From: Greg Kroah-Hartman Date: Thu, 11 Aug 2022 13:52:14 +0000 (+0200) Subject: 5.19-stable patches X-Git-Tag: v5.15.61~227 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=208a96886a097778f2f2bdb9cce9cdbae18b758f;p=thirdparty%2Fkernel%2Fstable-queue.git 5.19-stable patches added patches: asoc-amd-yc-update-dmi-table-entries.patch hwmon-nct6775-fix-platform-driver-suspend-regression.patch wifi-mac80211_hwsim-add-back-erroneously-removed-cast.patch wifi-mac80211_hwsim-fix-race-condition-in-pending-packet.patch wifi-mac80211_hwsim-use-32-bit-skb-cookie.patch --- diff --git a/queue-5.19/asoc-amd-yc-update-dmi-table-entries.patch b/queue-5.19/asoc-amd-yc-update-dmi-table-entries.patch new file mode 100644 index 00000000000..84792a40094 --- /dev/null +++ b/queue-5.19/asoc-amd-yc-update-dmi-table-entries.patch @@ -0,0 +1,80 @@ +From be0aa8d4b0fcb4532bf7973141e911998ab39508 Mon Sep 17 00:00:00 2001 +From: syed sabakareem +Date: Fri, 22 Jul 2022 19:15:32 +0530 +Subject: ASoC: amd: yc: Update DMI table entries + +From: syed sabakareem + +commit be0aa8d4b0fcb4532bf7973141e911998ab39508 upstream. + +Removed intel DMI product id's 21AW/21AX/21D8/21D9/21BN/21BQ +in DMI table and updated DMI entry for AMD platform X13 Gen 3 +platform 21CM/21CN. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216267 + +Signed-off-by: syed sabakareem +Reviewed-by: Mario Limonciello +Reported-by: David Korth +Fixes: fa991481b8b2 ("ASoC: amd: add YC machine driver using dmic") +Link: https://lore.kernel.org/r/20220722134603.316668-1-Syed.SabaKareem@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/amd/yc/acp6x-mach.c | 32 ++------------------------------ + 1 file changed, 2 insertions(+), 30 deletions(-) + +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -105,28 +105,14 @@ static const struct dmi_system_id yc_acp + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), +- DMI_MATCH(DMI_PRODUCT_NAME, "21AW"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21CM"), + } + }, + { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), +- DMI_MATCH(DMI_PRODUCT_NAME, "21AX"), +- } +- }, +- { +- .driver_data = &acp6x_card, +- .matches = { +- DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), +- DMI_MATCH(DMI_PRODUCT_NAME, "21BN"), +- } +- }, +- { +- .driver_data = &acp6x_card, +- .matches = { +- DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), +- DMI_MATCH(DMI_PRODUCT_NAME, "21BQ"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21CN"), + } + }, + { +@@ -157,20 +143,6 @@ static const struct dmi_system_id yc_acp + DMI_MATCH(DMI_PRODUCT_NAME, "21CL"), + } + }, +- { +- .driver_data = &acp6x_card, +- .matches = { +- DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), +- DMI_MATCH(DMI_PRODUCT_NAME, "21D8"), +- } +- }, +- { +- .driver_data = &acp6x_card, +- .matches = { +- DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), +- DMI_MATCH(DMI_PRODUCT_NAME, "21D9"), +- } +- }, + {} + }; + diff --git a/queue-5.19/hwmon-nct6775-fix-platform-driver-suspend-regression.patch b/queue-5.19/hwmon-nct6775-fix-platform-driver-suspend-regression.patch new file mode 100644 index 00000000000..be7ea8f91cb --- /dev/null +++ b/queue-5.19/hwmon-nct6775-fix-platform-driver-suspend-regression.patch @@ -0,0 +1,91 @@ +From f4e6960f4f16b1ca5da16cec7612ecc86402ac05 Mon Sep 17 00:00:00 2001 +From: Zev Weiss +Date: Tue, 9 Aug 2022 22:26:46 -0700 +Subject: hwmon: (nct6775) Fix platform driver suspend regression +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zev Weiss + +commit f4e6960f4f16b1ca5da16cec7612ecc86402ac05 upstream. + +Commit c3963bc0a0cf ("hwmon: (nct6775) Split core and platform +driver") introduced a slight change in nct6775_suspend() in order to +avoid an otherwise-needless symbol export for nct6775_update_device(), +replacing a call to that function with a simple dev_get_drvdata() +instead. + +As it turns out, there is no guarantee that nct6775_update_device() +is ever called prior to suspend. If this happens, the resume function +ends up writing bad data into the various chip registers, which results +in a crash shortly after resume. + +To fix the problem, just add the symbol export and return to using +nct6775_update_device() as was employed previously. + +Reported-by: Zoltán Kővágó +Tested-by: Zoltán Kővágó +Fixes: c3963bc0a0cf ("hwmon: (nct6775) Split core and platform driver") +Cc: stable@kernel.org +Signed-off-by: Zev Weiss +Link: https://lore.kernel.org/r/20220810052646.13825-1-zev@bewilderbeest.net +[groeck: Updated description] +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/nct6775-core.c | 3 ++- + drivers/hwmon/nct6775-platform.c | 2 +- + drivers/hwmon/nct6775.h | 2 ++ + 3 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c +index 446964cbae4c..da9ec6983e13 100644 +--- a/drivers/hwmon/nct6775-core.c ++++ b/drivers/hwmon/nct6775-core.c +@@ -1480,7 +1480,7 @@ static int nct6775_update_pwm_limits(struct device *dev) + return 0; + } + +-static struct nct6775_data *nct6775_update_device(struct device *dev) ++struct nct6775_data *nct6775_update_device(struct device *dev) + { + struct nct6775_data *data = dev_get_drvdata(dev); + int i, j, err = 0; +@@ -1615,6 +1615,7 @@ static struct nct6775_data *nct6775_update_device(struct device *dev) + mutex_unlock(&data->update_lock); + return err ? ERR_PTR(err) : data; + } ++EXPORT_SYMBOL_GPL(nct6775_update_device); + + /* + * Sysfs callback functions +diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c +index ab30437221ce..41c97cfacfb8 100644 +--- a/drivers/hwmon/nct6775-platform.c ++++ b/drivers/hwmon/nct6775-platform.c +@@ -359,7 +359,7 @@ static int __maybe_unused nct6775_suspend(struct device *dev) + { + int err; + u16 tmp; +- struct nct6775_data *data = dev_get_drvdata(dev); ++ struct nct6775_data *data = nct6775_update_device(dev); + + if (IS_ERR(data)) + return PTR_ERR(data); +diff --git a/drivers/hwmon/nct6775.h b/drivers/hwmon/nct6775.h +index 93f708148e65..be41848c3cd2 100644 +--- a/drivers/hwmon/nct6775.h ++++ b/drivers/hwmon/nct6775.h +@@ -196,6 +196,8 @@ static inline int nct6775_write_value(struct nct6775_data *data, u16 reg, u16 va + return regmap_write(data->regmap, reg, value); + } + ++struct nct6775_data *nct6775_update_device(struct device *dev); ++ + bool nct6775_reg_is_word_sized(struct nct6775_data *data, u16 reg); + int nct6775_probe(struct device *dev, struct nct6775_data *data, + const struct regmap_config *regmapcfg); +-- +2.37.1 + diff --git a/queue-5.19/series b/queue-5.19/series index a6e15311b3e..4622c240fca 100644 --- a/queue-5.19/series +++ b/queue-5.19/series @@ -9,3 +9,8 @@ alsa-bcd2000-fix-a-uaf-bug-on-the-error-path-of-probing.patch alsa-hda-realtek-add-quirk-for-clevo-nv45pz.patch alsa-hda-realtek-add-quirk-for-hp-spectre-x360-15-eb0xxx.patch alsa-hda-realtek-add-quirk-for-lenovo-yoga9-14iap7.patch +asoc-amd-yc-update-dmi-table-entries.patch +hwmon-nct6775-fix-platform-driver-suspend-regression.patch +wifi-mac80211_hwsim-fix-race-condition-in-pending-packet.patch +wifi-mac80211_hwsim-add-back-erroneously-removed-cast.patch +wifi-mac80211_hwsim-use-32-bit-skb-cookie.patch diff --git a/queue-5.19/wifi-mac80211_hwsim-add-back-erroneously-removed-cast.patch b/queue-5.19/wifi-mac80211_hwsim-add-back-erroneously-removed-cast.patch new file mode 100644 index 00000000000..046753001c5 --- /dev/null +++ b/queue-5.19/wifi-mac80211_hwsim-add-back-erroneously-removed-cast.patch @@ -0,0 +1,33 @@ +From 58b6259d820d63c2adf1c7541b54cce5a2ae6073 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 11 Jul 2022 13:14:24 +0200 +Subject: wifi: mac80211_hwsim: add back erroneously removed cast + +From: Johannes Berg + +commit 58b6259d820d63c2adf1c7541b54cce5a2ae6073 upstream. + +The robots report that we're now casting to a differently +sized integer, which is correct, and the previous patch +had erroneously removed it. + +Reported-by: kernel test robot +Fixes: 4ee186fa7e40 ("wifi: mac80211_hwsim: fix race condition in pending packet") +Signed-off-by: Johannes Berg +Cc: Jeongik Cha +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mac80211_hwsim.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -4112,7 +4112,7 @@ static int hwsim_tx_info_frame_received_ + u64 skb_cookie; + + txi = IEEE80211_SKB_CB(skb); +- skb_cookie = (u64)txi->rate_driver_data[0]; ++ skb_cookie = (u64)(uintptr_t)txi->rate_driver_data[0]; + + if (skb_cookie == ret_skb_cookie) { + __skb_unlink(skb, &data2->pending); diff --git a/queue-5.19/wifi-mac80211_hwsim-fix-race-condition-in-pending-packet.patch b/queue-5.19/wifi-mac80211_hwsim-fix-race-condition-in-pending-packet.patch new file mode 100644 index 00000000000..4d8e26e92be --- /dev/null +++ b/queue-5.19/wifi-mac80211_hwsim-fix-race-condition-in-pending-packet.patch @@ -0,0 +1,88 @@ +From 4ee186fa7e40ae06ebbfbad77e249e3746e14114 Mon Sep 17 00:00:00 2001 +From: Jeongik Cha +Date: Mon, 4 Jul 2022 17:43:54 +0900 +Subject: wifi: mac80211_hwsim: fix race condition in pending packet + +From: Jeongik Cha + +commit 4ee186fa7e40ae06ebbfbad77e249e3746e14114 upstream. + +A pending packet uses a cookie as an unique key, but it can be duplicated +because it didn't use atomic operators. + +And also, a pending packet can be null in hwsim_tx_info_frame_received_nl +due to race condition with mac80211_hwsim_stop. + +For this, + * Use an atomic type and operator for a cookie + * Add a lock around the loop for pending packets + +Signed-off-by: Jeongik Cha +Link: https://lore.kernel.org/r/20220704084354.3556326-1-jeongik@google.com +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mac80211_hwsim.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -680,7 +680,7 @@ struct mac80211_hwsim_data { + bool ps_poll_pending; + struct dentry *debugfs; + +- uintptr_t pending_cookie; ++ atomic64_t pending_cookie; + struct sk_buff_head pending; /* packets pending */ + /* + * Only radios in the same group can communicate together (the +@@ -1347,7 +1347,7 @@ static void mac80211_hwsim_tx_frame_nl(s + int i; + struct hwsim_tx_rate tx_attempts[IEEE80211_TX_MAX_RATES]; + struct hwsim_tx_rate_flag tx_attempts_flags[IEEE80211_TX_MAX_RATES]; +- uintptr_t cookie; ++ u64 cookie; + + if (data->ps != PS_DISABLED) + hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM); +@@ -1416,8 +1416,7 @@ static void mac80211_hwsim_tx_frame_nl(s + goto nla_put_failure; + + /* We create a cookie to identify this skb */ +- data->pending_cookie++; +- cookie = data->pending_cookie; ++ cookie = (u64)atomic64_inc_return(&data->pending_cookie); + info->rate_driver_data[0] = (void *)cookie; + if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD)) + goto nla_put_failure; +@@ -4080,6 +4079,7 @@ static int hwsim_tx_info_frame_received_ + const u8 *src; + unsigned int hwsim_flags; + int i; ++ unsigned long flags; + bool found = false; + + if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] || +@@ -4107,18 +4107,20 @@ static int hwsim_tx_info_frame_received_ + } + + /* look for the skb matching the cookie passed back from user */ ++ spin_lock_irqsave(&data2->pending.lock, flags); + skb_queue_walk_safe(&data2->pending, skb, tmp) { + u64 skb_cookie; + + txi = IEEE80211_SKB_CB(skb); +- skb_cookie = (u64)(uintptr_t)txi->rate_driver_data[0]; ++ skb_cookie = (u64)txi->rate_driver_data[0]; + + if (skb_cookie == ret_skb_cookie) { +- skb_unlink(skb, &data2->pending); ++ __skb_unlink(skb, &data2->pending); + found = true; + break; + } + } ++ spin_unlock_irqrestore(&data2->pending.lock, flags); + + /* not found */ + if (!found) diff --git a/queue-5.19/wifi-mac80211_hwsim-use-32-bit-skb-cookie.patch b/queue-5.19/wifi-mac80211_hwsim-use-32-bit-skb-cookie.patch new file mode 100644 index 00000000000..128e43d6b2c --- /dev/null +++ b/queue-5.19/wifi-mac80211_hwsim-use-32-bit-skb-cookie.patch @@ -0,0 +1,65 @@ +From cc5250cdb43d444061412df7fae72d2b4acbdf97 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 13 Jul 2022 21:16:45 +0200 +Subject: wifi: mac80211_hwsim: use 32-bit skb cookie + +From: Johannes Berg + +commit cc5250cdb43d444061412df7fae72d2b4acbdf97 upstream. + +We won't really have enough skbs to need a 64-bit cookie, +and on 32-bit platforms storing the 64-bit cookie into the +void *rate_driver_data doesn't work anyway. Switch back to +using just a 32-bit cookie and uintptr_t for the type to +avoid compiler warnings about all this. + +Fixes: 4ee186fa7e40 ("wifi: mac80211_hwsim: fix race condition in pending packet") +Signed-off-by: Johannes Berg +Cc: Jeongik Cha +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mac80211_hwsim.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -680,7 +680,7 @@ struct mac80211_hwsim_data { + bool ps_poll_pending; + struct dentry *debugfs; + +- atomic64_t pending_cookie; ++ atomic_t pending_cookie; + struct sk_buff_head pending; /* packets pending */ + /* + * Only radios in the same group can communicate together (the +@@ -1347,7 +1347,7 @@ static void mac80211_hwsim_tx_frame_nl(s + int i; + struct hwsim_tx_rate tx_attempts[IEEE80211_TX_MAX_RATES]; + struct hwsim_tx_rate_flag tx_attempts_flags[IEEE80211_TX_MAX_RATES]; +- u64 cookie; ++ uintptr_t cookie; + + if (data->ps != PS_DISABLED) + hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM); +@@ -1416,7 +1416,7 @@ static void mac80211_hwsim_tx_frame_nl(s + goto nla_put_failure; + + /* We create a cookie to identify this skb */ +- cookie = (u64)atomic64_inc_return(&data->pending_cookie); ++ cookie = atomic_inc_return(&data->pending_cookie); + info->rate_driver_data[0] = (void *)cookie; + if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD)) + goto nla_put_failure; +@@ -4109,10 +4109,10 @@ static int hwsim_tx_info_frame_received_ + /* look for the skb matching the cookie passed back from user */ + spin_lock_irqsave(&data2->pending.lock, flags); + skb_queue_walk_safe(&data2->pending, skb, tmp) { +- u64 skb_cookie; ++ uintptr_t skb_cookie; + + txi = IEEE80211_SKB_CB(skb); +- skb_cookie = (u64)(uintptr_t)txi->rate_driver_data[0]; ++ skb_cookie = (uintptr_t)txi->rate_driver_data[0]; + + if (skb_cookie == ret_skb_cookie) { + __skb_unlink(skb, &data2->pending);