From: Greg Kroah-Hartman Date: Fri, 8 Dec 2023 06:46:23 +0000 (+0100) Subject: drop a bunch of duplicate commits in the 5.10 queue X-Git-Tag: v4.14.332~1 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=45fe2deb59b99ab37fdbb8134e6bbc35eaf0fa90;p=thirdparty%2Fkernel%2Fstable-queue.git drop a bunch of duplicate commits in the 5.10 queue --- diff --git a/queue-5.10/drm-amdgpu-fix-a-null-pointer-access-when-the-smc_rr.patch b/queue-5.10/drm-amdgpu-fix-a-null-pointer-access-when-the-smc_rr.patch deleted file mode 100644 index 868b2b9d3df..00000000000 --- a/queue-5.10/drm-amdgpu-fix-a-null-pointer-access-when-the-smc_rr.patch +++ /dev/null @@ -1,105 +0,0 @@ -From 54478c2e4a510eb6dbc12c0449c47a8a777dcceb Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 23 Oct 2023 12:56:37 +0000 -Subject: drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is - NULL - -From: Qu Huang - -[ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ] - -In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer access when the smc_rreg pointer is NULL. Below are the steps to reproduce this issue and the corresponding exception log: - -1. Navigate to the directory: /sys/kernel/debug/dri/0 -2. Execute command: cat amdgpu_regs_smc -3. Exception Log:: -[4005007.702554] BUG: kernel NULL pointer dereference, address: 0000000000000000 -[4005007.702562] #PF: supervisor instruction fetch in kernel mode -[4005007.702567] #PF: error_code(0x0010) - not-present page -[4005007.702570] PGD 0 P4D 0 -[4005007.702576] Oops: 0010 [#1] SMP NOPTI -[4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G OE 5.15.0-43-generic #46-Ubunt u -[4005007.702590] RIP: 0010:0x0 -[4005007.702598] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. -[4005007.702600] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206 -[4005007.702605] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68 -[4005007.702609] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000 -[4005007.702612] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980 -[4005007.702615] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000 -[4005007.702618] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000 -[4005007.702622] FS: 00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000 -[4005007.702626] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -[4005007.702629] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0 -[4005007.702633] Call Trace: -[4005007.702636] -[4005007.702640] amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu] -[4005007.703002] full_proxy_read+0x5c/0x80 -[4005007.703011] vfs_read+0x9f/0x1a0 -[4005007.703019] ksys_read+0x67/0xe0 -[4005007.703023] __x64_sys_read+0x19/0x20 -[4005007.703028] do_syscall_64+0x5c/0xc0 -[4005007.703034] ? do_user_addr_fault+0x1e3/0x670 -[4005007.703040] ? exit_to_user_mode_prepare+0x37/0xb0 -[4005007.703047] ? irqentry_exit_to_user_mode+0x9/0x20 -[4005007.703052] ? irqentry_exit+0x19/0x30 -[4005007.703057] ? exc_page_fault+0x89/0x160 -[4005007.703062] ? asm_exc_page_fault+0x8/0x30 -[4005007.703068] entry_SYSCALL_64_after_hwframe+0x44/0xae -[4005007.703075] RIP: 0033:0x7f5e07672992 -[4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e c 28 48 89 54 24 -[4005007.703083] RSP: 002b:00007ffe03097898 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 -[4005007.703088] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5e07672992 -[4005007.703091] RDX: 0000000000020000 RSI: 00007f5e06753000 RDI: 0000000000000003 -[4005007.703094] RBP: 00007f5e06753000 R08: 00007f5e06752010 R09: 00007f5e06752010 -[4005007.703096] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000022000 -[4005007.703099] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 -[4005007.703105] -[4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash af_alg binfmt_misc nls_ iso8859_1 ipmi_ssif ast intel_rapl_msr intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t tm edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl sch_fq_codel ipmi_devintf ipm i_msghandler msr parport_pc ppdev lp parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo mon ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) amdttm(OE) iommu_v 2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec rc_core drm igb ahci xhci_pci libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca -[4005007.703184] CR2: 0000000000000000 -[4005007.703188] ---[ end trace ac65a538d240da39 ]--- -[4005007.800865] RIP: 0010:0x0 -[4005007.800871] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. -[4005007.800874] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206 -[4005007.800878] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68 -[4005007.800881] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000 -[4005007.800883] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980 -[4005007.800886] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000 -[4005007.800888] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000 -[4005007.800891] FS: 00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000 -[4005007.800895] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -[4005007.800898] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0 - -Signed-off-by: Qu Huang -Signed-off-by: Alex Deucher -Signed-off-by: Sasha Levin ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c -index 48df32dd352ed..d7d3cf4da9e05 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c -@@ -456,6 +456,9 @@ static ssize_t amdgpu_debugfs_regs_didt_read(struct file *f, char __user *buf, - ssize_t result = 0; - int r; - -+ if (!adev->smc_wreg) -+ return -EPERM; -+ - if (size & 0x3 || *pos & 0x3) - return -EINVAL; - -@@ -515,6 +518,9 @@ static ssize_t amdgpu_debugfs_regs_didt_write(struct file *f, const char __user - ssize_t result = 0; - int r; - -+ if (!adev->smc_rreg) -+ return -EPERM; -+ - if (size & 0x3 || *pos & 0x3) - return -EINVAL; - --- -2.42.0 - diff --git a/queue-5.10/i2c-sun6i-p2wi-prevent-potential-division-by-zero.patch b/queue-5.10/i2c-sun6i-p2wi-prevent-potential-division-by-zero.patch deleted file mode 100644 index 9fb2cec5907..00000000000 --- a/queue-5.10/i2c-sun6i-p2wi-prevent-potential-division-by-zero.patch +++ /dev/null @@ -1,39 +0,0 @@ -From dab54a8c0116b011bf722a739768e1bfdb430298 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 13 Apr 2016 08:54:30 +0800 -Subject: i2c: sun6i-p2wi: Prevent potential division by zero - -From: Axel Lin - -[ Upstream commit 5ac61d26b8baff5b2e5a9f3dc1ef63297e4b53e7 ] - -Make sure we don't OOPS in case clock-frequency is set to 0 in a DT. The -variable set here is later used as a divisor. - -Signed-off-by: Axel Lin -Acked-by: Boris Brezillon -Signed-off-by: Wolfram Sang -Signed-off-by: Sasha Levin ---- - drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/drivers/i2c/busses/i2c-sun6i-p2wi.c b/drivers/i2c/busses/i2c-sun6i-p2wi.c -index 4f7a4f5a1150a..389ca6fddc1db 100644 ---- a/drivers/i2c/busses/i2c-sun6i-p2wi.c -+++ b/drivers/i2c/busses/i2c-sun6i-p2wi.c -@@ -206,6 +206,11 @@ static int p2wi_probe(struct platform_device *pdev) - return -EINVAL; - } - -+ if (clk_freq == 0) { -+ dev_err(dev, "clock-frequency is set to 0 in DT\n"); -+ return -EINVAL; -+ } -+ - if (of_get_child_count(np) > 1) { - dev_err(dev, "P2WI only supports one slave device\n"); - return -EINVAL; --- -2.42.0 - diff --git a/queue-5.10/media-imon-fix-access-to-invalid-resource-for-the-se.patch b/queue-5.10/media-imon-fix-access-to-invalid-resource-for-the-se.patch deleted file mode 100644 index 09676da90d0..00000000000 --- a/queue-5.10/media-imon-fix-access-to-invalid-resource-for-the-se.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 0f37496a7f43d64678c633935964e014fcd677da Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 22 Sep 2023 14:38:07 +0200 -Subject: media: imon: fix access to invalid resource for the second interface - -From: Takashi Iwai - -[ Upstream commit a1766a4fd83befa0b34d932d532e7ebb7fab1fa7 ] - -imon driver probes two USB interfaces, and at the probe of the second -interface, the driver assumes blindly that the first interface got -bound with the same imon driver. It's usually true, but it's still -possible that the first interface is bound with another driver via a -malformed descriptor. Then it may lead to a memory corruption, as -spotted by syzkaller; imon driver accesses the data from drvdata as -struct imon_context object although it's a completely different one -that was assigned by another driver. - -This patch adds a sanity check -- whether the first interface is -really bound with the imon driver or not -- for avoiding the problem -above at the probe time. - -Reported-by: syzbot+59875ffef5cb9c9b29e9@syzkaller.appspotmail.com -Closes: https://lore.kernel.org/all/000000000000a838aa0603cc74d6@google.com/ -Tested-by: Ricardo B. Marliere -Link: https://lore.kernel.org/r/20230922005152.163640-1-ricardo@marliere.net -Signed-off-by: Takashi Iwai -Signed-off-by: Sean Young -Signed-off-by: Hans Verkuil -Signed-off-by: Sasha Levin ---- - drivers/media/rc/imon.