From: Sasha Levin Date: Sat, 9 Nov 2024 02:46:11 +0000 (-0500) Subject: Fixes for 5.4 X-Git-Tag: v5.15.172~85 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=67a92f8d71dce152a0ac917ea8803ab03eb97805;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/arm-dts-rockchip-drop-grf-reference-from-rk3036-hdmi.patch b/queue-5.4/arm-dts-rockchip-drop-grf-reference-from-rk3036-hdmi.patch new file mode 100644 index 00000000000..b36f088ead1 --- /dev/null +++ b/queue-5.4/arm-dts-rockchip-drop-grf-reference-from-rk3036-hdmi.patch @@ -0,0 +1,39 @@ +From 7748679b92bb08dca5581648930e64e52f1e1e05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:38 +0200 +Subject: ARM: dts: rockchip: drop grf reference from rk3036 hdmi + +From: Heiko Stuebner + +[ Upstream commit 1580ccb6ed9dc76b8ff3e2d8912e8215c8b0fa6d ] + +Neither the binding nor the driver implementation specify/use the grf +reference provided in the rk3036. And neither does the newer rk3128 +user of the hdmi controller. So drop the rockchip,grf property. + +Fixes: b7217cf19c63 ("ARM: dts: rockchip: add hdmi device node for rk3036") +Cc: Caesar Wang +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-13-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3036.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi +index 69ca841d57e75..7c031260186db 100644 +--- a/arch/arm/boot/dts/rk3036.dtsi ++++ b/arch/arm/boot/dts/rk3036.dtsi +@@ -333,7 +333,6 @@ + interrupts = ; + clocks = <&cru PCLK_HDMI>; + clock-names = "pclk"; +- rockchip,grf = <&grf>; + pinctrl-names = "default"; + pinctrl-0 = <&hdmi_ctl>; + status = "disabled"; +-- +2.43.0 + diff --git a/queue-5.4/arm-dts-rockchip-fix-rk3036-acodec-node.patch b/queue-5.4/arm-dts-rockchip-fix-rk3036-acodec-node.patch new file mode 100644 index 00000000000..6055bcc514b --- /dev/null +++ b/queue-5.4/arm-dts-rockchip-fix-rk3036-acodec-node.patch @@ -0,0 +1,49 @@ +From 97d6ba4f8c92af685bf3f18ff5bf8aa631f7e600 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:37 +0200 +Subject: ARM: dts: rockchip: fix rk3036 acodec node + +From: Heiko Stuebner + +[ Upstream commit c7206853cd7d31c52575fb1dc7616b4398f3bc8f ] + +The acodec node is not conformant to the binding. + +Set the correct nodename, use the correct compatible, add the needed +#sound-dai-cells and sort the rockchip,grf below clocks properties +as expected. + +Fixes: faea098e1808 ("ARM: dts: rockchip: add core rk3036 dtsi") +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-12-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3036.dtsi | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi +index cc2d596da7d4e..69ca841d57e75 100644 +--- a/arch/arm/boot/dts/rk3036.dtsi ++++ b/arch/arm/boot/dts/rk3036.dtsi +@@ -317,12 +317,13 @@ + }; + }; + +- acodec: acodec-ana@20030000 { +- compatible = "rk3036-codec"; ++ acodec: audio-codec@20030000 { ++ compatible = "rockchip,rk3036-codec"; + reg = <0x20030000 0x4000>; +- rockchip,grf = <&grf>; + clock-names = "acodec_pclk"; + clocks = <&cru PCLK_ACODEC>; ++ rockchip,grf = <&grf>; ++ #sound-dai-cells = <0>; + status = "disabled"; + }; + +-- +2.43.0 + diff --git a/queue-5.4/arm-dts-rockchip-fix-the-realtek-audio-codec-on-rk30.patch b/queue-5.4/arm-dts-rockchip-fix-the-realtek-audio-codec-on-rk30.patch new file mode 100644 index 00000000000..e5cc8c5eb01 --- /dev/null +++ b/queue-5.4/arm-dts-rockchip-fix-the-realtek-audio-codec-on-rk30.patch @@ -0,0 +1,41 @@ +From 9907f49e7a08801d9cc87b5617fe1ff5d292a26c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:40 +0200 +Subject: ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin + +From: Heiko Stuebner + +[ Upstream commit 77a9a7f2d3b94d29d13d71b851114d593a2147cf ] + +Both the node name as well as the compatible were not named +according to the binding expectations, fix that. + +Fixes: 47bf3a5c9e2a ("ARM: dts: rockchip: add the sound setup for rk3036-kylin board") +Cc: Caesar Wang +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-15-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3036-kylin.