbage value in peb2466_reg_read() + +From: Su Hui + +[ Upstream commit 38cc0334baabc5baf08a1db753de521e016c0432 ] + +Clang static checker (scan-build) warning: +sound/soc/codecs/peb2466.c:232:8: +Assigned value is garbage or undefined [core.uninitialized.Assign] + 232 | *val = tmp; + | ^ ~~~ + +When peb2466_read_byte() fails, 'tmp' will have a garbage value. +Add a judgemnet to avoid this problem. + +Fixes: 227f609c7c0e ("ASoC: codecs: Add support for the Infineon PEB2466 codec") +Signed-off-by: Su Hui +Link: https://patch.msgid.link/20240911115448.277828-1-suhui@nfschina.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/peb2466.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/peb2466.c b/sound/soc/codecs/peb2466.c +index 5dec69be0acb..06c83d2042f3 100644 +--- a/sound/soc/codecs/peb2466.c ++++ b/sound/soc/codecs/peb2466.c +@@ -229,7 +229,8 @@ static int peb2466_reg_read(void *context, unsigned int reg, unsigned int *val) + case PEB2466_CMD_XOP: + case PEB2466_CMD_SOP: + ret = peb2466_read_byte(peb2466, reg, &tmp); +- *val = tmp; ++ if (!ret) ++ *val = tmp; + break; + default: + dev_err(&peb2466->spi->dev, "Not a XOP or SOP command\n"); +-- +2.43.0 + diff --git a/queue-6.10/asoc-intel-soc-acpi-intel-lnl-match-add-missing-empt.patch b/queue-6.10/asoc-intel-soc-acpi-intel-lnl-match-add-missing-empt.patch new file mode 100644 index 00000000000..4ae736fdb07 --- /dev/null +++ b/queue-6.10/asoc-intel-soc-acpi-intel-lnl-match-add-missing-empt.patch @@ -0,0 +1,42 @@ +From 760389c9ba4ed2ac7e0e8f6f60c863a53a7c5634 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Sep 2024 06:02:23 +0000 +Subject: ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bard Liao + +[ Upstream commit c4246f1fe9f24f8dcd97887ed67d8fcfd91f4796 ] + +There is no links_num in struct snd_soc_acpi_mach {}, and we test +!link->num_adr as a condition to end the loop in hda_sdw_machine_select(). +So an empty item in struct snd_soc_acpi_link_adr array is required. + +Fixes: dd3bd9dc4708 ("ASoC: Intel: soc-acpi-intel-lnl-match: add cs42l43 only support") +Signed-off-by: Bard Liao +Reviewed-by: Ranjani Sridharan +Reviewed-by: Péter Ujfalusi +Link: https://patch.msgid.link/20240906060224.2241212-2-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/common/soc-acpi-intel-lnl-match.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/intel/common/soc-acpi-intel-lnl-match.c b/sound/soc/intel/common/soc-acpi-intel-lnl-match.c +index e6ffcd5be6c5..edfb668d0580 100644 +--- a/sound/soc/intel/common/soc-acpi-intel-lnl-match.c ++++ b/sound/soc/intel/common/soc-acpi-intel-lnl-match.c +@@ -208,6 +208,7 @@ static const struct snd_soc_acpi_link_adr lnl_cs42l43_l0[] = { + .num_adr = ARRAY_SIZE(cs42l43_0_adr), + .adr_d = cs42l43_0_adr, + }, ++ {} + }; + + static const struct snd_soc_acpi_link_adr lnl_rvp[] = { +-- +2.43.0 + diff --git a/queue-6.10/asoc-intel-soc-acpi-intel-mtl-match-add-missing-empt.patch b/queue-6.10/asoc-intel-soc-acpi-intel-mtl-match-add-missing-empt.patch new file mode 100644 index 00000000000..47df21b2d38 --- /dev/null +++ b/queue-6.10/asoc-intel-soc-acpi-intel-mtl-match-add-missing-empt.patch @@ -0,0 +1,42 @@ +From 08e5096499a42d7021f31e1f60db2739b7da5a46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Sep 2024 06:02:24 +0000 +Subject: ASoC: Intel: soc-acpi-intel-mtl-match: add missing empty item +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bard Liao + +[ Upstream commit bf6d7a44a144aa9c476dee83c23faf3151181bab ] + +There is no links_num in struct snd_soc_acpi_mach {}, and we test +!link->num_adr as a condition to end the loop in hda_sdw_machine_select(). +So an empty item in struct snd_soc_acpi_link_adr array is required. + +Fixes: f77ae7fcdc4763 ("ASoC: Intel: soc-acpi-intel-mtl-match: add cs42l43 only support") +Signed-off-by: Bard Liao +Reviewed-by: Ranjani Sridharan +Reviewed-by: Péter Ujfalusi +Link: https://patch.msgid.link/20240906060224.2241212-3-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/common/soc-acpi-intel-mtl-match.