From: Greg Kroah-Hartman Date: Thu, 13 Oct 2022 13:23:29 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v5.4.218~39 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4bd4d94d0bdcaf84a18d444f02a4cf98bf34427c;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: alsa-hda-fix-position-reporting-on-poulsbo.patch efi-correct-macmini-dmi-match-in-uefi-cert-quirk.patch random-clamp-credited-irq-bits-to-maximum-mixed.patch random-restore-o_nonblock-support.patch revert-crypto-qat-reduce-size-of-mapped-region.patch revert-powerpc-rtas-implement-reentrant-rtas-call.patch scsi-stex-properly-zero-out-the-passthrough-command-structure.patch usb-serial-qcserial-add-new-usb-id-for-dell-branded-em7455.patch --- diff --git a/queue-5.15/alsa-hda-fix-position-reporting-on-poulsbo.patch b/queue-5.15/alsa-hda-fix-position-reporting-on-poulsbo.patch new file mode 100644 index 00000000000..b90772ffec4 --- /dev/null +++ b/queue-5.15/alsa-hda-fix-position-reporting-on-poulsbo.patch @@ -0,0 +1,40 @@ +From 56e696c0f0c71b77fff921fc94b58a02f0445b2c Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sat, 1 Oct 2022 16:21:24 +0200 +Subject: ALSA: hda: Fix position reporting on Poulsbo + +From: Takashi Iwai + +commit 56e696c0f0c71b77fff921fc94b58a02f0445b2c upstream. + +Hans reported that his Sony VAIO VPX11S1E showed the broken sound +behavior at the start of the stream for a couple of seconds, and it +turned out that the position_fix=1 option fixes the issue. It implies +that the position reporting is inaccurate, and very likely hitting on +all Poulsbo devices. + +The patch applies the workaround for Poulsbo generically to switch to +LPIB mode instead of the default position buffer. + +Reported-and-tested-by: Hans de Goede +Cc: +Link: https://lore.kernel.org/r/3e8697e1-87c6-7a7b-d2e8-b21f1d2f181b@redhat.com +Link: https://lore.kernel.org/r/20221001142124.7241-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/hda_intel.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2523,7 +2523,8 @@ static const struct pci_device_id azx_id + .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM }, + /* Poulsbo */ + { PCI_DEVICE(0x8086, 0x811b), +- .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE }, ++ .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE | ++ AZX_DCAPS_POSFIX_LPIB }, + /* Oaktrail */ + { PCI_DEVICE(0x8086, 0x080a), + .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE }, diff --git a/queue-5.15/efi-correct-macmini-dmi-match-in-uefi-cert-quirk.patch b/queue-5.15/efi-correct-macmini-dmi-match-in-uefi-cert-quirk.patch new file mode 100644 index 00000000000..857efb1c29f --- /dev/null +++ b/queue-5.15/efi-correct-macmini-dmi-match-in-uefi-cert-quirk.patch @@ -0,0 +1,55 @@ +From bab715bdaa9ebf28d99a6d1efb2704a30125e96d Mon Sep 17 00:00:00 2001 +From: Orlando Chamberlain +Date: Thu, 29 Sep 2022 11:49:56 +0000 +Subject: efi: Correct Macmini DMI match in uefi cert quirk + +From: Orlando Chamberlain + +commit bab715bdaa9ebf28d99a6d1efb2704a30125e96d upstream. + +It turns out Apple doesn't capitalise the "mini" in "Macmini" in DMI, which +is inconsistent with other model line names. + +Correct the capitalisation of Macmini in the quirk for skipping loading +platform certs on T2 Macs. + +Currently users get: + +------------[ cut here ]------------ +[Firmware