From: Greg Kroah-Hartman Date: Mon, 5 May 2025 08:19:31 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v6.1.137~8 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a05112a74eedb820bd51c36097ca973fe462d4fa;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: amd-xgbe-fix-to-ensure-dependent-features-are-toggled-with-rx-checksum-offload.patch arm64-errata-add-missing-sentinels-to-spectre-bhb-midr-arrays.patch cpufreq-avoid-using-inconsistent-policy-min-and-policy-max.patch cpufreq-fix-setting-policy-limits-when-frequency-tables-are-used.patch dm-always-update-the-array-size-in-realloc_argv-on-success.patch dm-integrity-fix-a-warning-on-invalid-table-line.patch drm-nouveau-fix-warn_on-in-nouveau_fence_context_kill.patch edac-altera-set-ddr-and-sdmmc-interrupt-mask-before-registration.patch edac-altera-test-the-correct-error-reg-offset.patch i2c-imx-lpi2c-fix-clock-count-when-probe-defers.patch iommu-amd-fix-potential-buffer-overflow-in-parse_ivrs_acpihid.patch iommu-vt-d-apply-quirk_iommu_igfx-for-8086-0044-qm57-qs57.patch irqchip-qcom-mpm-prevent-crash-when-trying-to-handle-non-wake-gpios.patch ksmbd-fix-use-after-free-in-kerberos-authentication.patch mmc-renesas_sdhi-fix-error-handling-in-renesas_sdhi_probe.patch parisc-fix-double-sigfpe-crash.patch perf-x86-intel-kvm-mask-pebs_enable-loaded-for-guest-with-vcpu-s-value.patch platform-x86-intel-uncore-freq-fix-missing-uncore-sysfs-during-cpu-hotplug.patch tracing-fix-oob-write-in-trace_seq_to_buffer.patch wifi-brcm80211-fmac-add-error-handling-for-brcmf_usb_dl_writeimage.patch --- diff --git a/queue-6.1/amd-xgbe-fix-to-ensure-dependent-features-are-toggled-with-rx-checksum-offload.patch b/queue-6.1/amd-xgbe-fix-to-ensure-dependent-features-are-toggled-with-rx-checksum-offload.patch new file mode 100644 index 0000000000..586afe29ce --- /dev/null +++ b/queue-6.1/amd-xgbe-fix-to-ensure-dependent-features-are-toggled-with-rx-checksum-offload.patch @@ -0,0 +1,135 @@ +From f04dd30f1bef1ed2e74a4050af6e5e5e3869bac3 Mon Sep 17 00:00:00 2001 +From: Vishal Badole +Date: Thu, 24 Apr 2025 18:32:48 +0530 +Subject: amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload + +From: Vishal Badole + +commit f04dd30f1bef1ed2e74a4050af6e5e5e3869bac3 upstream. + +According to the XGMAC specification, enabling features such as Layer 3 +and Layer 4 Packet Filtering, Split Header and Virtualized Network support +automatically selects the IPC Full Checksum Offload Engine on the receive +side. + +When RX checksum offload is disabled, these dependent features must also +be disabled to prevent abnormal behavior caused by mismatched feature +dependencies. + +Ensure that toggling RX checksum offload (disabling or enabling) properly +disables or enables all dependent features, maintaining consistent and +expected behavior in the network device. + +Cc: stable@vger.kernel.org +Fixes: 1a510ccf5869 ("amd-xgbe: Add support for VXLAN offload capabilities") +Signed-off-by: Vishal Badole +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250424130248.428865-1-Vishal.Badole@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/amd/xgbe/xgbe-desc.c | 9 +++++++-- + drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 24 ++++++++++++++++++++++-- + drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 11 +++++++++-- + drivers/net/ethernet/amd/xgbe/xgbe.h | 4 ++++ + 4 files changed, 42 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c +@@ -373,8 +373,13 @@ static int xgbe_map_rx_buffer(struct xgb + } + + /* Set up the header page info */ +- xgbe_set_buffer_data(&rdata->rx.hdr, &ring->rx_hdr_pa, +- XGBE_SKB_ALLOC_SIZE); ++ if (pdata->netdev->features & NETIF_F_RXCSUM) { ++ xgbe_set_buffer_data(&rdata->rx.hdr, &ring->rx_hdr_pa, ++ XGBE_SKB_ALLOC_SIZE); ++ } else { ++ xgbe_set_buffer_data(&rdata->rx.hdr, &ring->rx_hdr_pa, ++ pdata->rx_buf_size); ++ } + + /* Set up the buffer page info */ + xgbe_set_buffer_data(&rdata->rx.buf, &ring->rx_buf_pa, +--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c +@@ -320,6 +320,18 @@ static void xgbe_config_sph_mode(struct + XGMAC_IOWRITE_BITS(pdata, MAC_RCR, HDSMS, XGBE_SPH_HDSMS_SIZE); + } + ++static void xgbe_disable_sph_mode(struct xgbe_prv_data *pdata) ++{ ++ unsigned int i; ++ ++ for (i = 0; i < pdata->channel_count; i++) { ++ if (!pdata->channel[i]->rx_ring) ++ break; ++ ++ XGMAC_DMA_IOWRITE_BITS(pdata->channel[i], DMA_CH_CR, SPH, 0); ++ } ++} ++ + static int xgbe_write_rss_reg(struct xgbe_prv_data *pdata, unsigned int type, + unsigned int index, unsigned int val) + { +@@ -3495,8 +3507,12 @@ static int xgbe_init(struct xgbe_prv_dat + xgbe_config_tx_coalesce(pdata); + xgbe_config_rx_buffer_size(pdata); + xgbe_config_tso_mode(pdata); +- xgbe_config_sph_mode(pdata); +- xgbe_config_rss(pdata); ++ ++ if (pdata->netdev->features & NETIF_F_RXCSUM) { ++ xgbe_config_sph_mode(pdata); ++ xgbe_config_rss(pdata); ++ } ++ + desc_if->wrapper_tx_desc_init(pdata); + desc_if->wrapper_rx_desc_init(pdata); + xgbe_enable_dma_interrupts(pdata); +@@ -3650,5 +3666,9 @@ void xgbe_init_function_ptrs_dev(struct + hw_if->disable_vxlan = xgbe_disable_vxlan; + hw_if->set_vxlan_id = xgbe_set_vxlan_id; + ++ /* For Split Header*/ ++ hw_if->enable_sph = xgbe_config_sph_mode; ++ hw_if->disable_sph = xgbe_disable_sph_mode; ++ + DBGPR("<--xgbe_init_function_ptrs\n"); + } +--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +@@ -2257,10 +2257,17 @@ static int xgbe_set_features(struct net_ + if (ret) + return ret; + +- if ((features & NETIF_F_RXCSUM) && !rxcsum) ++ if ((features & NETIF_F_RXCSUM) && !rxcsum) { ++ hw_if->enable_sph(pdata); ++ hw_if->enable_vxlan(pdata); + hw_if->enable_rx_csum(pdata); +- else if (!(features & NETIF_F_RXCSUM) && rxcsum) ++ schedule_work(&pdata->restart_work); ++ } else if (!(features & NETIF_F_RXCSUM) && rxcsum) { ++ hw_if->disable_sph(pdata); ++ hw_if->disable_vxlan(pdata); + hw_if->disable_rx_csum(pdata); ++ schedule_work(&pdata->restart_work); ++ } + + if ((features & NETIF_F_HW_VLAN_CTAG_RX) && !rxvlan) + hw_if->enable_rx_vlan_stripping(pdata); +--- a/drivers/net/ethernet/amd/xgbe/xgbe.h ++++ b/drivers/net/ethernet/amd/xgbe/xgbe.h +@@ -859,6 +859,10 @@ struct xgbe_hw_if { + void (*enable_vxlan)(struct xgbe_prv_data *); + void (*disable_vxlan)(struct xgbe_prv_data *); + void (*set_vxlan_id)(struct xgbe_prv_data *); ++ ++ /* For Split Header */ ++ void (*enable_sph)(struct xgbe_prv_data *pdata); ++ void (*disable_sph)(struct xgbe_prv_data *pdata); + }; + + /* This structure represents implementation specific routines for an diff --git a/queue-6.1/arm64-errata-add-missing-sentinels-to-spectre-bhb-midr-arrays.patch b/queue-6.1/arm64-errata-add-missing-sentinels-to-spectre-bhb-midr-arrays.patch new file mode 100644 index 0000000000..ca6bb4ba23 --- /dev/null +++ b/queue-6.1/arm64-errata-add-missing-sentinels-to-spectre-bhb-midr-arrays.patch @@ -0,0 +1,76 @@ +From fee4d171451c1ad9e8aaf65fc0ab7d143a33bd72 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Thu, 1 May 2025 11:47:47 +0100 +Subject: arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Will Deacon + +commit fee4d171451c1ad9e8aaf65fc0ab7d143a33bd72 upstream. + +Commit a5951389e58d ("arm64: errata: Add newer ARM cores to the +spectre_bhb_loop_affected() lists") added some additional CPUs to the +Spectre-BHB workaround, including some new arrays for designs that +require new 'k' values for the workaround to be effective. + +Unfortunately, the new arrays omitted the sentinel entry and so +is_midr_in_range_list() will walk off the end when it doesn't find a +match. With UBSAN enabled, this leads to a crash during boot when +is_midr_in_range_list() is inlined (which was more common prior to +c8c2647e69be ("arm64: Make  _midr_in_range_list() an exported +function")): + + | Internal error: aarch64 BRK: 00000000f2000001 [#1] PREEMPT SMP + | pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + | pc : spectre_bhb_loop_affected+0x28/0x30 + | lr : is_spectre_bhb_affected+0x170/0x190 + | [...] + | Call trace: + | spectre_bhb_loop_affected+0x28/0x30 + | update_cpu_capabilities+0xc0/0x184 + | init_cpu_features+0x188/0x1a4 + | cpuinfo_store_boot_cpu+0x4c/0x60 + | smp_prepare_boot_cpu+0x38/0x54 + | start_kernel+0x8c/0x478 + | __primary_switched+0xc8/0xd4 + | Code: 6b09011f 54000061 52801080 d65f03c0 (d4200020) + | ---[ end trace 0000000000000000 ]--- + | Kernel panic - not syncing: aarch64 BRK: Fatal exception + +Add the missing sentinel entries. + +Cc: Lee Jones +Cc: James Morse +Cc: Doug Anderson +Cc: Shameer Kolothum +Cc: +Reported-by: Greg Kroah-Hartman +Fixes: a5951389e58d ("arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists") +Signed-off-by: Will Deacon +Reviewed-by: Lee Jones +Reviewed-by: Douglas Anderson +Reviewed-by: Greg Kroah-Hartman +Link: https://lore.kernel.org/r/20250501104747.28431-1-will@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kernel/proton-pack.