From: Sasha Levin Date: Mon, 8 Jul 2024 14:41:25 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v6.6.38~6 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=950b8c82208c7b0f273fca17f18c1364f919e8ec;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/alsa-hda-realtek-enable-headset-mic-of-jp-ik-leap-w5.patch b/queue-5.15/alsa-hda-realtek-enable-headset-mic-of-jp-ik-leap-w5.patch new file mode 100644 index 00000000000..850199fec03 --- /dev/null +++ b/queue-5.15/alsa-hda-realtek-enable-headset-mic-of-jp-ik-leap-w5.patch @@ -0,0 +1,71 @@ +From 46d9674d34eb478f358a2e097b57a8632903e2b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 13:50:09 +0800 +Subject: ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897 + +From: Jian-Hong Pan + +[ Upstream commit 45e37f9ce28d248470bab4376df2687a215d1b22 ] + +JP-IK LEAP W502 laptop's headset mic is not enabled until +ALC897_FIXUP_HEADSET_MIC_PIN3 quirk is applied. + +Here is the original pin node values: + +0x11 0x40000000 +0x12 0xb7a60130 +0x14 0x90170110 +0x15 0x411111f0 +0x16 0x411111f0 +0x17 0x411111f0 +0x18 0x411111f0 +0x19 0x411111f0 +0x1a 0x411111f0 +0x1b 0x03211020 +0x1c 0x411111f0 +0x1d 0x4026892d +0x1e 0x411111f0 +0x1f 0x411111f0 + +Signed-off-by: Jian-Hong Pan +Link: https://lore.kernel.org/r/20240520055008.7083-2-jhp@endlessos.org +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index ae59b208f12ac..fa504f319d43e 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10898,6 +10898,7 @@ enum { + ALC897_FIXUP_LENOVO_HEADSET_MODE, + ALC897_FIXUP_HEADSET_MIC_PIN2, + ALC897_FIXUP_UNIS_H3C_X500S, ++ ALC897_FIXUP_HEADSET_MIC_PIN3, + }; + + static const struct hda_fixup alc662_fixups[] = { +@@ -11344,10 +11345,18 @@ static const struct hda_fixup alc662_fixups[] = { + {} + }, + }, ++ [ALC897_FIXUP_HEADSET_MIC_PIN3] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x03a11050 }, /* use as headset mic */ ++ { } ++ }, ++ }, + }; + + static const struct snd_pci_quirk alc662_fixup_tbl[] = { + SND_PCI_QUIRK(0x1019, 0x9087, "ECS", ALC662_FIXUP_ASUS_MODE2), ++ SND_PCI_QUIRK(0x1019, 0x9859, "JP-IK LEAP W502", ALC897_FIXUP_HEADSET_MIC_PIN3), + SND_PCI_QUIRK(0x1025, 0x022f, "Acer Aspire One", ALC662_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x1025, 0x0241, "Packard Bell DOTS", ALC662_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE), +-- +2.43.0 + diff --git a/queue-5.15/clk-qcom-gcc-sm6350-fix-gpll6-gpll7-parents.patch b/queue-5.15/clk-qcom-gcc-sm6350-fix-gpll6-gpll7-parents.patch new file mode 100644 index 00000000000..1844556ce61 --- /dev/null +++ b/queue-5.15/clk-qcom-gcc-sm6350-fix-gpll6-gpll7-parents.patch @@ -0,0 +1,77 @@ +From a009f60e5218387d6035519284fefc5a3429100b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 10:12:53 +0200 +Subject: clk: qcom: gcc-sm6350: Fix gpll6* & gpll7 parents + +From: Luca Weiss + +[ Upstream commit 3414f41a13eb41db15c558fbc695466203dca4fa ] + +Both gpll6 and gpll7 are parented to CXO at 19.2 MHz and not to GPLL0 +which runs at 600 MHz. Also gpll6_out_even should have the parent gpll6 +and not gpll0. + +Adjust the parents of these clocks to make Linux report the correct rate +and not absurd numbers like gpll7 at ~25 GHz or gpll6 at 24 GHz. + +Corrected rates are the following: + + gpll7 807999902 Hz + gpll6 768000000 Hz + gpll6_out_even 384000000 Hz + gpll0 600000000 Hz + gpll0_out_odd 200000000 Hz + gpll0_out_even 300000000 Hz + +And because gpll6 is the parent of gcc_sdcc2_apps_clk_src (at 202 MHz) +that clock also reports the correct rate now and avoids this warning: + + [ 5.984062] mmc0: Card appears overclocked; req 202000000 Hz, actual 6312499237 Hz + +Fixes: 131abae905df ("clk: qcom: Add SM6350 GCC driver") +Signed-off-by: Luca Weiss +Link: https://lore.kernel.org/r/20240508-sm6350-gpll-fix-v1-1-e4ea34284a6d@fairphone.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sm6350.