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/rk3036-kylin.dts b/arch/arm/boot/dts/rk3036-kylin.dts +index 2ef47ebeb0cbe..e5bee30b35581 100644 +--- a/arch/arm/boot/dts/rk3036-kylin.dts ++++ b/arch/arm/boot/dts/rk3036-kylin.dts +@@ -300,8 +300,8 @@ + &i2c2 { + status = "okay"; + +- rt5616: rt5616@1b { +- compatible = "rt5616"; ++ rt5616: audio-codec@1b { ++ compatible = "realtek,rt5616"; + reg = <0x1b>; + clocks = <&cru SCLK_I2S_OUT>; + clock-names = "mclk"; +-- +2.43.0 + diff --git a/queue-5.4/arm-dts-rockchip-fix-the-spi-controller-on-rk3036.patch b/queue-5.4/arm-dts-rockchip-fix-the-spi-controller-on-rk3036.patch new file mode 100644 index 00000000000..a3e70692f1a --- /dev/null +++ b/queue-5.4/arm-dts-rockchip-fix-the-spi-controller-on-rk3036.patch @@ -0,0 +1,48 @@ +From bb0459596bbead24a03597a1ce55bf966cb44038 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:39 +0200 +Subject: ARM: dts: rockchip: Fix the spi controller on rk3036 + +From: Heiko Stuebner + +[ Upstream commit 8bade1ad1f0821aef31f6a8fb1027ae292566d85 ] + +Compatible and clock names did not match the existing binding. +So set the correct values and re-order+rename the clocks. + +It looks like no rk3036 board did use the spi controller so far, +so this was never detected on a running device yet. + +Fixes: f629fcfab2cd ("ARM: dts: rockchip: support the spi for rk3036") +Cc: Caesar Wang +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-14-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3036.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi +index 7c031260186db..c26981c75c21c 100644 +--- a/arch/arm/boot/dts/rk3036.dtsi ++++ b/arch/arm/boot/dts/rk3036.dtsi +@@ -489,11 +489,11 @@ + }; + + spi: spi@20074000 { +- compatible = "rockchip,rockchip-spi"; ++ compatible = "rockchip,rk3036-spi"; + reg = <0x20074000 0x1000>; + interrupts = ; +- clocks = <&cru PCLK_SPI>, <&cru SCLK_SPI>; +- clock-names = "apb-pclk","spi_pclk"; ++ clocks = <&cru SCLK_SPI>, <&cru PCLK_SPI>; ++ clock-names = "spiclk", "apb_pclk"; + dmas = <&pdma 8>, <&pdma 9>; + dma-names = "tx", "rx"; + pinctrl-names = "default"; +-- +2.43.0 + diff --git a/queue-5.4/arm64-dts-rockchip-fix-bluetooth-properties-on-rock9.patch b/queue-5.4/arm64-dts-rockchip-fix-bluetooth-properties-on-rock9.patch new file mode 100644 index 00000000000..13e882b8cd8 --- /dev/null +++ b/queue-5.4/arm64-dts-rockchip-fix-bluetooth-properties-on-rock9.patch @@ -0,0 +1,41 @@ +From b1d9bb6a63f8389ddcfbbd863edc4dae0beb8d7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:30 +0200 +Subject: arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards + +From: Heiko Stuebner + +[ Upstream commit ea74528aaea5a1dfc8e3de09ef2af37530eca526 ] + +The expected clock-name is different, and extclk also is deprecated +in favor of txco for clocks that are not crystals. + +So fix it to match the binding. + +Fixes: c72235c288c8 ("arm64: dts: rockchip: Add on-board WiFi/BT support for Rock960 boards") +Cc: Manivannan Sadhasivam +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-5-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi +index c7d48d41e184e..f5ad0a5399204 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi +@@ -557,7 +557,7 @@ + bluetooth { + compatible = "brcm,bcm43438-bt"; + clocks = <&rk808 1>; +- clock-names = "ext_clock"; ++ clock-names = "txco"; + device-wakeup-gpios = <&gpio2 RK_PD3 GPIO_ACTIVE_HIGH>; + host-wakeup-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_HIGH>; + shutdown-gpios = <&gpio0 RK_PB1 GPIO_ACTIVE_HIGH>; +-- +2.43.0 + diff --git a/queue-5.4/arm64-dts-rockchip-fix-rt5651-compatible-value-on-rk.patch b/queue-5.4/arm64-dts-rockchip-fix-rt5651-compatible-value-on-rk.patch new file mode 100644 index 00000000000..34303e06132 --- /dev/null +++ b/queue-5.4/arm64-dts-rockchip-fix-rt5651-compatible-value-on-rk.patch @@ -0,0 +1,39 @@ +From 9b010a3e51639ae460ce5dc87c27a246f4faa102 