From: Greg Kroah-Hartman Date: Tue, 30 Jul 2024 10:32:14 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v6.1.103~34 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5ade0c82a7c4932367ae5a9982b09bd5cf88cda8;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: drm-panfrost-mark-simple_ondemand-governor-as-softdep.patch mips-dts-loongson-fix-gmac-phy-node.patch mips-ip30-ip30-console-add-missing-include.patch mips-loongson64-env-hook-up-loongsson-2k.patch mips-loongson64-remove-memory-node-for-builtin-dtb.patch mips-loongson64-reset-prioritise-firmware-service.patch mips-loongson64-test-register-availability-before-use.patch platform-mips-cpu_hwmon-disable-driver-on-unsupported-hardware.patch rbd-don-t-assume-rbd_is_lock_owner-for-exclusive-mappings.patch rdma-iwcm-fix-a-use-after-free-related-to-destroying-cm-ids.patch remoteproc-imx_rproc-skip-over-memory-region-when-node-value-is-null.patch remoteproc-stm32_rproc-fix-mailbox-interrupts-queuing.patch selftests-sigaltstack-fix-ppc64-gcc-build.patch --- diff --git a/queue-5.15/drm-panfrost-mark-simple_ondemand-governor-as-softdep.patch b/queue-5.15/drm-panfrost-mark-simple_ondemand-governor-as-softdep.patch new file mode 100644 index 00000000000..23e5823171a --- /dev/null +++ b/queue-5.15/drm-panfrost-mark-simple_ondemand-governor-as-softdep.patch @@ -0,0 +1,64 @@ +From 80f4e62730a91572b7fdc657f7bb747e107ae308 Mon Sep 17 00:00:00 2001 +From: Dragan Simic +Date: Mon, 17 Jun 2024 22:17:48 +0200 +Subject: drm/panfrost: Mark simple_ondemand governor as softdep + +From: Dragan Simic + +commit 80f4e62730a91572b7fdc657f7bb747e107ae308 upstream. + +Panfrost DRM driver uses devfreq to perform DVFS, while using simple_ondemand +devfreq governor by default. This causes driver initialization to fail on +boot when simple_ondemand governor isn't built into the kernel statically, +as a result of the missing module dependency and, consequently, the required +governor module not being included in the initial ramdisk. Thus, let's mark +simple_ondemand governor as a softdep for Panfrost, to have its kernel module +included in the initial ramdisk. + +This is a rather longstanding issue that has forced distributions to build +devfreq governors statically into their kernels, [1][2] or has forced users +to introduce some unnecessary workarounds. [3] + +For future reference, not having support for the simple_ondemand governor in +the initial ramdisk produces errors in the kernel log similar to these below, +which were taken from a Pine64 RockPro64: + + panfrost ff9a0000.gpu: [drm:panfrost_devfreq_init [panfrost]] *ERROR* Couldn't initialize GPU devfreq + panfrost ff9a0000.gpu: Fatal error during GPU init + panfrost: probe of ff9a0000.gpu failed with error -22 + +Having simple_ondemand marked as a softdep for Panfrost may not resolve this +issue for all Linux distributions. In particular, it will remain unresolved +for the distributions whose utilities for the initial ramdisk generation do +not handle the available softdep information [4] properly yet. However, some +Linux distributions already handle softdeps properly while generating their +initial ramdisks, [5] and this is a prerequisite step in the right direction +for the distributions that don't handle them properly yet. + +[1] https://gitlab.manjaro.org/manjaro-arm/packages/core/linux/-/blob/linux61/config?ref_type=heads#L8180 +[2] https://salsa.debian.org/kernel-team/linux/-/merge_requests/1066 +[3] https://forum.pine64.org/showthread.php?tid=15458 +[4] https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git/commit/?id=49d8e0b59052999de577ab732b719cfbeb89504d +[5] https://github.com/archlinux/mkinitcpio/commit/97ac4d37aae084a050be512f6d8f4489054668ad + +Cc: Diederik de Haas +Cc: Furkan Kardame +Cc: stable@vger.kernel.org +Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver") +Signed-off-by: Dragan Simic +Reviewed-by: Steven Price +Reviewed-by: Boris Brezillon +Signed-off-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/4e1e00422a14db4e2a80870afb704405da16fd1b.1718655077.git.dsimic@manjaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/panfrost/panfrost_drv.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/panfrost/panfrost_drv.c ++++ b/drivers/gpu/drm/panfrost/panfrost_drv.c +@@ -687,3 +687,4 @@ module_platform_driver(panfrost_driver); + MODULE_AUTHOR("Panfrost Project Developers"); + MODULE_DESCRIPTION("Panfrost DRM Driver"); + MODULE_LICENSE("GPL v2"); ++MODULE_SOFTDEP("pre: governor_simpleondemand"); diff --git a/queue-5.15/mips-dts-loongson-fix-gmac-phy-node.patch b/queue-5.15/mips-dts-loongson-fix-gmac-phy-node.patch new file mode 100644 index 00000000000..d9d67b6abc1 --- /dev/null +++ b/queue-5.15/mips-dts-loongson-fix-gmac-phy-node.patch @@ -0,0 +1,44 @@ +From 813c18d1ca1987afaf47e035152e1baa1375b1b2 Mon Sep 17 00:00:00 2001 +From: Jiaxun Yang +Date: Fri, 14 Jun 2024 16:40:12 +0100 +Subject: MIPS: dts: loongson: Fix GMAC phy node + +From: Jiaxun Yang + +commit 813c18d1ca1987afaf47e035152e1baa1375b1b2 upstream. + +phy-mode should be rgmii-id to match hardware configuration. + +Also there should be a phy-handle to reference phy node. + +Fixes: f8a11425075f ("MIPS: Loongson64: Add GMAC support for Loongson-2K1000") +Cc: stable@vger.kernel.org +Signed-off-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi ++++ b/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi +@@ -125,7 +125,8 @@ + <13 IRQ_TYPE_LEVEL_LOW>; + interrupt-names = "macirq", "eth_lpi"; + interrupt-parent = <&liointc0>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; ++ phy-handle = <&phy1>; + mdio { + #address-cells = <1>; + #size-cells = <0>; +@@ -148,7 +149,8 @@ + <15 IRQ_TYPE_LEVEL_LOW>; + interrupt-names = "macirq", "eth_lpi"; + interrupt-parent = <&liointc0>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; ++ phy-handle = <&phy1>; + mdio { + #address-cells = <1>; + #size-cells = <0>; diff --git a/queue-5.15/mips-ip30-ip30-console-add-missing-include.patch b/queue-5.15/mips-ip30-ip30-console-add-missing-include.patch new file mode 100644 index 00000000000..1009e903871 --- /dev/null +++ b/queue-5.15/mips-ip30-ip30-console-add-missing-include.patch @@ -0,0 +1,36 @@ +From 8de4ed75bd14ed197119ac509c6902a8561e0c1c Mon Sep 17 00:00:00 2001 +From: Jiaxun Yang +Date: Sun, 16 Jun 2024 18:54:24 +0100 +Subject: MIPS: ip30: ip30-console: Add missing include +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jiaxun Yang + +commit 8de4ed75bd14ed197119ac509c6902a8561e0c1c upstream. + +Include linux/processor.h to fix build error: + +arch/mips/sgi-ip30/ip30-console.c: In function ‘prom_putchar’: +arch/mips/sgi-ip30/ip30-console.c:21:17: error: implicit declaration of function ‘cpu_relax’ [-Werror=implicit-function-declaration] + 21 | cpu_relax(); + +Cc: stable@vger.kernel.org +Signed-off-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/sgi-ip30/ip30-console.