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-sm6350.c b/drivers/clk/qcom/gcc-sm6350.c +index e32ad7499285f..84ae27184cfd0 100644 +--- a/drivers/clk/qcom/gcc-sm6350.c ++++ b/drivers/clk/qcom/gcc-sm6350.c +@@ -99,8 +99,8 @@ static struct clk_alpha_pll gpll6 = { + .enable_mask = BIT(6), + .hw.init = &(struct clk_init_data){ + .name = "gpll6", +- .parent_hws = (const struct clk_hw*[]){ +- &gpll0.clkr.hw, ++ .parent_data = &(const struct clk_parent_data){ ++ .fw_name = "bi_tcxo", + }, + .num_parents = 1, + .ops = &clk_alpha_pll_fixed_fabia_ops, +@@ -123,7 +123,7 @@ static struct clk_alpha_pll_postdiv gpll6_out_even = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll6_out_even", + .parent_hws = (const struct clk_hw*[]){ +- &gpll0.clkr.hw, ++ &gpll6.clkr.hw, + }, + .num_parents = 1, + .ops = &clk_alpha_pll_postdiv_fabia_ops, +@@ -138,8 +138,8 @@ static struct clk_alpha_pll gpll7 = { + .enable_mask = BIT(7), + .hw.init = &(struct clk_init_data){ + .name = "gpll7", +- .parent_hws = (const struct clk_hw*[]){ +- &gpll0.clkr.hw, ++ .parent_data = &(const struct clk_parent_data){ ++ .fw_name = "bi_tcxo", + }, + .num_parents = 1, + .ops = &clk_alpha_pll_fixed_fabia_ops, +-- +2.43.0 + diff --git a/queue-5.15/dma-mapping-benchmark-avoid-needless-copy_to_user-if.patch b/queue-5.15/dma-mapping-benchmark-avoid-needless-copy_to_user-if.patch new file mode 100644 index 00000000000..2f7a561958c --- /dev/null +++ b/queue-5.15/dma-mapping-benchmark-avoid-needless-copy_to_user-if.patch @@ -0,0 +1,39 @@ +From 21368ad67f9c28722f8bbc3706661998856dd58c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2024 14:47:02 +0300 +Subject: dma-mapping: benchmark: avoid needless copy_to_user if benchmark + fails + +From: Fedor Pchelkin + +[ Upstream commit f7c9ccaadffd13066353332c13d7e9bf73b8f92d ] + +If do_map_benchmark() has failed, there is nothing useful to copy back +to userspace. + +Suggested-by: Barry Song <21cnbao@gmail.com> +Signed-off-by: Fedor Pchelkin +Acked-by: Robin Murphy +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/map_benchmark.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/kernel/dma/map_benchmark.c b/kernel/dma/map_benchmark.c +index b7f8bb7a1e5c5..fc67b39d8b38a 100644 +--- a/kernel/dma/map_benchmark.c ++++ b/kernel/dma/map_benchmark.c +@@ -275,6 +275,9 @@ static long map_benchmark_ioctl(struct file *file, unsigned int cmd, + * dma_mask changed by benchmark + */ + dma_set_mask(map->dev, old_dma_mask); ++ ++ if (ret) ++ return ret; + break; + default: + return -EINVAL; +-- +2.43.0 + diff --git a/queue-5.15/fs-ntfs3-mark-volume-as-dirty-if-xattr-is-broken.patch b/queue-5.15/fs-ntfs3-mark-volume-as-dirty-if-xattr-is-broken.patch new file mode 100644 index 00000000000..3d52f8fa3c8 --- /dev/null +++ b/queue-5.15/fs-ntfs3-mark-volume-as-dirty-if-xattr-is-broken.patch @@ -0,0 +1,38 @@ +From 7028e2d94398e1b6bc72504e516fd73ded6fb524 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 17:18:51 +0300 +Subject: fs/ntfs3: Mark volume as dirty if xattr is broken + +From: Konstantin Komarov + +[ Upstream commit 24f6f5020b0b2c89c2cba5ec224547be95f753ee ] + +Mark a volume as corrupted if the name length exceeds the space +occupied by ea. + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/xattr.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c +index d0b75d7f58a7b..4a7753384b0e9 100644 +--- a/fs/ntfs3/xattr.c ++++ b/fs/ntfs3/xattr.c +@@ -217,8 +217,11 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer, + if (!ea->name_len) + break; + +- if (ea->name_len > ea_size) ++ if (ea->name_len > ea_size) { ++ ntfs_set_state(ni->mi.sbi, NTFS_DIRTY_ERROR); ++ err = -EINVAL; /* corrupted fs */ + break; ++ } + + if (buffer) { + /* Check if we can use field ea->name */ +-- +2.43.0 + diff --git a/queue-5.15/i2c-pnx-fix-potential-deadlock-warning-from-del_time.patch b/queue-5.15/i2c-pnx-fix-potential-deadlock-warning-from-del_time.patch new file mode 100644 index 00000000000..395085eac0f --- /dev/null +++ b/queue-5.15/i2c-pnx-fix-potential-deadlock-warning-from-del_time.patch @@ -0,0 +1,185 @@ +From 963d3db134573fa606b377fb6a6ac3d281e1f3a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2024 17:25:42 +0200 +Subject: i2c: pnx: Fix potential deadlock warning from del_timer_sync() call + in isr + +From: Piotr Wojtaszczyk + +[ Upstream commit f63b94be6942ba82c55343e196bd09b53227618e ] + +When del_timer_sync() is called in an interrupt context it throws a warning +because of potential deadlock. The timer is used only to exit from +wait_for_completion() after a timeout so replacing the call with +wait_for_completion_timeout() allows to remove the problematic timer and +its related functions altogether. + +Fixes: 41561f28e76a ("i2c: New Philips PNX bus driver") +Signed-off-by: Piotr Wojtaszczyk +Signed-off-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-pnx.c | 48 ++++++++---------------------------- + 1 file changed, 10 insertions(+), 38 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-pnx.c b/drivers/i2c/busses/i2c-pnx.c +index 50f21cdbe90d3..d2c09b0fdf527 100644 +--- a/drivers/i2c/busses/i2c-pnx.c ++++ b/drivers/i2c/busses/i2c-pnx.c +@@ -15,7 +15,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -32,7 +31,6 @@ struct i2c_pnx_mif { + int ret; /* Return value */ + int mode; /* Interface mode */ + struct completion complete; /* I/O completion */ +- struct timer_list timer; /* Timeout */ + u8 * buf; /* Data buffer */ + int len; /* Length of data buffer */ + int order; /* RX Bytes to order via TX */ +@@ -117,24 +115,6 @@ static inline int wait_reset(struct i2c_pnx_algo_data *data) + return (timeout <= 0); + } + +-static inline void i2c_pnx_arm_timer(struct i2c_pnx_algo_data *alg_data) +-{ +- struct timer_list *timer = &alg_data->mif.timer; +- unsigned long expires = msecs_to_jiffies(alg_data->timeout); +- +- if (expires <= 1) +- expires = 2; +- +- del_timer_sync(timer); +- +- dev_dbg(&alg_data->adapter.dev, "Timer armed at %lu plus %lu jiffies.\n", +- jiffies, expires); +- +- timer->expires = jiffies + expires; +- +- add_timer(timer); +-} +- + /** + * i2c_pnx_start - start a device + * @slave_addr: slave address +@@ -259,8 +239,6 @@ static int i2c_pnx_master_xmit(struct i2c_pnx_algo_data *alg_data) + ~(mcntrl_afie | mcntrl_naie | mcntrl_drmie), + I2C_REG_CTL(alg_data)); + +- del_timer_sync(&alg_data->mif.timer); +- + dev_dbg(&alg_data->adapter.dev, + "%s(): Waking up xfer routine.\n", + __func__); +@@ -276,8 +254,6 @@ static int i2c_pnx_master_xmit(struct i2c_pnx_algo_data *alg_data) + ~(mcntrl_afie | mcntrl_naie | mcntrl_drmie), + I2C_REG_CTL(alg_data)); + +- /* Stop timer. */ +- del_timer_sync(&alg_data->mif.timer); + dev_dbg(&alg_data->adapter.dev, + "%s(): Waking up xfer routine after zero-xfer.\n", + __func__); +@@ -364,8 +340,6 @@ static int i2c_pnx_master_rcv(struct i2c_pnx_algo_data *alg_data) + mcntrl_drmie | mcntrl_daie); + iowrite32(ctl, I2C_REG_CTL(alg_data)); + +- /* Kill timer. */ +- del_timer_sync(&alg_data->mif.timer); + complete(&alg_data->mif.complete); + } + } +@@ -400,8 +374,6 @@ static irqreturn_t i2c_pnx_interrupt(int irq, void *dev_id) + mcntrl_drmie); + iowrite32(ctl, I2C_REG_CTL(alg_data)); + +- /* Stop timer, to prevent timeout. */ +- del_timer_sync(&alg_data->mif.timer); + complete(&alg_data->mif.complete); + } else if (stat & mstatus_nai) { + /* Slave did not acknowledge, generate a STOP */ +@@ -419,8 +391,6 @@ static irqreturn_t i2c_pnx_interrupt(int irq, void *dev_id) + /* Our return value. */ + alg_data->mif.ret = -EIO; + +- /* Stop timer, to prevent timeout. */ +- del_timer_sync(&alg_data->mif.timer); + complete(&alg_data->mif.complete); + } else { + /* +@@ -453,9 +423,8 @@ static irqreturn_t i2c_pnx_interrupt(int irq, void *dev_id) + return IRQ_HANDLED; + } + +-static void i2c_pnx_timeout(struct timer_list *t) ++static void i2c_pnx_timeout(struct i2c_pnx_algo_data *alg_data) + { +- struct i2c_pnx_algo_data *alg_data = from_timer(alg_data, t, mif.timer); + u32 ctl; + + dev_err(&alg_data->adapter.dev, +@@ -472,7 +441,6 @@ static void i2c_pnx_timeout(struct timer_list *t) + iowrite32(ctl, I2C_REG_CTL(alg_data)); + wait_reset(alg_data); + alg_data->mif.ret = -EIO; +- complete(&alg_data->mif.complete); + } + + static inline void bus_reset_if_active(struct i2c_pnx_algo_data *alg_data) +@@ -514,6 +482,7 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + struct i2c_msg *pmsg; + int rc = 0, completed = 0, i; + struct i2c_pnx_algo_data *alg_data = adap->algo_data; ++ unsigned long time_left; + u32 stat; + + dev_dbg(&alg_data->adapter.dev, +@@ -548,7 +517,6 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + dev_dbg(&alg_data->adapter.dev, "%s(): mode %d, %d bytes\n", + __func__, alg_data->mif.mode, alg_data->mif.len); + +- i2c_pnx_arm_timer(alg_data); + + /* initialize the completion var */ + init_completion(&alg_data->mif.complete); +@@ -564,7 +532,10 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + break; + + /* Wait for completion */ +- wait_for_completion(&alg_data->mif.complete); ++ time_left = wait_for_completion_timeout(&alg_data->mif.complete, ++ alg_data->timeout); ++ if (time_left == 0) ++ i2c_pnx_timeout(alg_data); + + if (!