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/intel/common/soc-acpi-intel-mtl-match.c b/sound/soc/intel/common/soc-acpi-intel-mtl-match.c +index 8e0ae3635a35..d4435a34a3a3 100644 +--- a/sound/soc/intel/common/soc-acpi-intel-mtl-match.c ++++ b/sound/soc/intel/common/soc-acpi-intel-mtl-match.c +@@ -674,6 +674,7 @@ static const struct snd_soc_acpi_link_adr mtl_cs42l43_l0[] = { + .num_adr = ARRAY_SIZE(cs42l43_0_adr), + .adr_d = cs42l43_0_adr, + }, ++ {} + }; + + static const struct snd_soc_acpi_link_adr mtl_cs42l43_cs35l56[] = { +-- +2.43.0 + diff --git a/queue-6.10/cifs-fix-signature-miscalculation.patch b/queue-6.10/cifs-fix-signature-miscalculation.patch new file mode 100644 index 00000000000..9366566f970 --- /dev/null +++ b/queue-6.10/cifs-fix-signature-miscalculation.patch @@ -0,0 +1,43 @@ +From 6c28e7ec9800b109959654e8250c7cc303b169a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Sep 2024 16:58:48 +0100 +Subject: cifs: Fix signature miscalculation + +From: David Howells + +[ Upstream commit 5a20b7cb0d8d3ee490a8e088dc2584aa782e3355 ] + +Fix the calculation of packet signatures by adding the offset into a page +in the read or write data payload when hashing the pages from it. + +Fixes: 39bc58203f04 ("cifs: Add a function to Hash the contents of an iterator") +Signed-off-by: David Howells +Reviewed-by: Tom Talpey +Reviewed-by: Paulo Alcantara (Red Hat) +cc: Shyam Prasad N +cc: Rohith Surabattula +cc: Jeff Layton +cc: linux-cifs@vger.kernel.org +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsencrypt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/cifsencrypt.c b/fs/smb/client/cifsencrypt.c +index 6322f0f68a17..b0473c2567fe 100644 +--- a/fs/smb/client/cifsencrypt.c ++++ b/fs/smb/client/cifsencrypt.c +@@ -129,7 +129,7 @@ static ssize_t cifs_shash_xarray(const struct iov_iter *iter, ssize_t maxsize, + for (j = foffset / PAGE_SIZE; j < npages; j++) { + len = min_t(size_t, maxsize, PAGE_SIZE - offset); + p = kmap_local_page(folio_page(folio, j)); +- ret = crypto_shash_update(shash, p, len); ++ ret = crypto_shash_update(shash, p + offset, len); + kunmap_local(p); + if (ret < 0) + return ret; +-- +2.43.0 + diff --git a/queue-6.10/drm-i915-guc-prevent-a-possible-int-overflow-in-wq-o.patch b/queue-6.10/drm-i915-guc-prevent-a-possible-int-overflow-in-wq-o.patch new file mode 100644 index 00000000000..af97032c73a --- /dev/null +++ b/queue-6.10/drm-i915-guc-prevent-a-possible-int-overflow-in-wq-o.patch @@ -0,0 +1,53 @@ +From 4bcffe725c5b907246467c42adddba3b1c64fcc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jul 2024 08:59:25 -0700 +Subject: drm/i915/guc: prevent a possible int overflow in wq offsets + +From: Nikita Zhandarovich + +[ Upstream commit d3d37f74683e2f16f2635ee265884f7ca69350ae ] + +It may be possible for the sum of the values derived from +i915_ggtt_offset() and __get_parent_scratch_offset()/ +i915_ggtt_offset() to go over the u32 limit before being assigned +to wq offsets of u64 type. + +Mitigate these issues by expanding one of the right operands +to u64 to avoid any overflow issues just in case. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: c2aa552ff09d ("drm/i915/guc: Add multi-lrc context registration") +Cc: Matthew Brost +Cc: John Harrison +Signed-off-by: Nikita Zhandarovich +Link: https://patchwork.freedesktop.org/patch/msgid/20240725155925.14707-1-n.zhandarovich@fintech.ru +Reviewed-by: Rodrigo Vivi +Signed-off-by: Rodrigo Vivi +(cherry picked from commit 1f1c1bd56620b80ae407c5790743e17caad69cec) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +index 0eaa1064242c..f8e189a73a79 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +@@ -2842,9 +2842,9 @@ static void prepare_context_registration_info_v70(struct intel_context *ce, + ce->parallel.guc.wqi_tail = 0; + ce->parallel.guc.wqi_head = 0; + +- wq_desc_offset = i915_ggtt_offset(ce->state) + ++ wq_desc_offset = (u64)i915_ggtt_offset(ce->state) + + __get_parent_scratch_offset(ce); +- wq_base_offset = i915_ggtt_offset(ce->state) + ++ wq_base_offset = (u64)i915_ggtt_offset(ce->state) + + __get_wq_offset(ce); + info->wq_desc_lo = lower_32_bits(wq_desc_offset); + info->wq_desc_hi = upper_32_bits(wq_desc_offset); +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-display-fix-compat-is_display_step-range-end.patch b/queue-6.10/drm-xe-display-fix-compat-is_display_step-range-end.patch new file mode 100644 index 00000000000..80a3b9a3311 --- /dev/null +++ b/queue-6.10/drm-xe-display-fix-compat-is_display_step-range-end.patch @@ -0,0 +1,41 @@ +From e0d2dd3a656ab47911dd770dadfd67ac78d2bf53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Aug 2024 22:00:34 +0300 +Subject: drm/xe/display: fix compat IS_DISPLAY_STEP() range end + +From: Jani Nikula + +[ Upstream commit dd10595c3232d362f5a01e5d616434b2371ae8d4 ] + +It's supposed to be an open range at the end like in i915. Fingers +crossed that nobody relies on this definition. + +Fixes: 44e694958b95 ("drm/xe/display: Implement display support") +Reviewed-by: Lucas De Marchi +Reviewed-by: Matt Roper +Acked-by: Lucas De Marchi +Link: https://patchwork.freedesktop.org/patch/msgid/fe8743770694e429f6902491cdb306c97bdf701a.1724180287.git.jani.nikula@intel.com +Signed-off-by: Jani Nikula +(cherry picked from commit 453afb1a439994deeacb8d9ecbb48c1f2348ea0a) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/compat-i915-headers/i915_drv.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/compat-i915-headers/i915_drv.h b/drivers/gpu/drm/xe/compat-i915-headers/i915_drv.h +index cd4632276141..68ade1a05ca9 100644 +--- a/drivers/gpu/drm/xe/compat-i915-headers/i915_drv.h ++++ b/drivers/gpu/drm/xe/compat-i915-headers/i915_drv.h +@@ -96,7 +96,7 @@ static inline struct drm_i915_private *kdev_to_i915(struct device *kdev) + #define HAS_GMD_ID(xe) GRAPHICS_VERx100(xe) >= 1270 + + /* Workarounds not handled yet */ +-#define IS_DISPLAY_STEP(xe, first, last) ({u8 __step = (xe)->info.step.display; first <= __step && __step <= last; }) ++#define IS_DISPLAY_STEP(xe, first, last) ({u8 __step = (xe)->info.step.display; first <= __step && __step < last; }) + + #define IS_LP(xe) (0) + #define IS_GEN9_LP(xe) (0) +-- +2.43.0 + diff --git a/queue-6.10/series b/queue-6.10/series index 837e3a1c0dd..d210f1c5e6b 100644 --- a/queue-6.10/series +++ b/queue-6.10/series @@ -108,3 +108,11 @@ drm-amd-amdgpu-apply-command-submission-parser-for-jpeg-v2.patch drm-xe-client-fix-deadlock-in-show_meminfo.patch drm-xe-client-add-missing-bo-locking-in-show_meminfo.patch tracing-kprobes-fix-build-error-when-find_module-is-not-available.patch +asoc-intel-soc-acpi-intel-lnl-match-add-missing-empt.patch +asoc-intel-soc-acpi-intel-mtl-match-add-missing-empt.patch +spi-geni-qcom-undo-runtime-pm-changes-at-driver-exit.patch +spi-geni-qcom-fix-incorrect-free_irq-sequence.patch +drm-i915-guc-prevent-a-possible-int-overflow-in-wq-o.patch +asoc-codecs-avoid-possible-garbage-value-in-peb2466_.patch +drm-xe-display-fix-compat-is_display_step-range-end.patch +cifs-fix-signature-miscalculation.patch diff --git a/queue-6.10/spi-geni-qcom-fix-incorrect-free_irq-sequence.patch b/queue-6.10/spi-geni-qcom-fix-incorrect-free_irq-sequence.patch new file mode 100644 index 00000000000..8b3653134e4 --- /dev/null +++ b/queue-6.10/spi-geni-qcom-fix-incorrect-free_irq-sequence.patch @@ -0,0 +1,43 @@ +From 61290d00eab42d11bc5cfe40505ac0e0dff9f273 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Sep 2024 15:31:40 +0800 +Subject: spi: geni-qcom: Fix incorrect free_irq() sequence + +From: Jinjie