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/kernel/proton-pack.c ++++ b/arch/arm64/kernel/proton-pack.c +@@ -891,10 +891,12 @@ static u8 spectre_bhb_loop_affected(void + static const struct midr_range spectre_bhb_k132_list[] = { + MIDR_ALL_VERSIONS(MIDR_CORTEX_X3), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), ++ {}, + }; + static const struct midr_range spectre_bhb_k38_list[] = { + MIDR_ALL_VERSIONS(MIDR_CORTEX_A715), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A720), ++ {}, + }; + static const struct midr_range spectre_bhb_k32_list[] = { + MIDR_ALL_VERSIONS(MIDR_CORTEX_A78), diff --git a/queue-6.1/cpufreq-avoid-using-inconsistent-policy-min-and-policy-max.patch b/queue-6.1/cpufreq-avoid-using-inconsistent-policy-min-and-policy-max.patch new file mode 100644 index 0000000000..98b5fd0939 --- /dev/null +++ b/queue-6.1/cpufreq-avoid-using-inconsistent-policy-min-and-policy-max.patch @@ -0,0 +1,106 @@ +From 7491cdf46b5cbdf123fc84fbe0a07e9e3d7b7620 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 16 Apr 2025 16:12:37 +0200 +Subject: cpufreq: Avoid using inconsistent policy->min and policy->max + +From: Rafael J. Wysocki + +commit 7491cdf46b5cbdf123fc84fbe0a07e9e3d7b7620 upstream. + +Since cpufreq_driver_resolve_freq() can run in parallel with +cpufreq_set_policy() and there is no synchronization between them, +the former may access policy->min and policy->max while the latter +is updating them and it may see intermediate values of them due +to the way the update is carried out. Also the compiler is free +to apply any optimizations it wants both to the stores in +cpufreq_set_policy() and to the loads in cpufreq_driver_resolve_freq() +which may result in additional inconsistencies. + +To address this, use WRITE_ONCE() when updating policy->min and +policy->max in cpufreq_set_policy() and use READ_ONCE() for reading +them in cpufreq_driver_resolve_freq(). Moreover, rearrange the update +in cpufreq_set_policy() to avoid storing intermediate values in +policy->min and policy->max with the help of the observation that +their new values are expected to be properly ordered upfront. + +Also modify cpufreq_driver_resolve_freq() to take the possible reverse +ordering of policy->min and policy->max, which may happen depending on +the ordering of operations when this function and cpufreq_set_policy() +run concurrently, into account by always honoring the max when it +turns out to be less than the min (in case it comes from thermal +throttling or similar). + +Fixes: 151717690694 ("cpufreq: Make policy min/max hard requirements") +Cc: 5.16+ # 5.16+ +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Christian Loehle +Acked-by: Viresh Kumar +Link: https://patch.msgid.link/5907080.DvuYhMxLoT@rjwysocki.net +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/cpufreq.c | 32 +++++++++++++++++++++++++------- + 1 file changed, 25 insertions(+), 7 deletions(-) + +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -532,8 +532,6 @@ static unsigned int __resolve_freq(struc + { + unsigned int idx; + +- target_freq = clamp_val(target_freq, policy->min, policy->max); +- + if (!policy->freq_table) + return target_freq; + +@@ -557,7 +555,22 @@ static unsigned int __resolve_freq(struc + unsigned int cpufreq_driver_resolve_freq(struct cpufreq_policy *policy, + unsigned int target_freq) + { +- return __resolve_freq(policy, target_freq, CPUFREQ_RELATION_LE); ++ unsigned int min = READ_ONCE(policy->min); ++ unsigned int max = READ_ONCE(policy->max); ++ ++ /* ++ * If this function runs in parallel with cpufreq_set_policy(), it may ++ * read policy->min before the update and policy->max after the update ++ * or the other way around, so there is no ordering guarantee. ++ * ++ * Resolve this by always honoring the max (in case it comes from ++ * thermal throttling or similar). ++ */ ++ if (unlikely(min > max)) ++ min = max; ++ ++ return __resolve_freq(policy, clamp_val(target_freq, min, max), ++ CPUFREQ_RELATION_LE); + } + EXPORT_SYMBOL_GPL(cpufreq_driver_resolve_freq); + +@@ -2283,6 +2296,7 @@ int __cpufreq_driver_target(struct cpufr + if (cpufreq_disabled()) + return -ENODEV; + ++ target_freq = clamp_val(target_freq, policy->min, policy->max); + target_freq = __resolve_freq(policy, target_freq, relation); + + pr_debug("target for CPU %u: %u kHz, relation %u, requested %u kHz\n", +@@ -2573,11 +2587,15 @@ static int cpufreq_set_policy(struct cpu + * Resolve policy min/max to available frequencies. It ensures + * no frequency resolution will neither overshoot the requested maximum + * nor undershoot the requested minimum. ++ * ++ * Avoid storing intermediate values in policy->max or policy->min and ++ * compiler optimizations around them because they may be accessed ++ * concurrently by cpufreq_driver_resolve_freq() during the update. + */ +- policy->min = new_data.min; +- policy->max = new_data.max; +- policy->min = __resolve_freq(policy, policy->min, CPUFREQ_RELATION_L); +- policy->max = __resolve_freq(policy, policy->max, CPUFREQ_RELATION_H); ++ WRITE_ONCE(policy->max, __resolve_freq(policy, new_data.max, CPUFREQ_RELATION_H)); ++ new_data.min = __resolve_freq(policy, new_data.min, CPUFREQ_RELATION_L); ++ WRITE_ONCE(policy->min, new_data.min > policy->max ? policy->max : new_data.min); ++ + trace_cpu_frequency_limits(policy); + + policy->cached_target_freq = UINT_MAX; diff --git a/queue-6.1/cpufreq-fix-setting-policy-limits-when-frequency-tables-are-used.patch b/queue-6.1/cpufreq-fix-setting-policy-limits-when-frequency-tables-are-used.patch new file mode 100644 index 0000000000..1282cd1274 --- /dev/null +++ b/queue-6.1/cpufreq-fix-setting-policy-limits-when-frequency-tables-are-used.patch @@ -0,0 +1,295 @@ +From b79028039f440e7d2c4df6ab243060c4e3803e84 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Fri, 25 Apr 2025 13:36:21 +0200 +Subject: cpufreq: Fix setting policy limits when frequency tables are used + +From: Rafael J. Wysocki + +commit b79028039f440e7d2c4df6ab243060c4e3803e84 upstream. + +Commit 7491cdf46b5c ("cpufreq: Avoid using inconsistent policy->min and +policy->max") overlooked the fact that policy->min and policy->max were +accessed directly in cpufreq_frequency_table_target() and in the +functions called by it. Consequently, the changes made by that commit +led to problems with setting policy limits. + +Address this by passing the target frequency limits to __resolve_freq() +and cpufreq_frequency_table_target() and propagating them to the +functions called by the latter. + +Fixes: 7491cdf46b5c ("cpufreq: Avoid using inconsistent policy->min and policy->max") +Cc: 5.16+ # 5.16+ +Closes: https://lore.kernel.org/linux-pm/aAplED3IA_J0eZN0@linaro.org/ +Reported-by: Stephan Gerhold +Signed-off-by: Rafael J. Wysocki +Tested-by: Stephan Gerhold +Reviewed-by: Lifeng Zheng +Link: https://patch.msgid.link/5896780.DvuYhMxLoT@rjwysocki.net +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/cpufreq.c | 22 ++++++--- + drivers/cpufreq/cpufreq_ondemand.c | 3 - + drivers/cpufreq/freq_table.c | 6 +- + include/linux/cpufreq.h | 83 ++++++++++++++++++++++++------------- + 4 files changed, 73 insertions(+), 41 deletions(-) + +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -528,14 +528,18 @@ void cpufreq_disable_fast_switch(struct + EXPORT_SYMBOL_GPL(cpufreq_disable_fast_switch); + + static unsigned int __resolve_freq(struct cpufreq_policy *policy, +- unsigned int target_freq, unsigned int relation) ++ unsigned int target_freq, ++ unsigned int min, unsigned int max, ++ unsigned int relation) + { + unsigned int idx; + ++ target_freq = clamp_val(target_freq, min, max); ++ + if (!policy->freq_table) + return target_freq; + +- idx = cpufreq_frequency_table_target(policy, target_freq, relation); ++ idx = cpufreq_frequency_table_target(policy, target_freq, min, max, relation); + policy->cached_resolved_idx = idx; + policy->cached_target_freq = target_freq; + return policy->freq_table[idx].frequency; +@@ -569,8 +573,7 @@ unsigned int cpufreq_driver_resolve_freq + if (unlikely(min > max)) + min = max; + +- return __resolve_freq(policy, clamp_val(target_freq, min, max), +- CPUFREQ_RELATION_LE); ++ return __resolve_freq(policy, target_freq, min, max, CPUFREQ_RELATION_LE); + } + EXPORT_SYMBOL_GPL(cpufreq_driver_resolve_freq); + +@@ -2296,8 +2299,8 @@ int __cpufreq_driver_target(struct cpufr + if (cpufreq_disabled()) + return -ENODEV; + +- target_freq = clamp_val(target_freq, policy->min, policy->max); +- target_freq = __resolve_freq(policy, target_freq, relation); ++ target_freq = __resolve_freq(policy, target_freq, policy->min, ++ policy->max, relation); + + pr_debug("target for CPU %u: %u kHz, relation %u, requested %u kHz\n", + policy->cpu, target_freq, relation, old_target_freq); +@@ -2592,8 +2595,11 @@ static int cpufreq_set_policy(struct cpu + * compiler optimizations around them because they may be accessed + * concurrently by cpufreq_driver_resolve_freq() during the update. + */ +- WRITE_ONCE(policy->max, __resolve_freq(policy, new_data.max, CPUFREQ_RELATION_H)); +- new_data.min = __resolve_freq(policy, new_data.min, CPUFREQ_RELATION_L); ++ WRITE_ONCE(policy->max, __resolve_freq(policy, new_data.max, ++ new_data.min, new_data.max, ++ CPUFREQ_RELATION_H)); ++ new_data.min = __resolve_freq(policy, new_data.min, new_data.min, ++ new_data.max, CPUFREQ_RELATION_L); + WRITE_ONCE(policy->min, new_data.min > policy->max ? policy->max : new_data.min); + + trace_cpu_frequency_limits(policy); +--- a/drivers/cpufreq/cpufreq_ondemand.c ++++ b/drivers/cpufreq/cpufreq_ondemand.c +@@ -77,7 +77,8 @@ static unsigned int generic_powersave_bi + return freq_next; + } + +- index = cpufreq_frequency_table_target(policy, freq_next, relation); ++ index = cpufreq_frequency_table_target(policy, freq_next, policy->min, ++ policy->max, relation); + freq_req = freq_table[index].frequency; + freq_reduc = freq_req * od_tuners->powersave_bias / 1000; + freq_avg = freq_req - freq_reduc; +--- a/drivers/cpufreq/freq_table.c ++++ b/drivers/cpufreq/freq_table.c +@@ -116,8 +116,8 @@ int cpufreq_generic_frequency_table_veri + EXPORT_SYMBOL_GPL(cpufreq_generic_frequency_table_verify); + + int cpufreq_table_index_unsorted(struct cpufreq_policy *policy, +- unsigned int target_freq, +- unsigned int relation) ++ unsigned int target_freq, unsigned int min, ++ unsigned int max, unsigned int relation) + { + struct cpufreq_frequency_table optimal = { + .driver_data = ~0, +@@ -148,7 +148,7 @@ int cpufreq_table_index_unsorted(struct + cpufreq_for_each_valid_entry_idx(pos, table, i) { + freq = pos->frequency; + +- if ((freq < policy->min) || (freq > policy->max)) ++ if (freq < min || freq > max) + continue; + if (freq == target_freq) { + optimal.driver_data = i; +--- a/include/linux/cpufreq.h ++++ b/include/linux/cpufreq.h +@@ -789,8 +789,8 @@ int cpufreq_frequency_table_verify(struc + int cpufreq_generic_frequency_table_verify(struct cpufreq_policy_data *policy); + + int cpufreq_table_index_unsorted(struct cpufreq_policy *policy, +- unsigned int target_freq, +- unsigned int relation); ++ unsigned int target_freq, unsigned int min, ++ unsigned int max, unsigned int relation); + int cpufreq_frequency_table_get_index(struct cpufreq_policy *policy, + unsigned int freq); + +@@ -855,12 +855,12 @@ static inline int cpufreq_table_find_ind + return best; + } + +-/* Works only on sorted freq-tables */ +-static inline int cpufreq_table_find_index_l(struct cpufreq_policy *policy, +- unsigned int target_freq, +- bool efficiencies) ++static inline int find_index_l(struct cpufreq_policy *policy, ++ unsigned int target_freq, ++ unsigned int min, unsigned int max, ++ bool efficiencies) + { +- target_freq = clamp_val(target_freq, policy->min, policy->max); ++ target_freq = clamp_val(target_freq, min, max); + + if (policy->freq_table_sorted == CPUFREQ_TABLE_SORTED_ASCENDING) + return cpufreq_table_find_index_al(policy, target_freq, +@@ -870,6 +870,14 @@ static inline int cpufreq_table_find_ind + efficiencies); + } + ++/* Works only on sorted freq-tables */ ++static inline int cpufreq_table_find_index_l(struct cpufreq_policy *policy, ++ unsigned int target_freq, ++ bool efficiencies) ++{ ++ return find_index_l(policy, target_freq, policy->min, policy->max, efficiencies); ++} ++ + /* Find highest freq at or below target in a table in ascending order */ + static inline int cpufreq_table_find_index_ah(struct cpufreq_policy *policy, + unsigned int target_freq, +@@ -923,12 +931,12 @@ static inline int cpufreq_table_find_ind + return best; + } + +-/* Works only on sorted freq-tables */ +-static inline int cpufreq_table_find_index_h(struct cpufreq_policy *policy, +- unsigned int target_freq, +- bool efficiencies) ++static inline int find_index_h(struct cpufreq_policy *policy, ++ unsigned int target_freq, ++ unsigned int min, unsigned int max, ++ bool efficiencies) + { +- target_freq = clamp_val(target_freq, policy->min, policy->max); ++ target_freq = clamp_val(target_freq, min, max); + + if (policy->freq_table_sorted == CPUFREQ_TABLE_SORTED_ASCENDING) + return cpufreq_table_find_index_ah(policy, target_freq, +@@ -938,6 +946,14 @@ static inline int cpufreq_table_find_ind + efficiencies); + } + ++/* Works only on sorted freq-tables */ ++static inline int cpufreq_table_find_index_h(struct cpufreq_policy *policy, ++ unsigned int target_freq, ++ bool efficiencies) ++{ ++ return find_index_h(policy, target_freq, policy->min, policy->max, efficiencies); ++} ++ + /* Find closest freq to target in a table in ascending order */ + static inline int cpufreq_table_find_index_ac(struct cpufreq_policy *policy, + unsigned int target_freq, +@@ -1008,12 +1024,12 @@ static inline int cpufreq_table_find_ind + return best; + } + +-/* Works only on sorted freq-tables */ +-static inline int cpufreq_table_find_index_c(struct cpufreq_policy *policy, +- unsigned int target_freq, +- bool efficiencies) ++static inline int find_index_c(struct cpufreq_policy *policy, ++ unsigned int target_freq, ++ unsigned int min, unsigned int max, ++ bool efficiencies) + { +- target_freq = clamp_val(target_freq, policy->min, policy->max); ++ target_freq = clamp_val(target_freq, min, max); + + if (policy->freq_table_sorted == CPUFREQ_TABLE_SORTED_ASCENDING) + return cpufreq_table_find_index_ac(policy, target_freq, +@@ -1023,7 +1039,17 @@ static inline int cpufreq_table_find_ind + efficiencies); + } + +-static inline bool cpufreq_is_in_limits(struct cpufreq_policy *policy, int idx) ++/* Works only on sorted freq-tables */ ++static inline int cpufreq_table_find_index_c(struct cpufreq_policy *policy, ++ unsigned int target_freq, ++ bool efficiencies) ++{ ++ return find_index_c(policy, target_freq, policy->min, policy->max, efficiencies); ++} ++ ++static inline bool cpufreq_is_in_limits(struct cpufreq_policy *policy, ++ unsigned int min, unsigned int max, ++ int idx) + { + unsigned int freq; + +@@ -1032,11 +1058,13 @@ static inline bool cpufreq_is_in_limits( + + freq = policy->freq_table[idx].frequency; + +- return freq == clamp_val(freq, policy->min, policy->max); ++ return freq == clamp_val(freq, min, max); + } + + static inline int cpufreq_frequency_table_target(struct cpufreq_policy *policy, + unsigned int target_freq, ++ unsigned int min, ++ unsigned int max, + unsigned int relation) + { + bool efficiencies = policy->efficiencies_available && +@@ -1047,29 +1075,26 @@ static inline int cpufreq_frequency_tabl + relation &= ~CPUFREQ_RELATION_E; + + if (unlikely(policy->freq_table_sorted == CPUFREQ_TABLE_UNSORTED)) +- return cpufreq_table_index_unsorted(policy, target_freq, +- relation); ++ return cpufreq_table_index_unsorted(policy, target_freq, min, ++ max, relation); + retry: + switch (relation) { + case CPUFREQ_RELATION_L: +- idx = cpufreq_table_find_index_l(policy, target_freq, +- efficiencies); ++ idx = find_index_l(policy, target_freq, min, max, efficiencies); + break; + case CPUFREQ_RELATION_H: +- idx = cpufreq_table_find_index_h(policy, target_freq, +- efficiencies); ++ idx = find_index_h(policy, target_freq, min, max, efficiencies); + break; + case CPUFREQ_RELATION_C: +- idx = cpufreq_table_find_index_c(policy, target_freq, +- efficiencies); ++ idx = find_index_c(policy, target_freq, min, max, efficiencies); + break; + default: + WARN_ON_ONCE(1); + return 0; + } + +- /* Limit frequency index to honor policy->min/max */ +- if (!cpufreq_is_in_limits(policy, idx) && efficiencies) { ++ /* Limit frequency index to honor min and max */ ++ if (!cpufreq_is_in_limits(policy, min, max, idx) && efficiencies) { + efficiencies = false; + goto retry; + } diff --git a/queue-6.1/dm-always-update-the-array-size-in-realloc_argv-on-success.patch b/queue-6.1/dm-always-update-the-array-size-in-realloc_argv-on-success.patch new file mode 100644 index 0000000000..092674b394 --- /dev/null +++ b/queue-6.1/dm-always-update-the-array-size-in-realloc_argv-on-success.patch @@ -0,0 +1,43 @@ +From 5a2a6c428190f945c5cbf5791f72dbea83e97f66 Mon Sep 17 00:00:00 2001 +From: Benjamin Marzinski +Date: Tue, 15 Apr 2025 00:17:16 -0400 +Subject: dm: always update the array size in realloc_argv on success + +From: Benjamin Marzinski + +commit 5a2a6c428190f945c5cbf5791f72dbea83e97f66 upstream. + +realloc_argv() was only updating the array size if it was called with +old_argv already allocated. The first time it was called to create an +argv array, it would allocate the array but return the array size as +zero. dm_split_args() would think that it couldn't store any arguments +in the array and would call realloc_argv() again, causing it to +reallocate the initial slots (this time using GPF_KERNEL) and finally +return a size. Aside from being wasteful, this could cause deadlocks on +targets that need to process messages without starting new IO. Instead, +realloc_argv should always update the allocated array size on success. + +Fixes: a0651926553c ("dm table: don't copy from a NULL pointer in realloc_argv()") +Cc: stable@vger.kernel.org +Signed-off-by: Benjamin Marzinski +Signed-off-by: Mikulas Patocka +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm-table.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -502,9 +502,10 @@ static char **realloc_argv(unsigned int + gfp = GFP_NOIO; + } + argv = kmalloc_array(new_size, sizeof(*argv), gfp); +- if (argv && old_argv) { +- memcpy(argv, old_argv, *size * sizeof(*argv)); ++ if (argv) { + *size = new_size; ++ if (old_argv) ++ memcpy(argv, old_argv, *size * sizeof(*argv)); + } + + kfree(old_argv); diff --git a/queue-6.1/dm-integrity-fix-a-warning-on-invalid-table-line.patch b/queue-6.1/dm-integrity-fix-a-warning-on-invalid-table-line.patch new file mode 100644 index 0000000000..749af73a6e --- /dev/null +++ b/queue-6.1/dm-integrity-fix-a-warning-on-invalid-table-line.patch @@ -0,0 +1,31 @@ +From 0a533c3e4246c29d502a7e0fba0e86d80a906b04 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Tue, 22 Apr 2025 21:18:33 +0200 +Subject: dm-integrity: fix a warning on invalid table line + +From: Mikulas Patocka + +commit 0a533c3e4246c29d502a7e0fba0e86d80a906b04 upstream. + +If we use the 'B' mode and we have an invalit table line, +cancel_delayed_work_sync would trigger a warning. This commit avoids the +warning. + +Signed-off-by: Mikulas Patocka +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm-integrity.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -4637,7 +4637,7 @@ static void dm_integrity_dtr(struct dm_t + BUG_ON(!RB_EMPTY_ROOT(&ic->in_progress)); + BUG_ON(!list_empty(&ic->wait_list)); + +- if (ic->mode == 'B') ++ if (ic->mode == 'B' && ic->bitmap_flush_work.work.func) + cancel_delayed_work_sync(&ic->bitmap_flush_work); + if (ic->metadata_wq) + destroy_workqueue(ic->metadata_wq); diff --git a/queue-6.1/drm-nouveau-fix-warn_on-in-nouveau_fence_context_kill.patch b/queue-6.1/drm-nouveau-fix-warn_on-in-nouveau_fence_context_kill.patch new file mode 100644 index 0000000000..140b93b324 --- /dev/null +++ b/queue-6.1/drm-nouveau-fix-warn_on-in-nouveau_fence_context_kill.patch @@ -0,0 +1,46 @@ +From bbe5679f30d7690a9b6838a583b9690ea73fe0e9 Mon Sep 17 00:00:00 2001 +From: Philipp Stanner +Date: Tue, 15 Apr 2025 14:19:00 +0200 +Subject: drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Philipp Stanner + +commit bbe5679f30d7690a9b6838a583b9690ea73fe0e9 upstream. + +Nouveau is mostly designed in a way that it's expected that fences only +ever get signaled through nouveau_fence_signal(). However, in at least +one other place, nouveau_fence_done(), can signal fences, too. If that +happens (race) a signaled fence remains in the pending list for a while, +until it gets removed by nouveau_fence_update(). + +Should nouveau_fence_context_kill() run in the meantime, this would be +a bug because the function would attempt to set an error code on an +already signaled fence. + +Have nouveau_fence_context_kill() check for a fence being signaled. + +Cc: stable@vger.kernel.org # v5.10+ +Fixes: ea13e5abf807 ("drm/nouveau: signal pending fences when channel has been killed") +Suggested-by: Christian König +Signed-off-by: Philipp Stanner +Link: https://lore.kernel.org/r/20250415121900.55719-3-phasta@kernel.org +Signed-off-by: Danilo Krummrich +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/nouveau/nouveau_fence.c ++++ b/drivers/gpu/drm/nouveau/nouveau_fence.c +@@ -95,7 +95,7 @@ nouveau_fence_context_kill(struct nouvea + while (!list_empty(&fctx->pending)) { + fence = list_entry(fctx->pending.next, typeof(*fence), head); + +- if (error) ++ if (error && !dma_fence_is_signaled_locked(&fence->base)) + dma_fence_set_error(&fence->base, error); + + if (nouveau_fence_signal(fence)) diff --git a/queue-6.1/edac-altera-set-ddr-and-sdmmc-interrupt-mask-before-registration.patch b/queue-6.1/edac-altera-set-ddr-and-sdmmc-interrupt-mask-before-registration.patch new file mode 100644 index 0000000000..1f1bdfacc6 --- /dev/null +++ b/queue-6.1/edac-altera-set-ddr-and-sdmmc-interrupt-mask-before-registration.patch @@ -0,0 +1,59 @@ +From 6dbe3c5418c4368e824bff6ae4889257dd544892 Mon Sep 17 00:00:00 2001 +From: Niravkumar L Rabara +Date: Fri, 25 Apr 2025 07:26:40 -0700 +Subject: EDAC/altera: Set DDR and SDMMC interrupt mask before registration + +From: Niravkumar L Rabara + +commit 6dbe3c5418c4368e824bff6ae4889257dd544892 upstream. + +Mask DDR and SDMMC in probe function to avoid spurious interrupts before +registration. Removed invalid register write to system manager. + +Fixes: 1166fde93d5b ("EDAC, altera: Add Arria10 ECC memory init functions") +Signed-off-by: Niravkumar L Rabara +Signed-off-by: Matthew Gerlach +Signed-off-by: Borislav Petkov (AMD) +Acked-by: Dinh Nguyen +Cc: stable@kernel.org +Link: https://lore.kernel.org/20250425142640.33125-3-matthew.gerlach@altera.