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/mips/sgi-ip30/ip30-console.c ++++ b/arch/mips/sgi-ip30/ip30-console.c +@@ -1,6 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0 + + #include ++#include + + #include + diff --git a/queue-5.15/mips-loongson64-env-hook-up-loongsson-2k.patch b/queue-5.15/mips-loongson64-env-hook-up-loongsson-2k.patch new file mode 100644 index 00000000000..84fc8c5a902 --- /dev/null +++ b/queue-5.15/mips-loongson64-env-hook-up-loongsson-2k.patch @@ -0,0 +1,65 @@ +From 77543269ff23c75bebfb8e6e9a1177b350908ea7 Mon Sep 17 00:00:00 2001 +From: Jiaxun Yang +Date: Fri, 14 Jun 2024 16:40:18 +0100 +Subject: MIPS: Loongson64: env: Hook up Loongsson-2K + +From: Jiaxun Yang + +commit 77543269ff23c75bebfb8e6e9a1177b350908ea7 upstream. + +Somehow those enablement bits were left over when we were +adding initial Loongson-2K support. + +Set up basic information and select proper builtin DTB for +Loongson-2K. + +Cc: stable@vger.kernel.org +Signed-off-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/include/asm/mach-loongson64/boot_param.h | 2 ++ + arch/mips/loongson64/env.c | 8 ++++++++ + 2 files changed, 10 insertions(+) + +--- a/arch/mips/include/asm/mach-loongson64/boot_param.h ++++ b/arch/mips/include/asm/mach-loongson64/boot_param.h +@@ -42,12 +42,14 @@ enum loongson_cpu_type { + Legacy_1B = 0x5, + Legacy_2G = 0x6, + Legacy_2H = 0x7, ++ Legacy_2K = 0x8, + Loongson_1A = 0x100, + Loongson_1B = 0x101, + Loongson_2E = 0x200, + Loongson_2F = 0x201, + Loongson_2G = 0x202, + Loongson_2H = 0x203, ++ Loongson_2K = 0x204, + Loongson_3A = 0x300, + Loongson_3B = 0x301 + }; +--- a/arch/mips/loongson64/env.c ++++ b/arch/mips/loongson64/env.c +@@ -88,6 +88,12 @@ void __init prom_lefi_init_env(void) + cpu_clock_freq = ecpu->cpu_clock_freq; + loongson_sysconf.cputype = ecpu->cputype; + switch (ecpu->cputype) { ++ case Legacy_2K: ++ case Loongson_2K: ++ smp_group[0] = 0x900000001fe11000; ++ loongson_sysconf.cores_per_node = 2; ++ loongson_sysconf.cores_per_package = 2; ++ break; + case Legacy_3A: + case Loongson_3A: + loongson_sysconf.cores_per_node = 4; +@@ -221,6 +227,8 @@ void __init prom_lefi_init_env(void) + default: + break; + } ++ } else if ((read_c0_prid() & PRID_IMP_MASK) == PRID_IMP_LOONGSON_64R) { ++ loongson_fdt_blob = __dtb_loongson64_2core_2k1000_begin; + } else if ((read_c0_prid() & PRID_IMP_MASK) == PRID_IMP_LOONGSON_64G) { + if (loongson_sysconf.bridgetype == LS7A) + loongson_fdt_blob = __dtb_loongson64g_4core_ls7a_begin; diff --git a/queue-5.15/mips-loongson64-remove-memory-node-for-builtin-dtb.patch b/queue-5.15/mips-loongson64-remove-memory-node-for-builtin-dtb.patch new file mode 100644 index 00000000000..cad383386d9 --- /dev/null +++ b/queue-5.15/mips-loongson64-remove-memory-node-for-builtin-dtb.patch @@ -0,0 +1,40 @@ +From b81656c37acf1e682dde02f3e07987784b0f3634 Mon Sep 17 00:00:00 2001 +From: Jiaxun Yang +Date: Fri, 14 Jun 2024 16:40:09 +0100 +Subject: MIPS: Loongson64: Remove memory node for builtin-dtb + +From: Jiaxun Yang + +commit b81656c37acf1e682dde02f3e07987784b0f3634 upstream. + +Builtin DTBS should never contain memory node as memory is +going to be managed by LEFI interface. + +Remove memory node to prevent confliction. + +Fixes: b1a792601f26 ("MIPS: Loongson64: DeviceTree for Loongson-2K1000") +Cc: stable@vger.kernel.org +Signed-off-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi | 8 -------- + 1 file changed, 8 deletions(-) + +--- a/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi ++++ b/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi +@@ -23,14 +23,6 @@ + }; + }; + +- memory@200000 { +- compatible = "memory"; +- device_type = "memory"; +- reg = <0x00000000 0x00200000 0x00000000 0x0ee00000>, /* 238 MB at 2 MB */ +- <0x00000000 0x20000000 0x00000000 0x1f000000>, /* 496 MB at 512 MB */ +- <0x00000001 0x10000000 0x00000001 0xb0000000>; /* 6912 MB at 4352MB */ +- }; +- + cpu_clk: cpu_clk { + #clock-cells = <0>; + compatible = "fixed-clock"; diff --git a/queue-5.15/mips-loongson64-reset-prioritise-firmware-service.patch b/queue-5.15/mips-loongson64-reset-prioritise-firmware-service.patch new file mode 100644 index 00000000000..5f550fb4f81 --- /dev/null +++ b/queue-5.15/mips-loongson64-reset-prioritise-firmware-service.patch @@ -0,0 +1,102 @@ +From 4e7ca0b57f3bc09ba3e4ab86bf6b7c35134bfd04 Mon Sep 17 00:00:00 2001 +From: Jiaxun Yang +Date: Fri, 14 Jun 2024 16:40:16 +0100 +Subject: MIPS: Loongson64: reset: Prioritise firmware service + +From: Jiaxun Yang + +commit 4e7ca0b57f3bc09ba3e4ab86bf6b7c35134bfd04 upstream. + +We should always use firmware's poweroff & reboot service +if it's available as firmware may need to perform more task +than platform's syscon etc. + +However _machine_restart & poweroff hooks are registered at +low priority, which means platform reboot driver can override +them. + +Register firmware based reboot/poweroff implementation with +register_sys_off_handler with appropriate priority so that +they will be prioritised. Remove _machine_halt hook as it's +deemed to be unnecessary. + +Cc: stable@vger.kernel.org +Signed-off-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/loongson64/reset.c | 38 ++++++++++++++++---------------------- + 1 file changed, 16 insertions(+), 22 deletions(-) + +--- a/arch/mips/loongson64/reset.c ++++ b/arch/mips/loongson64/reset.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -21,36 +22,21 @@ + #include + #include + +-static void loongson_restart(char *command) ++static int firmware_restart(struct sys_off_data *unusedd) + { + + void (*fw_restart)(void) = (void *)loongson_sysconf.restart_addr; + + fw_restart(); +- while (1) { +- if (cpu_wait) +- cpu_wait(); +- } ++ return NOTIFY_DONE; + } + +-static void loongson_poweroff(void) ++static int firmware_poweroff(struct sys_off_data *unused) + { + void (*fw_poweroff)(void) = (void *)loongson_sysconf.poweroff_addr; + + fw_poweroff(); +- while (1) { +- if (cpu_wait) +- cpu_wait(); +- } +-} +- +-static void loongson_halt(void) +-{ +- pr_notice("\n\n** You can safely turn off the power now **\n\n"); +- while (1) { +- if (cpu_wait) +- cpu_wait(); +- } ++ return NOTIFY_DONE; + } + + #ifdef CONFIG_KEXEC +@@ -154,9 +140,17 @@ static void loongson_crash_shutdown(stru + + static int __init mips_reboot_setup(void) + { +- _machine_restart = loongson_restart; +- _machine_halt = loongson_halt; +- pm_power_off = loongson_poweroff; ++ if (loongson_sysconf.restart_addr) { ++ register_sys_off_handler(SYS_OFF_MODE_RESTART, ++ SYS_OFF_PRIO_FIRMWARE, ++ firmware_restart, NULL); ++ } ++ ++ if (loongson_sysconf.poweroff_addr) { ++ register_sys_off_handler(SYS_OFF_MODE_POWER_OFF, ++ SYS_OFF_PRIO_FIRMWARE, ++ firmware_poweroff, NULL); ++ } + + #ifdef CONFIG_KEXEC + kexec_argv = kmalloc(KEXEC_ARGV_SIZE, GFP_KERNEL); diff --git a/queue-5.15/mips-loongson64-test-register-availability-before-use.patch b/queue-5.15/mips-loongson64-test-register-availability-before-use.patch new file mode 100644 index 00000000000..535d9278f68 --- /dev/null +++ b/queue-5.15/mips-loongson64-test-register-availability-before-use.patch @@ -0,0 +1,85 @@ +From c04366b1207a036b7de02dfcc1ac7138d3343c9b Mon Sep 17 00:00:00 2001 +From: Jiaxun Yang +Date: Fri, 14 Jun 2024 16:40:14 +0100 +Subject: MIPS: Loongson64: Test register availability before use + +From: Jiaxun Yang + +commit c04366b1207a036b7de02dfcc1ac7138d3343c9b upstream. + +Some global register address variable may be missing on +specific CPU type, test them before use them. + +Cc: stable@vger.kernel.org +Signed-off-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/loongson64/smp.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +--- a/arch/mips/loongson64/smp.c ++++ b/arch/mips/loongson64/smp.c +@@ -479,12 +479,25 @@ static void loongson3_smp_finish(void) + static void __init loongson3_smp_setup(void) + { + int i = 0, num = 0; /* i: physical id, num: logical id */ ++ int max_cpus = 0; + + init_cpu_possible(cpu_none_mask); + ++ for (i = 0; i < ARRAY_SIZE(smp_group); i++) { ++ if (!smp_group[i]) ++ break; ++ max_cpus += loongson_sysconf.cores_per_node; ++ } ++ ++ if (max_cpus < loongson_sysconf.nr_cpus) { ++ pr_err("SMP Groups are less than the number of CPUs\n"); ++ loongson_sysconf.nr_cpus = max_cpus ? max_cpus : 1; ++ } ++ + /* For unified kernel, NR_CPUS is the maximum possible value, + * loongson_sysconf.nr_cpus is the really present value + */ ++ i = 0; + while (i < loongson_sysconf.nr_cpus) { + if (loongson_sysconf.reserved_cpus_mask & (1< +Date: Fri, 14 Jun 2024 16:40:15 +0100 +Subject: platform: mips: cpu_hwmon: Disable driver on unsupported hardware + +From: Jiaxun Yang + +commit f4d430db17b4ef4e9c3c352a04b2fe3c93011978 upstream. + +cpu_hwmon is unsupported on CPUs without loongson_chiptemp +register and csr. + +Cc: stable@vger.kernel.org +Signed-off-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/mips/cpu_hwmon.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/platform/mips/cpu_hwmon.c ++++ b/drivers/platform/mips/cpu_hwmon.c +@@ -139,6 +139,9 @@ static int __init loongson_hwmon_init(vo + csr_temp_enable = csr_readl(LOONGSON_CSR_FEATURES) & + LOONGSON_CSRF_TEMP; + ++ if (!csr_temp_enable && !loongson_chiptemp[0]) ++ return -ENODEV; ++ + nr_packages = loongson_sysconf.nr_cpus / + loongson_sysconf.cores_per_package; + diff --git a/queue-5.15/rbd-don-t-assume-rbd_is_lock_owner-for-exclusive-mappings.patch b/queue-5.15/rbd-don-t-assume-rbd_is_lock_owner-for-exclusive-mappings.patch new file mode 100644 index 00000000000..73ba08a47e7 --- /dev/null +++ b/queue-5.15/rbd-don-t-assume-rbd_is_lock_owner-for-exclusive-mappings.patch @@ -0,0 +1,43 @@ +From 3ceccb14f5576e02b81cc8b105ab81f224bd87f6 Mon Sep 17 00:00:00 2001 +From: Ilya Dryomov +Date: Tue, 23 Jul 2024 18:08:08 +0200 +Subject: rbd: don't assume rbd_is_lock_owner() for exclusive mappings + +From: Ilya Dryomov + +commit 3ceccb14f5576e02b81cc8b105ab81f224bd87f6 upstream. + +Expanding on the previous commit, assuming that rbd_is_lock_owner() +always returns true (i.e. that we are either in RBD_LOCK_STATE_LOCKED +or RBD_LOCK_STATE_QUIESCING) if the mapping is exclusive is wrong too. +In case ceph_cls_set_cookie() fails, the lock would be temporarily +released even if the mapping is exclusive, meaning that we can end up +even in RBD_LOCK_STATE_UNLOCKED. + +IOW, exclusive mappings are really "just" about disabling automatic +lock transitions (as documented in the man page), not about grabbing +the lock and holding on to it whatever it takes. + +Cc: stable@vger.kernel.org +Fixes: 637cd060537d ("rbd: new exclusive lock wait/wake code") +Signed-off-by: Ilya Dryomov +Reviewed-by: Dongsheng Yang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/rbd.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -6592,11 +6592,6 @@ static int rbd_add_acquire_lock(struct r + if (ret) + return ret; + +- /* +- * The lock may have been released by now, unless automatic lock +- * transitions are disabled. +- */ +- rbd_assert(!rbd_dev->opts->exclusive || rbd_is_lock_owner(rbd_dev)); + return 0; + } + diff --git a/queue-5.15/rdma-iwcm-fix-a-use-after-free-related-to-destroying-cm-ids.patch b/queue-5.15/rdma-iwcm-fix-a-use-after-free-related-to-destroying-cm-ids.patch new file mode 100644 index 00000000000..86909013145 --- /dev/null +++ b/queue-5.15/rdma-iwcm-fix-a-use-after-free-related-to-destroying-cm-ids.patch @@ -0,0 +1,74 @@ +From aee2424246f9f1dadc33faa78990c1e2eb7826e4 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Wed, 5 Jun 2024 08:51:01 -0600 +Subject: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs + +From: Bart Van Assche + +commit aee2424246f9f1dadc33faa78990c1e2eb7826e4 upstream. + +iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with +an existing struct iw_cm_id (cm_id) as follows: + + conn_id->cm_id.iw = cm_id; + cm_id->context = conn_id; + cm_id->cm_handler = cma_iw_handler; + +rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make +sure that cm_work_handler() does not trigger a use-after-free by only +freeing of the struct rdma_id_private after all pending work has finished. + +Cc: stable@vger.kernel.org +Fixes: 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") +Reviewed-by: Zhu Yanjun +Tested-by: Shin'ichiro Kawasaki +Signed-off-by: Bart Van Assche +Link: https://lore.kernel.org/r/20240605145117.397751-6-bvanassche@acm.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/iwcm.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/infiniband/core/iwcm.c ++++ b/drivers/infiniband/core/iwcm.c +@@ -369,8 +369,10 @@ EXPORT_SYMBOL(iw_cm_disconnect); + * + * Clean up all resources associated with the connection and release + * the initial reference taken by iw_create_cm_id. ++ * ++ * Returns true if and only if the last cm_id_priv reference has been dropped. + */ +-static void destroy_cm_id(struct iw_cm_id *cm_id) ++static bool destroy_cm_id(struct iw_cm_id *cm_id) + { + struct iwcm_id_private *cm_id_priv; + struct ib_qp *qp; +@@ -440,7 +442,7 @@ static void destroy_cm_id(struct iw_cm_i + iwpm_remove_mapping(&cm_id->local_addr, RDMA_NL_IWCM); + } + +- (void)iwcm_deref_id(cm_id_priv); ++ return iwcm_deref_id(cm_id_priv); + } + + /* +@@ -451,7 +453,8 @@ static void destroy_cm_id(struct iw_cm_i + */ + void iw_destroy_cm_id(struct iw_cm_id *cm_id) + { +- destroy_cm_id(cm_id); ++ if (!destroy_cm_id(cm_id)) ++ flush_workqueue(iwcm_wq); + } + EXPORT_SYMBOL(iw_destroy_cm_id); + +@@ -1035,7 +1038,7 @@ static void