Ruan + +[ Upstream commit b787a33864121a565aeb0e88561bf6062a19f99c ] + +In spi_geni_remove(), the free_irq() sequence is different from that +on the probe error path. And the IRQ will still remain and it's interrupt +handler may use the dma channel after release dma channel and before free +irq, which is not secure, fix it. + +Fixes: b59c122484ec ("spi: spi-geni-qcom: Add support for GPI dma") +Signed-off-by: Jinjie Ruan +Reviewed-by: Dmitry Baryshkov +Link: https://patch.msgid.link/20240909073141.951494-3-ruanjinjie@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index fef522fece1b..6f4057330444 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -1170,9 +1170,9 @@ static void spi_geni_remove(struct platform_device *pdev) + /* Unregister _before_ disabling pm_runtime() so we stop transfers */ + spi_unregister_controller(spi); + +- spi_geni_release_dma_chan(mas); +- + free_irq(mas->irq, spi); ++ ++ spi_geni_release_dma_chan(mas); + } + + static int __maybe_unused spi_geni_runtime_suspend(struct device *dev) +-- +2.43.0 + diff --git a/queue-6.10/spi-geni-qcom-undo-runtime-pm-changes-at-driver-exit.patch b/queue-6.10/spi-geni-qcom-undo-runtime-pm-changes-at-driver-exit.patch new file mode 100644 index 00000000000..2aeb2085229 --- /dev/null +++ b/queue-6.10/spi-geni-qcom-undo-runtime-pm-changes-at-driver-exit.patch @@ -0,0 +1,85 @@ +From 300b3124b1b2304b00643672f0d67e67e0fe16ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Sep 2024 15:31:39 +0800 +Subject: spi: geni-qcom: Undo runtime PM changes at driver exit time + +From: Jinjie Ruan + +[ Upstream commit 89e362c883c65ff94b76b9862285f63545fb5274 ] + +It's important to undo pm_runtime_use_autosuspend() with +pm_runtime_dont_use_autosuspend() at driver exit time unless driver +initially enabled pm_runtime with devm_pm_runtime_enable() +(which handles it for you). + +Hence, switch to devm_pm_runtime_enable() to fix it, so the +pm_runtime_disable() in probe error path and remove function +can be removed. + +Fixes: cfdab2cd85ec ("spi: spi-geni-qcom: Set an autosuspend delay of 250 ms") +Signed-off-by: Jinjie Ruan +Suggested-by: Dmitry Baryshkov +Reviewed-by: Dmitry Baryshkov +Link: https://patch.msgid.link/20240909073141.951494-2-ruanjinjie@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index 37ef8c40b276..fef522fece1b 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -1110,25 +1110,27 @@ static int spi_geni_probe(struct platform_device *pdev) + spin_lock_init(&mas->lock); + pm_runtime_use_autosuspend(&pdev->dev); + pm_runtime_set_autosuspend_delay(&pdev->dev, 250); +- pm_runtime_enable(dev); ++ ret = devm_pm_runtime_enable(dev); ++ if (ret) ++ return ret; + + if (device_property_read_bool(&pdev->dev, "spi-slave")) + spi->target = true; + + ret = geni_icc_get(&mas->se, NULL); + if (ret) +- goto spi_geni_probe_runtime_disable; ++ return ret; + /* Set the bus quota to a reasonable value for register access */ + mas->se.icc_paths[GENI_TO_CORE].avg_bw = Bps_to_icc(CORE_2X_50_MHZ); + mas->se.icc_paths[CPU_TO_GENI].avg_bw = GENI_DEFAULT_BW; + + ret = geni_icc_set_bw(&mas->se); + if (ret) +- goto spi_geni_probe_runtime_disable; ++ return ret; + + ret = spi_geni_init(mas); + if (ret) +- goto spi_geni_probe_runtime_disable; ++ return ret; + + /* + * check the mode supported and set_cs for fifo mode only +@@ -1157,8 +1159,6 @@ static int spi_geni_probe(struct platform_device *pdev) + free_irq(mas->irq, spi); + spi_geni_release_dma: + spi_geni_release_dma_chan(mas); +-spi_geni_probe_runtime_disable: +- pm_runtime_disable(dev); + return ret; + } + +@@ -1173,7 +1173,6 @@ static void spi_geni_remove(struct platform_device *pdev) + spi_geni_release_dma_chan(mas); + + free_irq(mas->irq, spi); +- pm_runtime_disable(&pdev->dev); + } + + static int __maybe_unused spi_geni_runtime_suspend(struct device *dev) +-- +2.43.0 +