From: Sasha Levin Date: Sat, 4 Nov 2023 03:00:43 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v4.14.329~46 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=52f04286fcf9ad5b166a48ca6f3e0411e1ef7b59;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/asoc-rt5650-fix-the-wrong-result-of-key-button.patch b/queue-5.15/asoc-rt5650-fix-the-wrong-result-of-key-button.patch new file mode 100644 index 00000000000..403773314c1 --- /dev/null +++ b/queue-5.15/asoc-rt5650-fix-the-wrong-result-of-key-button.patch @@ -0,0 +1,35 @@ +From 66ffb28282a60b332871774dbb9bd13d9a8cb93d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Oct 2023 17:45:25 +0800 +Subject: ASoC: rt5650: fix the wrong result of key button + +From: Shuming Fan + +[ Upstream commit f88dfbf333b3661faff996bb03af2024d907b76a ] + +The RT5650 should enable a power setting for button detection to avoid the wrong result. + +Signed-off-by: Shuming Fan +Link: https://lore.kernel.org/r/20231013094525.715518-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5645.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index 8ea6d43335626..385f2cca939a0 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -3251,6 +3251,8 @@ int rt5645_set_jack_detect(struct snd_soc_component *component, + RT5645_GP1_PIN_IRQ, RT5645_GP1_PIN_IRQ); + regmap_update_bits(rt5645->regmap, RT5645_GEN_CTRL1, + RT5645_DIG_GATE_CTRL, RT5645_DIG_GATE_CTRL); ++ regmap_update_bits(rt5645->regmap, RT5645_DEPOP_M1, ++ RT5645_HP_CB_MASK, RT5645_HP_CB_PU); + } + rt5645_irq(0, rt5645); + +-- +2.42.0 + diff --git a/queue-5.15/asoc-simple-card-fixup-asoc_simple_probe-error-handl.patch b/queue-5.15/asoc-simple-card-fixup-asoc_simple_probe-error-handl.patch new file mode 100644 index 00000000000..827ce831f39 --- /dev/null +++ b/queue-5.15/asoc-simple-card-fixup-asoc_simple_probe-error-handl.patch @@ -0,0 +1,85 @@ +From 7d29474aa9e3326849a5adab90ee9e7d6787494e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Sep 2023 05:34:18 +0000 +Subject: ASoC: simple-card: fixup asoc_simple_probe() error handling + +From: Kuninori Morimoto + +[ Upstream commit 41bae58df411f9accf01ea660730649b2fab1dab ] + +asoc_simple_probe() is used for both "DT probe" (A) and "platform probe" +(B). It uses "goto err" when error case, but it is not needed for +"platform probe" case (B). Thus it is using "return" directly there. + + static int asoc_simple_probe(...) + { + ^ if (...) { + | ... +(A) if (ret < 0) + | goto err; + v } else { + ^ ... + | if (ret < 0) +(B) return -Exxx; + v } + + ... + ^ if (ret < 0) +(C) goto err; + v ... + + err: +(D) simple_util_clean_reference(card); + + return ret; + } + +Both case are using (C) part, and it calls (D) when err case. +But (D) will do nothing for (B) case. +Because of these behavior, current code itself is not wrong, +but is confusable, and more, static analyzing tool will warning on +(B) part (should use goto err). + +To avoid static analyzing tool warning, this patch uses "goto err" +on (B) part. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87o7hy7mlh.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/generic/simple-card.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c +index 283aa21879aa5..95e4c53cd90c7 100644 +--- a/sound/soc/generic/simple-card.c ++++ b/sound/soc/generic/simple-card.c +@@ -680,10 +680,12 @@ static int asoc_simple_probe(struct platform_device *pdev) + struct snd_soc_dai_link *dai_link = priv->dai_link; + struct simple_dai_props *dai_props = priv->dai_props; + ++ ret = -EINVAL; ++ + cinfo = dev->platform_data; + if (!cinfo) { + dev_err(dev, "no info for asoc-simple-card\n"); +- return -EINVAL; ++ goto err; + } + + if (!cinfo->name || +@@ -692,7 +694,7 @@ static int asoc_simple_probe(struct platform_device *pdev) + !cinfo->platform || + !cinfo->cpu_dai.name) { + dev_err(dev, "insufficient asoc_simple_card_info settings\n"); +- return -EINVAL; ++ goto err; + } + + cpus = dai_link->cpus; +-- +2.42.0 + diff --git a/queue-5.15/dmaengine-ste_dma40-fix-pm-disable-depth-imbalance-i.patch b/queue-5.15/dmaengine-ste_dma40-fix-pm-disable-depth-imbalance-i.patch new file mode 100644 index 00000000000..8ad57706047 --- /dev/null +++ b/queue-5.15/dmaengine-ste_dma40-fix-pm-disable-depth-imbalance-i.patch @@ -0,0 +1,38 @@ +From a7e80bbdb7bb17329dad606df67961f0ab0e724d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Oct 2023 22:28:35 +0800 +Subject: dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe + +From: Zhang Shurong + +[ Upstream commit 0618c077a8c20e8c81e367988f70f7e32bb5a717 ] + +The pm_runtime_enable will increase power disable depth. Thus +a pairing decrement is needed on the error handling path to +keep it balanced according to context. +We fix it by calling pm_runtime_disable when error returns. + +Signed-off-by: Zhang Shurong +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/tencent_DD2D371DB5925B4B602B1E1D0A5FA88F1208@qq.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ste_dma40.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c +index cb6b0e9ed5adc..0e9cb01682647 100644 +--- a/drivers/dma/ste_dma40.c ++++ b/drivers/dma/ste_dma40.c +@@ -3697,6 +3697,7 @@ static int __init d40_probe(struct platform_device *pdev) + regulator_disable(base->lcpa_regulator); + regulator_put(base->lcpa_regulator); + } ++ pm_runtime_disable(base->dev); + + kfree(base->lcla_pool.alloc_map); + kfree(base->lookup_log_chans); +-- +2.42.0 + diff --git a/queue-5.15/drm-ttm-reorder-sys-manager-cleanup-step.patch b/queue-5.15/drm-ttm-reorder-sys-manager-cleanup-step.patch new file mode 100644 index 00000000000..476a3b758db --- /dev/null +++ b/queue-5.15/drm-ttm-reorder-sys-manager-cleanup-step.patch @@ -0,0 +1,59 @@ +From f093a5109bfc92dc25dd9d79b0460622fc0221cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Oct 2023 14:15:25 +0200 +Subject: drm/ttm: Reorder sys manager cleanup step +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Karolina Stolarek + +[ Upstream commit 3b401e30c249849d803de6c332dad2a595a58658 ] + +With the current cleanup flow, we could trigger a NULL pointer +dereference if there is a delayed destruction of a BO with a +system resource that gets executed on drain_workqueue() call, +as we attempt to free a resource using an already released +resource manager. + +Remove the device from the device list and drain its workqueue +before releasing the system domain manager in ttm_device_fini(). + +Signed-off-by: Karolina Stolarek +Reviewed-by: Christian König +Link: https://patchwork.freedesktop.org/patch/msgid/20231016121525.2237838-1-karolina.stolarek@intel.com +Signed-off-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/ttm_device.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/ttm/ttm_device.c b/drivers/gpu/drm/ttm/ttm_device.c +index 2df59b3c2ea16..291cdd893fc50 100644 +--- a/drivers/gpu/drm/ttm/ttm_device.c ++++ b/drivers/gpu/drm/ttm/ttm_device.c +@@ -234,10 +234,6 @@ void ttm_device_fini(struct ttm_device *bdev) + struct ttm_resource_manager *man; + unsigned i; + +- man = ttm_manager_type(bdev, TTM_PL_SYSTEM); +- ttm_resource_manager_set_used(man, false); +- ttm_set_driver_manager(bdev, TTM_PL_SYSTEM, NULL); +- + mutex_lock(&ttm_global_mutex); + list_del(&bdev->device_list); + mutex_unlock(&ttm_global_mutex); +@@ -247,6 +243,10 @@ void ttm_device_fini(struct ttm_device *bdev) + if (ttm_bo_delayed_delete(bdev, true)) + pr_debug("Delayed destroy list was clean\n"); + ++ man = ttm_manager_type(bdev, TTM_PL_SYSTEM); ++ ttm_resource_manager_set_used(man, false); ++ ttm_set_driver_manager(bdev, TTM_PL_SYSTEM, NULL); ++ + spin_lock(&bdev->lru_lock); + for (i = 0; i < TTM_MAX_BO_PRIORITY; ++i) + if (list_empty(&man->lru[0])) +-- +2.42.0 + diff --git a/queue-5.15/fbdev-atyfb-only-use-ioremap_uc-on-i386-and-ia64.patch b/queue-5.15/fbdev-atyfb-only-use-ioremap_uc-on-i386-and-ia64.patch new file mode 100644 index 00000000000..4ca64b3b08b --- /dev/null +++ b/queue-5.15/fbdev-atyfb-only-use-ioremap_uc-on-i386-and-ia64.patch @@ -0,0 +1,58 @@ +From 4bf0e3e43d932cebdeeaf74370ba6ec3e9e17884 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Sep 2023 19:04:21 +0800 +Subject: fbdev: atyfb: only use ioremap_uc() on i386 and ia64 + +From: Arnd Bergmann + +[ Upstream commit c1a8d1d0edb71dec15c9649cb56866c71c1ecd9e ] + +ioremap_uc() is only meaningful on old x86-32 systems with the PAT +extension, and on ia64 with its slightly unconventional ioremap() +behavior, everywhere else this is the same as ioremap() anyway. + +Change the only driver that still references ioremap_uc() to only do so +on x86-32/ia64 in order to allow removing that interface at some +point in the future for the other architectures. + +On some architectures, ioremap_uc() just returns NULL, changing +the driver to call ioremap() means that they now have a chance +of working correctly. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Baoquan He +Reviewed-by: Luis Chamberlain +Cc: Helge Deller +Cc: Thomas Zimmermann +Cc: Christophe Leroy +Cc: linux-fbdev@vger.kernel.org +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/aty/atyfb_base.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c +index 1aef3d6ebd880..246bf67b32ea0 100644 +--- a/drivers/video/fbdev/aty/atyfb_base.c ++++ b/drivers/video/fbdev/aty/atyfb_base.c +@@ -3447,11 +3447,15 @@ static int atyfb_setup_generic(struct pci_dev *pdev, struct fb_info *info, + } + + info->fix.mmio_start = raddr; ++#if defined(__i386__) || defined(__ia64__) + /* + * By using strong UC we force the MTRR to never have an + * effect on the MMIO region on both non-PAT and PAT systems. + */ + par->ati_regbase = ioremap_uc(info->fix.mmio_start, 0x1000); ++#else ++ par->ati_regbase = ioremap(info->fix.mmio_start, 0x1000); ++#endif + if (par->ati_regbase == NULL) + return -ENOMEM; + +-- +2.42.0 + diff --git a/queue-5.15/fbdev-uvesafb-call-cn_del_callback-at-the-end-of-uve.patch b/queue-5.15/fbdev-uvesafb-call-cn_del_callback-at-the-end-of-uve.patch new file mode 100644 index 00000000000..6a7450fef95 --- /dev/null +++ b/queue-5.15/fbdev-uvesafb-call-cn_del_callback-at-the-end-of-uve.patch @@ -0,0 +1,41 @@ +From d0ed51ae15b46de263f637b94c0931d8a90bcb85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Oct 2023 17:43:47 -0300 +Subject: fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit() + +From: Jorge Maidana + +[ Upstream commit 1022e7e2f40574c74ed32c3811b03d26b0b81daf ] + +Delete the v86d netlink only after all the VBE tasks have been +completed. + +Fixes initial state restore on module unload: +uvesafb: VBE state restore call failed (eax=0x4f04, err=-19) + +Signed-off-by: Jorge Maidana +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/uvesafb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c +index 1f3b7e013568c..3a285af76f7ed 100644 +--- a/drivers/video/fbdev/uvesafb.c ++++ b/drivers/video/fbdev/uvesafb.c +@@ -1935,10 +1935,10 @@ static void uvesafb_exit(void) + } + } + +- cn_del_callback(&uvesafb_cn_id); + driver_remove_file(&uvesafb_driver.driver, &driver_attr_v86d); + platform_device_unregister(uvesafb_device); + platform_driver_unregister(&uvesafb_driver); ++ cn_del_callback(&uvesafb_cn_id); + } + + module_exit(uvesafb_exit); +-- +2.42.0 + diff --git a/queue-5.15/fs-ntfs3-add-ckeck-in-ni_update_parent.patch b/queue-5.15/fs-ntfs3-add-ckeck-in-ni_update_parent.patch new file mode 100644 index 00000000000..e3eccb929b5 --- /dev/null +++ b/queue-5.15/fs-ntfs3-add-ckeck-in-ni_update_parent.patch @@ -0,0 +1,37 @@ +From e6c32ce1ded7c6df4be58c2165909db8e5ed6f6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 15:52:19 +0400 +Subject: fs/ntfs3: Add ckeck in ni_update_parent() + +From: Konstantin Komarov + +[ Upstream commit 87d1888aa40f25773fa0b948bcb2545f97e2cb15 ] + +Check simple case when parent inode equals current inode. + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/frecord.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c +index 9a1744955d1cf..73a56d7ac84b7 100644 +--- a/fs/ntfs3/frecord.c ++++ b/fs/ntfs3/frecord.c +@@ -3144,6 +3144,12 @@ static bool ni_update_parent(struct ntfs_inode *ni, struct NTFS_DUP_INFO *dup, + if (!fname || !memcmp(&fname->dup, dup, sizeof(fname->dup))) + continue; + ++ /* Check simple case when parent inode equals current inode. */ ++ if (ino_get(&fname->home) == ni->vfs_inode.i_ino) { ++ ntfs_set_state(sbi, NTFS_DIRTY_ERROR); ++ continue; ++ } ++ + /* ntfs_iget5 may sleep. */ + dir = ntfs_iget5(sb, &fname->home, NULL); + if (IS_ERR(dir)) { +-- +2.42.0 + diff --git a/queue-5.15/fs-ntfs3-avoid-possible-memory-leak.patch b/queue-5.15/fs-ntfs3-avoid-possible-memory-leak.patch new file mode 100644 index 00000000000..bee84277fa6 --- /dev/null +++ b/queue-5.15/fs-ntfs3-avoid-possible-memory-leak.patch @@ -0,0 +1,41 @@ +From a3a18c7326f9c9de4567892b0f6e3dfd7086e76d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Sep 2023 12:48:07 +0800 +Subject: fs/ntfs3: Avoid possible memory leak + +From: Su Hui + +[ Upstream commit e4494770a5cad3c9d1d2a65ed15d07656c0d9b82 ] + +smatch warn: +fs/ntfs3/fslog.c:2172 last_log_lsn() warn: possible memory leak of 'page_bufs' +Jump to label 'out' to free 'page_bufs' and is more consistent with +other code. + +Signed-off-by: Su Hui +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fslog.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c +index 59f813cbdaa8e..8b95c06e5a4c5 100644 +--- a/fs/ntfs3/fslog.c ++++ b/fs/ntfs3/fslog.c +@@ -2169,8 +2169,10 @@ static int last_log_lsn(struct ntfs_log *log) + + if (!page) { + page = kmalloc(log->page_size, GFP_NOFS); +- if (!page) +- return -ENOMEM; ++ if (!page) { ++ err = -ENOMEM; ++ goto out; ++ } + } + + /* +-- +2.42.0 + diff --git a/queue-5.15/fs-ntfs3-fix-directory-element-type-detection.patch b/queue-5.15/fs-ntfs3-fix-directory-element-type-detection.patch new file mode 100644 index 00000000000..1e750d1f824 --- /dev/null +++ b/queue-5.15/fs-ntfs3-fix-directory-element-type-detection.patch @@ -0,0 +1,44 @@ +From fdf6d459c74f5b90098ed2757b4b629bcc682516 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Sep 2023 21:50:32 -0700 +Subject: fs/ntfs3: Fix directory element type detection + +From: Gabriel Marcano + +[ Upstream commit 85a4780dc96ed9dd643bbadf236552b3320fae26 ] + +Calling stat() from userspace correctly identified junctions in an NTFS +partition as symlinks, but using readdir() and iterating through the +directory containing the same junction did not identify the junction +as a symlink. + +When emitting directory contents, check FILE_ATTRIBUTE_REPARSE_POINT +attribute to detect junctions and report them as links. + +Signed-off-by: Gabriel Marcano +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/dir.