From: Greg Kroah-Hartman Date: Sat, 31 Aug 2024 06:23:01 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v4.19.321~38 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2947e350093e70536e98d4c27fc44cb07b0a8deb;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: dmaengine-dw-edma-do-not-enable-watermark-interrupts-for-hdma.patch dmaengine-dw-edma-fix-unmasking-stop-and-abort-interrupts-for-hdma.patch iommufd-do-not-allow-creating-areas-without-read-or-write.patch phy-fsl-imx8mq-usb-fix-tuning-parameter-name.patch selinux-smack-don-t-bypass-permissions-check-in-inode_setsecctx-hook.patch soundwire-stream-fix-programming-slave-ports-for-non-continous-port-maps.patch --- diff --git a/queue-6.6/dmaengine-dw-edma-do-not-enable-watermark-interrupts-for-hdma.patch b/queue-6.6/dmaengine-dw-edma-do-not-enable-watermark-interrupts-for-hdma.patch new file mode 100644 index 00000000000..4e84bece1a1 --- /dev/null +++ b/queue-6.6/dmaengine-dw-edma-do-not-enable-watermark-interrupts-for-hdma.patch @@ -0,0 +1,80 @@ +From 9f646ff25c09c52cebe726601db27a60f876f15e Mon Sep 17 00:00:00 2001 +From: Mrinmay Sarkar +Date: Mon, 26 Aug 2024 17:41:01 +0530 +Subject: dmaengine: dw-edma: Do not enable watermark interrupts for HDMA + +From: Mrinmay Sarkar + +commit 9f646ff25c09c52cebe726601db27a60f876f15e upstream. + +DW_HDMA_V0_LIE and DW_HDMA_V0_RIE are initialized as BIT(3) and BIT(4) +respectively in dw_hdma_control enum. But as per HDMA register these +bits are corresponds to LWIE and RWIE bit i.e local watermark interrupt +enable and remote watermarek interrupt enable. In linked list mode LWIE +and RWIE bits only enable the local and remote watermark interrupt. + +Since the watermark interrupts are not used but enabled, this leads to +spurious interrupts getting generated. So remove the code that enables +them to avoid generating spurious watermark interrupts. + +And also rename DW_HDMA_V0_LIE to DW_HDMA_V0_LWIE and DW_HDMA_V0_RIE to +DW_HDMA_V0_RWIE as there is no LIE and RIE bits in HDMA and those bits +are corresponds to LWIE and RWIE bits. + +Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA") +cc: stable@vger.kernel.org +Signed-off-by: Mrinmay Sarkar +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Serge Semin +Link: https://lore.kernel.org/r/1724674261-3144-3-git-send-email-quic_msarkar@quicinc.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/dw-edma/dw-hdma-v0-core.c | 17 +++-------------- + 1 file changed, 3 insertions(+), 14 deletions(-) + +diff --git a/drivers/dma/dw-edma/dw-hdma-v0-core.c b/drivers/dma/dw-edma/dw-hdma-v0-core.c +index 2addaca3b694..e3f8db4fe909 100644 +--- a/drivers/dma/dw-edma/dw-hdma-v0-core.c ++++ b/drivers/dma/dw-edma/dw-hdma-v0-core.c +@@ -17,8 +17,8 @@ enum dw_hdma_control { + DW_HDMA_V0_CB = BIT(0), + DW_HDMA_V0_TCB = BIT(1), + DW_HDMA_V0_LLP = BIT(2), +- DW_HDMA_V0_LIE = BIT(3), +- DW_HDMA_V0_RIE = BIT(4), ++ DW_HDMA_V0_LWIE = BIT(3), ++ DW_HDMA_V0_RWIE = BIT(4), + DW_HDMA_V0_CCS = BIT(8), + DW_HDMA_V0_LLE = BIT(9), + }; +@@ -195,25 +195,14 @@ static void dw_hdma_v0_write_ll_link(struct dw_edma_chunk *chunk, + static void dw_hdma_v0_core_write_chunk(struct dw_edma_chunk *chunk) + { + struct dw_edma_burst *child; +- struct dw_edma_chan *chan = chunk->chan; + u32 control = 0, i = 0; +- int j; + + if (chunk->cb) + control = DW_HDMA_V0_CB; + +- j = chunk->bursts_alloc; +- list_for_each_entry(child, &chunk->burst->list, list) { +- j--; +- if (!j) { +- control |= DW_HDMA_V0_LIE; +- if (!