(rc = alg_data->mif.ret)) + completed++; +@@ -657,7 +628,10 @@ static int i2c_pnx_probe(struct platform_device *pdev) + alg_data->adapter.algo_data = alg_data; + alg_data->adapter.nr = pdev->id; + +- alg_data->timeout = I2C_PNX_TIMEOUT_DEFAULT; ++ alg_data->timeout = msecs_to_jiffies(I2C_PNX_TIMEOUT_DEFAULT); ++ if (alg_data->timeout <= 1) ++ alg_data->timeout = 2; ++ + #ifdef CONFIG_OF + alg_data->adapter.dev.of_node = of_node_get(pdev->dev.of_node); + if (pdev->dev.of_node) { +@@ -677,8 +651,6 @@ static int i2c_pnx_probe(struct platform_device *pdev) + if (IS_ERR(alg_data->clk)) + return PTR_ERR(alg_data->clk); + +- timer_setup(&alg_data->mif.timer, i2c_pnx_timeout, 0); +- + snprintf(alg_data->adapter.name, sizeof(alg_data->adapter.name), + "%s", pdev->name); + +-- +2.43.0 + diff --git a/queue-5.15/kbuild-fix-short-log-for-as-in-link-vmlinux.sh.patch b/queue-5.15/kbuild-fix-short-log-for-as-in-link-vmlinux.sh.patch new file mode 100644 index 00000000000..177efb656b1 --- /dev/null +++ b/queue-5.15/kbuild-fix-short-log-for-as-in-link-vmlinux.sh.patch @@ -0,0 +1,59 @@ +From 3b833f617ff93382113745b5cdb9b14ab059fc2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 21:42:11 +0900 +Subject: kbuild: fix short log for AS in link-vmlinux.sh + +From: Masahiro Yamada + +[ Upstream commit 3430f65d6130ccbc86f0ff45642eeb9e2032a600 ] + +In convention, short logs print the output file, not the input file. + +Let's change the suffix for 'AS' since it assembles *.S into *.o. + +[Before] + + LD .tmp_vmlinux.kallsyms1 + NM .tmp_vmlinux.kallsyms1.syms + KSYMS .tmp_vmlinux.kallsyms1.S + AS .tmp_vmlinux.kallsyms1.S + LD .tmp_vmlinux.kallsyms2 + NM .tmp_vmlinux.kallsyms2.syms + KSYMS .tmp_vmlinux.kallsyms2.S + AS .tmp_vmlinux.kallsyms2.S + LD vmlinux + +[After] + + LD .tmp_vmlinux.kallsyms1 + NM .tmp_vmlinux.kallsyms1.syms + KSYMS .tmp_vmlinux.kallsyms1.S + AS .tmp_vmlinux.kallsyms1.o + LD .tmp_vmlinux.kallsyms2 + NM .tmp_vmlinux.kallsyms2.syms + KSYMS .tmp_vmlinux.kallsyms2.S + AS .tmp_vmlinux.kallsyms2.o + LD vmlinux + +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/link-vmlinux.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh +index 5a5a0cfad69df..40cbc73c7813c 100755 +--- a/scripts/link-vmlinux.sh ++++ b/scripts/link-vmlinux.sh +@@ -278,7 +278,7 @@ kallsyms_step() + vmlinux_link ${kallsyms_vmlinux} "${kallsymso_prev}" ${btf_vmlinux_bin_o} + kallsyms ${kallsyms_vmlinux} ${kallsyms_S} + +- info AS ${kallsyms_S} ++ info AS ${kallsymso} + ${CC} ${NOSTDINC_FLAGS} ${LINUXINCLUDE} ${KBUILD_CPPFLAGS} \ + ${KBUILD_AFLAGS} ${KBUILD_AFLAGS_KERNEL} \ + -c -o ${kallsymso} ${kallsyms_S} +-- +2.43.0 + diff --git a/queue-5.15/nfc-nci-add-the-inconsistency-check-between-the-inpu.patch b/queue-5.15/nfc-nci-add-the-inconsistency-check-between-the-inpu.patch new file mode 100644 index 00000000000..28c9c8ba8c3 --- /dev/null +++ b/queue-5.15/nfc-nci-add-the-inconsistency-check-between-the-inpu.patch @@ -0,0 +1,45 @@ +From 51fd72adf644062e262886fdf61477b859145b31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 11:12:31 +0800 +Subject: nfc/nci: Add the inconsistency check between the input data length + and count + +From: Edward Adam Davis + +[ Upstream commit 068648aab72c9ba7b0597354ef4d81ffaac7b979 ] + +write$nci(r0, &(0x7f0000000740)=ANY=[@ANYBLOB="610501"], 0xf) + +Syzbot constructed a write() call with a data length of 3 bytes but a count value +of 15, which passed too little data to meet the basic requirements of the function +nci_rf_intf_activated_ntf_packet(). + +Therefore, increasing the comparison between data length and count value to avoid +problems caused by inconsistent data length and count. + +Reported-and-tested-by: syzbot+71bfed2b2bcea46c98f2@syzkaller.appspotmail.com +Signed-off-by: Edward Adam Davis +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/nfc/virtual_ncidev.