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c +index fb438d6040409..d4d9f4ffb6d9a 100644 +--- a/fs/ntfs3/dir.c ++++ b/fs/ntfs3/dir.c +@@ -309,7 +309,11 @@ static inline int ntfs_filldir(struct ntfs_sb_info *sbi, struct ntfs_inode *ni, + return 0; + } + +- dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG; ++ /* NTFS: symlinks are "dir + reparse" or "file + reparse" */ ++ if (fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT) ++ dt_type = DT_LNK; ++ else ++ dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG; + + return !dir_emit(ctx, (s8 *)name, name_len, ino, dt_type); + } +-- +2.42.0 + diff --git a/queue-5.15/fs-ntfs3-fix-null-pointer-dereference-on-error-in-at.patch b/queue-5.15/fs-ntfs3-fix-null-pointer-dereference-on-error-in-at.patch new file mode 100644 index 00000000000..1fd70631d6c --- /dev/null +++ b/queue-5.15/fs-ntfs3-fix-null-pointer-dereference-on-error-in-at.patch @@ -0,0 +1,36 @@ +From eb4e276ace670ed87ff6b028a4495a3a0657f897 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Sep 2023 11:28:11 +0300 +Subject: fs/ntfs3: Fix NULL pointer dereference on error in + attr_allocate_frame() + +From: Konstantin Komarov + +[ Upstream commit 9c689c8dc86f8ca99bf91c05f24c8bab38fe7d5f ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 321d55b3ca17d..1d5ac2164d94f 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -1583,10 +1583,8 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size, + le_b = NULL; + attr_b = ni_find_attr(ni, NULL, &le_b, ATTR_DATA, NULL, + 0, NULL, &mi_b); +- if (!attr_b) { +- err = -ENOENT; +- goto out; +- } ++ if (!attr_b) ++ return -ENOENT; + + attr = attr_b; + le = le_b; +-- +2.42.0 + diff --git a/queue-5.15/fs-ntfs3-fix-possible-null-ptr-deref-in-ni_readpage_.patch b/queue-5.15/fs-ntfs3-fix-possible-null-ptr-deref-in-ni_readpage_.patch new file mode 100644 index 00000000000..763bee80889 --- /dev/null +++ b/queue-5.15/fs-ntfs3-fix-possible-null-ptr-deref-in-ni_readpage_.patch @@ -0,0 +1,31 @@ +From 5022470ecff3f1bc736d3606fd84fc27d163947a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Sep 2023 11:19:08 +0300 +Subject: fs/ntfs3: Fix possible NULL-ptr-deref in ni_readpage_cmpr() + +From: Konstantin Komarov + +[ Upstream commit 32e9212256b88f35466642f9c939bb40cfb2c2de ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/frecord.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c +index 73a56d7ac84b7..b02778cbb1d34 100644 +--- a/fs/ntfs3/frecord.c ++++ b/fs/ntfs3/frecord.c +@@ -2100,7 +2100,7 @@ int ni_readpage_cmpr(struct ntfs_inode *ni, struct page *page) + + for (i = 0; i < pages_per_frame; i++) { + pg = pages[i]; +- if (i == idx) ++ if (i == idx || !pg) + continue; + unlock_page(pg); + put_page(pg); +-- +2.42.0 + diff --git a/queue-5.15/fs-ntfs3-use-kvmalloc-instead-of-kmalloc-.-__gfp_now.patch b/queue-5.15/fs-ntfs3-use-kvmalloc-instead-of-kmalloc-.-__gfp_now.patch new file mode 100644 index 00000000000..15473bbf332 --- /dev/null +++ b/queue-5.15/fs-ntfs3-use-kvmalloc-instead-of-kmalloc-.-__gfp_now.patch @@ -0,0 +1,80 @@ +From 0e661ec6ea95ad590e0165cbeb52efb2a281adde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 16:12:58 +0400 +Subject: fs/ntfs3: Use kvmalloc instead of kmalloc(... __GFP_NOWARN) + +From: Konstantin Komarov + +[ Upstream commit fc471e39e38fea6677017cbdd6d928088a59fc67 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrlist.c | 15 +++++++++++++-- + fs/ntfs3/bitmap.c | 3 ++- + fs/ntfs3/super.c | 2 +- + 3 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c +index 81c22df27c725..0c6a68e71e7d4 100644 +--- a/fs/ntfs3/attrlist.c ++++ b/fs/ntfs3/attrlist.c +@@ -52,7 +52,8 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + + if (!attr->non_res) { + lsize = le32_to_cpu(attr->res.data_size); +- le = kmalloc(al_aligned(lsize), GFP_NOFS | __GFP_NOWARN); ++ /* attr is resident: lsize < record_size (1K or 4K) */ ++ le = kvmalloc(al_aligned(lsize), GFP_KERNEL); + if (!le) { + err = -ENOMEM; + goto out; +@@ -80,7 +81,17 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + if (err < 0) + goto out; + +- le = kmalloc(al_aligned(lsize), GFP_NOFS | __GFP_NOWARN); ++ /* attr is nonresident. ++ * The worst case: ++ * 1T (2^40) extremely fragmented file. ++ * cluster = 4K (2^12) => 2^28 fragments ++ * 2^9 fragments per one record => 2^19 records ++ * 2^5 bytes of ATTR_LIST_ENTRY per one record => 2^24 bytes. ++ * ++ * the result is 16M bytes per attribute list. ++ * Use kvmalloc to allocate in range [several Kbytes - dozen Mbytes] ++ */ ++ le = kvmalloc(al_aligned(lsize), GFP_KERNEL); + if (!le) { + err = -ENOMEM; + goto out; +diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c +index 3261b69cdac33..21536b72aa5e5 100644 +--- a/fs/ntfs3/bitmap.c ++++ b/fs/ntfs3/bitmap.c +@@ -667,7 +667,8 @@ int wnd_init(struct wnd_bitmap *wnd, struct super_block *sb, size_t nbits) + wnd->bits_last = wbits; + + wnd->free_bits = +- kcalloc(wnd->nwnd, sizeof(u16), GFP_NOFS | __GFP_NOWARN); ++ kvmalloc_array(wnd->nwnd, sizeof(u16), GFP_KERNEL | __GFP_ZERO); ++ + if (!wnd->free_bits) + return -ENOMEM; + +diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c +index 33b1833ad525c..fbaf1c84311be 100644 +--- a/fs/ntfs3/super.c ++++ b/fs/ntfs3/super.c +@@ -1136,7 +1136,7 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc) + goto put_inode_out; + } + bytes = inode->i_size; +- sbi->def_table = t = kmalloc(bytes, GFP_NOFS | __GFP_NOWARN); ++ sbi->def_table = t = kvmalloc(bytes, GFP_KERNEL); + if (!t) { + err = -ENOMEM; + goto put_inode_out; +-- +2.42.0 + diff --git a/queue-5.15/fs-ntfs3-write-immediately-updated-ntfs-state.patch b/queue-5.15/fs-ntfs3-write-immediately-updated-ntfs-state.patch new file mode 100644 index 00000000000..22c15a81274 --- /dev/null +++ b/queue-5.15/fs-ntfs3-write-immediately-updated-ntfs-state.patch @@ -0,0 +1,44 @@ +From b2decc2c6a86501f1e86c24b3e9095faef747f56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 15:57:19 +0400 +Subject: fs/ntfs3: Write immediately updated ntfs state + +From: Konstantin Komarov + +[ Upstream commit 06ccfb00645990a9fcc14249e6d1c25921ecb836 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fsntfs.c | 13 +++---------- + 1 file changed, 3 insertions(+), 10 deletions(-) + +diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c +index 11de2d469e9e8..4413f6da68e60 100644 +--- a/fs/ntfs3/fsntfs.c ++++ b/fs/ntfs3/fsntfs.c +@@ -958,18 +958,11 @@ int ntfs_set_state(struct ntfs_sb_info *sbi, enum NTFS_DIRTY_FLAGS dirty) + if (err) + return err; + +- mark_inode_dirty(&ni->vfs_inode); ++ mark_inode_dirty_sync(&ni->vfs_inode); + /* verify(!ntfs_update_mftmirr()); */ + +- /* +- * If we used wait=1, sync_inode_metadata waits for the io for the +- * inode to finish. It hangs when media is removed. +- * So wait=0 is sent down to sync_inode_metadata +- * and filemap_fdatawrite is used for the data blocks. +- */ +- err = sync_inode_metadata(&ni->vfs_inode, 0); +- if (!err) +- err = filemap_fdatawrite(ni->vfs_inode.i_mapping); ++ /* write mft record on disk. */ ++ err = _ni_write_inode(&ni->vfs_inode, 1); + + return err; + } +-- +2.42.0 + diff --git a/queue-5.15/input-synaptics-rmi4-handle-reset-delay-when-using-s.patch b/queue-5.15/input-synaptics-rmi4-handle-reset-delay-when-using-s.patch new file mode 100644 index 00000000000..1dbc1bcbb43 --- /dev/null +++ b/queue-5.15/input-synaptics-rmi4-handle-reset-delay-when-using-s.patch @@ -0,0 +1,135 @@ +From 629db819737677489e153640ad7403051dbd2c12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Oct 2023 17:29:57 -0700 +Subject: Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport + +From: Dmitry Torokhov + +[ Upstream commit 5030b2fe6aab37fe42d14f31842ea38be7c55c57 ] + +Touch controllers need some time after receiving reset command for the +firmware to finish re-initializing and be ready to respond to commands +from the host. The driver already had handling for the post-reset delay +for I2C and SPI transports, this change adds the handling to +SMBus-connected devices. + +SMBus devices are peculiar because they implement legacy PS/2 +compatibility mode, so reset is actually issued by psmouse driver on the +associated serio port, after which the control is passed to the RMI4 +driver with SMBus companion device. + +Note that originally the delay was added to psmouse driver in +92e24e0e57f7 ("Input: psmouse - add delay when deactivating for SMBus +mode"), but that resulted in an unwanted delay in "fast" reconnect +handler for the serio port, so it was decided to revert the patch and +have the delay being handled in the RMI4 driver, similar to the other +transports. + +Tested-by: Jeffery Miller +Link: https://lore.kernel.org/r/ZR1yUFJ8a9Zt606N@penguin +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/synaptics.c | 1 + + drivers/input/rmi4/rmi_smbus.c | 50 ++++++++++++++++++--------------- + 2 files changed, 29 insertions(+), 22 deletions(-) + +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index ecc7ca653d75c..c3a341c16d45a 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -1752,6 +1752,7 @@ static int