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2024 15:48:41 +0200 +Subject: arm64: dts: rockchip: Fix rt5651 compatible value on + rk3399-sapphire-excavator + +From: Geert Uytterhoeven + +[ Upstream commit 577b5761679da90e691acc939ebbe7879fff5f31 ] + +There are no DT bindings and driver support for a "rockchip,rt5651" +codec. Replace "rockchip,rt5651" by "realtek,rt5651", which matches the +"simple-audio-card,name" property in the "rt5651-sound" node. + +Fixes: 0a3c78e251b3a266 ("arm64: dts: rockchip: Add support for rk3399 excavator main board") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/abc6c89811b3911785601d6d590483eacb145102.1727358193.git.geert+renesas@glider.be +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts +index 808ea77f951d7..0d495716df6d1 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts +@@ -159,7 +159,7 @@ + status = "okay"; + + rt5651: rt5651@1a { +- compatible = "rockchip,rt5651"; ++ compatible = "realtek,rt5651"; + reg = <0x1a>; + clocks = <&cru SCLK_I2S_8CH_OUT>; + clock-names = "mclk"; +-- +2.43.0 + diff --git a/queue-5.4/arm64-dts-rockchip-remove-cooling-cells-from-fan-on-.patch b/queue-5.4/arm64-dts-rockchip-remove-cooling-cells-from-fan-on-.patch new file mode 100644 index 00000000000..f76d3ec2ce4 --- /dev/null +++ b/queue-5.4/arm64-dts-rockchip-remove-cooling-cells-from-fan-on-.patch @@ -0,0 +1,52 @@ +From 507c6aaee55dd2be8a180647398ed12713abc613 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 22:39:32 +0200 +Subject: arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma + lion + +From: Heiko Stuebner + +[ Upstream commit 5ed96580568c4f79a0aff11a67f10b3e9229ba86 ] + +All Theobroma boards use a ti,amc6821 as fan controller. +It normally runs in an automatically controlled way and while it may be +possible to use it as part of a dt-based thermal management, this is +not yet specified in the binding, nor implemented in any kernel. + +Newer boards already don't contain that #cooling-cells property, but +older ones do. So remove them for now, they can be re-added if thermal +integration gets implemented in the future. + +There are two further occurences in v6.12-rc in px30-ringneck and +rk3399-puma, but those already get removed by the i2c-mux conversion +scheduled for 6.13 . As the undocumented property is in the kernel so +long, I opted for not causing extra merge conflicts between 6.12 and 6.13 + +Fixes: d99a02bcfa81 ("arm64: dts: rockchip: add RK3368-uQ7 (Lion) SoM") +Cc: Quentin Schulz +Cc: Klaus Goger +Reviewed-by: Quentin Schulz +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20241008203940.2573684-7-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi +index 216aafd90e7f1..08a8e35cd7d6e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi +@@ -56,7 +56,6 @@ + fan: fan@18 { + compatible = "ti,amc6821"; + reg = <0x18>; +- #cooling-cells = <2>; + }; + + rtc_twi: rtc@6f { +-- +2.43.0 + diff --git a/queue-5.4/arm64-dts-rockchip-remove-hdmi-s-2nd-interrupt-on-rk.patch b/queue-5.4/arm64-dts-rockchip-remove-hdmi-s-2nd-interrupt-on-rk.patch new file mode 100644 index 00000000000..13a8fb2f549 --- /dev/null +++ b/queue-5.4/arm64-dts-rockchip-remove-hdmi-s-2nd-interrupt-on-rk.patch @@ -0,0 +1,53 @@ +From bca0ff3ce478cc1c1e60d4e39d16086618196eb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 13:15:37 +0200 +Subject: arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328 + +From: Diederik de Haas + +[ Upstream commit de50a7e3681771c6b990238af82bf1dea9b11b21 ] + +The "synopsys,dw-hdmi.yaml" binding specifies that the interrupts +property of the hdmi node has 'maxItems: 1', so the hdmi node in +rk3328.dtsi having 2 is incorrect. + +Paragraph 1.3 ("System Interrupt connection") of the RK3328 TRM v1.1 +page 16 and 17 define the following hdmi related interrupts: +- 67 hdmi_intr +- 103 hdmi_intr_wakeup + +The difference of 32 is due to a different base used in the TRM. + +The RK3399 (which uses the same binding) has '23: hdmi_irq' and +'24: hdmi_wakeup_irq' according to its TRM (page 19). +The RK3568 (also same binding) has '76: hdmi_wakeup' and '77: hdmi' +according to page 17 of its TRM. +In both cases the non-wakeup IRQ was used, so use that too for rk3328. + +Helped-by: Heiko Stuebner +Fixes: 725e351c265a ("arm64: dts: rockchip: add rk3328 display nodes") +Signed-off-by: Diederik de Haas +Link: https://lore.kernel.org/r/20241008113344.23957-3-didi.debian@cknow.