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/nfc/virtual_ncidev.c b/drivers/nfc/virtual_ncidev.c +index 6317e8505aaad..09d4ab0e63b1a 100644 +--- a/drivers/nfc/virtual_ncidev.c ++++ b/drivers/nfc/virtual_ncidev.c +@@ -121,6 +121,10 @@ static ssize_t virtual_ncidev_write(struct file *file, + kfree_skb(skb); + return -EFAULT; + } ++ if (strnlen(skb->data, count) != count) { ++ kfree_skb(skb); ++ return -EINVAL; ++ } + + nci_recv_frame(ndev, skb); + return count; +-- +2.43.0 + diff --git a/queue-5.15/null_blk-do-not-allow-runt-zone-with-zone-capacity-s.patch b/queue-5.15/null_blk-do-not-allow-runt-zone-with-zone-capacity-s.patch new file mode 100644 index 00000000000..9db6ed83a7a --- /dev/null +++ b/queue-5.15/null_blk-do-not-allow-runt-zone-with-zone-capacity-s.patch @@ -0,0 +1,56 @@ +From e76cd6f118e37dd7f62520fab8276045c3142b04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 14:40:32 +0900 +Subject: null_blk: Do not allow runt zone with zone capacity smaller then zone + size + +From: Damien Le Moal + +[ Upstream commit b164316808ec5de391c3e7b0148ec937d32d280d ] + +A zoned device with a smaller last zone together with a zone capacity +smaller than the zone size does make any sense as that does not +correspond to any possible setup for a real device: +1) For ZNS and zoned UFS devices, all zones are always the same size. +2) For SMR HDDs, all zones always have the same capacity. +In other words, if we have a smaller last runt zone, then this zone +capacity should always be equal to the zone size. + +Add a check in null_init_zoned_dev() to prevent a configuration to have +both a smaller zone size and a zone capacity smaller than the zone size. + +Signed-off-by: Damien Le Moal +Reviewed-by: Niklas Cassel +Reviewed-by: Bart Van Assche +Link: https://lore.kernel.org/r/20240530054035.491497-2-dlemoal@kernel.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk/zoned.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/block/null_blk/zoned.c b/drivers/block/null_blk/zoned.c +index 0cdeafd9defcf..174d93a84137b 100644 +--- a/drivers/block/null_blk/zoned.c ++++ b/drivers/block/null_blk/zoned.c +@@ -80,6 +80,17 @@ int null_init_zoned_dev(struct nullb_device *dev, struct request_queue *q) + return -EINVAL; + } + ++ /* ++ * If a smaller zone capacity was requested, do not allow a smaller last ++ * zone at the same time as such zone configuration does not correspond ++ * to any real zoned device. ++ */ ++ if (dev->zone_capacity != dev->zone_size && ++ dev->size & (dev->zone_size - 1)) { ++ pr_err("A smaller last zone is not allowed with zone capacity smaller than zone size.\n"); ++ return -EINVAL; ++ } ++ + zone_capacity_sects = mb_to_sects(dev->zone_capacity); + dev_capacity_sects = mb_to_sects(dev->size); + dev->zone_size_sects = mb_to_sects(dev->zone_size); +-- +2.43.0 + diff --git a/queue-5.15/nvme-adjust-multiples-of-nvme_ctrl_page_size-in-offs.patch b/queue-5.15/nvme-adjust-multiples-of-nvme_ctrl_page_size-in-offs.patch new file mode 100644 index 00000000000..cb72e89b750 --- /dev/null +++ b/queue-5.15/nvme-adjust-multiples-of-nvme_ctrl_page_size-in-offs.patch @@ -0,0 +1,45 @@ +From 8bab0d3de7c00987e3c39ccfab1e2931468da09d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 May 2024 17:01:49 +0530 +Subject: nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset + +From: Kundan Kumar + +[ Upstream commit 1bd293fcf3af84674e82ed022c049491f3768840 ] + +bio_vec start offset may be relatively large particularly when large +folio gets added to the bio. A bigger offset will result in avoiding the +single-segment mapping optimization and end up using expensive +mempool_alloc further. + +Rather than using absolute value, adjust bv_offset by +NVME_CTRL_PAGE_SIZE while checking if segment can be fitted into one/two +PRP entries. + +Suggested-by: Christoph Hellwig +Signed-off-by: Kundan Kumar +Reviewed-by: Sagi Grimberg +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 7bb74112fef37..5a3ba7e390546 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -836,7 +836,8 @@ static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req, + struct bio_vec bv = req_bvec(req); + + if (!is_pci_p2pdma_page(bv.bv_page)) { +- if (bv.bv_offset + bv.bv_len <= NVME_CTRL_PAGE_SIZE * 2) ++ if ((bv.bv_offset & (NVME_CTRL_PAGE_SIZE - 1)) + ++ bv.bv_len <= NVME_CTRL_PAGE_SIZE * 2) + return nvme_setup_prp_simple(dev, req, + &cmnd->rw, &bv); + +-- +2.43.0 + diff --git a/queue-5.15/nvme-multipath-find-numa-path-only-for-online-numa-n.patch b/queue-5.15/nvme-multipath-find-numa-path-only-for-online-numa-n.patch new file mode 100644 index 00000000000..a33b2fa6df1 --- /dev/null +++ b/queue-5.15/nvme-multipath-find-numa-path-only-for-online-numa-n.patch @@ -0,0 +1,54 @@ +From 45e38f57e97d69cf415e45eaf86fa7d0baff2e99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 May 2024 17:43:51 +0530 +Subject: nvme-multipath: find NUMA path only for online numa-node + +From: Nilay Shroff + +[ Upstream commit d3a043733f25d743f3aa617c7f82dbcb5ee2211a ] + +In current native multipath design when a shared namespace is created, +we loop through each possible numa-node, calculate the NUMA distance of +that node from each nvme controller and then cache the optimal IO path +for future reference while sending IO. The issue with this design is that +we may refer to the NUMA distance table for an offline node which may not +be populated at the time and so we may inadvertently end up finding and +caching a non-optimal path for IO. Then latter when the corresponding +numa-node becomes online and hence the NUMA distance table entry for that +node is created, ideally we should re-calculate the multipath node distance +for the newly added node however that doesn't happen unless we rescan/reset +the controller. So essentially, we may keep using non-optimal IO path for a +node which is made online after namespace is created. +This patch helps fix this issue ensuring that when a shared namespace is +created, we calculate the multipath node distance for each online numa-node +instead of each possible numa-node. Then latter when a node becomes online +and we receive any IO on that newly added node, we would calculate the +multipath node distance for newly added node but this time NUMA distance +table would have been already populated for newly added node. Hence we +would be able to correctly calculate the multipath node distance and choose +the optimal path for the IO. + +Signed-off-by: Nilay Shroff +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/multipath.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index f8ad43b5f0690..4bc0ce9c16df1 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -517,7 +517,7 @@ static void nvme_mpath_set_live(struct nvme_ns *ns) + int node, srcu_idx; + + srcu_idx = srcu_read_lock(&head->srcu); +- for_each_node(node) ++ for_each_online_node(node) + __nvme_find_path(head, node); + srcu_read_unlock(&head->srcu, srcu_idx); + } +-- +2.43.0 + diff --git a/queue-5.15/nvmet-fix-a-possible-leak-when-destroy-a-ctrl-during.patch b/queue-5.15/nvmet-fix-a-possible-leak-when-destroy-a-ctrl-during.patch new file mode 100644 index 00000000000..fd0916122da --- /dev/null +++ b/queue-5.15/nvmet-fix-a-possible-leak-when-destroy-a-ctrl-during.patch @@ -0,0 +1,63 @@ +From 577182f07a6972121747a6344a02866854a7ccc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 22:38:52 +0300 +Subject: nvmet: fix a possible leak when destroy a ctrl during qp + establishment + +From: Sagi Grimberg + +[ Upstream commit c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4 ] + +In nvmet_sq_destroy we capture sq->ctrl early and if it is non-NULL we +know that a ctrl was allocated (in the admin connect request handler) +and we need to release pending AERs, clear ctrl->sqs and sq->ctrl +(for nvme-loop primarily), and drop the final reference on the ctrl. + +However, a small window is possible where nvmet_sq_destroy starts (as +a result of the client giving up and disconnecting) concurrently with +the nvme admin connect cmd (which may be in an early stage). But *before* +kill_and_confirm of sq->ref (i.e. the admin connect managed to get an sq +live reference). In this case, sq->ctrl was allocated however after it was +captured in a local variable in nvmet_sq_destroy. +This prevented the final reference drop on the ctrl. + +Solve this by re-capturing the sq->ctrl after all inflight request has +completed, where for sure sq->ctrl reference is final, and move forward +based on that. + +This issue was observed in an environment with many hosts connecting +multiple ctrls simoutanuosly, creating a delay in allocating a ctrl +leading up to this race window. + +Reported-by: Alex Turin +Signed-off-by: Sagi Grimberg +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/core.