synaptics_create_intertouch(struct psmouse *psmouse, + psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids) && + !SYN_CAP_EXT_BUTTONS_STICK(info->ext_cap_10); + const struct rmi_device_platform_data pdata = { ++ .reset_delay_ms = 30, + .sensor_pdata = { + .sensor_type = rmi_sensor_touchpad, + .axis_align.flip_y = true, +diff --git a/drivers/input/rmi4/rmi_smbus.c b/drivers/input/rmi4/rmi_smbus.c +index 2407ea43de59b..f38bf9a5f599d 100644 +--- a/drivers/input/rmi4/rmi_smbus.c ++++ b/drivers/input/rmi4/rmi_smbus.c +@@ -235,12 +235,29 @@ static void rmi_smb_clear_state(struct rmi_smb_xport *rmi_smb) + + static int rmi_smb_enable_smbus_mode(struct rmi_smb_xport *rmi_smb) + { +- int retval; ++ struct i2c_client *client = rmi_smb->client; ++ int smbus_version; ++ ++ /* ++ * psmouse driver resets the controller, we only need to wait ++ * to give the firmware chance to fully reinitialize. ++ */ ++ if (rmi_smb->xport.pdata.reset_delay_ms) ++ msleep(rmi_smb->xport.pdata.reset_delay_ms); + + /* we need to get the smbus version to activate the touchpad */ +- retval = rmi_smb_get_version(rmi_smb); +- if (retval < 0) +- return retval; ++ smbus_version = rmi_smb_get_version(rmi_smb); ++ if (smbus_version < 0) ++ return smbus_version; ++ ++ rmi_dbg(RMI_DEBUG_XPORT, &client->dev, "Smbus version is %d", ++ smbus_version); ++ ++ if (smbus_version != 2 && smbus_version != 3) { ++ dev_err(&client->dev, "Unrecognized SMB version %d\n", ++ smbus_version); ++ return -ENODEV; ++ } + + return 0; + } +@@ -253,11 +270,10 @@ static int rmi_smb_reset(struct rmi_transport_dev *xport, u16 reset_addr) + rmi_smb_clear_state(rmi_smb); + + /* +- * we do not call the actual reset command, it has to be handled in +- * PS/2 or there will be races between PS/2 and SMBus. +- * PS/2 should ensure that a psmouse_reset is called before +- * intializing the device and after it has been removed to be in a known +- * state. ++ * We do not call the actual reset command, it has to be handled in ++ * PS/2 or there will be races between PS/2 and SMBus. PS/2 should ++ * ensure that a psmouse_reset is called before initializing the ++ * device and after it has been removed to be in a known state. + */ + return rmi_smb_enable_smbus_mode(rmi_smb); + } +@@ -273,7 +289,6 @@ static int rmi_smb_probe(struct i2c_client *client, + { + struct rmi_device_platform_data *pdata = dev_get_platdata(&client->dev); + struct rmi_smb_xport *rmi_smb; +- int smbus_version; + int error; + + if (!pdata) { +@@ -312,18 +327,9 @@ static int rmi_smb_probe(struct i2c_client *client, + rmi_smb->xport.proto_name = "smb"; + rmi_smb->xport.ops = &rmi_smb_ops; + +- smbus_version = rmi_smb_get_version(rmi_smb); +- if (smbus_version < 0) +- return smbus_version; +- +- rmi_dbg(RMI_DEBUG_XPORT, &client->dev, "Smbus version is %d", +- smbus_version); +- +- if (smbus_version != 2 && smbus_version != 3) { +- dev_err(&client->dev, "Unrecognized SMB version %d\n", +- smbus_version); +- return -ENODEV; +- } ++ error = rmi_smb_enable_smbus_mode(rmi_smb); ++ if (error) ++ return error; + + i2c_set_clientdata(client, rmi_smb); + +-- +2.42.0 + diff --git a/queue-5.15/irqchip-riscv-intc-mark-all-intc-nodes-as-initialize.patch b/queue-5.15/irqchip-riscv-intc-mark-all-intc-nodes-as-initialize.patch new file mode 100644 index 00000000000..9c37996f909 --- /dev/null +++ b/queue-5.15/irqchip-riscv-intc-mark-all-intc-nodes-as-initialize.patch @@ -0,0 +1,54 @@ +From 874385d140a2dfcd702018db3b49faf360d19845 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Oct 2023 10:13:51 +0530 +Subject: irqchip/riscv-intc: Mark all INTC nodes as initialized + +From: Anup Patel + +[ Upstream commit e13cd66bd821be417c498a34928652db4ac6b436 ] + +The RISC-V INTC local interrupts are per-HART (or per-CPU) so we +create INTC IRQ domain only for the INTC node belonging to the boot +HART. This means only the boot HART INTC node will be marked as +initialized and other INTC nodes won't be marked which results +downstream interrupt controllers (such as PLIC, IMSIC and APLIC +direct-mode) not being probed due to missing device suppliers. + +To address this issue, we mark all INTC node for which we don't +create IRQ domain as initialized. + +Reported-by: Dmitry Dunaev +Signed-off-by: Anup Patel +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230926102801.1591126-1-dunaev@tecon.ru +Link: https://lore.kernel.org/r/20231003044403.1974628-4-apatel@ventanamicro.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-riscv-intc.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-riscv-intc.c b/drivers/irqchip/irq-riscv-intc.c +index 8017f6d32d52b..54c99441c1b54 100644 +--- a/drivers/irqchip/irq-riscv-intc.c ++++ b/drivers/irqchip/irq-riscv-intc.c +@@ -109,8 +109,16 @@ static int __init riscv_intc_init(struct device_node *node, + * for each INTC DT node. We only need to do INTC initialization + * for the INTC DT node belonging to boot CPU (or boot HART). + */ +- if (riscv_hartid_to_cpuid(hartid) != smp_processor_id()) ++ if (riscv_hartid_to_cpuid(hartid) != smp_processor_id()) { ++ /* ++ * The INTC nodes of each CPU are suppliers for downstream ++ * interrupt controllers (such as PLIC, IMSIC and APLIC ++ * direct-mode) so we should mark an INTC node as initialized ++ * if we are not creating IRQ domain for it. ++ */ ++ fwnode_dev_initialized(of_fwnode_handle(node), true); + return 0; ++ } + + intc_domain = irq_domain_add_linear(node, BITS_PER_LONG, + &riscv_intc_domain_ops, NULL); +-- +2.42.0 + diff --git a/queue-5.15/irqchip-stm32-exti-add-missing-dt-irq-flag-translati.patch b/queue-5.15/irqchip-stm32-exti-add-missing-dt-irq-flag-translati.patch new file mode 100644 index 00000000000..51a4b69f1f1 --- /dev/null +++ b/queue-5.15/irqchip-stm32-exti-add-missing-dt-irq-flag-translati.patch @@ -0,0 +1,37 @@ +From 6db6206c31263deb27425b765c2d0b94326aa470 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Oct 2023 12:20:03 -0400 +Subject: irqchip/stm32-exti: add missing DT IRQ flag translation + +From: Ben Wolsieffer + +[ Upstream commit 8554cba1d6dbd3c74e0549e28ddbaccbb1d6b30a ] + +The STM32F4/7 EXTI driver was missing the xlate callback, so IRQ trigger +flags specified in the device tree were being ignored. This was +preventing the RTC alarm interrupt from working, because it must be set +to trigger on the rising edge to function correctly. + +Signed-off-by: Ben Wolsieffer +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20231003162003.1649967-1-ben.wolsieffer@hefring.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-stm32-exti.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c +index 33c76710f845f..9c150c402f0ba 100644 +--- a/drivers/irqchip/irq-stm32-exti.c ++++ b/drivers/irqchip/irq-stm32-exti.c +@@ -408,6 +408,7 @@ static const struct irq_domain_ops irq_exti_domain_ops = { + .map = irq_map_generic_chip, + .alloc = stm32_exti_alloc, + .free = stm32_exti_free, ++ .xlate = irq_domain_xlate_twocell, + }; + + static void stm32_irq_ack(struct irq_data *d) +-- +2.42.0 + diff --git a/queue-5.15/net-chelsio-cxgb4-add-an-error-code-check-in-t4_load.patch b/queue-5.15/net-chelsio-cxgb4-add-an-error-code-check-in-t4_load.patch new file mode 100644 index 00000000000..e3dd1c2aa35 --- /dev/null +++ b/queue-5.15/net-chelsio-cxgb4-add-an-error-code-check-in-t4_load.patch @@ -0,0 +1,35 @@ +From 2ff5aac98139d652df3d54f8591a957a8ce0a2f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 17:27:59 +0800 +Subject: net: chelsio: cxgb4: add an error code check in t4_load_phy_fw + +From: Su Hui + +[ Upstream commit 9f771493da935299c6393ad3563b581255d01a37 ] + +t4_set_params_timeout() can return -EINVAL if failed, add check +for this. + +Signed-off-by: Su Hui +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +index b1c9f65ab10f6..c99f5920c957c 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -3816,6 +3816,8 @@ int t4_load_phy_fw(struct adapter *adap, int