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3328.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index 9f300719a8fd3..5bb84ec31c6f3 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -667,8 +667,7 @@ + compatible = "rockchip,rk3328-dw-hdmi"; + reg = <0x0 0xff3c0000 0x0 0x20000>; + reg-io-width = <4>; +- interrupts = , +- ; ++ interrupts = ; + clocks = <&cru PCLK_HDMI>, + <&cru SCLK_HDMI_SFC>, + <&cru SCLK_RTC32K>; +-- +2.43.0 + diff --git a/queue-5.4/can-c_can-fix-rx-tx-_errors-statistics.patch b/queue-5.4/can-c_can-fix-rx-tx-_errors-statistics.patch new file mode 100644 index 00000000000..7b873560781 --- /dev/null +++ b/queue-5.4/can-c_can-fix-rx-tx-_errors-statistics.patch @@ -0,0 +1,71 @@ +From 654eed542e790629d3fd02d96faab353ce9ba271 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2024 15:53:13 +0200 +Subject: can: c_can: fix {rx,tx}_errors statistics + +From: Dario Binacchi + +[ Upstream commit 4d6d26537940f3b3e17138987ed9e4a334780bf7 ] + +The c_can_handle_bus_err() function was incorrectly incrementing only the +receive error counter, even in cases of bit or acknowledgment errors that +occur during transmission. The patch fixes the issue by incrementing the +appropriate counter based on the type of error. + +Fixes: 881ff67ad450 ("can: c_can: Added support for Bosch C_CAN controller") +Signed-off-by: Dario Binacchi +Link: https://patch.msgid.link/20241014135319.2009782-1-dario.binacchi@amarulasolutions.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/c_can/c_can.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c +index f14e739ba3f45..07cf6fda9720f 100644 +--- a/drivers/net/can/c_can/c_can.c ++++ b/drivers/net/can/c_can/c_can.c +@@ -1001,7 +1001,6 @@ static int c_can_handle_bus_err(struct net_device *dev, + + /* common for all type of bus errors */ + priv->can.can_stats.bus_error++; +- stats->rx_errors++; + + /* propagate the error condition to the CAN stack */ + skb = alloc_can_err_skb(dev, &cf); +@@ -1018,26 +1017,32 @@ static int c_can_handle_bus_err(struct net_device *dev, + case LEC_STUFF_ERROR: + netdev_dbg(dev, "stuff error\n"); + cf->data[2] |= CAN_ERR_PROT_STUFF; ++ stats->rx_errors++; + break; + case LEC_FORM_ERROR: + netdev_dbg(dev, "form error\n"); + cf->data[2] |= CAN_ERR_PROT_FORM; ++ stats->rx_errors++; + break; + case LEC_ACK_ERROR: + netdev_dbg(dev, "ack error\n"); + cf->data[3] = CAN_ERR_PROT_LOC_ACK; ++ stats->tx_errors++; + break; + case LEC_BIT1_ERROR: + netdev_dbg(dev, "bit1 error\n"); + cf->data[2] |= CAN_ERR_PROT_BIT1; ++ stats->tx_errors++; + break; + case LEC_BIT0_ERROR: + netdev_dbg(dev, "bit0 error\n"); + cf->data[2] |= CAN_ERR_PROT_BIT0; ++ stats->tx_errors++; + break; + case LEC_CRC_ERROR: + netdev_dbg(dev, "CRC error\n"); + cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ; ++ stats->rx_errors++; + break; + default: + break; +-- +2.43.0 + diff --git a/queue-5.4/enetc-simplify-the-return-expression-of-enetc_vf_set.patch b/queue-5.4/enetc-simplify-the-return-expression-of-enetc_vf_set.patch new file mode 100644 index 00000000000..5afa7e9c3f9 --- /dev/null +++ b/queue-5.4/enetc-simplify-the-return-expression-of-enetc_vf_set.patch @@ -0,0 +1,45 @@ +From 3491af9ef797aac5aff39956be138ed4d9fa384c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Sep 2020 21:10:26 +0800 +Subject: enetc: simplify the return expression of enetc_vf_set_mac_addr() + +From: Qinglang Miao + +[ Upstream commit d4b717dd2009f9003a5b4844a0e0ae0370d4c506 ] + +Simplify the return expression. + +Signed-off-by: Qinglang Miao +Reviewed-by: Claudiu Manoil +Signed-off-by: David S. Miller +Stable-dep-of: badccd49b93b ("net: enetc: set MAC address to the VF net_device") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc_vf.