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index 2c44d5a95c8d6..ef2e500bccfdf 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -801,6 +801,15 @@ void nvmet_sq_destroy(struct nvmet_sq *sq) + wait_for_completion(&sq->free_done); + percpu_ref_exit(&sq->ref); + ++ /* ++ * we must reference the ctrl again after waiting for inflight IO ++ * to complete. Because admin connect may have sneaked in after we ++ * store sq->ctrl locally, but before we killed the percpu_ref. the ++ * admin connect allocates and assigns sq->ctrl, which now needs a ++ * final ref put, as this ctrl is going away. ++ */ ++ ctrl = sq->ctrl; ++ + if (ctrl) { + /* + * The teardown flow may take some time, and the host may not +-- +2.43.0 + diff --git a/queue-5.15/platform-x86-touchscreen_dmi-add-info-for-globalspac.patch b/queue-5.15/platform-x86-touchscreen_dmi-add-info-for-globalspac.patch new file mode 100644 index 00000000000..e750bc9e7f5 --- /dev/null +++ b/queue-5.15/platform-x86-touchscreen_dmi-add-info-for-globalspac.patch @@ -0,0 +1,69 @@ +From 096b5aad08053b861a8b1695fa35be4ecaa7db13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 11:14:46 +0200 +Subject: platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT IVW + 11.6" tablet + +From: hmtheboy154 + +[ Upstream commit 7c8639aa41343fd7b3dbe09baf6b0791fcc407a1 ] + +This is a tablet created by GlobalSpace Technologies Limited +which uses an Intel Atom x5-Z8300, 4GB of RAM & 64GB of storage. + +Link: https://web.archive.org/web/20171102141952/http://globalspace.in/11.6-device.html +Signed-off-by: hmtheboy154 +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20240527091447.248849-2-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/touchscreen_dmi.c | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c +index 161bd19441042..c6605e0e4760e 100644 +--- a/drivers/platform/x86/touchscreen_dmi.c ++++ b/drivers/platform/x86/touchscreen_dmi.c +@@ -874,6 +874,22 @@ static const struct ts_dmi_data schneider_sct101ctm_data = { + .properties = schneider_sct101ctm_props, + }; + ++static const struct property_entry globalspace_solt_ivw116_props[] = { ++ PROPERTY_ENTRY_U32("touchscreen-min-x", 7), ++ PROPERTY_ENTRY_U32("touchscreen-min-y", 22), ++ PROPERTY_ENTRY_U32("touchscreen-size-x", 1723), ++ PROPERTY_ENTRY_U32("touchscreen-size-y", 1077), ++ PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-globalspace-solt-ivw116.fw"), ++ PROPERTY_ENTRY_U32("silead,max-fingers", 10), ++ PROPERTY_ENTRY_BOOL("silead,home-button"), ++ { } ++}; ++ ++static const struct ts_dmi_data globalspace_solt_ivw116_data = { ++ .acpi_name = "MSSL1680:00", ++ .properties = globalspace_solt_ivw116_props, ++}; ++ + static const struct property_entry techbite_arc_11_6_props[] = { + PROPERTY_ENTRY_U32("touchscreen-min-x", 5), + PROPERTY_ENTRY_U32("touchscreen-min-y", 7), +@@ -1569,6 +1585,15 @@ const struct dmi_system_id touchscreen_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "SCT101CTM"), + }, + }, ++ { ++ /* GlobalSpace SoLT IVW 11.6" */ ++ .driver_data = (void *)&globalspace_solt_ivw116_data, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Globalspace Tech Pvt Ltd"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "SolTIVW"), ++ DMI_MATCH(DMI_PRODUCT_SKU, "PN20170413488"), ++ }, ++ }, + { + /* Techbite Arc 11.6 */ + .driver_data = (void *)&techbite_arc_11_6_data, +-- +2.43.0 + diff --git a/queue-5.15/platform-x86-touchscreen_dmi-add-info-for-the-ezpad-.patch b/queue-5.15/platform-x86-touchscreen_dmi-add-info-for-the-ezpad-.patch new file mode 100644 index 00000000000..c4b62b5e22a --- /dev/null +++ b/queue-5.15/platform-x86-touchscreen_dmi-add-info-for-the-ezpad-.patch @@ -0,0 +1,46 @@ +From b424c428b5a195e3f6c51fb100ae1e7b96837616 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 11:14:47 +0200 +Subject: platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro + +From: hmtheboy154 + +[ Upstream commit 3050052613790e75b5e4a8536930426b0a8b0774 ] + +The "EZpad 6s Pro" uses the same touchscreen as the "EZpad 6 Pro B", +unlike the "Ezpad 6 Pro" which has its own touchscreen. + +Signed-off-by: hmtheboy154 +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20240527091447.248849-3-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/touchscreen_dmi.