Bug]: Page fault caused by firmware at PA: 0xffffa30640054000 +WARNING: CPU: 1 PID: 8 at arch/x86/platform/efi/quirks.c:735 efi_crash_gracefully_on_page_fault+0x55/0xe0 +Modules linked in: +CPU: 1 PID: 8 Comm: kworker/u12:0 Not tainted 5.18.14-arch1-2-t2 #1 4535eb3fc40fd08edab32a509fbf4c9bc52d111e +Hardware name: Apple Inc. Macmini8,1/Mac-7BA5B2DFE22DDD8C, BIOS 1731.120.10.0.0 (iBridge: 19.16.15071.0.0,0) 04/24/2022 +Workqueue: efi_rts_wq efi_call_rts +... +---[ end trace 0000000000000000 ]--- +efi: Froze efi_rts_wq and disabled EFI Runtime Services +integrity: Couldn't get size: 0x8000000000000015 +integrity: MODSIGN: Couldn't get UEFI db list +efi: EFI Runtime Services are disabled! +integrity: Couldn't get size: 0x8000000000000015 +integrity: Couldn't get UEFI dbx list + +Fixes: 155ca952c7ca ("efi: Do not import certificates from UEFI Secure Boot for T2 Macs") +Cc: stable@vger.kernel.org +Cc: Aditya Garg +Tested-by: Samuel Jiang +Signed-off-by: Orlando Chamberlain +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman +--- + security/integrity/platform_certs/load_uefi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/security/integrity/platform_certs/load_uefi.c ++++ b/security/integrity/platform_certs/load_uefi.c +@@ -30,7 +30,7 @@ static const struct dmi_system_id uefi_s + { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") }, + { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") }, + { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") }, +- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacMini8,1") }, ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") }, + { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") }, + { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") }, + { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") }, diff --git a/queue-5.15/random-clamp-credited-irq-bits-to-maximum-mixed.patch b/queue-5.15/random-clamp-credited-irq-bits-to-maximum-mixed.patch new file mode 100644 index 00000000000..d28fa0569a6 --- /dev/null +++ b/queue-5.15/random-clamp-credited-irq-bits-to-maximum-mixed.patch @@ -0,0 +1,31 @@ +From e78a802a7b4febf53f2a92842f494b01062d85a8 Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Fri, 23 Sep 2022 02:42:51 +0200 +Subject: random: clamp credited irq bits to maximum mixed + +From: Jason A. Donenfeld + +commit e78a802a7b4febf53f2a92842f494b01062d85a8 upstream. + +Since the most that's mixed into the pool is sizeof(long)*2, don't +credit more than that many bytes of entropy. + +Fixes: e3e33fc2ea7f ("random: do not use input pool from hard IRQs") +Cc: stable@vger.kernel.org +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -980,7 +980,7 @@ static void mix_interrupt_randomness(str + local_irq_enable(); + + mix_pool_bytes(pool, sizeof(pool)); +- credit_init_bits(max(1u, (count & U16_MAX) / 64)); ++ credit_init_bits(clamp_t(unsigned int, (count & U16_MAX) / 64, 1, sizeof(pool) * 8)); + + memzero_explicit(pool, sizeof(pool)); + } diff --git a/queue-5.15/random-restore-o_nonblock-support.patch b/queue-5.15/random-restore-o_nonblock-support.patch new file mode 100644 index 00000000000..bc1c31e924a --- /dev/null +++ b/queue-5.15/random-restore-o_nonblock-support.patch @@ -0,0 +1,65 @@ +From cd4f24ae9404fd31fc461066e57889be3b68641b Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Thu, 