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_vf.c b/drivers/net/ethernet/freescale/enetc/enetc_vf.c +index 3a8c2049b417c..af287b6d5f3b7 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_vf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_vf.c +@@ -85,16 +85,11 @@ static int enetc_vf_set_mac_addr(struct net_device *ndev, void *addr) + { + struct enetc_ndev_priv *priv = netdev_priv(ndev); + struct sockaddr *saddr = addr; +- int err; + + if (!is_valid_ether_addr(saddr->sa_data)) + return -EADDRNOTAVAIL; + +- err = enetc_msg_vsi_set_primary_mac_addr(priv, saddr); +- if (err) +- return err; +- +- return 0; ++ return enetc_msg_vsi_set_primary_mac_addr(priv, saddr); + } + + static int enetc_vf_set_features(struct net_device *ndev, +-- +2.43.0 + diff --git a/queue-5.4/hid-core-zero-initialize-the-report-buffer.patch b/queue-5.4/hid-core-zero-initialize-the-report-buffer.patch new file mode 100644 index 00000000000..ca97ac77827 --- /dev/null +++ b/queue-5.4/hid-core-zero-initialize-the-report-buffer.patch @@ -0,0 +1,41 @@ +From 421e63dd9b749b553a447200cd4760088cb2d994 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2024 15:44:35 +0100 +Subject: HID: core: zero-initialize the report buffer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jiri Kosina + +[ Upstream commit 177f25d1292c7e16e1199b39c85480f7f8815552 ] + +Since the report buffer is used by all kinds of drivers in various ways, let's +zero-initialize it during allocation to make sure that it can't be ever used +to leak kernel memory via specially-crafted report. + +Fixes: 27ce405039bf ("HID: fix data access in implement()") +Reported-by: Benoît Sevens +Acked-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 2462be8c4ae65..10ee4d3269b96 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1657,7 +1657,7 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags) + + u32 len = hid_report_len(report) + 7; + +- return kmalloc(len, flags); ++ return kzalloc(len, flags); + } + EXPORT_SYMBOL_GPL(hid_alloc_report_buf); + +-- +2.43.0 + diff --git a/queue-5.4/net-enetc-set-mac-address-to-the-vf-net_device.patch b/queue-5.4/net-enetc-set-mac-address-to-the-vf-net_device.patch new file mode 100644 index 00000000000..a937e875c2b --- /dev/null +++ b/queue-5.4/net-enetc-set-mac-address-to-the-vf-net_device.patch @@ -0,0 +1,66 @@ +From a5a4fd3f3a11848a42999ea4a394a820a38e4e60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2024 17:04:06 +0800 +Subject: net: enetc: set MAC address to the VF net_device + +From: Wei Fang + +[ Upstream commit badccd49b93bb945bf4e5cc8707db67cdc5e27e5 ] + +The MAC address of VF can be configured through the mailbox mechanism of +ENETC, but the previous implementation forgot to set the MAC address in +net_device, resulting in the SMAC of the sent frames still being the old +MAC address. Since the MAC address in the hardware has been changed, Rx +cannot receive frames with the DMAC address as the new MAC address. The +most obvious phenomenon is that after changing the MAC address, we can +see that the MAC address of eno0vf0 has not changed through the "ifconfig +eno0vf0" command and the IP address cannot be obtained . + +root@ls1028ardb:~# ifconfig eno0vf0 down +root@ls1028ardb:~# ifconfig eno0vf0 hw ether 00:04:9f:3a:4d:56 up +root@ls1028ardb:~# ifconfig eno0vf0 +eno0vf0: flags=4163 mtu 1500 + ether 66:36:2c:3b:87:76 txqueuelen 1000 (Ethernet) + RX packets 794 bytes 69239 (69.2 KB) + RX errors 0 dropped 0 overruns 0 frame 0 + TX packets 11 bytes 2226 (2.2 KB) + TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 + +Fixes: beb74ac878c8 ("enetc: Add vf to pf messaging support") +Signed-off-by: Wei Fang +Reviewed-by: Vladimir Oltean +Reviewed-by: Claudiu Manoil +Link: https://patch.msgid.link/20241029090406.841836-1-wei.fang@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc_vf.