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/edac/altera_edac.c | 7 ++++--- + drivers/edac/altera_edac.h | 2 ++ + 2 files changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/edac/altera_edac.c ++++ b/drivers/edac/altera_edac.c +@@ -1015,9 +1015,6 @@ altr_init_a10_ecc_block(struct device_no + } + } + +- /* Interrupt mode set to every SBERR */ +- regmap_write(ecc_mgr_map, ALTR_A10_ECC_INTMODE_OFST, +- ALTR_A10_ECC_INTMODE); + /* Enable ECC */ + ecc_set_bits(ecc_ctrl_en_mask, (ecc_block_base + + ALTR_A10_ECC_CTRL_OFST)); +@@ -2138,6 +2135,10 @@ static int altr_edac_a10_probe(struct pl + return PTR_ERR(edac->ecc_mgr_map); + } + ++ /* Set irq mask for DDR SBE to avoid any pending irq before registration */ ++ regmap_write(edac->ecc_mgr_map, A10_SYSMGR_ECC_INTMASK_SET_OFST, ++ (A10_SYSMGR_ECC_INTMASK_SDMMCB | A10_SYSMGR_ECC_INTMASK_DDR0)); ++ + edac->irq_chip.name = pdev->dev.of_node->name; + edac->irq_chip.irq_mask = a10_eccmgr_irq_mask; + edac->irq_chip.irq_unmask = a10_eccmgr_irq_unmask; +--- a/drivers/edac/altera_edac.h ++++ b/drivers/edac/altera_edac.h +@@ -249,6 +249,8 @@ struct altr_sdram_mc_data { + #define A10_SYSMGR_ECC_INTMASK_SET_OFST 0x94 + #define A10_SYSMGR_ECC_INTMASK_CLR_OFST 0x98 + #define A10_SYSMGR_ECC_INTMASK_OCRAM BIT(1) ++#define A10_SYSMGR_ECC_INTMASK_SDMMCB BIT(16) ++#define A10_SYSMGR_ECC_INTMASK_DDR0 BIT(17) + + #define A10_SYSMGR_ECC_INTSTAT_SERR_OFST 0x9C + #define A10_SYSMGR_ECC_INTSTAT_DERR_OFST 0xA0 diff --git a/queue-6.1/edac-altera-test-the-correct-error-reg-offset.patch b/queue-6.1/edac-altera-test-the-correct-error-reg-offset.patch new file mode 100644 index 0000000000..3f4fd2c6a6 --- /dev/null +++ b/queue-6.1/edac-altera-test-the-correct-error-reg-offset.patch @@ -0,0 +1,36 @@ +From 4fb7b8fceb0beebbe00712c3daf49ade0386076a Mon Sep 17 00:00:00 2001 +From: Niravkumar L Rabara +Date: Fri, 25 Apr 2025 07:26:39 -0700 +Subject: EDAC/altera: Test the correct error reg offset + +From: Niravkumar L Rabara + +commit 4fb7b8fceb0beebbe00712c3daf49ade0386076a upstream. + +Test correct structure member, ecc_cecnt_offset, before using it. + + [ bp: Massage commit message. ] + +Fixes: 73bcc942f427 ("EDAC, altera: Add Arria10 EDAC support") +Signed-off-by: Niravkumar L Rabara +Signed-off-by: Matthew Gerlach +Signed-off-by: Borislav Petkov (AMD) +Acked-by: Dinh Nguyen +Cc: stable@kernel.org +Link: https://lore.kernel.org/20250425142640.33125-2-matthew.gerlach@altera.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/edac/altera_edac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/edac/altera_edac.c ++++ b/drivers/edac/altera_edac.c +@@ -98,7 +98,7 @@ static irqreturn_t altr_sdram_mc_err_han + if (status & priv->ecc_stat_ce_mask) { + regmap_read(drvdata->mc_vbase, priv->ecc_saddr_offset, + &err_addr); +- if (priv->ecc_uecnt_offset) ++ if (priv->ecc_cecnt_offset) + regmap_read(drvdata->mc_vbase, priv->ecc_cecnt_offset, + &err_count); + edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, err_count, diff --git a/queue-6.1/i2c-imx-lpi2c-fix-clock-count-when-probe-defers.patch b/queue-6.1/i2c-imx-lpi2c-fix-clock-count-when-probe-defers.patch new file mode 100644 index 0000000000..ef0b18bfe5 --- /dev/null +++ b/queue-6.1/i2c-imx-lpi2c-fix-clock-count-when-probe-defers.patch @@ -0,0 +1,38 @@ +From b1852c5de2f2a37dd4462f7837c9e3e678f9e546 Mon Sep 17 00:00:00 2001 +From: Clark Wang +Date: Mon, 21 Apr 2025 14:23:41 +0800 +Subject: i2c: imx-lpi2c: Fix clock count when probe defers + +From: Clark Wang + +commit b1852c5de2f2a37dd4462f7837c9e3e678f9e546 upstream. + +Deferred probe with pm_runtime_put() may delay clock disable, causing +incorrect clock usage count. Use pm_runtime_put_sync() to ensure the +clock is disabled immediately. + +Fixes: 13d6eb20fc79 ("i2c: imx-lpi2c: add runtime pm support") +Signed-off-by: Clark Wang +Signed-off-by: Carlos Song +Cc: # v4.16+ +Link: https://lore.kernel.org/r/20250421062341.2471922-1-carlos.song@nxp.com +Signed-off-by: Andi Shyti +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-imx-lpi2c.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/i2c/busses/i2c-imx-lpi2c.c ++++ b/drivers/i2c/busses/i2c-imx-lpi2c.c +@@ -616,9 +616,9 @@ static int lpi2c_imx_probe(struct platfo + return 0; + + rpm_disable: +- pm_runtime_put(&pdev->dev); +- pm_runtime_disable(&pdev->dev); + pm_runtime_dont_use_autosuspend(&pdev->dev); ++ pm_runtime_put_sync(&pdev->dev); ++ pm_runtime_disable(&pdev->dev); + + return ret; + } diff --git a/queue-6.1/iommu-amd-fix-potential-buffer-overflow-in-parse_ivrs_acpihid.patch b/queue-6.1/iommu-amd-fix-potential-buffer-overflow-in-parse_ivrs_acpihid.patch new file mode 100644 index 0000000000..1685ce28bc --- /dev/null +++ b/queue-6.1/iommu-amd-fix-potential-buffer-overflow-in-parse_ivrs_acpihid.patch @@ -0,0 +1,52 @@ +From 8dee308e4c01dea48fc104d37f92d5b58c50b96c Mon Sep 17 00:00:00 2001 +From: Pavel Paklov +Date: Tue, 25 Mar 2025 09:22:44 +0000 +Subject: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid + +From: Pavel Paklov + +commit 8dee308e4c01dea48fc104d37f92d5b58c50b96c upstream. + +There is a string parsing logic error which can lead to an overflow of hid +or uid buffers. Comparing ACPIID_LEN against a total string length doesn't +take into account the lengths of individual hid and uid buffers so the +check is insufficient in some cases. For example if the length of hid +string is 4 and the length of the uid string is 260, the length of str +will be equal to ACPIID_LEN + 1 but uid string will overflow uid buffer +which size is 256. + +The same applies to the hid string with length 13 and uid string with +length 250. + +Check the length of hid and uid strings separately to prevent +buffer overflow. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter") +Cc: stable@vger.kernel.org +Signed-off-by: Pavel Paklov +Link: https://lore.kernel.org/r/20250325092259.392844-1-Pavel.Paklov@cyberprotect.ru +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iommu/amd/init.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/iommu/amd/init.c ++++ b/drivers/iommu/amd/init.c +@@ -3610,6 +3610,14 @@ found: + while (*uid == '0' && *(uid + 1)) + uid++; + ++ if (strlen(hid) >= ACPIHID_HID_LEN) { ++ pr_err("Invalid command line: hid is too long\n"); ++ return 1; ++ } else if (strlen(uid) >= ACPIHID_UID_LEN) { ++ pr_err("Invalid command line: uid is too long\n"); ++ return 1; ++ } ++ + i = early_acpihid_map_size++; + memcpy(early_acpihid_map[i].hid, hid, strlen(hid)); + memcpy(early_acpihid_map[i].uid, uid, strlen(uid)); diff --git a/queue-6.1/iommu-vt-d-apply-quirk_iommu_igfx-for-8086-0044-qm57-qs57.patch b/queue-6.1/iommu-vt-d-apply-quirk_iommu_igfx-for-8086-0044-qm57-qs57.patch new file mode 100644 index 0000000000..a9b1ad1fa8 --- /dev/null +++ b/queue-6.1/iommu-vt-d-apply-quirk_iommu_igfx-for-8086-0044-qm57-qs57.patch @@ -0,0 +1,102 @@ +From 2c8a7c66c90832432496616a9a3c07293f1364f3 Mon Sep 17 00:00:00 2001 +From: Mingcong Bai +Date: Fri, 18 Apr 2025 11:16:42 +0800 +Subject: iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) + +From: Mingcong Bai + +commit 2c8a7c66c90832432496616a9a3c07293f1364f3 upstream. + +On the Lenovo ThinkPad X201, when Intel VT-d is enabled in the BIOS, the +kernel boots with errors related to DMAR, the graphical interface