8 Sep 2022 16:14:00 +0200 +Subject: random: restore O_NONBLOCK support + +From: Jason A. Donenfeld + +commit cd4f24ae9404fd31fc461066e57889be3b68641b upstream. + +Prior to 5.6, when /dev/random was opened with O_NONBLOCK, it would +return -EAGAIN if there was no entropy. When the pools were unified in +5.6, this was lost. The post 5.6 behavior of blocking until the pool is +initialized, and ignoring O_NONBLOCK in the process, went unnoticed, +with no reports about the regression received for two and a half years. +However, eventually this indeed did break somebody's userspace. + +So we restore the old behavior, by returning -EAGAIN if the pool is not +initialized. Unlike the old /dev/random, this can only occur during +early boot, after which it never blocks again. + +In order to make this O_NONBLOCK behavior consistent with other +expectations, also respect users reading with preadv2(RWF_NOWAIT) and +similar. + +Fixes: 30c08efec888 ("random: make /dev/random be almost like /dev/urandom") +Reported-by: Guozihua +Reported-by: Zhongguohua +Cc: Al Viro +Cc: Theodore Ts'o +Cc: Andrew Lutomirski +Cc: stable@vger.kernel.org +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/mem.c | 4 ++-- + drivers/char/random.c | 5 +++++ + 2 files changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/char/mem.c ++++ b/drivers/char/mem.c +@@ -702,8 +702,8 @@ static const struct memdev { + #endif + [5] = { "zero", 0666, &zero_fops, 0 }, + [7] = { "full", 0666, &full_fops, 0 }, +- [8] = { "random", 0666, &random_fops, 0 }, +- [9] = { "urandom", 0666, &urandom_fops, 0 }, ++ [8] = { "random", 0666, &random_fops, FMODE_NOWAIT }, ++ [9] = { "urandom", 0666, &urandom_fops, FMODE_NOWAIT }, + #ifdef CONFIG_PRINTK + [11] = { "kmsg", 0644, &kmsg_fops, 0 }, + #endif +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1298,6 +1298,11 @@ static ssize_t random_read_iter(struct k + { + int ret; + ++ if (!crng_ready() && ++ ((kiocb->ki_flags & (IOCB_NOWAIT | IOCB_NOIO)) || ++ (kiocb->ki_filp->f_flags & O_NONBLOCK))) ++ return -EAGAIN; ++ + ret = wait_for_random_bytes(); + if (ret != 0) + return ret; diff --git a/queue-5.15/revert-crypto-qat-reduce-size-of-mapped-region.patch b/queue-5.15/revert-crypto-qat-reduce-size-of-mapped-region.patch new file mode 100644 index 00000000000..9765aae91a1 --- /dev/null +++ b/queue-5.15/revert-crypto-qat-reduce-size-of-mapped-region.patch @@ -0,0 +1,98 @@ +From 9c5f21b198d259bfe1191b1fedf08e2eab15b33b Mon Sep 17 00:00:00 2001 +From: Giovanni Cabiddu +Date: Fri, 9 Sep 2022 11:49:13 +0100 +Subject: Revert "crypto: qat - reduce size of mapped region" + +From: Giovanni Cabiddu + +commit 9c5f21b198d259bfe1191b1fedf08e2eab15b33b upstream. + +This reverts commit e48767c17718067ba21fb2ef461779ec2506f845. + +In an attempt to resolve a set of warnings reported by the static +analyzer Smatch, the reverted commit improperly reduced the sizes of the +DMA mappings used for the input and output parameters for both RSA and +DH creating a mismatch (map size=8 bytes, unmap size=64 bytes). + +This issue is reported when CONFIG_DMA_API_DEBUG is selected, when the +crypto self test is run. The function dma_unmap_single() reports a +warning similar to the one below, saying that the `device driver frees +DMA memory with different size`. + + DMA-API: 