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_vf.c b/drivers/net/ethernet/freescale/enetc/enetc_vf.c +index af287b6d5f3b7..85998060df705 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_vf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_vf.c +@@ -85,11 +85,18 @@ static int enetc_vf_set_mac_addr(struct net_device *ndev, void *addr) + { + struct enetc_ndev_priv *priv = netdev_priv(ndev); + struct sockaddr *saddr = addr; ++ int err; + + if (!is_valid_ether_addr(saddr->sa_data)) + return -EADDRNOTAVAIL; + +- return enetc_msg_vsi_set_primary_mac_addr(priv, saddr); ++ err = enetc_msg_vsi_set_primary_mac_addr(priv, saddr); ++ if (err) ++ return err; ++ ++ eth_hw_addr_set(ndev, saddr->sa_data); ++ ++ return 0; + } + + static int enetc_vf_set_features(struct net_device *ndev, +-- +2.43.0 + diff --git a/queue-5.4/net-hns3-fix-kernel-crash-when-uninstalling-driver.patch b/queue-5.4/net-hns3-fix-kernel-crash-when-uninstalling-driver.patch new file mode 100644 index 00000000000..b3bc8ef14ed --- /dev/null +++ b/queue-5.4/net-hns3-fix-kernel-crash-when-uninstalling-driver.patch @@ -0,0 +1,89 @@ +From d000adf039e25afa6d605f6880000797e54d2759 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2024 17:15:07 +0800 +Subject: net: hns3: fix kernel crash when uninstalling driver + +From: Peiyang Wang + +[ Upstream commit df3dff8ab6d79edc942464999d06fbaedf8cdd18 ] + +When the driver is uninstalled and the VF is disabled concurrently, a +kernel crash occurs. The reason is that the two actions call function +pci_disable_sriov(). The num_VFs is checked to determine whether to +release the corresponding resources. During the second calling, num_VFs +is not 0 and the resource release function is called. However, the +corresponding resource has been released during the first invoking. +Therefore, the problem occurs: + +[15277.839633][T50670] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 +... +[15278.131557][T50670] Call trace: +[15278.134686][T50670] klist_put+0x28/0x12c +[15278.138682][T50670] klist_del+0x14/0x20 +[15278.142592][T50670] device_del+0xbc/0x3c0 +[15278.146676][T50670] pci_remove_bus_device+0x84/0x120 +[15278.151714][T50670] pci_stop_and_remove_bus_device+0x6c/0x80 +[15278.157447][T50670] pci_iov_remove_virtfn+0xb4/0x12c +[15278.162485][T50670] sriov_disable+0x50/0x11c +[15278.166829][T50670] pci_disable_sriov+0x24/0x30 +[15278.171433][T50670] hnae3_unregister_ae_algo_prepare+0x60/0x90 [hnae3] +[15278.178039][T50670] hclge_exit+0x28/0xd0 [hclge] +[15278.182730][T50670] __se_sys_delete_module.isra.0+0x164/0x230 +[15278.188550][T50670] __arm64_sys_delete_module+0x1c/0x30 +[15278.193848][T50670] invoke_syscall+0x50/0x11c +[15278.198278][T50670] el0_svc_common.constprop.0+0x158/0x164 +[15278.203837][T50670] do_el0_svc+0x34/0xcc +[15278.207834][T50670] el0_svc+0x20/0x30 + +For details, see the following figure. + + rmmod hclge disable VFs +---------------------------------------------------- +hclge_exit() sriov_numvfs_store() + ... device_lock() + pci_disable_sriov() hns3_pci_sriov_configure() + pci_disable_sriov() + sriov_disable() + sriov_disable() if !num_VFs : + if !num_VFs : return; + return; sriov_del_vfs() + sriov_del_vfs() ... + ... klist_put() + klist_put() ... + ... num_VFs = 0; + num_VFs = 0; device_unlock(); + +In this patch, when driver is removing, we get the device_lock() +to protect num_VFs, just like sriov_numvfs_store(). + +Fixes: 0dd8a25f355b ("net: hns3: disable sriov before unload hclge layer") +Signed-off-by: Peiyang Wang +Signed-off-by: Jijie Shao +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20241101091507.3644584-1-shaojijie@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hnae3.