From: Greg Kroah-Hartman Date: Thu, 30 Jul 2026 13:54:31 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v6.6.148~21 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=47cbd1b19a98770a6017cb4ff025efc57359528d;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: asoc-mediatek-mt8195-add-platform-entry-for-etdm1_out_be-dai-link.patch asoc-mediatek-mt8195-set-etdm1-2-in-out-to-comp_dummy.patch rxrpc-disable-irq-not-bh-to-take-the-lock-for-attend_link.patch udmabuf-ensure-to-perform-cache-synchronisation-in-begin_cpu_udmabuf.patch --- diff --git a/queue-6.6/asoc-mediatek-mt8195-add-platform-entry-for-etdm1_out_be-dai-link.patch b/queue-6.6/asoc-mediatek-mt8195-add-platform-entry-for-etdm1_out_be-dai-link.patch new file mode 100644 index 0000000000..c1b08b7a6d --- /dev/null +++ b/queue-6.6/asoc-mediatek-mt8195-add-platform-entry-for-etdm1_out_be-dai-link.patch @@ -0,0 +1,51 @@ +From 282a4482e198e03781c152c88aac8aa382ef9a55 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Mon, 24 Jun 2024 14:12:56 +0800 +Subject: ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link + +From: Chen-Yu Tsai + +commit 282a4482e198e03781c152c88aac8aa382ef9a55 upstream. + +Commit e70b8dd26711 ("ASoC: mediatek: mt8195: Remove afe-dai component +and rework codec link") removed the codec entry for the ETDM1_OUT_BE +dai link entirely instead of replacing it with COMP_EMPTY(). This worked +by accident as the remaining COMP_EMPTY() platform entry became the codec +entry, and the platform entry became completely empty, effectively the +same as COMP_DUMMY() since snd_soc_fill_dummy_dai() doesn't do anything +for platform entries. + +This causes a KASAN out-of-bounds warning in mtk_soundcard_common_probe() +in sound/soc/mediatek/common/mtk-soundcard-driver.c: + + for_each_card_prelinks(card, i, dai_link) { + if (adsp_node && !strncmp(dai_link->name, "AFE_SOF", strlen("AFE_SOF"))) + dai_link->platforms->of_node = adsp_node; + else if (!dai_link->platforms->name && !dai_link->platforms->of_node) + dai_link->platforms->of_node = platform_node; + } + +where the code expects the platforms array to have space for at least one entry. + +Add an COMP_EMPTY() entry so that dai_link->platforms has space. + +Fixes: e70b8dd26711 ("ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patch.msgid.link/20240624061257.3115467-1-wenst@chromium.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/mediatek/mt8195/mt8195-mt6359.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/soc/mediatek/mt8195/mt8195-mt6359.c ++++ b/sound/soc/mediatek/mt8195/mt8195-mt6359.c +@@ -939,6 +939,7 @@ SND_SOC_DAILINK_DEFS(ETDM2_IN_BE, + + SND_SOC_DAILINK_DEFS(ETDM1_OUT_BE, + DAILINK_COMP_ARRAY(COMP_CPU("ETDM1_OUT")), ++ DAILINK_COMP_ARRAY(COMP_EMPTY()), + DAILINK_COMP_ARRAY(COMP_EMPTY())); + + SND_SOC_DAILINK_DEFS(ETDM2_OUT_BE, diff --git a/queue-6.6/asoc-mediatek-mt8195-set-etdm1-2-in-out-to-comp_dummy.patch b/queue-6.6/asoc-mediatek-mt8195-set-etdm1-2-in-out-to-comp_dummy.patch new file mode 100644 index 0000000000..a9825b433a --- /dev/null +++ b/queue-6.6/asoc-mediatek-mt8195-set-etdm1-2-in-out-to-comp_dummy.patch @@ -0,0 +1,93 @@ +From 7af317f7faaab09d5a78f24605057d11f5955115 Mon Sep 17 00:00:00 2001 +From: Julien Massot +Date: Thu, 17 Apr 2025 10:44:33 +0200 +Subject: ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() + +From: Julien Massot + +commit 7af317f7faaab09d5a78f24605057d11f5955115 upstream. + +ETDM2_IN_BE and ETDM1_OUT_BE are defined as COMP_EMPTY(), +in the case the codec dai_name will be null. + +Avoid a crash if the device tree is not assigning a codec +to these links. + +[ 1.179936] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 +[ 1.181065] Mem abort info: +[ 1.181420] ESR = 0x0000000096000004 +[ 1.181892] EC = 0x25: DABT (current EL), IL = 32 bits +[ 1.182576] SET = 0, FnV = 0 +[ 1.182964] EA = 0, S1PTW = 0 +[ 1.183367] FSC = 0x04: level 0 translation fault +[ 1.183983] Data abort info: +[ 1.184406] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 +[ 1.185097] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 +[ 