cm_work_handler(struct work_ + if (!test_bit(IWCM_F_DROP_EVENTS, &cm_id_priv->flags)) { + ret = process_event(cm_id_priv, &levent); + if (ret) +- destroy_cm_id(&cm_id_priv->id); ++ WARN_ON_ONCE(destroy_cm_id(&cm_id_priv->id)); + } else + pr_debug("dropping event %d\n", levent.event); + if (iwcm_deref_id(cm_id_priv)) diff --git a/queue-5.15/remoteproc-imx_rproc-skip-over-memory-region-when-node-value-is-null.patch b/queue-5.15/remoteproc-imx_rproc-skip-over-memory-region-when-node-value-is-null.patch new file mode 100644 index 00000000000..4648ded7b68 --- /dev/null +++ b/queue-5.15/remoteproc-imx_rproc-skip-over-memory-region-when-node-value-is-null.patch @@ -0,0 +1,39 @@ +From 2fa26ca8b786888673689ccc9da6094150939982 Mon Sep 17 00:00:00 2001 +From: Aleksandr Mishin +Date: Thu, 6 Jun 2024 10:52:04 +0300 +Subject: remoteproc: imx_rproc: Skip over memory region when node value is NULL + +From: Aleksandr Mishin + +commit 2fa26ca8b786888673689ccc9da6094150939982 upstream. + +In imx_rproc_addr_init() "nph = of_count_phandle_with_args()" just counts +number of phandles. But phandles may be empty. So of_parse_phandle() in +the parsing loop (0 < a < nph) may return NULL which is later dereferenced. +Adjust this issue by adding NULL-return check. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: a0ff4aa6f010 ("remoteproc: imx_rproc: add a NXP/Freescale imx_rproc driver") +Signed-off-by: Aleksandr Mishin +Reviewed-by: Peng Fan +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240606075204.12354-1-amishin@t-argos.ru +[Fixed title to fit within the prescribed 70-75 charcters] +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman +--- + drivers/remoteproc/imx_rproc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/remoteproc/imx_rproc.c ++++ b/drivers/remoteproc/imx_rproc.c +@@ -588,6 +588,8 @@ static int imx_rproc_addr_init(struct im + struct resource res; + + node = of_parse_phandle(np, "memory-region", a); ++ if (!node) ++ continue; + /* Not map vdevbuffer, vdevring region */ + if (!strncmp(node->name, "vdev", strlen("vdev"))) { + of_node_put(node); diff --git a/queue-5.15/remoteproc-stm32_rproc-fix-mailbox-interrupts-queuing.patch b/queue-5.15/remoteproc-stm32_rproc-fix-mailbox-interrupts-queuing.patch new file mode 100644 index 00000000000..a6947ceee03 --- /dev/null +++ b/queue-5.15/remoteproc-stm32_rproc-fix-mailbox-interrupts-queuing.patch @@ -0,0 +1,34 @@ +From c3281abea67c9c0dc6219bbc41d1feae05a16da3 Mon Sep 17 00:00:00 2001 +From: Gwenael Treuveur +Date: Tue, 21 May 2024 18:23:16 +0200 +Subject: remoteproc: stm32_rproc: Fix mailbox interrupts queuing + +From: Gwenael Treuveur + +commit c3281abea67c9c0dc6219bbc41d1feae05a16da3 upstream. + +Manage interrupt coming from coprocessor also when state is +ATTACHED. + +Fixes: 35bdafda40cc ("remoteproc: stm32_rproc: Add mutex protection for workqueue") +Cc: stable@vger.kernel.org +Signed-off-by: Gwenael Treuveur +Acked-by: Arnaud Pouliquen +Link: https://lore.kernel.org/r/20240521162316.156259-1-gwenael.treuveur@foss.st.