win, + FW_PARAMS_PARAM_Z_V(FW_PARAMS_PARAM_DEV_PHYFW_DOWNLOAD)); + ret = t4_set_params_timeout(adap, adap->mbox, adap->pf, 0, 1, + ¶m, &val, 30000); ++ if (ret) ++ return ret; + + /* If we have version number support, then check to see that the new + * firmware got loaded properly. +-- +2.42.0 + diff --git a/queue-5.15/net-sched-cls_u32-fix-allocation-size-in-u32_init.patch b/queue-5.15/net-sched-cls_u32-fix-allocation-size-in-u32_init.patch new file mode 100644 index 00000000000..403895acc18 --- /dev/null +++ b/queue-5.15/net-sched-cls_u32-fix-allocation-size-in-u32_init.patch @@ -0,0 +1,105 @@ +From 80d295acb90cfa2916a010f1175d1258b29c488d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Oct 2023 15:19:37 +0200 +Subject: net: sched: cls_u32: Fix allocation size in u32_init() + +From: Gustavo A. R. Silva + +[ Upstream commit c4d49196ceec80e30e8d981410d73331b49b7850 ] + +commit d61491a51f7e ("net/sched: cls_u32: Replace one-element array +with flexible-array member") incorrecly replaced an instance of +`sizeof(*tp_c)` with `struct_size(tp_c, hlist->ht, 1)`. This results +in a an over-allocation of 8 bytes. + +This change is wrong because `hlist` in `struct tc_u_common` is a +pointer: + +net/sched/cls_u32.c: +struct tc_u_common { + struct tc_u_hnode __rcu *hlist; + void *ptr; + int refcnt; + struct idr handle_idr; + struct hlist_node hnode; + long knodes; +}; + +So, the use of `struct_size()` makes no sense: we don't need to allocate +any extra space for a flexible-array member. `sizeof(*tp_c)` is just fine. + +So, `struct_size(tp_c, hlist->ht, 1)` translates to: + +sizeof(*tp_c) + sizeof(tp_c->hlist->ht) == +sizeof(struct tc_u_common) + sizeof(struct tc_u_knode *) == + 144 + 8 == 0x98 (byes) + ^^^ + | + unnecessary extra + allocation size + +$ pahole -C tc_u_common net/sched/cls_u32.o +struct tc_u_common { + struct tc_u_hnode * hlist; /* 0 8 */ + void * ptr; /* 8 8 */ + int refcnt; /* 16 4 */ + + /* XXX 4 bytes hole, try to pack */ + + struct idr handle_idr; /* 24 96 */ + /* --- cacheline 1 boundary (64 bytes) was 56 bytes ago --- */ + struct hlist_node hnode; /* 120 16 */ + /* --- cacheline 2 boundary (128 bytes) was 8 bytes ago --- */ + long int knodes; /* 136 8 */ + + /* size: 144, cachelines: 3, members: 6 */ + /* sum members: 140, holes: 1, sum holes: 4 */ + /* last cacheline: 16 bytes */ +}; + +And with `sizeof(*tp_c)`, we have: + + sizeof(*tp_c) == sizeof(struct tc_u_common) == 144 == 0x90 (bytes) + +which is the correct and original allocation size. + +Fix this issue by replacing `struct_size(tp_c, hlist->ht, 1)` with +`sizeof(*tp_c)`, and avoid allocating 8 too many bytes. + +The following difference in binary output is expected and reflects the +desired change: + +| net/sched/cls_u32.o +| @@ -6148,7 +6148,7 @@ +| include/linux/slab.h:599 +| 2cf5: mov 0x0(%rip),%rdi # 2cfc +| 2cf8: R_X86_64_PC32 kmalloc_caches+0xc +|- 2cfc: mov $0x98,%edx +|+ 2cfc: mov $0x90,%edx + +Reported-by: Alejandro Colomar +Closes: https://lore.kernel.org/lkml/09b4a2ce-da74-3a19-6961-67883f634d98@kernel.org/ +Signed-off-by: Gustavo A. R. Silva +Acked-by: Jamal Hadi Salim +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/cls_u32.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c +index 17edcf1d1c3b6..440c29dc058ed 100644 +--- a/net/sched/cls_u32.c ++++ b/net/sched/cls_u32.c +@@ -364,7 +364,7 @@ static int u32_init(struct tcf_proto *tp) + idr_init(&root_ht->handle_idr); + + if (tp_c == NULL) { +- tp_c = kzalloc(struct_size(tp_c, hlist->ht, 1), GFP_KERNEL); ++ tp_c = kzalloc(sizeof(*tp_c), GFP_KERNEL); + if (tp_c == NULL) { + kfree(root_ht); + return -ENOBUFS; +-- +2.42.0 + diff --git a/queue-5.15/netfilter-nfnetlink_log-silence-bogus-compiler-warni.patch b/queue-5.15/netfilter-nfnetlink_log-silence-bogus-compiler-warni.patch new file mode 100644 index 00000000000..e97dc0bc617 --- /dev/null +++ b/queue-5.15/netfilter-nfnetlink_log-silence-bogus-compiler-warni.patch @@ -0,0 +1,39 @@ +From 2e588ae285189c39a2cc8a59b7a5c808004f4af1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Oct 2023 10:53:08 +0200 +Subject: netfilter: nfnetlink_log: silence bogus compiler warning + +From: Florian Westphal + +[ Upstream commit 2e1d175410972285333193837a4250a74cd472e6 ] + +net/netfilter/nfnetlink_log.c:800:18: warning: variable 'ctinfo' is uninitialized + +The warning is bogus, the variable is only used if ct is non-NULL and +always initialised in that case. Init to 0 too to silence this. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202309100514.ndBFebXN-lkp@intel.com/ +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nfnetlink_log.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c +index 7f83f9697fc14..09fe6cf358ec7 100644 +--- a/net/netfilter/nfnetlink_log.c ++++ b/net/netfilter/nfnetlink_log.c +@@ -687,8 +687,8 @@ nfulnl_log_packet(struct net *net, + unsigned int plen = 0; + struct nfnl_log_net *log = nfnl_log_pernet(net); + const struct nfnl_ct_hook *nfnl_ct = NULL; ++ enum ip_conntrack_info ctinfo = 0; + struct nf_conn *ct = NULL; +- enum ip_conntrack_info ctinfo; + + if (li_user && li_user->type == NF_LOG_TYPE_ULOG) + li = li_user; +-- +2.42.0 + diff --git a/queue-5.15/platform-mellanox-mlxbf-tmfifo-fix-a-warning-message.patch b/queue-5.15/platform-mellanox-mlxbf-tmfifo-fix-a-warning-message.patch new file mode 100644 index 00000000000..11cbe8f255a --- /dev/null +++ b/queue-5.15/platform-mellanox-mlxbf-tmfifo-fix-a-warning-message.patch @@ -0,0 +1,65 @@ +From 4c6b4544ad6147146cd5c3fddea4f18fe4b9c111 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Oct 2023 19:02:35 -0400 +Subject: platform/mellanox: mlxbf-tmfifo: Fix a warning message + +From: Liming Sun + +[ Upstream commit 99c09c985e5973c8f0ad976ebae069548dd86f12 ] + +This commit fixes the smatch static checker warning in function +mlxbf_tmfifo_rxtx_word() which complains data not initialized at +line 634 when IS_VRING_DROP() is TRUE. + +Signed-off-by: Liming Sun +Link: https://lore.kernel.org/r/20231012230235.219861-1-limings@nvidia.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-tmfifo.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c +index 194f3205e5597..767f4406e55f1 100644 +--- a/drivers/platform/mellanox/mlxbf-tmfifo.c ++++ b/drivers/platform/mellanox/mlxbf-tmfifo.c +@@ -588,24 +588,25 @@ static void mlxbf_tmfifo_rxtx_word(struct mlxbf_tmfifo_vring *vring, + + if (vring->cur_len + sizeof(u64) <= len) { + /* The whole word. */ +- if (!IS_VRING_DROP(vring)) { +- if (is_rx) ++ if (is_rx) { ++ if (!IS_VRING_DROP(vring)) + memcpy(addr + vring->cur_len, &data, + sizeof(u64)); +- else +- memcpy(&data, addr + vring->cur_len, +- sizeof(u64)); ++ } else { ++ memcpy(&data, addr + vring->cur_len, ++ sizeof(u64)); + } + vring->cur_len += sizeof(u64); + } else { + /* Leftover bytes. */ +- if (!IS_VRING_DROP(vring)) { +- if (is_rx) ++ if (is_rx) { ++ if (!IS_VRING_DROP(vring)) + memcpy(addr + vring->cur_len, &data, + len - vring->cur_len); +- else +- memcpy(&data, addr + vring->cur_len, +- len - vring->cur_len); ++ } else { ++ data = 0; ++ memcpy(&data, addr + vring->cur_len, ++ len - vring->cur_len); + } + vring->cur_len = len; + } +-- +2.42.0 + diff --git a/queue-5.15/powerpc-85xx-fix-math-emulation-exception.patch b/queue-5.15/powerpc-85xx-fix-math-emulation-exception.patch new file mode 100644 index 00000000000..8f02c27105d --- /dev/null +++ b/queue-5.15/powerpc-85xx-fix-math-emulation-exception.patch @@ -0,0 +1,47 @@ +From d4c7c7d95f30a4d6d25af30b6c6aa30d5a1502f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Sep 2023 17:55:51 +0200 +Subject: powerpc/85xx: Fix math emulation exception + +From: Christophe Leroy + +[ Upstream commit 8e8a12ecbc86700b5e1a3596ce2b3c43dafad336 ] + +Booting mpc85xx_defconfig kernel on QEMU leads to: + +Bad trap at PC: fe9bab0, SR: 2d000, vector=800 +awk[82]: unhandled trap (5) at 0 nip fe9bab0 lr fe9e01c code 5 in libc-2.27.so[fe5a000+17a000] +awk[82]: code: 3aa00000 3a800010 4bffe03c 9421fff0 7ca62b78 38a00000 93c10008 83c10008 +awk[82]: code: 38210010 4bffdec8 9421ffc0 7c0802a6 d8010008 4815190d 93810030 +Trace/breakpoint trap +WARNING: no useful console + +This is because allthough CONFIG_MATH_EMULATION is selected, +Exception 800 calls unknown_exception(). + +Call emulation_assist_interrupt() instead. + +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/066caa6d9480365da9b8ed83692d7101e10ac5f8.1695657339.