1.185766] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +[ 1.186439] [0000000000000000] user address but active_mm is swapper +[ 1.187239] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP +[ 1.188029] Modules linked in: +[ 1.188420] CPU: 7 UID: 0 PID: 70 Comm: kworker/u32:1 Not tainted 6.14.0-rc4-next-20250226+ #85 +[ 1.189515] Hardware name: Radxa NIO 12L (DT) +[ 1.190065] Workqueue: events_unbound deferred_probe_work_func +[ 1.190808] pstate: 40400009 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 1.191683] pc : __pi_strcmp+0x24/0x140 +[ 1.192170] lr : mt8195_mt6359_soc_card_probe+0x224/0x7b0 +[ 1.192854] sp : ffff800083473970 +[ 1.193271] x29: ffff800083473a10 x28: 0000000000001008 x27: 0000000000000002 +[ 1.194168] x26: ffff800082408960 x25: ffff800082417db0 x24: ffff800082417d88 +[ 1.195065] x23: 000000000000001e x22: ffff800082dbf480 x21: ffff800082dc07b8 +[ 1.195961] x20: 0000000000000000 x19: 0000000000000013 x18: 00000000ffffffff +[ 1.196858] x17: 000000040044ffff x16: 005000f2b5503510 x15: 0000000000000006 +[ 1.197755] x14: ffff800082407af0 x13: 6e6f69737265766e x12: 692d6b636f6c6374 +[ 1.198651] x11: 0000000000000002 x10: ffff80008240b920 x9 : 0000000000000018 +[ 1.199547] x8 : 0101010101010101 x7 : 0000000000000000 x6 : 0000000000000000 +[ 1.200443] x5 : 0000000000000000 x4 : 8080808080000000 x3 : 303933383978616d +[ 1.201339] x2 : 0000000000000000 x1 : ffff80008240b920 x0 : 0000000000000000 +[ 1.202236] Call trace: +[ 1.202545] __pi_strcmp+0x24/0x140 (P) +[ 1.203029] mtk_soundcard_common_probe+0x3bc/0x5b8 +[ 1.203644] platform_probe+0x70/0xe8 +[ 1.204106] really_probe+0xc8/0x3a0 +[ 1.204556] __driver_probe_device+0x84/0x160 +[ 1.205104] driver_probe_device+0x44/0x130 +[ 1.205630] __device_attach_driver+0xc4/0x170 +[ 1.206189] bus_for_each_drv+0x8c/0xf8 +[ 1.206672] __device_attach+0xa8/0x1c8 +[ 1.207155] device_initial_probe+0x1c/0x30 +[ 1.207681] bus_probe_device+0xb0/0xc0 +[ 1.208165] deferred_probe_work_func+0xa4/0x100 +[ 1.208747] process_one_work+0x158/0x3e0 +[ 1.209254] worker_thread+0x2c4/0x3e8 +[ 1.209727] kthread+0x134/0x1f0 +[ 1.210136] ret_from_fork+0x10/0x20 +[ 1.210589] Code: 54000401 b50002c6 d503201f f86a6803 (f8408402) +[ 1.211355] ---[ end trace 0000000000000000 ]--- + +Signed-off-by: Julien Massot +Fixes: e70b8dd26711 ("ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link") +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patch.msgid.link/20250417-mt8395-audio-sof-v1-2-30587426e5dd@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/mediatek/mt8195/mt8195-mt6359.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/mediatek/mt8195/mt8195-mt6359.c ++++ b/sound/soc/mediatek/mt8195/mt8195-mt6359.c +@@ -934,12 +934,12 @@ SND_SOC_DAILINK_DEFS(ETDM1_IN_BE, + + SND_SOC_DAILINK_DEFS(ETDM2_IN_BE, + DAILINK_COMP_ARRAY(COMP_CPU("ETDM2_IN")), +- DAILINK_COMP_ARRAY(COMP_EMPTY()), ++ DAILINK_COMP_ARRAY(COMP_DUMMY()), + DAILINK_COMP_ARRAY(COMP_EMPTY())); + + SND_SOC_DAILINK_DEFS(ETDM1_OUT_BE, + DAILINK_COMP_ARRAY(COMP_CPU("ETDM1_OUT")), +- DAILINK_COMP_ARRAY(COMP_EMPTY()), ++ DAILINK_COMP_ARRAY(COMP_DUMMY()), + DAILINK_COMP_ARRAY(COMP_EMPTY())); + + SND_SOC_DAILINK_DEFS(ETDM2_OUT_BE, diff --git a/queue-6.6/rxrpc-disable-irq-not-bh-to-take-the-lock-for-attend_link.patch b/queue-6.6/rxrpc-disable-irq-not-bh-to-take-the-lock-for-attend_link.patch new file mode 100644 index 0000000000..72ceb1b1a0 --- /dev/null +++ b/queue-6.6/rxrpc-disable-irq-not-bh-to-take-the-lock-for-attend_link.patch @@ -0,0 +1,50 @@ +From d920270a6dbf756384b125ce39c17666a7c0c9f4 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Thu, 12 Dec 2024 20:58:15 +0000 +Subject: rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link + +From: David Howells + +commit d920270a6dbf756384b125ce39c17666a7c0c9f4 upstream. + +Use spin_lock_irq(), not spin_lock_bh() to take the lock when accessing the +->attend_link() to stop a delay in the I/O thread due to an interrupt being +taken in the app thread whilst that holds the lock and vice versa. + +Fixes: a2ea9a907260 ("rxrpc: Use irq-disabling spinlocks between app and I/O thread") +Signed-off-by: David Howells +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Link: https://patch.msgid.link/2870146.1734037095@warthog.procyon.org.uk +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/io_thread.