(chan->dw->chip->flags & DW_EDMA_CHIP_LOCAL)) +- control |= DW_HDMA_V0_RIE; +- } +- ++ list_for_each_entry(child, &chunk->burst->list, list) + dw_hdma_v0_write_ll_data(chunk, i++, control, child->sz, + child->sar, child->dar); +- } + + control = DW_HDMA_V0_LLP | DW_HDMA_V0_TCB; + if (!chunk->cb) +-- +2.46.0 + diff --git a/queue-6.6/dmaengine-dw-edma-fix-unmasking-stop-and-abort-interrupts-for-hdma.patch b/queue-6.6/dmaengine-dw-edma-fix-unmasking-stop-and-abort-interrupts-for-hdma.patch new file mode 100644 index 00000000000..0e6b3d8763e --- /dev/null +++ b/queue-6.6/dmaengine-dw-edma-fix-unmasking-stop-and-abort-interrupts-for-hdma.patch @@ -0,0 +1,50 @@ +From 383baf5c8f062091af34c63f28d37642a8f188ae Mon Sep 17 00:00:00 2001 +From: Mrinmay Sarkar +Date: Mon, 26 Aug 2024 17:41:00 +0530 +Subject: dmaengine: dw-edma: Fix unmasking STOP and ABORT interrupts for HDMA + +From: Mrinmay Sarkar + +commit 383baf5c8f062091af34c63f28d37642a8f188ae upstream. + +The current logic is enabling both STOP_INT_MASK and ABORT_INT_MASK +bit. This is apparently masking those particular interrupts rather than +unmasking the same. If the interrupts are masked, they would never get +triggered. + +So fix the issue by unmasking the STOP and ABORT interrupts properly. + +Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA") +cc: stable@vger.kernel.org +Signed-off-by: Mrinmay Sarkar +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/1724674261-3144-2-git-send-email-quic_msarkar@quicinc.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/dw-edma/dw-hdma-v0-core.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/dma/dw-edma/dw-hdma-v0-core.c b/drivers/dma/dw-edma/dw-hdma-v0-core.c +index 10e8f0715114..2addaca3b694 100644 +--- a/drivers/dma/dw-edma/dw-hdma-v0-core.c ++++ b/drivers/dma/dw-edma/dw-hdma-v0-core.c +@@ -247,10 +247,11 @@ static void dw_hdma_v0_core_start(struct dw_edma_chunk *chunk, bool first) + if (first) { + /* Enable engine */ + SET_CH_32(dw, chan->dir, chan->id, ch_en, BIT(0)); +- /* Interrupt enable&unmask - done, abort */ +- tmp = GET_CH_32(dw, chan->dir, chan->id, int_setup) | +- HDMA_V0_STOP_INT_MASK | HDMA_V0_ABORT_INT_MASK | +- HDMA_V0_LOCAL_STOP_INT_EN | HDMA_V0_LOCAL_ABORT_INT_EN; ++ /* Interrupt unmask - stop, abort */ ++ tmp = GET_CH_32(dw, chan->dir, chan->id, int_setup); ++ tmp &= ~(HDMA_V0_STOP_INT_MASK | HDMA_V0_ABORT_INT_MASK); ++ /* Interrupt enable - stop, abort */ ++ tmp |= HDMA_V0_LOCAL_STOP_INT_EN | HDMA_V0_LOCAL_ABORT_INT_EN; + if (!(dw->chip->flags & DW_EDMA_CHIP_LOCAL)) + tmp |= HDMA_V0_REMOTE_STOP_INT_EN | HDMA_V0_REMOTE_ABORT_INT_EN; + SET_CH_32(dw, chan->dir, chan->id, int_setup, tmp); +-- +2.46.0 + diff --git a/queue-6.6/iommufd-do-not-allow-creating-areas-without-read-or-write.patch b/queue-6.6/iommufd-do-not-allow-creating-areas-without-read-or-write.patch new file mode 100644 index 00000000000..ac7f7d3df91 --- /dev/null +++ b/queue-6.6/iommufd-do-not-allow-creating-areas-without-read-or-write.patch @@ -0,0 +1,95 @@ +From 996dc53ac289b81957aa70d62ccadc6986d26a87 Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Thu, 22 Aug 2024 11:45:54 -0300 +Subject: iommufd: Do not allow creating areas without READ or WRITE + +From: Jason Gunthorpe + +commit 996dc53ac289b81957aa70d62ccadc6986d26a87 upstream. + +This results in passing 0 or just IOMMU_CACHE to iommu_map(). Most of +the page table formats don't like this: + + amdv1 - -EINVAL + armv7s - returns 0, doesn't update mapped + arm-lpae - returns 0 doesn't update mapped + dart - returns 0, doesn't update mapped + VT-D - returns -EINVAL + +Unfortunately the three formats that return 0 cause serious problems: + + - Returning ret = but not uppdating mapped from domain->map_pages() + causes an infinite loop in __iommu_map() + + - Not writing ioptes means that VFIO/iommufd have no way to recover them + and we will have memory leaks and worse during unmap + +Since almost nothing can support this, and it is a useless thing to do, +block it early in iommufd. + +Cc: stable@kernel.org +Fixes: aad37e71d5c4 ("iommufd: IOCTLs for the io_pagetable") +Signed-off-by: Jason Gunthorpe +Reviewed-by: Nicolin Chen +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/1-v1-1211e1294c27+4b1-iommu_no_prot_jgg@nvidia.com +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iommu/iommufd/ioas.c | 8 ++++++++ + tools/testing/selftests/iommu/iommufd.c | 6 +++--- + 2 files changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/iommu/iommufd/ioas.c ++++ b/drivers/iommu/iommufd/ioas.c +@@ -213,6 +213,10 @@ int iommufd_ioas_map(struct iommufd_ucmd + if (cmd->iova >= ULONG_MAX || cmd->length >= ULONG_MAX) + return -EOVERFLOW; + ++ if (!(cmd->flags & ++ (IOMMU_IOAS_MAP_WRITEABLE | IOMMU_IOAS_MAP_READABLE))) ++ return -EINVAL; ++ + ioas = iommufd_get_ioas(ucmd->ictx, cmd->ioas_id); + if (IS_ERR(ioas)) + return PTR_ERR(ioas); +@@ -253,6 +257,10 @@ int iommufd_ioas_copy(struct iommufd_ucm + cmd->dst_iova >= ULONG_MAX) + return -EOVERFLOW; + ++ if (!(cmd->flags & ++ (IOMMU_IOAS_MAP_WRITEABLE | IOMMU_IOAS_MAP_READABLE))) ++ return -EINVAL; ++ + src_ioas = iommufd_get_ioas(ucmd->ictx, cmd->src_ioas_id); + if (IS_ERR(src_ioas)) + return PTR_ERR(src_ioas); +--- a/tools/testing/selftests/iommu/iommufd.c ++++ b/tools/testing/selftests/iommu/iommufd.c +@@ -531,7 +531,7 @@ TEST_F(iommufd_ioas, copy_area) + { + struct iommu_ioas_copy copy_cmd = { + .size = sizeof(copy_cmd), +- .flags = IOMMU_IOAS_MAP_FIXED_IOVA, ++ .flags = IOMMU_IOAS_MAP_FIXED_IOVA | IOMMU_IOAS_MAP_WRITEABLE, + .dst_ioas_id = self->ioas_id, + .src_ioas_id = self->ioas_id, + .length = PAGE_SIZE, +@@ -1024,7 +1024,7 @@ TEST_F(iommufd_ioas, copy_sweep) + { + struct iommu_ioas_copy copy_cmd = { + .size = sizeof(copy_cmd), +- .flags = IOMMU_IOAS_MAP_FIXED_IOVA, ++ .flags = IOMMU_IOAS_MAP_FIXED_IOVA | IOMMU_IOAS_MAP_WRITEABLE, + .src_ioas_id = self->ioas_id, + .dst_iova = MOCK_APERTURE_START, + .length = MOCK_PAGE_SIZE, +@@ -1314,7 +1314,7 @@ TEST_F(iommufd_mock_domain, user_copy) + }; + struct iommu_ioas_copy copy_cmd = { + .size = sizeof(copy_cmd), +- .flags = IOMMU_IOAS_MAP_FIXED_IOVA, ++ .flags = IOMMU_IOAS_MAP_FIXED_IOVA | IOMMU_IOAS_MAP_WRITEABLE, + .dst_ioas_id = self->ioas_id, + .dst_iova = MOCK_APERTURE_START, + .length = BUFFER_SIZE, diff --git a/queue-6.6/phy-fsl-imx8mq-usb-fix-tuning-parameter-name.patch b/queue-6.6/phy-fsl-imx8mq-usb-fix-tuning-parameter-name.patch new file mode 100644 index 00000000000..2b8633ee60a --- /dev/null +++ b/queue-6.6/phy-fsl-imx8mq-usb-fix-tuning-parameter-name.patch @@ -0,0 +1,39 @@ +From ce52c2532299c7ccfd34a52db8d071e890a78c59 Mon Sep 17 00:00:00 2001 +From: Xu Yang +Date: Thu, 1 Aug 2024 20:46:42 +0800 +Subject: phy: fsl-imx8mq-usb: fix tuning parameter name + +From: Xu Yang + +commit ce52c2532299c7ccfd34a52db8d071e890a78c59 upstream. + +According to fsl,imx8mq-usb-phy.yaml, this