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/head_fsl_booke.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/head_fsl_booke.S b/arch/powerpc/kernel/head_fsl_booke.S +index 0a9a0f301474d..40687e271c106 100644 +--- a/arch/powerpc/kernel/head_fsl_booke.S ++++ b/arch/powerpc/kernel/head_fsl_booke.S +@@ -394,7 +394,7 @@ interrupt_base: + #ifdef CONFIG_PPC_FPU + FP_UNAVAILABLE_EXCEPTION + #else +- EXCEPTION(0x0800, FP_UNAVAIL, FloatingPointUnavailable, unknown_exception) ++ EXCEPTION(0x0800, FP_UNAVAIL, FloatingPointUnavailable, emulation_assist_interrupt) + #endif + + /* System Call Interrupt */ +-- +2.42.0 + diff --git a/queue-5.15/powerpc-mm-fix-boot-crash-with-flatmem.patch b/queue-5.15/powerpc-mm-fix-boot-crash-with-flatmem.patch new file mode 100644 index 00000000000..5b288f87390 --- /dev/null +++ b/queue-5.15/powerpc-mm-fix-boot-crash-with-flatmem.patch @@ -0,0 +1,143 @@ +From 9238191c8cb3b7585bd5d0137d3fe944d0149999 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Oct 2023 22:25:00 +1100 +Subject: powerpc/mm: Fix boot crash with FLATMEM + +From: Michael Ellerman + +[ Upstream commit daa9ada2093ed23d52b4c1fe6e13cf78f55cc85f ] + +Erhard reported that his G5 was crashing with v6.6-rc kernels: + + mpic: Setting up HT PICs workarounds for U3/U4 + BUG: Unable to handle kernel data access at 0xfeffbb62ffec65fe + Faulting instruction address: 0xc00000000005dc40 + Oops: Kernel access of bad area, sig: 11 [#1] + BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2 PowerMac + Modules linked in: + CPU: 0 PID: 0 Comm: swapper/0 Tainted: G T 6.6.0-rc3-PMacGS #1 + Hardware name: PowerMac11,2 PPC970MP 0x440101 PowerMac + NIP: c00000000005dc40 LR: c000000000066660 CTR: c000000000007730 + REGS: c0000000022bf510 TRAP: 0380 Tainted: G T (6.6.0-rc3-PMacGS) + MSR: 9000000000001032 CR: 44004242 XER: 00000000 + IRQMASK: 3 + GPR00: 0000000000000000 c0000000022bf7b0 c0000000010c0b00 00000000000001ac + GPR04: 0000000003c80000 0000000000000300 c0000000f20001ae 0000000000000300 + GPR08: 0000000000000006 feffbb62ffec65ff 0000000000000001 0000000000000000 + GPR12: 9000000000001032 c000000002362000 c000000000f76b80 000000000349ecd8 + GPR16: 0000000002367ba8 0000000002367f08 0000000000000006 0000000000000000 + GPR20: 00000000000001ac c000000000f6f920 c0000000022cd985 000000000000000c + GPR24: 0000000000000300 00000003b0a3691d c0003e008030000e 0000000000000000 + GPR28: c00000000000000c c0000000f20001ee feffbb62ffec65fe 00000000000001ac + NIP hash_page_do_lazy_icache+0x50/0x100 + LR __hash_page_4K+0x420/0x590 + Call Trace: + hash_page_mm+0x364/0x6f0 + do_hash_fault+0x114/0x2b0 + data_access_common_virt+0x198/0x1f0 + --- interrupt: 300 at mpic_init+0x4bc/0x10c4 + NIP: c000000002020a5c LR: c000000002020a04 CTR: 0000000000000000 + REGS: c0000000022bf9f0 TRAP: 0300 Tainted: G T (6.6.0-rc3-PMacGS) + MSR: 9000000000001032 CR: 24004248 XER: 00000000 + DAR: c0003e008030000e DSISR: 40000000 IRQMASK: 1 + ... + NIP mpic_init+0x4bc/0x10c4 + LR mpic_init+0x464/0x10c4 + --- interrupt: 300 + pmac_setup_one_mpic+0x258/0x2dc + pmac_pic_init+0x28c/0x3d8 + init_IRQ+0x90/0x140 + start_kernel+0x57c/0x78c + start_here_common+0x1c/0x20 + +A bisect pointed to the breakage beginning with commit 9fee28baa601 ("powerpc: +implement the new page table range API"). + +Analysis of the oops pointed to a struct page with a corrupted +compound_head being loaded via page_folio() -> _compound_head() in +hash_page_do_lazy_icache(). + +The access by the mpic code is to an MMIO address, so the expectation +is that the struct page for that address would be initialised by +init_unavailable_range(), as pointed out by Aneesh. + +Instrumentation showed that was not the case, which eventually lead to +the realisation that pfn_valid() was returning false for that address, +causing the struct page to not be initialised. + +Because the system is using FLATMEM, the version of pfn_valid() in +memory_model.h is used: + +static inline int pfn_valid(unsigned long pfn) +{ + ... + return pfn >= pfn_offset && (pfn - pfn_offset) < max_mapnr; +} + +Which relies on max_mapnr being initialised. Early in boot max_mapnr is +zero meaning no PFNs are valid. + +max_mapnr is initialised in mem_init() called via: + + start_kernel() + mm_core_init() # init/main.c:928 + mem_init() + +But that is too late for the usage in init_unavailable_range() called via: + + start_kernel() + setup_arch() # init/main.c:893 + paging_init() + free_area_init() + init_unavailable_range() + +Although max_mapnr is currently set in mem_init(), the value is actually +already available much earlier, as soon as mem_topology_setup() has +completed, which is also before paging_init() is called. So move the +initialisation there, which causes paging_init() to correctly initialise +the struct page and fixes the bug. + +This bug seems to have been lurking for years, but went unnoticed +because the pre-folio code was inspecting the uninitialised page->flags +but not dereferencing it. + +Thanks to Erhard and Aneesh for help debugging. + +Reported-by: Erhard Furtner +Closes: https://lore.kernel.org/all/20230929132750.3cd98452@yea/ +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20231023112500.1550208-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/setup-common.c | 2 ++ + arch/powerpc/mm/mem.c | 1 - + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c +index b1e43b69a559d..42338e2921d64 100644 +--- a/arch/powerpc/kernel/setup-common.c ++++ b/arch/powerpc/kernel/setup-common.c +@@ -887,6 +887,8 @@ void __init setup_arch(char **cmdline_p) + + /* Parse memory topology */ + mem_topology_setup(); ++ /* Set max_mapnr before paging_init() */ ++ set_max_mapnr(max_pfn); + + /* + * Release secondary cpus out of their spinloops at 0x60 now that +diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c +index 6902f453c7451..01fc77564cac1 100644 +--- a/arch/powerpc/mm/mem.c ++++ b/arch/powerpc/mm/mem.c +@@ -288,7 +288,6 @@ void __init mem_init(void) + #endif + + high_memory = (void *) __va(max_low_pfn * PAGE_SIZE); +- set_max_mapnr(max_pfn); + + kasan_late_init(); + +-- +2.42.0 + diff --git a/queue-5.15/r8152-check-for-unplug-in-r8153b_ups_en-r8153c_ups_e.patch b/queue-5.15/r8152-check-for-unplug-in-r8153b_ups_en-r8153c_ups_e.patch new file mode 100644 index 00000000000..359f0f14892 --- /dev/null +++ b/queue-5.15/r8152-check-for-unplug-in-r8153b_ups_en-r8153c_ups_e.patch @@ -0,0 +1,47 @@ +From c770cd4b80473820ce307c9fdd2b4da0e05a3687 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 14:06:57 -0700 +Subject: r8152: Check for unplug in r8153b_ups_en() / r8153c_ups_en() + +From: Douglas Anderson + +[ Upstream commit bc65cc42af737a5a35f83842408ef2c6c79ba025 ] + +If the adapter is unplugged while we're looping in r8153b_ups_en() / +r8153c_ups_en() we could end up looping for 10 seconds (20 ms * 500 +loops). Add code similar to what's done in other places in the driver +to check for unplug and bail. + +Signed-off-by: Douglas Anderson +Reviewed-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 15610d7d677ce..663e3880bf713 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -3648,6 +3648,8 @@ static void r8153b_ups_en(struct r8152 *tp, bool enable) + int i; + + for (i = 0; i < 500; i++) { ++ if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ return; + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) + break; +@@ -3688,6 +3690,8 @@ static void r8153c_ups_en(struct r8152 *tp, bool enable) + int i; + + for (i = 0; i < 500; i++) { ++ if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ return; + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) + break; +-- +2.42.0 + diff --git a/queue-5.15/r8152-check-for-unplug-in-rtl_phy_patch_request.patch b/queue-5.15/r8152-check-for-unplug-in-rtl_phy_patch_request.patch new file mode 100644 index 00000000000..5153eedb845 --- /dev/null +++ b/queue-5.15/r8152-check-for-unplug-in-rtl_phy_patch_request.patch @@ -0,0 +1,39 @@ +From e6429ccc547f6a0b39db2bd0ac4f583016bdd56d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 14:06:56 -0700 +Subject: r8152: Check for unplug in rtl_phy_patch_request() + +From: Douglas Anderson + +[ Upstream commit dc90ba37a8c37042407fa6970b9830890cfe6047 ] + +If the adapter is unplugged while we're looping in +rtl_phy_patch_request() we could end up looping for 10 seconds (2 ms * +5000 loops). Add code similar to what's done in other places in the +driver to check for unplug and bail. + +Signed-off-by: Douglas Anderson +Reviewed-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index f6d5fbb9dee07..15610d7d677ce 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -4051,6 +4051,9 @@ static int rtl_phy_patch_request(struct r8152 *tp, bool request, bool wait) + for (i = 0; wait && i < 5000; i++) { + u32 ocp_data; + ++ if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ break; ++ + usleep_range(1000, 2000); + ocp_data = ocp_reg_read(tp, OCP_PHY_PATCH_STAT); + if ((ocp_data & PATCH_READY) ^ check) +-- +2.42.0 + diff --git a/queue-5.15/r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch b/queue-5.15/r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch new file mode 100644 index 00000000000..b7fcd89d1a1 --- /dev/null +++ b/queue-5.15/r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch @@ -0,0 +1,457 @@ +From 1389477e0fe15ac39335d863008fc195e1233590 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 14:06:58 -0700 +Subject: r8152: Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE + +From: Douglas Anderson + +[ Upstream commit 715f67f33af45ce2cc3a5b1ef133cc8c8e7787b0 ] + +Whenever the RTL8152_UNPLUG is set that just tells the driver that all +accesses will fail and we should just immediately bail. A future patch +will use this same concept at a time when the driver hasn't actually +been unplugged but is about to be reset. Rename the flag in +preparation for the future patch. + +This is a no-op change and just a search and replace. + +Signed-off-by: Douglas Anderson +Reviewed-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 96 ++++++++++++++++++++--------------------- + 1 file changed, 48 insertions(+), 48 deletions(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 663e3880bf713..7a353409928a6 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -763,7 +763,7 @@ enum rtl_register_content { + + /* rtl8152 flags */ + enum rtl8152_flags { +- RTL8152_UNPLUG = 0, ++ RTL8152_INACCESSIBLE = 0, + RTL8152_SET_RX_MODE, + WORK_ENABLE, + RTL8152_LINK_CHG, +@@ -1241,7 +1241,7 @@ int set_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data) + static void rtl_set_unplug(struct r8152 *tp) + { + if (tp->udev->state == USB_STATE_NOTATTACHED) { +- set_bit(RTL8152_UNPLUG, &tp->flags); ++ set_bit(RTL8152_INACCESSIBLE, &tp->flags); + smp_mb__after_atomic(); + } + } +@@ -1252,7 +1252,7 @@ static int generic_ocp_read(struct r8152 *tp, u16 index, u16 size, + u16 limit = 64; + int ret = 0; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + /* both size and indix must be 4 bytes align */ +@@ -1296,7 +1296,7 @@ static int generic_ocp_write(struct r8152 *tp, u16 index, u16 byteen, + u16 byteen_start, byteen_end, byen; + u16 limit = 512; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + /* both size and indix must be 4 bytes align */ +@@ -1526,7 +1526,7 @@ static int read_mii_word(struct net_device *netdev, int phy_id, int reg) + struct r8152 *tp = netdev_priv(netdev); + int ret; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + if (phy_id != R8152_PHY_ID) +@@ -1542,7 +1542,7 @@ void write_mii_word(struct net_device *netdev, int phy_id, int reg, int val) + { + struct r8152 *tp = netdev_priv(netdev); + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (phy_id != R8152_PHY_ID) +@@ -1747,7 +1747,7 @@ static void read_bulk_callback(struct urb *urb) + if (!tp) + return; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (!test_bit(WORK_ENABLE, &tp->flags)) +@@ -1839,7 +1839,7 @@ static void write_bulk_callback(struct urb *urb) + if (!test_bit(WORK_ENABLE, &tp->flags)) + return; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (!skb_queue_empty(&tp->tx_queue)) +@@ -1860,7 +1860,7 @@ static void intr_callback(struct urb *urb) + if (!test_bit(WORK_ENABLE, &tp->flags)) + return; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + switch (status) { +@@ -2604,7 +2604,7 @@ static void bottom_half(struct tasklet_struct *t) + { + struct r8152 *tp = from_tasklet(tp, t, tx_tl); + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (!test_bit(WORK_ENABLE, &tp->flags)) +@@ -2647,7 +2647,7 @@ int r8152_submit_rx(struct r8152 *tp, struct rx_agg *agg, gfp_t mem_flags) + int ret; + + /* The rx would be stopped, so skip submitting */ +- if (test_bit(RTL8152_UNPLUG, &tp->flags) || ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags) || + !test_bit(WORK_ENABLE, &tp->flags) || !netif_carrier_ok(tp->netdev)) + return 0; + +@@ -3043,7 +3043,7 @@ static int rtl_enable(struct r8152 *tp) + + static int rtl8152_enable(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + set_tx_qlen(tp); +@@ -3130,7 +3130,7 @@ static int rtl8153_enable(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + set_tx_qlen(tp); +@@ -3162,7 +3162,7 @@ static void rtl_disable(struct r8152 *tp) + u32 ocp_data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -3616,7 +3616,7 @@ static u16 r8153_phy_status(struct r8152 *tp, u16 desired) + } + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + break; + } + +@@ -3648,7 +3648,7 @@ static void r8153b_ups_en(struct r8152 *tp, bool enable) + int i; + + for (i = 0; i < 500; i++) { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) +@@ -3690,7 +3690,7 @@ static void r8153c_ups_en(struct r8152 *tp, bool enable) + int i; + + for (i = 0; i < 500; i++) { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) +@@ -4055,8 +4055,8 @@ static int rtl_phy_patch_request(struct r8152 *tp, bool request, bool wait) + for (i = 0; wait && i < 5000; i++) { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) +- break; ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ return -ENODEV; + + usleep_range(1000, 2000); + ocp_data = ocp_reg_read(tp, OCP_PHY_PATCH_STAT); +@@ -6019,7 +6019,7 @@ static int rtl8156_enable(struct r8152 *tp) + u32 ocp_data; + u16 speed; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + r8156_fc_parameter(tp); +@@ -6077,7 +6077,7 @@ static int rtl8156b_enable(struct r8152 *tp) + u32 ocp_data; + u16 speed; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + set_tx_qlen(tp); +@@ -6263,7 +6263,7 @@ static int rtl8152_set_speed(struct r8152 *tp, u8 autoneg, u32 speed, u8 duplex, + + static void rtl8152_up(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8152_aldps_en(tp, false); +@@ -6273,7 +6273,7 @@ static void rtl8152_up(struct r8152 *tp) + + static void rtl8152_down(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -6288,7 +6288,7 @@ static void rtl8153_up(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153_u1u2en(tp, false); +@@ -6328,7 +6328,7 @@ static void rtl8153_down(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -6349,7 +6349,7 @@ static void rtl8153b_up(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -6373,7 +6373,7 @@ static void rtl8153b_down(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -6410,7 +6410,7 @@ static void rtl8153c_up(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -6491,7 +6491,7 @@ static void rtl8156_up(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -6564,7 +6564,7 @@ static void rtl8156_down(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -6702,7 +6702,7 @@ static void rtl_work_func_t(struct work_struct *work) + /* If the device is unplugged or !netif_running(), the workqueue + * doesn't need to wake the device, and could return directly. + */ +- if (test_bit(RTL8152_UNPLUG, &tp->flags) || !netif_running(tp->netdev)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags) || !netif_running(tp->netdev)) + return; + + if (usb_autopm_get_interface(tp->intf) < 0) +@@ -6741,7 +6741,7 @@ static void rtl_hw_phy_work_func_t(struct work_struct *work) + { + struct r8152 *tp = container_of(work, struct r8152, hw_phy_work.work); + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (usb_autopm_get_interface(tp->intf) < 0) +@@ -6868,7 +6868,7 @@ static int rtl8152_close(struct net_device *netdev) + netif_stop_queue(netdev); + + res = usb_autopm_get_interface(tp->intf); +- if (res < 0 || test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (res < 0 || test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + rtl_stop_rx(tp); + } else { +@@ -6901,7 +6901,7 @@ static void r8152b_init(struct r8152 *tp) + u32 ocp_data; + u16 data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + data = r8152_mdio_read(tp, MII_BMCR); +@@ -6945,7 +6945,7 @@ static void r8153_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153_u1u2en(tp, false); +@@ -6956,7 +6956,7 @@ static void r8153_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + break; + } + +@@ -7085,7 +7085,7 @@ static void r8153b_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -7096,7 +7096,7 @@ static void r8153b_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + break; + } + +@@ -7167,7 +7167,7 @@ static void r8153c_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -7187,7 +7187,7 @@ static void r8153c_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + } + +@@ -8016,7 +8016,7 @@ static void r8156_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_ECM_OP); +@@ -8037,7 +8037,7 @@ static void r8156_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + } + +@@ -8112,7 +8112,7 @@ static void r8156b_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_ECM_OP); +@@ -8146,7 +8146,7 @@ static void r8156b_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + } + +@@ -9208,7 +9208,7 @@ static int rtl8152_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd) + struct mii_ioctl_data *data = if_mii(rq); + int res; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + res = usb_autopm_get_interface(tp->intf); +@@ -9310,7 +9310,7 @@ static const struct net_device_ops rtl8152_netdev_ops = { + + static void rtl8152_unload(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (tp->version != RTL_VER_01) +@@ -9319,7 +9319,7 @@ static void rtl8152_unload(struct r8152 *tp) + + static void rtl8153_unload(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153_power_cut_en(tp, false); +@@ -9327,7 +9327,7 @@ static void rtl8153_unload(struct r8152 *tp) + + static void rtl8153b_unload(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_power_cut_en(tp, false); +-- +2.42.0 + diff --git a/queue-5.15/scsi-mpt3sas-fix-in-error-path.patch b/queue-5.15/scsi-mpt3sas-fix-in-error-path.patch new file mode 100644 index 00000000000..0e065ef0f50 --- /dev/null +++ b/queue-5.15/scsi-mpt3sas-fix-in-error-path.patch @@ -0,0 +1,39 @@ +From 08021e493965cc5b4930561529e352b299d19619 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Oct 2023 13:45:29 +0200 +Subject: scsi: mpt3sas: Fix in error path + +From: Tomas Henzl + +[ Upstream commit e40c04ade0e2f3916b78211d747317843b11ce10 ] + +The driver should be deregistered as misc driver after PCI registration +failure. + +Signed-off-by: Tomas Henzl +Link: https://lore.kernel.org/r/20231015114529.10725-1-thenzl@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +index 9eb3d0b4891dd..c9f85605349bf 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -12899,8 +12899,10 @@ _mpt3sas_init(void) + mpt3sas_ctl_init(hbas_to_enumerate); + + error = pci_register_driver(&mpt3sas_driver); +- if (error) ++ if (error) { ++ mpt3sas_ctl_exit(hbas_to_enumerate); + scsih_exit(); ++ } + + return error; + } +-- +2.42.0 + diff --git a/queue-5.15/series b/queue-5.15/series index c06587a2e36..f90ab59c2c4 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -72,3 +72,30 @@ rpmsg-fix-calling-device_lock-on-non-initialized-device.patch rpmsg-glink-release-driver_override.patch rpmsg-fix-possible-refcount-leak-in-rpmsg_register_device_override.patch x86-fix-.brk-attribute-in-linker-script.patch +asoc-simple-card-fixup-asoc_simple_probe-error-handl.patch +net-sched-cls_u32-fix-allocation-size-in-u32_init.patch +irqchip-riscv-intc-mark-all-intc-nodes-as-initialize.patch +irqchip-stm32-exti-add-missing-dt-irq-flag-translati.patch +dmaengine-ste_dma40-fix-pm-disable-depth-imbalance-i.patch +powerpc-85xx-fix-math-emulation-exception.patch +input-synaptics-rmi4-handle-reset-delay-when-using-s.patch +fbdev-atyfb-only-use-ioremap_uc-on-i386-and-ia64.patch +fs-ntfs3-add-ckeck-in-ni_update_parent.patch +fs-ntfs3-write-immediately-updated-ntfs-state.patch +fs-ntfs3-use-kvmalloc-instead-of-kmalloc-.-__gfp_now.patch +fs-ntfs3-fix-possible-null-ptr-deref-in-ni_readpage_.patch +fs-ntfs3-fix-null-pointer-dereference-on-error-in-at.patch +fs-ntfs3-fix-directory-element-type-detection.patch +fs-ntfs3-avoid-possible-memory-leak.patch +spi-npcm-fiu-fix-uma-reads-when-dummy.nbytes-0.patch +netfilter-nfnetlink_log-silence-bogus-compiler-warni.patch +asoc-rt5650-fix-the-wrong-result-of-key-button.patch +drm-ttm-reorder-sys-manager-cleanup-step.patch +fbdev-uvesafb-call-cn_del_callback-at-the-end-of-uve.patch +scsi-mpt3sas-fix-in-error-path.patch +platform-mellanox-mlxbf-tmfifo-fix-a-warning-message.patch +net-chelsio-cxgb4-add-an-error-code-check-in-t4_load.patch +r8152-check-for-unplug-in-rtl_phy_patch_request.patch +r8152-check-for-unplug-in-r8153b_ups_en-r8153c_ups_e.patch +r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch +powerpc-mm-fix-boot-crash-with-flatmem.patch diff --git a/queue-5.15/spi-npcm-fiu-fix-uma-reads-when-dummy.nbytes-0.patch b/queue-5.15/spi-npcm-fiu-fix-uma-reads-when-dummy.nbytes-0.patch new file mode 100644 index 00000000000..bcd9d1bfef1 --- /dev/null +++ b/queue-5.15/spi-npcm-fiu-fix-uma-reads-when-dummy.nbytes-0.patch @@ -0,0 +1,40 @@ +From 8e35869c95694b704c2424da7efeb29975e272de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Sep 2023 11:28:12 -0700 +Subject: spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0 + +From: William A. Kennington III + +[ Upstream commit 2ec8b010979036c2fe79a64adb6ecc0bd11e91d1 ] + +We don't want to use the value of ilog2(0) as dummy.buswidth is 0 when +dummy.nbytes is 0. Since we have no dummy bytes, we don't need to +configure the dummy byte bits per clock register value anyway. + +Signed-off-by: "William A. Kennington III" +Link: https://lore.kernel.org/r/20230922182812.2728066-1-william@wkennington.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-npcm-fiu.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-npcm-fiu.c b/drivers/spi/spi-npcm-fiu.c +index b62471ab6d7f2..1edaf22e265bf 100644 +--- a/drivers/spi/spi-npcm-fiu.c ++++ b/drivers/spi/spi-npcm-fiu.c +@@ -334,8 +334,9 @@ static int npcm_fiu_uma_read(struct spi_mem *mem, + uma_cfg |= ilog2(op->cmd.buswidth); + uma_cfg |= ilog2(op->addr.buswidth) + << NPCM_FIU_UMA_CFG_ADBPCK_SHIFT; +- uma_cfg |= ilog2(op->dummy.buswidth) +- << NPCM_FIU_UMA_CFG_DBPCK_SHIFT; ++ if (op->dummy.nbytes) ++ uma_cfg |= ilog2(op->dummy.buswidth) ++ << NPCM_FIU_UMA_CFG_DBPCK_SHIFT; + uma_cfg |= ilog2(op->data.buswidth) + << NPCM_FIU_UMA_CFG_RDBPCK_SHIFT; + uma_cfg |= op->dummy.nbytes << NPCM_FIU_UMA_CFG_DBSIZ_SHIFT; +-- +2.42.0 +