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/net/rxrpc/io_thread.c ++++ b/net/rxrpc/io_thread.c +@@ -423,9 +423,9 @@ int rxrpc_io_thread(void *data) + struct rxrpc_connection, + attend_link); + if (conn) { +- spin_lock_bh(&local->lock); ++ spin_lock_irq(&local->lock); + list_del_init(&conn->attend_link); +- spin_unlock_bh(&local->lock); ++ spin_unlock_irq(&local->lock); + + rxrpc_input_conn_event(conn, NULL); + rxrpc_put_connection(conn, rxrpc_conn_put_poke); +@@ -440,9 +440,9 @@ int rxrpc_io_thread(void *data) + if ((call = list_first_entry_or_null(&local->call_attend_q, + struct rxrpc_call, + attend_link))) { +- spin_lock_bh(&local->lock); ++ spin_lock_irq(&local->lock); + list_del_init(&call->attend_link); +- spin_unlock_bh(&local->lock); ++ spin_unlock_irq(&local->lock); + + trace_rxrpc_call_poked(call); + rxrpc_input_call_event(call, NULL); diff --git a/queue-6.6/series b/queue-6.6/series index d25e058ada..36c7b0a5fb 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -477,3 +477,7 @@ kvm-x86-only-reset-tsc-deadline-timer-in-apic_timer_expired-on-kvm_run.patch coredump-fix-pidfs-file-refcount-leak-in-umh_coredump_setup.patch mm-damon-core-validate-ranges-in-damon_set_regions.patch mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch +asoc-mediatek-mt8195-add-platform-entry-for-etdm1_out_be-dai-link.patch +asoc-mediatek-mt8195-set-etdm1-2-in-out-to-comp_dummy.patch +udmabuf-ensure-to-perform-cache-synchronisation-in-begin_cpu_udmabuf.patch +rxrpc-disable-irq-not-bh-to-take-the-lock-for-attend_link.patch diff --git a/queue-6.6/udmabuf-ensure-to-perform-cache-synchronisation-in-begin_cpu_udmabuf.patch b/queue-6.6/udmabuf-ensure-to-perform-cache-synchronisation-in-begin_cpu_udmabuf.patch new file mode 100644 index 0000000000..75243fdc3d --- /dev/null +++ b/queue-6.6/udmabuf-ensure-to-perform-cache-synchronisation-in-begin_cpu_udmabuf.patch @@ -0,0 +1,62 @@ +From 1d0e25c1ddf2063c499264fb2ba0fa6a3e4f8a00 Mon Sep 17 00:00:00 2001 +From: Robert Mader +Date: Sat, 27 Jun 2026 12:57:25 +0200 +Subject: udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() + +From: Robert Mader + +commit 1d0e25c1ddf2063c499264fb2ba0fa6a3e4f8a00 upstream. + +The message of commit 504e2b4ab97a ("dma-buf/udmabuf: skip redundant cpu sync to +fix cacheline EEXIST warning") says: + +> The CPU sync at map/unmap time is also redundant for udmabuf: +> begin_cpu_udmabuf() and end_cpu_udmabuf() already perform explicit +> cache synchronization via dma_sync_sgtable_for_cpu/device() when CPU +> access is requested through the dma-buf interface. + +This, however, does not apply to the first time begin_cpu_udmabuf() is +called on an udmabuf, in which case the implementation previously relied on +get_sg_table() to perform the cache synchronisation. + +Ensure to call dma_sync_sgtable_for_cpu() in that case as well. + +Fixes: 504e2b4ab97a ("dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning") +Signed-off-by: Robert Mader +Reviewed-by: Mikhail Gavrilov +Signed-off-by: Vivek Kasireddy +Link: https://patch.msgid.link/20260627105725.9083-1-robert.mader@collabora.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma-buf/udmabuf.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/dma-buf/udmabuf.c ++++ b/drivers/dma-buf/udmabuf.c +@@ -155,21 +155,22 @@ static int begin_cpu_udmabuf(struct dma_ + { + struct udmabuf *ubuf = buf->priv; + struct device *dev = ubuf->device->this_device; +- int ret = 0; + + if (!ubuf->sg) { + ubuf->sg = get_sg_table(dev, buf, direction); + if (IS_ERR(ubuf->sg)) { ++ int ret; ++ + ret = PTR_ERR(ubuf->sg); + ubuf->sg = NULL; ++ return ret; + } else { + ubuf->sg_dir = direction; + } +- } else { +- dma_sync_sgtable_for_cpu(dev, ubuf->sg, direction); + } + +- return ret; ++ dma_sync_sgtable_for_cpu(dev, ubuf->sg, direction); ++ return 0; + } + + static int end_cpu_udmabuf(struct dma_buf *buf,