tuning parameter should be +fsl,phy-pcs-tx-deemph-3p5db-attenuation-db. + +Fixes: 63c85ad0cd81 ("phy: fsl-imx8mp-usb: add support for phy tuning") +Cc: stable@vger.kernel.org +Signed-off-by: Xu Yang +Reviewed-by: Alexander Stein +Link: https://lore.kernel.org/r/20240801124642.1152838-1-xu.yang_2@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +index 0b9a59d5b8f0..adc6394626ce 100644 +--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c ++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c +@@ -176,7 +176,7 @@ static void imx8m_get_phy_tuning_data(struct imx8mq_usb_phy *imx_phy) + imx_phy->comp_dis_tune = + phy_comp_dis_tune_from_property(imx_phy->comp_dis_tune); + +- if (device_property_read_u32(dev, "fsl,pcs-tx-deemph-3p5db-attenuation-db", ++ if (device_property_read_u32(dev, "fsl,phy-pcs-tx-deemph-3p5db-attenuation-db", + &imx_phy->pcs_tx_deemph_3p5db)) + imx_phy->pcs_tx_deemph_3p5db = PHY_TUNE_DEFAULT; + else +-- +2.46.0 + diff --git a/queue-6.6/selinux-smack-don-t-bypass-permissions-check-in-inode_setsecctx-hook.patch b/queue-6.6/selinux-smack-don-t-bypass-permissions-check-in-inode_setsecctx-hook.patch new file mode 100644 index 00000000000..facba1781c6 --- /dev/null +++ b/queue-6.6/selinux-smack-don-t-bypass-permissions-check-in-inode_setsecctx-hook.patch @@ -0,0 +1,72 @@ +From 76a0e79bc84f466999fa501fce5bf7a07641b8a7 Mon Sep 17 00:00:00 2001 +From: Scott Mayhew +Date: Wed, 28 Aug 2024 15:51:29 -0400 +Subject: selinux,smack: don't bypass permissions check in inode_setsecctx hook + +From: Scott Mayhew + +commit 76a0e79bc84f466999fa501fce5bf7a07641b8a7 upstream. + +Marek Gresko reports that the root user on an NFS client is able to +change the security labels on files on an NFS filesystem that is +exported with root squashing enabled. + +The end of the kerneldoc comment for __vfs_setxattr_noperm() states: + + * This function requires the caller to lock the inode's i_mutex before it + * is executed. It also assumes that the caller will make the appropriate + * permission checks. + +nfsd_setattr() does do permissions checking via fh_verify() and +nfsd_permission(), but those don't do all the same permissions checks +that are done by security_inode_setxattr() and its related LSM hooks do. + +Since nfsd_setattr() is the only consumer of security_inode_setsecctx(), +simplest solution appears to be to replace the call to +__vfs_setxattr_noperm() with a call to __vfs_setxattr_locked(). This +fixes the above issue and has the added benefit of causing nfsd to +recall conflicting delegations on a file when a client tries to change +its security label. + +Cc: stable@kernel.org +Reported-by: Marek Gresko +Link: https://bugzilla.kernel.org/show_bug.cgi?id=218809 +Signed-off-by: Scott Mayhew +Tested-by: Stephen Smalley +Reviewed-by: Stephen Smalley +Reviewed-by: Chuck Lever +Reviewed-by: Jeff Layton +Acked-by: Casey Schaufler +Signed-off-by: Paul Moore +Signed-off-by: Greg Kroah-Hartman +--- + security/selinux/hooks.c | 4 ++-- + security/smack/smack_lsm.