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c +index 2e38c7d214c45..6c7cef6f1532f 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c +@@ -25,8 +25,11 @@ void hnae3_unregister_ae_algo_prepare(struct hnae3_ae_algo *ae_algo) + pci_id = pci_match_id(ae_algo->pdev_id_table, ae_dev->pdev); + if (!pci_id) + continue; +- if (IS_ENABLED(CONFIG_PCI_IOV)) ++ if (IS_ENABLED(CONFIG_PCI_IOV)) { ++ device_lock(&ae_dev->pdev->dev); + pci_disable_sriov(ae_dev->pdev); ++ device_unlock(&ae_dev->pdev->dev); ++ } + } + } + EXPORT_SYMBOL(hnae3_unregister_ae_algo_prepare); +-- +2.43.0 + diff --git a/queue-5.4/sctp-properly-validate-chunk-size-in-sctp_sf_ootb.patch b/queue-5.4/sctp-properly-validate-chunk-size-in-sctp_sf_ootb.patch new file mode 100644 index 00000000000..1b4da623e5c --- /dev/null +++ b/queue-5.4/sctp-properly-validate-chunk-size-in-sctp_sf_ootb.patch @@ -0,0 +1,49 @@ +From 1114c1a43ff5ed8b230d83770d23dc8f964c9a4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2024 13:46:21 -0400 +Subject: sctp: properly validate chunk size in sctp_sf_ootb() + +From: Xin Long + +[ Upstream commit 0ead60804b64f5bd6999eec88e503c6a1a242d41 ] + +A size validation fix similar to that in Commit 50619dbf8db7 ("sctp: add +size validation when walking chunks") is also required in sctp_sf_ootb() +to address a crash reported by syzbot: + + BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 + sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 + sctp_do_sm+0x181/0x93d0 net/sctp/sm_sideeffect.c:1166 + sctp_endpoint_bh_rcv+0xc38/0xf90 net/sctp/endpointola.c:407 + sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 + sctp_rcv+0x3831/0x3b20 net/sctp/input.c:243 + sctp4_rcv+0x42/0x50 net/sctp/protocol.c:1159 + ip_protocol_deliver_rcu+0xb51/0x13d0 net/ipv4/ip_input.c:205 + ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233 + +Reported-by: syzbot+f0cbb34d39392f2746ca@syzkaller.appspotmail.com +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Xin Long +Link: https://patch.msgid.link/a29ebb6d8b9f8affd0f9abb296faafafe10c17d8.1730223981.git.lucien.xin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sctp/sm_statefuns.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 67df4022853ba..6b613569372a0 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -3637,7 +3637,7 @@ enum sctp_disposition sctp_sf_ootb(struct net *net, + } + + ch = (struct sctp_chunkhdr *)ch_end; +- } while (ch_end < skb_tail_pointer(skb)); ++ } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb)); + + if (ootb_shut_ack) + return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands); +-- +2.43.0 + diff --git a/queue-5.4/security-keys-fix-slab-out-of-bounds-in-key_task_per.patch b/queue-5.4/security-keys-fix-slab-out-of-bounds-in-key_task_per.patch new file mode 100644 index 00000000000..e241828692b --- /dev/null +++ b/queue-5.4/security-keys-fix-slab-out-of-bounds-in-key_task_per.patch @@ -0,0 +1,110 @@ +From 95a087fef53e2064926cdb5cff651dbc1e41c5dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 12:46:39 +0000 +Subject: security/keys: fix slab-out-of-bounds in key_task_permission + +From: Chen Ridong + +[ Upstream commit 4a74da044ec9ec8679e6beccc4306b936b62873f ] + +KASAN reports an out of bounds read: +BUG: KASAN: slab-out-of-bounds in __kuid_val include/linux/uidgid.h:36 +BUG: KASAN: slab-out-of-bounds in uid_eq include/linux/uidgid.h:63 [inline] +BUG: KASAN: slab-out-of-bounds in key_task_permission+0x394/0x410 +security/keys/permission.c:54 +Read of size 4 at addr ffff88813c3ab618 by task stress-ng/4362 + +CPU: 2 PID: 4362 Comm: stress-ng Not tainted 5.10.0-14930-gafbffd6c3ede #15 +Call Trace: + __dump_stack lib/dump_stack.c:82 [inline] + dump_stack+0x107/0x167 lib/dump_stack.c:123 + print_address_description.constprop.0+0x19/0x170 mm/kasan/report.c:400 + __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560 + kasan_report+0x3a/0x50 mm/kasan/report.c:585 + __kuid_val include/linux/uidgid.h:36 [inline] + uid_eq include/linux/uidgid.h:63 [inline] + key_task_permission+0x394/0x410 security/keys/permission.c:54 + search_nested_keyrings+0x90e/0xe90 