4xxx 0000:06:00.0: device driver frees DMA memory with different size [device address=0x0000000123206c80] [map size=8 bytes] [unmap size=64 bytes] + WARNING: CPU: 0 PID: 0 at kernel/dma/debug.c:973 check_unmap+0x3d0/0x8c0\ + ... + Call Trace: + + debug_dma_unmap_page+0x5c/0x60 + qat_dh_cb+0xd7/0x110 [intel_qat] + qat_alg_asym_callback+0x1a/0x30 [intel_qat] + adf_response_handler+0xbd/0x1a0 [intel_qat] + tasklet_action_common.constprop.0+0xcd/0xe0 + __do_softirq+0xf8/0x30c + __irq_exit_rcu+0xbf/0x140 + common_interrupt+0xb9/0xd0 + + + +The original commit was correct. + +Cc: +Reported-by: Herbert Xu +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/qat/qat_common/qat_asym_algs.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c +@@ -332,13 +332,13 @@ static int qat_dh_compute_value(struct k + qat_req->out.dh.out_tab[1] = 0; + /* Mapping in.in.b or in.in_g2.xa is the same */ + qat_req->phy_in = dma_map_single(dev, &qat_req->in.dh.in.b, +- sizeof(qat_req->in.dh.in.b), ++ sizeof(struct qat_dh_input_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_in))) + goto unmap_dst; + + qat_req->phy_out = dma_map_single(dev, &qat_req->out.dh.r, +- sizeof(qat_req->out.dh.r), ++ sizeof(struct qat_dh_output_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_out))) + goto unmap_in_params; +@@ -728,13 +728,13 @@ static int qat_rsa_enc(struct akcipher_r + qat_req->in.rsa.in_tab[3] = 0; + qat_req->out.rsa.out_tab[1] = 0; + qat_req->phy_in = dma_map_single(dev, &qat_req->in.rsa.enc.m, +- sizeof(qat_req->in.rsa.enc.m), ++ sizeof(struct qat_rsa_input_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_in))) + goto unmap_dst; + + qat_req->phy_out = dma_map_single(dev, &qat_req->out.rsa.enc.c, +- sizeof(qat_req->out.rsa.enc.c), ++ sizeof(struct qat_rsa_output_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_out))) + goto unmap_in_params; +@@ -873,13 +873,13 @@ static int qat_rsa_dec(struct akcipher_r + qat_req->in.rsa.in_tab[3] = 0; + qat_req->out.rsa.out_tab[1] = 0; + qat_req->phy_in = dma_map_single(dev, &qat_req->in.rsa.dec.c, +- sizeof(qat_req->in.rsa.dec.c), ++ sizeof(struct qat_rsa_input_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_in))) + goto unmap_dst; + + qat_req->phy_out = dma_map_single(dev, &qat_req->out.rsa.dec.m, +- sizeof(qat_req->out.rsa.dec.m), ++ sizeof(struct qat_rsa_output_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_out))) + goto unmap_in_params; diff --git a/queue-5.15/revert-powerpc-rtas-implement-reentrant-rtas-call.patch b/queue-5.15/revert-powerpc-rtas-implement-reentrant-rtas-call.patch new file mode 100644 index 00000000000..f4e19801da8 --- /dev/null +++ b/queue-5.15/revert-powerpc-rtas-implement-reentrant-rtas-call.patch @@ -0,0 +1,279 @@ +From f88aabad33ea22be2ce1c60d8901942e4e2a9edb Mon Sep 17 00:00:00 2001 +From: Nathan Lynch +Date: Wed, 7 Sep 2022 17:01:11 -0500 +Subject: Revert "powerpc/rtas: Implement reentrant rtas call" + +From: Nathan Lynch + +commit f88aabad33ea22be2ce1c60d8901942e4e2a9edb upstream. + +At the time this was submitted by Leonardo, I confirmed -- or thought +I had confirmed -- with PowerVM partition firmware development that +the following RTAS functions: + +- ibm,get-xive +- ibm,int-off +- ibm,int-on +- ibm,set-xive + +were safe to call on multiple CPUs simultaneously, not only with +respect to themselves as indicated by PAPR, but with arbitrary other +RTAS calls: + +https://lore.kernel.org/linuxppc-dev/875zcy2v8o.fsf@linux.ibm.com/ + +Recent discussion with firmware development makes it clear that this +is not true, and that the code in commit b664db8e3f97 ("powerpc/rtas: +Implement reentrant rtas call") is unsafe, likely explaining several +strange bugs we've seen in internal testing involving DLPAR and +LPM. These scenarios use ibm,configure-connector, whose internal state +can be corrupted by the concurrent use of the "reentrant" functions, +leading to symptoms like endless busy statuses from RTAS. + +Fixes: b664db8e3f97 ("powerpc/rtas: Implement reentrant rtas call") +Cc: stable@vger.kernel.org # v5.8+ +Signed-off-by: Nathan Lynch +Reviewed-by: Laurent Dufour +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220907220111.223267-1-nathanl@linux.ibm.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/include/asm/paca.h | 1 + arch/powerpc/include/asm/rtas.h | 1 + arch/powerpc/kernel/paca.c | 32 --------------------- + arch/powerpc/kernel/rtas.c | 54 ------------------------------------ + arch/powerpc/sysdev/xics/ics-rtas.c | 22 +++++++------- + 5 files changed, 11 insertions(+), 99 deletions(-) + +--- a/arch/powerpc/include/asm/paca.h ++++ b/arch/powerpc/include/asm/paca.h +@@ -263,7 +263,6 @@ struct paca_struct { + u64 l1d_flush_size; + #endif + #ifdef CONFIG_PPC_PSERIES +- struct rtas_args *rtas_args_reentrant; + u8 *mce_data_buf; /* buffer to hold per cpu rtas errlog */ + #endif /* CONFIG_PPC_PSERIES */ + +--- a/arch/powerpc/include/asm/rtas.h ++++ b/arch/powerpc/include/asm/rtas.h +@@ -240,7 +240,6 @@ extern struct rtas_t rtas; + extern int rtas_token(const char *service); + extern int rtas_service_present(const char *service); + extern int rtas_call(int token, int, int, int *, ...); +-int rtas_call_reentrant(int token, int nargs, int nret, int *outputs, ...); + void rtas_call_unlocked(struct rtas_args *args, int token, int nargs, + int nret, ...); + extern void __noreturn rtas_restart(char *cmd); +--- a/arch/powerpc/kernel/paca.c ++++ b/arch/powerpc/kernel/paca.c +@@ -16,7 +16,6 @@ + #include + #include + #include +-#include + + #include "setup.h" + +@@ -172,30 +171,6 @@ static struct slb_shadow * __init new_sl + + #endif /* CONFIG_PPC_BOOK3S_64 */ + +-#ifdef CONFIG_PPC_PSERIES +-/** +- * new_rtas_args() - Allocates rtas args +- * @cpu: CPU number +- * @limit: Memory limit for this allocation +- * +- * Allocates a struct rtas_args and return it's pointer, +- * if not in Hypervisor mode +- * +- * Return: Pointer to allocated rtas_args +- * NULL if CPU in Hypervisor Mode +- */ +-static struct rtas_args * __init new_rtas_args(int cpu, unsigned long limit) +-{ +- limit = min_t(unsigned long, limit, RTAS_INSTANTIATE_MAX); +- +- if (early_cpu_has_feature(CPU_FTR_HVMODE)) +- return NULL; +- +- return alloc_paca_data(sizeof(struct rtas_args), L1_CACHE_BYTES, +- limit, cpu); +-} +-#endif /* CONFIG_PPC_PSERIES */ +- + /* The Paca is an array with one entry per processor. Each contains an + * lppaca, which contains the information shared between the + * hypervisor and Linux. +@@ -234,10 +209,6 @@ void __init initialise_paca(struct paca_ + /* For now -- if we have threads this will be adjusted later */ + new_paca->tcd_ptr = &new_paca->tcd; + #endif +- +-#ifdef CONFIG_PPC_PSERIES +- new_paca->rtas_args_reentrant = NULL; +-#endif + } + + /* Put the paca pointer into r13 and SPRG_PACA */ +@@ -310,9 +281,6 @@ void __init allocate_paca(int cpu) + #ifdef CONFIG_PPC_BOOK3S_64 + paca->slb_shadow_ptr = new_slb_shadow(cpu, limit); + #endif +-#ifdef CONFIG_PPC_PSERIES +- paca->rtas_args_reentrant = new_rtas_args(cpu, limit); +-#endif + paca_struct_size += sizeof(struct paca_struct); + } + +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -42,7 +42,6 @@ + #include + #include + #include +-#include + + /* This is here deliberately so it's only used in this file */ + void enter_rtas(unsigned long); +@@ -845,59 +844,6 @@ void rtas_activate_firmware(void) + pr_err("ibm,activate-firmware failed (%i)\n", fwrc); + } + +-#ifdef CONFIG_PPC_PSERIES +-/** +- * rtas_call_reentrant() - Used for reentrant rtas calls +- * @token: Token for desired reentrant RTAS call +- * @nargs: Number of Input Parameters +- * @nret: Number of Output Parameters +- * @outputs: Array of outputs +- * @...: Inputs for desired RTAS call +- * +- * According to LoPAR documentation, only "ibm,int-on", "ibm,int-off", +- * "ibm,get-xive" and "ibm,set-xive" are currently reentrant. +- * Reentrant calls need their own rtas_args buffer, so not using rtas.args, but +- * PACA one instead. +- * +- * Return: -1 on error, +- * First output value of RTAS call if (nret > 0), +- * 0 otherwise, +- */ +-int rtas_call_reentrant(int token, int nargs, int nret, int *outputs, ...) +-{ +- va_list list; +- struct rtas_args *args; +- unsigned long flags; +- int i, ret = 0; +- +- if (!rtas.entry || token == RTAS_UNKNOWN_SERVICE) +- return -1; +- +- local_irq_save(flags); +- preempt_disable(); +- +- /* We use the per-cpu (PACA) rtas args buffer */ +- args = local_paca->rtas_args_reentrant; +- +- va_start(list, outputs); +- va_rtas_call_unlocked(args, token, nargs, nret, list); +- va_end(list); +- +- if (nret > 1 && outputs) +- for (i = 0; i < nret - 1; ++i) +- outputs[i] = be32_to_cpu(args->rets[i + 1]); +- +- if (nret > 0) +- ret = be32_to_cpu(args->rets[0]); +- +- local_irq_restore(flags); +- preempt_enable(); +- +- return ret; +-} +- +-#endif /* CONFIG_PPC_PSERIES */ +- + /** + * Find a specific pseries error log in an RTAS extended event log. + * @log: RTAS error/event log +--- a/arch/powerpc/sysdev/xics/ics-rtas.c ++++ b/arch/powerpc/sysdev/xics/ics-rtas.c +@@ -37,8 +37,8 @@ static void ics_rtas_unmask_irq(struct i + + server = xics_get_irq_server(d->irq, irq_data_get_affinity_mask(d), 0); + +- call_status = rtas_call_reentrant(ibm_set_xive, 3, 1, NULL, hw_irq, +- server, DEFAULT_PRIORITY); ++ call_status = rtas_call(ibm_set_xive, 3, 1, NULL, hw_irq, server, ++ DEFAULT_PRIORITY); + if (call_status != 0) { + printk(KERN_ERR + "%s: ibm_set_xive irq %u server %x returned %d\n", +@@ -47,7 +47,7 @@ static void ics_rtas_unmask_irq(struct i + } + + /* Now unmask the interrupt (often a no-op) */ +- call_status = rtas_call_reentrant(ibm_int_on, 1, 1, NULL, hw_irq); ++ call_status = rtas_call(ibm_int_on, 1, 1, NULL, hw_irq); + if (call_status != 0) { + printk(KERN_ERR "%s: ibm_int_on irq=%u returned %d\n", + __func__, hw_irq, call_status); +@@ -69,7 +69,7 @@ static void ics_rtas_mask_real_irq(unsig + if (hw_irq == XICS_IPI) + return; + +- call_status = rtas_call_reentrant(ibm_int_off, 1, 1, NULL, hw_irq); ++ call_status = rtas_call(ibm_int_off, 1, 1, NULL, hw_irq); + if (call_status != 0) { + printk(KERN_ERR "%s: ibm_int_off irq=%u returned %d\n", + __func__, hw_irq, call_status); +@@ -77,8 +77,8 @@ static void ics_rtas_mask_real_irq(unsig + } + + /* Have to set XIVE to 0xff to be able to remove a slot */ +- call_status = rtas_call_reentrant(ibm_set_xive, 3, 1, NULL, hw_irq, +- xics_default_server, 0xff); ++ call_status = rtas_call(ibm_set_xive, 3, 1, NULL, hw_irq, ++ xics_default_server, 0xff); + if (call_status != 0) { + printk(KERN_ERR "%s: ibm_set_xive(0xff) irq=%u returned %d\n", + __func__, hw_irq, call_status); +@@ -109,7 +109,7 @@ static int ics_rtas_set_affinity(struct + if (hw_irq == XICS_IPI || hw_irq == XICS_IRQ_SPURIOUS) + return -1; + +- status = rtas_call_reentrant(ibm_get_xive, 1, 3, xics_status, hw_irq); ++ status = rtas_call(ibm_get_xive, 1, 3, xics_status, hw_irq); + + if (status) { + printk(KERN_ERR "%s: ibm,get-xive irq=%u returns %d\n", +@@ -127,8 +127,8 @@ static int ics_rtas_set_affinity(struct + pr_debug("%s: irq %d [hw 0x%x] server: 0x%x\n", __func__, d->irq, + hw_irq, irq_server); + +- status = rtas_call_reentrant(ibm_set_xive, 3, 1, NULL, +- hw_irq, irq_server, xics_status[1]); ++ status = rtas_call(ibm_set_xive, 3, 1, NULL, ++ hw_irq, irq_server, xics_status[1]); + + if (status) { + printk(KERN_ERR "%s: ibm,set-xive irq=%u returns %d\n", +@@ -159,7 +159,7 @@ static int ics_rtas_check(struct ics *ic + return -EINVAL; + + /* Check if RTAS knows about this interrupt */ +- rc = rtas_call_reentrant(ibm_get_xive, 1, 3, status, hw_irq); ++ rc = rtas_call(ibm_get_xive, 1, 3, status, hw_irq); + if (rc) + return -ENXIO; + +@@ -175,7 +175,7 @@ static long ics_rtas_get_server(struct i + { + int rc, status[2]; + +- rc = rtas_call_reentrant(ibm_get_xive, 1, 3, status, vec); ++ rc = rtas_call(ibm_get_xive, 1, 3, status, vec); + if (rc) + return -1; + return status[0]; diff --git a/queue-5.15/scsi-stex-properly-zero-out-the-passthrough-command-structure.patch b/queue-5.15/scsi-stex-properly-zero-out-the-passthrough-command-structure.patch new file mode 100644 index 00000000000..7e732e1e945 --- /dev/null +++ b/queue-5.15/scsi-stex-properly-zero-out-the-passthrough-command-structure.patch @@ -0,0 +1,68 @@ +From 6022f210461fef67e6e676fd8544ca02d1bcfa7a Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Fri, 9 Sep 2022 08:54:47 +0200 +Subject: scsi: stex: Properly zero out the passthrough command structure + +From: Linus Torvalds + +commit 6022f210461fef67e6e676fd8544ca02d1bcfa7a upstream. + +The passthrough structure is declared off of the stack, so it needs to be +set to zero before copied back to userspace to prevent any unintentional +data leakage. Switch things to be statically allocated which will fill the +unused fields with 0 automatically. + +Link: https://lore.kernel.org/r/YxrjN3OOw2HHl9tx@kroah.com +Cc: stable@kernel.org +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: Dan Carpenter +Reported-by: hdthky +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/stex.c | 17 +++++++++-------- + include/scsi/scsi_cmnd.h | 2 +- + 2 files changed, 10 insertions(+), 9 deletions(-) + +--- a/drivers/scsi/stex.c ++++ b/drivers/scsi/stex.c +@@ -665,16 +665,17 @@ stex_queuecommand_lck(struct scsi_cmnd * + return 0; + case PASSTHRU_CMD: + if (cmd->cmnd[1] == PASSTHRU_GET_DRVVER) { +- struct st_drvver ver; ++ const struct st_drvver ver = { ++ .major = ST_VER_MAJOR, ++ .minor = ST_VER_MINOR, ++ .oem = ST_OEM, ++ .build = ST_BUILD_VER, ++ .signature[0] = PASSTHRU_SIGNATURE, ++ .console_id = host->max_id - 1, ++ .host_no = hba->host->host_no, ++ }; + size_t cp_len = sizeof(ver); + +- ver.major = ST_VER_MAJOR; +- ver.minor = ST_VER_MINOR; +- ver.oem = ST_OEM; +- ver.build = ST_BUILD_VER; +- ver.signature[0] = PASSTHRU_SIGNATURE; +- ver.console_id = host->max_id - 1; +- ver.host_no = hba->host->host_no; + cp_len = scsi_sg_copy_from_buffer(cmd, &ver, cp_len); + if (sizeof(ver) == cp_len) + cmd->result = DID_OK << 16; +--- a/include/scsi/scsi_cmnd.h ++++ b/include/scsi/scsi_cmnd.h +@@ -211,7 +211,7 @@ static inline unsigned int scsi_get_resi + for_each_sg(scsi_sglist(cmd), sg, nseg, __i) + + static inline int scsi_sg_copy_from_buffer(struct scsi_cmnd *cmd, +- void *buf, int buflen) ++ const void *buf, int buflen) + { + return sg_copy_from_buffer(scsi_sglist(cmd), scsi_sg_count(cmd), + buf, buflen); diff --git a/queue-5.15/series b/queue-5.15/series index caa06034619..89d65edb8e8 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -3,3 +3,11 @@ nilfs2-fix-use-after-free-bug-of-struct-nilfs_root.patch nilfs2-fix-leak-of-nilfs_root-in-case-of-writer-thread-creation-failure.patch nilfs2-replace-warn_ons-by-nilfs_error-for-checkpoint-acquisition-failure.patch ceph-don-t-truncate-file-in-atomic_open.patch +random-restore-o_nonblock-support.patch +random-clamp-credited-irq-bits-to-maximum-mixed.patch +alsa-hda-fix-position-reporting-on-poulsbo.patch +efi-correct-macmini-dmi-match-in-uefi-cert-quirk.patch +scsi-stex-properly-zero-out-the-passthrough-command-structure.patch +usb-serial-qcserial-add-new-usb-id-for-dell-branded-em7455.patch +revert-powerpc-rtas-implement-reentrant-rtas-call.patch +revert-crypto-qat-reduce-size-of-mapped-region.patch diff --git a/queue-5.15/usb-serial-qcserial-add-new-usb-id-for-dell-branded-em7455.patch b/queue-5.15/usb-serial-qcserial-add-new-usb-id-for-dell-branded-em7455.patch new file mode 100644 index 00000000000..7a76a81d1bf --- /dev/null +++ b/queue-5.15/usb-serial-qcserial-add-new-usb-id-for-dell-branded-em7455.patch @@ -0,0 +1,29 @@ +From eee48781ea199e32c1d0c4732641c494833788ca Mon Sep 17 00:00:00 2001 +From: Frank Wunderlich +Date: Mon, 26 Sep 2022 17:07:39 +0200 +Subject: USB: serial: qcserial: add new usb-id for Dell branded EM7455 + +From: Frank Wunderlich + +commit eee48781ea199e32c1d0c4732641c494833788ca upstream. + +Add support for Dell 5811e (EM7455) with USB-id 0x413c:0x81c2. + +Signed-off-by: Frank Wunderlich +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/qcserial.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -177,6 +177,7 @@ static const struct usb_device_id id_tab + {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */ + {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */ + {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */ ++ {DEVICE_SWI(0x413c, 0x81c2)}, /* Dell Wireless 5811e */ + {DEVICE_SWI(0x413c, 0x81cb)}, /* Dell Wireless 5816e QDL */ + {DEVICE_SWI(0x413c, 0x81cc)}, /* Dell Wireless 5816e */ + {DEVICE_SWI(0x413c, 0x81cf)}, /* Dell Wireless 5819 */