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -6553,8 +6553,8 @@ static int selinux_inode_notifysecctx(st + */ + static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) + { +- return __vfs_setxattr_noperm(&nop_mnt_idmap, dentry, XATTR_NAME_SELINUX, +- ctx, ctxlen, 0); ++ return __vfs_setxattr_locked(&nop_mnt_idmap, dentry, XATTR_NAME_SELINUX, ++ ctx, ctxlen, 0, NULL); + } + + static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -4772,8 +4772,8 @@ static int smack_inode_notifysecctx(stru + + static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) + { +- return __vfs_setxattr_noperm(&nop_mnt_idmap, dentry, XATTR_NAME_SMACK, +- ctx, ctxlen, 0); ++ return __vfs_setxattr_locked(&nop_mnt_idmap, dentry, XATTR_NAME_SMACK, ++ ctx, ctxlen, 0, NULL); + } + + static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) diff --git a/queue-6.6/series b/queue-6.6/series index c42b9422a6a..aaf9ca967db 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -39,3 +39,9 @@ ovl-ovl_parse_param_lowerdir-add-missed-n-for-pr_err.patch mm-fix-missing-folio-invalidation-calls-during-trunc.patch cifs-fix-falloc_fl_punch_hole-support.patch revert-change-alloc_pages-name-in-dma_map_ops-to-avoid-name-conflicts.patch +selinux-smack-don-t-bypass-permissions-check-in-inode_setsecctx-hook.patch +iommufd-do-not-allow-creating-areas-without-read-or-write.patch +phy-fsl-imx8mq-usb-fix-tuning-parameter-name.patch +soundwire-stream-fix-programming-slave-ports-for-non-continous-port-maps.patch +dmaengine-dw-edma-fix-unmasking-stop-and-abort-interrupts-for-hdma.patch +dmaengine-dw-edma-do-not-enable-watermark-interrupts-for-hdma.patch diff --git a/queue-6.6/soundwire-stream-fix-programming-slave-ports-for-non-continous-port-maps.patch b/queue-6.6/soundwire-stream-fix-programming-slave-ports-for-non-continous-port-maps.patch new file mode 100644 index 00000000000..d2001412df0 --- /dev/null +++ b/queue-6.6/soundwire-stream-fix-programming-slave-ports-for-non-continous-port-maps.patch @@ -0,0 +1,58 @@ +From ab8d66d132bc8f1992d3eb6cab8d32dda6733c84 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Mon, 29 Jul 2024 16:01:57 +0200 +Subject: soundwire: stream: fix programming slave ports for non-continous port maps + +From: Krzysztof Kozlowski + +commit ab8d66d132bc8f1992d3eb6cab8d32dda6733c84 upstream. + +Two bitmasks in 'struct sdw_slave_prop' - 'source_ports' and +'sink_ports' - define which ports to program in +sdw_program_slave_port_params(). The masks are used to get the +appropriate data port properties ('struct sdw_get_slave_dpn_prop') from +an array. + +Bitmasks can be non-continuous or can start from index different than 0, +thus when looking for matching port property for given port, we must +iterate over mask bits, not from 0 up to number of ports. + +This fixes allocation and programming slave ports, when a source or sink +masks start from further index. + +Fixes: f8101c74aa54 ("soundwire: Add Master and Slave port programming") +Cc: stable@vger.kernel.org +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20240729140157.326450-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soundwire/stream.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/soundwire/stream.c ++++ b/drivers/soundwire/stream.c +@@ -1286,18 +1286,18 @@ struct sdw_dpn_prop *sdw_get_slave_dpn_p + unsigned int port_num) + { + struct sdw_dpn_prop *dpn_prop; +- u8 num_ports; ++ unsigned long mask; + int i; + + if (direction == SDW_DATA_DIR_TX) { +- num_ports = hweight32(slave->prop.source_ports); ++ mask = slave->prop.source_ports; + dpn_prop = slave->prop.src_dpn_prop; + } else { +- num_ports = hweight32(slave->prop.sink_ports); ++ mask = slave->prop.sink_ports; + dpn_prop = slave->prop.sink_dpn_prop; + } + +- for (i = 0; i < num_ports; i++) { ++ for_each_set_bit(i, &mask, 32) { + if (dpn_prop[i].num == port_num) + return &dpn_prop[i]; + }