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman +--- + drivers/remoteproc/stm32_rproc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/remoteproc/stm32_rproc.c ++++ b/drivers/remoteproc/stm32_rproc.c +@@ -293,7 +293,7 @@ static void stm32_rproc_mb_vq_work(struc + + mutex_lock(&rproc->lock); + +- if (rproc->state != RPROC_RUNNING) ++ if (rproc->state != RPROC_RUNNING && rproc->state != RPROC_ATTACHED) + goto unlock_mutex; + + if (rproc_vq_interrupt(rproc, mb->vq_id) == IRQ_NONE) diff --git a/queue-5.15/selftests-sigaltstack-fix-ppc64-gcc-build.patch b/queue-5.15/selftests-sigaltstack-fix-ppc64-gcc-build.patch new file mode 100644 index 00000000000..a1caf44e0ae --- /dev/null +++ b/queue-5.15/selftests-sigaltstack-fix-ppc64-gcc-build.patch @@ -0,0 +1,48 @@ +From 17c743b9da9e0d073ff19fd5313f521744514939 Mon Sep 17 00:00:00 2001 +From: Michael Ellerman +Date: Mon, 20 May 2024 16:26:47 +1000 +Subject: selftests/sigaltstack: Fix ppc64 GCC build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Ellerman + +commit 17c743b9da9e0d073ff19fd5313f521744514939 upstream. + +Building the sigaltstack test with GCC on 64-bit powerpc errors with: + + gcc -Wall sas.c -o /home/michael/linux/.build/kselftest/sigaltstack/sas + In file included from sas.c:23: + current_stack_pointer.h:22:2: error: #error "implement current_stack_pointer equivalent" + 22 | #error "implement current_stack_pointer equivalent" + | ^~~~~ + sas.c: In function ‘my_usr1’: + sas.c:50:13: error: ‘sp’ undeclared (first use in this function); did you mean ‘p’? + 50 | if (sp < (unsigned long)sstack || + | ^~ + +This happens because GCC doesn't define __ppc__ for 64-bit builds, only +32-bit builds. Instead use __powerpc__ to detect powerpc builds, which +is defined by clang and GCC for 64-bit and 32-bit builds. + +Fixes: 05107edc9101 ("selftests: sigaltstack: fix -Wuninitialized") +Cc: stable@vger.kernel.org # v6.3+ +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240520062647.688667-1-mpe@ellerman.id.au +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/sigaltstack/current_stack_pointer.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/testing/selftests/sigaltstack/current_stack_pointer.h ++++ b/tools/testing/selftests/sigaltstack/current_stack_pointer.h +@@ -8,7 +8,7 @@ register unsigned long sp asm("sp"); + register unsigned long sp asm("esp"); + #elif __loongarch64 + register unsigned long sp asm("$sp"); +-#elif __ppc__ ++#elif __powerpc__ + register unsigned long sp asm("r1"); + #elif __s390x__ + register unsigned long sp asm("%15"); diff --git a/queue-5.15/series b/queue-5.15/series index 1ee1c5600dc..4349b2ad08e 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -238,3 +238,16 @@ drm-amdgpu-sdma5.2-update-wptr-registers-as-well-as-doorbell.patch drm-i915-dp-reset-intel_dp-link_trained-before-retraining-the-link.patch rtc-isl1208-fix-return-value-of-nvmem-callbacks.patch watchdog-perf-properly-initialize-the-turbo-mode-timestamp-and-rearm-counter.patch +platform-mips-cpu_hwmon-disable-driver-on-unsupported-hardware.patch +rdma-iwcm-fix-a-use-after-free-related-to-destroying-cm-ids.patch +selftests-sigaltstack-fix-ppc64-gcc-build.patch +rbd-don-t-assume-rbd_is_lock_owner-for-exclusive-mappings.patch +remoteproc-stm32_rproc-fix-mailbox-interrupts-queuing.patch +remoteproc-imx_rproc-skip-over-memory-region-when-node-value-is-null.patch +mips-ip30-ip30-console-add-missing-include.patch +mips-dts-loongson-fix-gmac-phy-node.patch +mips-loongson64-env-hook-up-loongsson-2k.patch +mips-loongson64-remove-memory-node-for-builtin-dtb.patch +mips-loongson64-reset-prioritise-firmware-service.patch +mips-loongson64-test-register-availability-before-use.patch +drm-panfrost-mark-simple_ondemand-governor-as-softdep.patch