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c -index 253a1d1a840a0..c6d9a6de8e4ed 100644 ---- a/drivers/media/rc/imon.c -+++ b/drivers/media/rc/imon.c -@@ -2436,6 +2436,12 @@ static int imon_probe(struct usb_interface *interface, - goto fail; - } - -+ if (first_if->dev.driver != interface->dev.driver) { -+ dev_err(&interface->dev, "inconsistent driver matching\n"); -+ ret = -EINVAL; -+ goto fail; -+ } -+ - if (ifnum == 0) { - ictx = imon_init_intf0(interface, id); - if (!ictx) { --- -2.42.0 - diff --git a/queue-5.10/net-r8169-disable-multicast-filter-for-rtl8168h-and-.patch b/queue-5.10/net-r8169-disable-multicast-filter-for-rtl8168h-and-.patch deleted file mode 100644 index a189ff66a84..00000000000 --- a/queue-5.10/net-r8169-disable-multicast-filter-for-rtl8168h-and-.patch +++ /dev/null @@ -1,43 +0,0 @@ -From c171a3f38a2b79ee7150594aabcbfd6e31919851 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 30 Oct 2023 16:50:14 -0400 -Subject: net: r8169: Disable multicast filter for RTL8168H and RTL8107E - -From: Patrick Thompson - -[ Upstream commit efa5f1311c4998e9e6317c52bc5ee93b3a0f36df ] - -RTL8168H and RTL8107E ethernet adapters erroneously filter unicast -eapol packets unless allmulti is enabled. These devices correspond to -RTL_GIGA_MAC_VER_46 and VER_48. Add an exception for VER_46 and VER_48 -in the same way that VER_35 has an exception. - -Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E") -Signed-off-by: Patrick Thompson -Reviewed-by: Jacob Keller -Reviewed-by: Heiner Kallweit -Link: https://lore.kernel.org/r/20231030205031.177855-1-ptf@google.com -Signed-off-by: Paolo Abeni -Signed-off-by: Sasha Levin ---- - drivers/net/ethernet/realtek/r8169_main.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c -index ab6af1f1ad5bb..6e0fe77d1019c 100644 ---- a/drivers/net/ethernet/realtek/r8169_main.c -+++ b/drivers/net/ethernet/realtek/r8169_main.c -@@ -2581,7 +2581,9 @@ static void rtl_set_rx_mode(struct net_device *dev) - rx_mode &= ~AcceptMulticast; - } else if (netdev_mc_count(dev) > MC_FILTER_LIMIT || - dev->flags & IFF_ALLMULTI || -- tp->mac_version == RTL_GIGA_MAC_VER_35) { -+ tp->mac_version == RTL_GIGA_MAC_VER_35 || -+ tp->mac_version == RTL_GIGA_MAC_VER_46 || -+ tp->mac_version == RTL_GIGA_MAC_VER_48) { - /* accept all multicasts */ - } else if (netdev_mc_empty(dev)) { - rx_mode &= ~AcceptMulticast; --- -2.42.0 - diff --git a/queue-5.10/revert-net-r8169-disable-multicast-filter-for-rtl816.patch b/queue-5.10/revert-net-r8169-disable-multicast-filter-for-rtl816.patch deleted file mode 100644 index 191443b66e1..00000000000 --- a/queue-5.10/revert-net-r8169-disable-multicast-filter-for-rtl816.patch +++ /dev/null @@ -1,52 +0,0 @@ -From b289a8a0fd5948ef3c1fc965876ec1bff952d270 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 21 Nov 2023 09:09:33 +0100 -Subject: Revert "net: r8169: Disable multicast filter for RTL8168H and - RTL8107E" - -From: Heiner Kallweit - -commit 6a26310273c323380da21eb23fcfd50e31140913 upstream. - -This reverts commit efa5f1311c4998e9e6317c52bc5ee93b3a0f36df. - -I couldn't reproduce the reported issue. What I did, based on a pcap -packet log provided by the reporter: -- Used same chip version (RTL8168h) -- Set MAC address to the one used on the reporters system -- Replayed the EAPOL unicast packet that, according to the reporter, - was filtered out by the mc filter. -The packet was properly received. - -Therefore the root cause of the reported issue seems to be somewhere -else. Disabling mc filtering completely for the most common chip -version is a quite big hammer. Therefore revert the change and wait -for further analysis results from the reporter. - -Cc: stable@vger.kernel.org -Signed-off-by: Heiner Kallweit -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Sasha Levin ---- - drivers/net/ethernet/realtek/r8169_main.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - -diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c -index 6e0fe77d1019c..ab6af1f1ad5bb 100644 ---- a/drivers/net/ethernet/realtek/r8169_main.c -+++ b/drivers/net/ethernet/realtek/r8169_main.c -@@ -2581,9 +2581,7 @@ static void rtl_set_rx_mode(struct net_device *dev) - rx_mode &= ~AcceptMulticast; - } else if (netdev_mc_count(dev) > MC_FILTER_LIMIT || - dev->flags & IFF_ALLMULTI || -- tp->mac_version == RTL_GIGA_MAC_VER_35 || -- tp->mac_version == RTL_GIGA_MAC_VER_46 || -- tp->mac_version == RTL_GIGA_MAC_VER_48) { -+ tp->mac_version == RTL_GIGA_MAC_VER_35) { - /* accept all multicasts */ - } else if (netdev_mc_empty(dev)) { - rx_mode &= ~AcceptMulticast; --- -2.42.0 - diff --git a/queue-5.10/series b/queue-5.10/series index 597df594917..e37acd71ccb 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -1,10 +1,5 @@ rdma-irdma-prevent-zero-length-stag-registration.patch pci-keystone-drop-__init-from-ks_pcie_add_pcie_-ep-port.patch -net-r8169-disable-multicast-filter-for-rtl8168h-and-.patch -drm-amdgpu-fix-a-null-pointer-access-when-the-smc_rr.patch -i2c-sun6i-p2wi-prevent-potential-division-by-zero.patch -media-imon-fix-access-to-invalid-resource-for-the-se.patch -revert-net-r8169-disable-multicast-filter-for-rtl816.patch afs-fix-afs_server_list-to-be-cleaned-up-with-rcu.patch afs-make-error-on-cell-lookup-failure-consistent-wit.patch drm-panel-boe-tv101wum-nl6-fine-tune-the-panel-power.patch