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c +index c6605e0e4760e..664a63c8a36c0 100644 +--- a/drivers/platform/x86/touchscreen_dmi.c ++++ b/drivers/platform/x86/touchscreen_dmi.c +@@ -1346,6 +1346,17 @@ const struct dmi_system_id touchscreen_dmi_table[] = { + DMI_MATCH(DMI_BIOS_DATE, "04/24/2018"), + }, + }, ++ { ++ /* Jumper EZpad 6s Pro */ ++ .driver_data = (void *)&jumper_ezpad_6_pro_b_data, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Jumper"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Ezpad"), ++ /* Above matches are too generic, add bios match */ ++ DMI_MATCH(DMI_BIOS_VERSION, "E.WSA116_8.E1.042.bin"), ++ DMI_MATCH(DMI_BIOS_DATE, "01/08/2020"), ++ }, ++ }, + { + /* Jumper EZpad 6 m4 */ + .driver_data = (void *)&jumper_ezpad_6_m4_data, +-- +2.43.0 + diff --git a/queue-5.15/regmap-i2c-subtract-reg-size-from-max_write.patch b/queue-5.15/regmap-i2c-subtract-reg-size-from-max_write.patch new file mode 100644 index 00000000000..d4e611bcd22 --- /dev/null +++ b/queue-5.15/regmap-i2c-subtract-reg-size-from-max_write.patch @@ -0,0 +1,46 @@ +From 5bdc55c4a839fc104f87846cf8a5531a04cbe727 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 May 2024 16:14:36 -0500 +Subject: regmap-i2c: Subtract reg size from max_write + +From: Jim Wylder + +[ Upstream commit 611b7eb19d0a305d4de00280e4a71a1b15c507fc ] + +Currently, when an adapter defines a max_write_len quirk, +the data will be chunked into data sizes equal to the +max_write_len quirk value. But the payload will be increased by +the size of the register address before transmission. The +resulting value always ends up larger than the limit set +by the quirk. + +Avoid this error by setting regmap's max_write to the quirk's +max_write_len minus the number of bytes for the register and +padding. This allows the chunking to work correctly for this +limited case without impacting other use-cases. + +Signed-off-by: Jim Wylder +Link: https://msgid.link/r/20240523211437.2839942-1-jwylder@google.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap-i2c.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/regmap/regmap-i2c.c b/drivers/base/regmap/regmap-i2c.c +index 3ec611dc0c09f..a905e955bbfc7 100644 +--- a/drivers/base/regmap/regmap-i2c.c ++++ b/drivers/base/regmap/regmap-i2c.c +@@ -350,7 +350,8 @@ static const struct regmap_bus *regmap_get_i2c_bus(struct i2c_client *i2c, + + if (quirks->max_write_len && + (bus->max_raw_write == 0 || bus->max_raw_write > quirks->max_write_len)) +- max_write = quirks->max_write_len; ++ max_write = quirks->max_write_len - ++ (config->reg_bits + config->pad_bits) / BITS_PER_BYTE; + + if (max_read || max_write) { + ret_bus = kmemdup(bus, sizeof(*bus), GFP_KERNEL); +-- +2.43.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 3911086e724..5e7d16e055f 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -64,3 +64,17 @@ mtd-rawnand-rockchip-ensure-nvddr-timings-are-rejected.patch bnx2x-fix-multiple-ubsan-array-index-out-of-bounds.patch ima-avoid-blocking-in-rcu-read-side-critical-section.patch media-dw2102-fix-a-potential-buffer-overflow.patch +clk-qcom-gcc-sm6350-fix-gpll6-gpll7-parents.patch +i2c-pnx-fix-potential-deadlock-warning-from-del_time.patch +fs-ntfs3-mark-volume-as-dirty-if-xattr-is-broken.patch +alsa-hda-realtek-enable-headset-mic-of-jp-ik-leap-w5.patch +nvme-multipath-find-numa-path-only-for-online-numa-n.patch +dma-mapping-benchmark-avoid-needless-copy_to_user-if.patch +nvme-adjust-multiples-of-nvme_ctrl_page_size-in-offs.patch +regmap-i2c-subtract-reg-size-from-max_write.patch +platform-x86-touchscreen_dmi-add-info-for-globalspac.patch +platform-x86-touchscreen_dmi-add-info-for-the-ezpad-.patch +nvmet-fix-a-possible-leak-when-destroy-a-ctrl-during.patch +kbuild-fix-short-log-for-as-in-link-vmlinux.sh.patch +nfc-nci-add-the-inconsistency-check-between-the-inpu.patch +null_blk-do-not-allow-runt-zone-with-zone-capacity-s.patch