security/keys/keyring.c:793 + +This issue was also reported by syzbot. + +It can be reproduced by following these steps(more details [1]): +1. Obtain more than 32 inputs that have similar hashes, which ends with the + pattern '0xxxxxxxe6'. +2. Reboot and add the keys obtained in step 1. + +The reproducer demonstrates how this issue happened: +1. In the search_nested_keyrings function, when it iterates through the + slots in a node(below tag ascend_to_node), if the slot pointer is meta + and node->back_pointer != NULL(it means a root), it will proceed to + descend_to_node. However, there is an exception. If node is the root, + and one of the slots points to a shortcut, it will be treated as a + keyring. +2. Whether the ptr is keyring decided by keyring_ptr_is_keyring function. + However, KEYRING_PTR_SUBTYPE is 0x2UL, the same as + ASSOC_ARRAY_PTR_SUBTYPE_MASK. +3. When 32 keys with the similar hashes are added to the tree, the ROOT + has keys with hashes that are not similar (e.g. slot 0) and it splits + NODE A without using a shortcut. When NODE A is filled with keys that + all hashes are xxe6, the keys are similar, NODE A will split with a + shortcut. Finally, it forms the tree as shown below, where slot 6 points + to a shortcut. + + NODE A + +------>+---+ + ROOT | | 0 | xxe6 + +---+ | +---+ + xxxx | 0 | shortcut : : xxe6 + +---+ | +---+ + xxe6 : : | | | xxe6 + +---+ | +---+ + | 6 |---+ : : xxe6 + +---+ +---+ + xxe6 : : | f | xxe6 + +---+ +---+ + xxe6 | f | + +---+ + +4. As mentioned above, If a slot(slot 6) of the root points to a shortcut, + it may be mistakenly transferred to a key*, leading to a read + out-of-bounds read. + +To fix this issue, one should jump to descend_to_node if the ptr is a +shortcut, regardless of whether the node is root or not. + +[1] https://lore.kernel.org/linux-kernel/1cfa878e-8c7b-4570-8606-21daf5e13ce7@huaweicloud.com/ + +[jarkko: tweaked the commit message a bit to have an appropriate closes + tag.] +Fixes: b2a4df200d57 ("KEYS: Expand the capacity of a keyring") +Reported-by: syzbot+5b415c07907a2990d1a3@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/000000000000cbb7860611f61147@google.com/T/ +Signed-off-by: Chen Ridong +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + security/keys/keyring.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/security/keys/keyring.c b/security/keys/keyring.c +index 5ca620d31cd30..5ec89db5a7c1b 100644 +--- a/security/keys/keyring.c ++++ b/security/keys/keyring.c +@@ -772,8 +772,11 @@ static bool search_nested_keyrings(struct key *keyring, + for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) { + ptr = READ_ONCE(node->slots[slot]); + +- if (assoc_array_ptr_is_meta(ptr) && node->back_pointer) +- goto descend_to_node; ++ if (assoc_array_ptr_is_meta(ptr)) { ++ if (node->back_pointer || ++ assoc_array_ptr_is_shortcut(ptr)) ++ goto descend_to_node; ++ } + + if (!keyring_ptr_is_keyring(ptr)) + continue; +-- +2.43.0 + diff --git a/queue-5.4/series b/queue-5.4/series index e69de29bb2d..19a32e76904 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -0,0 +1,15 @@ +arm64-dts-rockchip-fix-rt5651-compatible-value-on-rk.patch +arm64-dts-rockchip-remove-hdmi-s-2nd-interrupt-on-rk.patch +arm64-dts-rockchip-fix-bluetooth-properties-on-rock9.patch +arm64-dts-rockchip-remove-cooling-cells-from-fan-on-.patch +arm-dts-rockchip-fix-rk3036-acodec-node.patch +arm-dts-rockchip-drop-grf-reference-from-rk3036-hdmi.patch +arm-dts-rockchip-fix-the-spi-controller-on-rk3036.patch +arm-dts-rockchip-fix-the-realtek-audio-codec-on-rk30.patch +hid-core-zero-initialize-the-report-buffer.patch +security-keys-fix-slab-out-of-bounds-in-key_task_per.patch +enetc-simplify-the-return-expression-of-enetc_vf_set.patch +net-enetc-set-mac-address-to-the-vf-net_device.patch +sctp-properly-validate-chunk-size-in-sctp_sf_ootb.patch +can-c_can-fix-rx-tx-_errors-statistics.patch +net-hns3-fix-kernel-crash-when-uninstalling-driver.patch