appeared +quite choppy, and the system resets erratically within a minute after it +booted: + +DMAR: DRHD: handling fault status reg 3 +DMAR: [DMA Write NO_PASID] Request device [00:02.0] fault addr 0xb97ff000 +[fault reason 0x05] PTE Write access is not set + +Upon comparing boot logs with VT-d on/off, I found that the Intel Calpella +quirk (`quirk_calpella_no_shadow_gtt()') correctly applied the igfx IOMMU +disable/quirk correctly: + +pci 0000:00:00.0: DMAR: BIOS has allocated no shadow GTT; disabling IOMMU +for graphics + +Whereas with VT-d on, it went into the "else" branch, which then +triggered the DMAR handling fault above: + +... else if (!disable_igfx_iommu) { + /* we have to ensure the gfx device is idle before we flush */ + pci_info(dev, "Disabling batched IOTLB flush on Ironlake\n"); + iommu_set_dma_strict(); +} + +Now, this is not exactly scientific, but moving 0x0044 to quirk_iommu_igfx +seems to have fixed the aforementioned issue. Running a few `git blame' +runs on the function, I have found that the quirk was originally +introduced as a fix specific to ThinkPad X201: + +commit 9eecabcb9a92 ("intel-iommu: Abort IOMMU setup for igfx if BIOS gave +no shadow GTT space") + +Which was later revised twice to the "else" branch we saw above: + +- 2011: commit 6fbcfb3e467a ("intel-iommu: Workaround IOTLB hang on + Ironlake GPU") +- 2024: commit ba00196ca41c ("iommu/vt-d: Decouple igfx_off from graphic + identity mapping") + +I'm uncertain whether further testings on this particular laptops were +done in 2011 and (honestly I'm not sure) 2024, but I would be happy to do +some distro-specific testing if that's what would be required to verify +this patch. + +P.S., I also see IDs 0x0040, 0x0062, and 0x006a listed under the same +`quirk_calpella_no_shadow_gtt()' quirk, but I'm not sure how similar these +chipsets are (if they share the same issue with VT-d or even, indeed, if +this issue is specific to a bug in the Lenovo BIOS). With regards to +0x0062, it seems to be a Centrino wireless card, but not a chipset? + +I have also listed a couple (distro and kernel) bug reports below as +references (some of them are from 7-8 years ago!), as they seem to be +similar issue found on different Westmere/Ironlake, Haswell, and Broadwell +hardware setups. + +Cc: stable@vger.kernel.org +Fixes: 6fbcfb3e467a ("intel-iommu: Workaround IOTLB hang on Ironlake GPU") +Fixes: ba00196ca41c ("iommu/vt-d: Decouple igfx_off from graphic identity mapping") +Link: https://groups.google.com/g/qubes-users/c/4NP4goUds2c?pli=1 +Link: https://bugs.archlinux.org/task/65362 +Link: https://bbs.archlinux.org/viewtopic.php?id=230323 +Reported-by: Wenhao Sun +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=197029 +Signed-off-by: Mingcong Bai +Link: https://lore.kernel.org/r/20250415133330.12528-1-jeffbai@aosc.io +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iommu/intel/iommu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -4836,6 +4836,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e40, quirk_iommu_igfx); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e90, quirk_iommu_igfx); + ++/* QM57/QS57 integrated gfx malfunctions with dmar */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0044, quirk_iommu_igfx); ++ + /* Broadwell igfx malfunctions with dmar */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1606, quirk_iommu_igfx); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x160B, quirk_iommu_igfx); +@@ -4913,7 +4916,6 @@ static void quirk_calpella_no_shadow_gtt + } + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0040, quirk_calpella_no_shadow_gtt); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0044, quirk_calpella_no_shadow_gtt); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0062, quirk_calpella_no_shadow_gtt); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x006a, quirk_calpella_no_shadow_gtt); + diff --git a/queue-6.1/irqchip-qcom-mpm-prevent-crash-when-trying-to-handle-non-wake-gpios.patch b/queue-6.1/irqchip-qcom-mpm-prevent-crash-when-trying-to-handle-non-wake-gpios.patch new file mode 100644 index 0000000000..1a5fa900c6 --- /dev/null +++ b/queue-6.1/irqchip-qcom-mpm-prevent-crash-when-trying-to-handle-non-wake-gpios.patch @@ -0,0 +1,63 @@ +From 38a05c0b87833f5b188ae43b428b1f792df2b384 Mon Sep 17 00:00:00 2001 +From: Stephan Gerhold +Date: Fri, 2 May 2025 13:22:28 +0200 +Subject: irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs + +From: Stephan Gerhold + +commit 38a05c0b87833f5b188ae43b428b1f792df2b384 upstream. + +On Qualcomm chipsets not all GPIOs are wakeup capable. Those GPIOs do not +have a corresponding MPM pin and should not be handled inside the MPM +driver. The IRQ domain hierarchy is always applied, so it's required to +explicitly disconnect the hierarchy for those. The pinctrl-msm driver marks +these with GPIO_NO_WAKE_IRQ. qcom-pdc has a check for this, but +irq-qcom-mpm is currently missing the check. This is causing crashes when +setting up interrupts for non-wake GPIOs: + + root@rb1:~# gpiomon -c gpiochip1 10 + irq: IRQ159: trimming hierarchy from :soc@0:interrupt-controller@f200000-1 + Unable to handle kernel paging request at virtual address ffff8000a1dc3820 + Hardware name: Qualcomm Technologies, Inc. Robotics RB1 (DT) + pc : mpm_set_type+0x80/0xcc + lr : mpm_set_type+0x5c/0xcc + Call trace: + mpm_set_type+0x80/0xcc (P) + qcom_mpm_set_type+0x64/0x158 + irq_chip_set_type_parent+0x20/0x38 + msm_gpio_irq_set_type+0x50/0x530 + __irq_set_trigger+0x60/0x184 + __setup_irq+0x304/0x6bc + request_threaded_irq+0xc8/0x19c + edge_detector_setup+0x260/0x364 + linereq_create+0x420/0x5a8 + gpio_ioctl+0x2d4/0x6c0 + +Fix this by copying the check for GPIO_NO_WAKE_IRQ from qcom-pdc.c, so that +MPM is removed entirely from the hierarchy for non-wake GPIOs. + +Fixes: a6199bb514d8 ("irqchip: Add Qualcomm MPM controller driver") +Reported-by: Alexey Klimov +Signed-off-by: Stephan Gerhold +Signed-off-by: Thomas Gleixner +Tested-by: Alexey Klimov +Reviewed-by: Bartosz Golaszewski +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/20250502-irq-qcom-mpm-fix-no-wake-v1-1-8a1eafcd28d4@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-qcom-mpm.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/irqchip/irq-qcom-mpm.c ++++ b/drivers/irqchip/irq-qcom-mpm.c +@@ -226,6 +226,9 @@ static int qcom_mpm_alloc(struct irq_dom + if (ret) + return ret; + ++ if (pin == GPIO_NO_WAKE_IRQ) ++ return irq_domain_disconnect_hierarchy(domain, virq); ++ + ret = irq_domain_set_hwirq_and_chip(domain, virq, pin, + &qcom_mpm_chip, priv); + if (ret) diff --git a/queue-6.1/ksmbd-fix-use-after-free-in-kerberos-authentication.patch b/queue-6.1/ksmbd-fix-use-after-free-in-kerberos-authentication.patch new file mode 100644 index 0000000000..8f459c4964 --- /dev/null +++ b/queue-6.1/ksmbd-fix-use-after-free-in-kerberos-authentication.patch @@ -0,0 +1,61 @@ +From e86e9134e1d1c90a960dd57f59ce574d27b9a124 Mon Sep 17 00:00:00 2001 +From: Sean Heelan +Date: Sat, 19 Apr 2025 19:59:28 +0100 +Subject: ksmbd: fix use-after-free in kerberos authentication + +From: Sean Heelan + +commit e86e9134e1d1c90a960dd57f59ce574d27b9a124 upstream. + +Setting sess->user = NULL was introduced to fix the dangling pointer +created by ksmbd_free_user. However, it is possible another thread could +be operating on the session and make use of sess->user after it has been +passed to ksmbd_free_user but before sess->user is set to NULL. + +Cc: stable@vger.kernel.org +Signed-off-by: Sean Heelan +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/server/auth.c | 14 +++++++++++++- + fs/smb/server/smb2pdu.c | 5 ----- + 2 files changed, 13 insertions(+), 6 deletions(-) + +--- a/fs/smb/server/auth.c ++++ b/fs/smb/server/auth.c +@@ -544,7 +544,19 @@ int ksmbd_krb5_authenticate(struct ksmbd + retval = -ENOMEM; + goto out; + } +- sess->user = user; ++ ++ if (!sess->user) { ++ /* First successful authentication */ ++ sess->user = user; ++ } else { ++ if (!ksmbd_compare_user(sess->user, user)) { ++ ksmbd_debug(AUTH, "different user tried to reuse session\n"); ++ retval = -EPERM; ++ ksmbd_free_user(user); ++ goto out; ++ } ++ ksmbd_free_user(user); ++ } + + memcpy(sess->sess_key, resp->payload, resp->session_key_len); + memcpy(out_blob, resp->payload + resp->session_key_len, +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -1615,11 +1615,6 @@ static int krb5_authenticate(struct ksmb + if (prev_sess_id && prev_sess_id != sess->id) + destroy_previous_session(conn, sess->user, prev_sess_id); + +- if (sess->state == SMB2_SESSION_VALID) { +- ksmbd_free_user(sess->user); +- sess->user = NULL; +- } +- + retval = ksmbd_krb5_authenticate(sess, in_blob, in_len, + out_blob, &out_len); + if (retval) { diff --git a/queue-6.1/mmc-renesas_sdhi-fix-error-handling-in-renesas_sdhi_probe.patch b/queue-6.1/mmc-renesas_sdhi-fix-error-handling-in-renesas_sdhi_probe.patch new file mode 100644 index 0000000000..bc62844add --- /dev/null +++ b/queue-6.1/mmc-renesas_sdhi-fix-error-handling-in-renesas_sdhi_probe.patch @@ -0,0 +1,68 @@ +From 649b50a82f09fa44c2f7a65618e4584072145ab7 Mon Sep 17 00:00:00 2001 +From: Ruslan Piasetskyi +Date: Wed, 26 Mar 2025 23:06:38 +0100 +Subject: mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe + +From: Ruslan Piasetskyi + +commit 649b50a82f09fa44c2f7a65618e4584072145ab7 upstream. + +After moving tmio_mmc_host_probe down, error handling has to be +adjusted. + +Fixes: 74f45de394d9 ("mmc: renesas_sdhi: register irqs before registering controller") +Reviewed-by: Ihar Salauyou +Signed-off-by: Ruslan Piasetskyi +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Wolfram Sang +Tested-by: Wolfram Sang +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250326220638.460083-1-ruslan.piasetskyi@gmail.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/renesas_sdhi_core.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +--- a/drivers/mmc/host/renesas_sdhi_core.c ++++ b/drivers/mmc/host/renesas_sdhi_core.c +@@ -1109,26 +1109,26 @@ int renesas_sdhi_probe(struct platform_d + num_irqs = platform_irq_count(pdev); + if (num_irqs < 0) { + ret = num_irqs; +- goto eirq; ++ goto edisclk; + } + + /* There must be at least one IRQ source */ + if (!num_irqs) { + ret = -ENXIO; +- goto eirq; ++ goto edisclk; + } + + for (i = 0; i < num_irqs; i++) { + irq = platform_get_irq(pdev, i); + if (irq < 0) { + ret = irq; +- goto eirq; ++ goto edisclk; + } + + ret = devm_request_irq(&pdev->dev, irq, tmio_mmc_irq, 0, + dev_name(&pdev->dev), host); + if (ret) +- goto eirq; ++ goto edisclk; + } + + ret = tmio_mmc_host_probe(host); +@@ -1140,8 +1140,6 @@ int renesas_sdhi_probe(struct platform_d + + return ret; + +-eirq: +- tmio_mmc_host_remove(host); + edisclk: + renesas_sdhi_clk_disable(host); + efree: diff --git a/queue-6.1/parisc-fix-double-sigfpe-crash.patch b/queue-6.1/parisc-fix-double-sigfpe-crash.patch new file mode 100644 index 0000000000..811f2d7272 --- /dev/null +++ b/queue-6.1/parisc-fix-double-sigfpe-crash.patch @@ -0,0 +1,90 @@ +From de3629baf5a33af1919dec7136d643b0662e85ef Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sat, 3 May 2025 18:24:01 +0200 +Subject: parisc: Fix double SIGFPE crash + +From: Helge Deller + +commit de3629baf5a33af1919dec7136d643b0662e85ef upstream. + +Camm noticed that on parisc a SIGFPE exception will crash an application with +a second SIGFPE in the signal handler. Dave analyzed it, and it happens +because glibc uses a double-word floating-point store to atomically update +function descriptors. As a result of lazy binding, we hit a floating-point +store in fpe_func almost immediately. + +When the T bit is set, an assist exception trap occurs when when the +co-processor encounters *any* floating-point instruction except for a double +store of register %fr0. The latter cancels all pending traps. Let's fix this +by clearing the Trap (T) bit in the FP status register before returning to the +signal handler in userspace. + +The issue can be reproduced with this test program: + +root@parisc:~# cat fpe.c + +static void fpe_func(int sig, siginfo_t *i, void *v) { + sigset_t set; + sigemptyset(&set); + sigaddset(&set, SIGFPE); + sigprocmask(SIG_UNBLOCK, &set, NULL); + printf("GOT signal %d with si_code %ld\n", sig, i->si_code); +} + +int main() { + struct sigaction action = { + .sa_sigaction = fpe_func, + .sa_flags = SA_RESTART|SA_SIGINFO }; + sigaction(SIGFPE, &action, 0); + feenableexcept(FE_OVERFLOW); + return printf("%lf\n",1.7976931348623158E308*1.7976931348623158E308); +} + +root@parisc:~# gcc fpe.c -lm +root@parisc:~# ./a.out + Floating point exception + +root@parisc:~# strace -f ./a.out + execve("./a.out", ["./a.out"], 0xf9ac7034 /* 20 vars */) = 0 + getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0 + ... + rt_sigaction(SIGFPE, {sa_handler=0x1110a, sa_mask=[], sa_flags=SA_RESTART|SA_SIGINFO}, NULL, 8) = 0 + --- SIGFPE {si_signo=SIGFPE, si_code=FPE_FLTOVF, si_addr=0x1078f} --- + --- SIGFPE {si_signo=SIGFPE, si_code=FPE_FLTOVF, si_addr=0xf8f21237} --- + +++ killed by SIGFPE +++ + Floating point exception + +Signed-off-by: Helge Deller +Suggested-by: John David Anglin +Reported-by: Camm Maguire +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + arch/parisc/math-emu/driver.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +--- a/arch/parisc/math-emu/driver.c ++++ b/arch/parisc/math-emu/driver.c +@@ -103,9 +103,19 @@ handle_fpe(struct pt_regs *regs) + + memcpy(regs->fr, frcopy, sizeof regs->fr); + if (signalcode != 0) { +- force_sig_fault(signalcode >> 24, signalcode & 0xffffff, +- (void __user *) regs->iaoq[0]); +- return -1; ++ int sig = signalcode >> 24; ++ ++ if (sig == SIGFPE) { ++ /* ++ * Clear floating point trap bit to avoid trapping ++ * again on the first floating-point instruction in ++ * the userspace signal handler. ++ */ ++ regs->fr[0] &= ~(1ULL << 38); ++ } ++ force_sig_fault(sig, signalcode & 0xffffff, ++ (void __user *) regs->iaoq[0]); ++ return -1; + } + + return signalcode ? -1 : 0; diff --git a/queue-6.1/perf-x86-intel-kvm-mask-pebs_enable-loaded-for-guest-with-vcpu-s-value.patch b/queue-6.1/perf-x86-intel-kvm-mask-pebs_enable-loaded-for-guest-with-vcpu-s-value.patch new file mode 100644 index 0000000000..922ab2c5eb --- /dev/null +++ b/queue-6.1/perf-x86-intel-kvm-mask-pebs_enable-loaded-for-guest-with-vcpu-s-value.patch @@ -0,0 +1,64 @@ +From 58f6217e5d0132a9f14e401e62796916aa055c1b Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Fri, 25 Apr 2025 17:13:55 -0700 +Subject: perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. + +From: Sean Christopherson + +commit 58f6217e5d0132a9f14e401e62796916aa055c1b upstream. + +When generating the MSR_IA32_PEBS_ENABLE value that will be loaded on +VM-Entry to a KVM guest, mask the value with the vCPU's desired PEBS_ENABLE +value. Consulting only the host kernel's host vs. guest masks results in +running the guest with PEBS enabled even when the guest doesn't want to use +PEBS. Because KVM uses perf events to proxy the guest virtual PMU, simply +looking at exclude_host can't differentiate between events created by host +userspace, and events created by KVM on behalf of the guest. + +Running the guest with PEBS unexpectedly enabled typically manifests as +crashes due to a near-infinite stream of #PFs. E.g. if the guest hasn't +written MSR_IA32_DS_AREA, the CPU will hit page faults on address '0' when +trying to record PEBS events. + +The issue is most easily reproduced by running `perf kvm top` from before +commit 7b100989b4f6 ("perf evlist: Remove __evlist__add_default") (after +which, `perf kvm top` effectively stopped using PEBS). The userspace side +of perf creates a guest-only PEBS event, which intel_guest_get_msrs() +misconstrues a guest-*owned* PEBS event. + +Arguably, this is a userspace bug, as enabling PEBS on guest-only events +simply cannot work, and userspace can kill VMs in many other ways (there +is no danger to the host). However, even if this is considered to be bad +userspace behavior, there's zero downside to perf/KVM restricting PEBS to +guest-owned events. + +Note, commit 854250329c02 ("KVM: x86/pmu: Disable guest PEBS temporarily +in two rare situations") fixed the case where host userspace is profiling +KVM *and* userspace, but missed the case where userspace is profiling only +KVM. + +Fixes: c59a1f106f5c ("KVM: x86/pmu: Add IA32_PEBS_ENABLE MSR emulation for extended PEBS") +Closes: https://lore.kernel.org/all/Z_VUswFkWiTYI0eD@do-x1carbon +Reported-by: Seth Forshee +Signed-off-by: Sean Christopherson +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Dapeng Mi +Tested-by: "Seth Forshee (DigitalOcean)" +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250426001355.1026530-1-seanjc@google.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/events/intel/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -4177,7 +4177,7 @@ static struct perf_guest_switch_msr *int + arr[pebs_enable] = (struct perf_guest_switch_msr){ + .msr = MSR_IA32_PEBS_ENABLE, + .host = cpuc->pebs_enabled & ~cpuc->intel_ctrl_guest_mask, +- .guest = pebs_mask & ~cpuc->intel_ctrl_host_mask, ++ .guest = pebs_mask & ~cpuc->intel_ctrl_host_mask & kvm_pmu->pebs_enable, + }; + + if (arr[pebs_enable].host) { diff --git a/queue-6.1/platform-x86-intel-uncore-freq-fix-missing-uncore-sysfs-during-cpu-hotplug.patch b/queue-6.1/platform-x86-intel-uncore-freq-fix-missing-uncore-sysfs-during-cpu-hotplug.patch new file mode 100644 index 0000000000..33c41f22c5 --- /dev/null +++ b/queue-6.1/platform-x86-intel-uncore-freq-fix-missing-uncore-sysfs-during-cpu-hotplug.patch @@ -0,0 +1,73 @@ +From 8d6955ed76e8a47115f2ea1d9c263ee6f505d737 Mon Sep 17 00:00:00 2001 +From: Shouye Liu +Date: Thu, 17 Apr 2025 11:23:21 +0800 +Subject: platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shouye Liu + +commit 8d6955ed76e8a47115f2ea1d9c263ee6f505d737 upstream. + +In certain situations, the sysfs for uncore may not be present when all +CPUs in a package are offlined and then brought back online after boot. + +This issue can occur if there is an error in adding the sysfs entry due +to a memory allocation failure. Retrying to bring the CPUs online will +not resolve the issue, as the uncore_cpu_mask is already set for the +package before the failure condition occurs. + +This issue does not occur if the failure happens during module +initialization, as the module will fail to load in the event of any +error. + +To address this, ensure that the uncore_cpu_mask is not set until the +successful return of uncore_freq_add_entry(). + +Fixes: dbce412a7733 ("platform/x86/intel-uncore-freq: Split common and enumeration part") +Signed-off-by: Shouye Liu +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250417032321.75580-1-shouyeliu@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c | 13 ++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c ++++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c +@@ -121,15 +121,13 @@ static int uncore_event_cpu_online(unsig + { + struct uncore_data *data; + int target; ++ int ret; + + /* Check if there is an online cpu in the package for uncore MSR */ + target = cpumask_any_and(&uncore_cpu_mask, topology_die_cpumask(cpu)); + if (target < nr_cpu_ids) + return 0; + +- /* Use this CPU on this die as a control CPU */ +- cpumask_set_cpu(cpu, &uncore_cpu_mask); +- + data = uncore_get_instance(cpu); + if (!data) + return 0; +@@ -137,7 +135,14 @@ static int uncore_event_cpu_online(unsig + data->package_id = topology_physical_package_id(cpu); + data->die_id = topology_die_id(cpu); + +- return uncore_freq_add_entry(data, cpu); ++ ret = uncore_freq_add_entry(data, cpu); ++ if (ret) ++ return ret; ++ ++ /* Use this CPU on this die as a control CPU */ ++ cpumask_set_cpu(cpu, &uncore_cpu_mask); ++ ++ return 0; + } + + static int uncore_event_cpu_offline(unsigned int cpu) diff --git a/queue-6.1/series b/queue-6.1/series index cb1e3c2c3d..88c66000df 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -1,2 +1,22 @@ revert-rndis_host-flag-rndis-modems-as-wwan-devices.patch alsa-usb-audio-add-second-usb-id-for-jabra-evolve-65-headset.patch +drm-nouveau-fix-warn_on-in-nouveau_fence_context_kill.patch +edac-altera-test-the-correct-error-reg-offset.patch +edac-altera-set-ddr-and-sdmmc-interrupt-mask-before-registration.patch +i2c-imx-lpi2c-fix-clock-count-when-probe-defers.patch +arm64-errata-add-missing-sentinels-to-spectre-bhb-midr-arrays.patch +parisc-fix-double-sigfpe-crash.patch +perf-x86-intel-kvm-mask-pebs_enable-loaded-for-guest-with-vcpu-s-value.patch +amd-xgbe-fix-to-ensure-dependent-features-are-toggled-with-rx-checksum-offload.patch +irqchip-qcom-mpm-prevent-crash-when-trying-to-handle-non-wake-gpios.patch +mmc-renesas_sdhi-fix-error-handling-in-renesas_sdhi_probe.patch +wifi-brcm80211-fmac-add-error-handling-for-brcmf_usb_dl_writeimage.patch +dm-integrity-fix-a-warning-on-invalid-table-line.patch +dm-always-update-the-array-size-in-realloc_argv-on-success.patch +iommu-amd-fix-potential-buffer-overflow-in-parse_ivrs_acpihid.patch +iommu-vt-d-apply-quirk_iommu_igfx-for-8086-0044-qm57-qs57.patch +platform-x86-intel-uncore-freq-fix-missing-uncore-sysfs-during-cpu-hotplug.patch +ksmbd-fix-use-after-free-in-kerberos-authentication.patch +cpufreq-avoid-using-inconsistent-policy-min-and-policy-max.patch +cpufreq-fix-setting-policy-limits-when-frequency-tables-are-used.patch +tracing-fix-oob-write-in-trace_seq_to_buffer.patch diff --git a/queue-6.1/tracing-fix-oob-write-in-trace_seq_to_buffer.patch b/queue-6.1/tracing-fix-oob-write-in-trace_seq_to_buffer.patch new file mode 100644 index 0000000000..4a72b06d8c --- /dev/null +++ b/queue-6.1/tracing-fix-oob-write-in-trace_seq_to_buffer.patch @@ -0,0 +1,66 @@ +From f5178c41bb43444a6008150fe6094497135d07cb Mon Sep 17 00:00:00 2001 +From: Jeongjun Park +Date: Tue, 22 Apr 2025 20:30:25 +0900 +Subject: tracing: Fix oob write in trace_seq_to_buffer() + +From: Jeongjun Park + +commit f5178c41bb43444a6008150fe6094497135d07cb upstream. + +syzbot reported this bug: +================================================================== +BUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/trace.c:1830 [inline] +BUG: KASAN: slab-out-of-bounds in tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822 +Write of size 4507 at addr ffff888032b6b000 by task syz.2.320/7260 + +CPU: 1 UID: 0 PID: 7260 Comm: syz.2.320 Not tainted 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full) +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 + print_address_description mm/kasan/report.c:408 [inline] + print_report+0xc3/0x670 mm/kasan/report.c:521 + kasan_report+0xe0/0x110 mm/kasan/report.c:634 + check_region_inline mm/kasan/generic.c:183 [inline] + kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 + __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106 + trace_seq_to_buffer kernel/trace/trace.c:1830 [inline] + tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822 + .... +================================================================== + +It has been reported that trace_seq_to_buffer() tries to copy more data +than PAGE_SIZE to buf. Therefore, to prevent this, we should use the +smaller of trace_seq_used(&iter->seq) and PAGE_SIZE as an argument. + +Link: https://lore.kernel.org/20250422113026.13308-1-aha310510@gmail.com +Reported-by: syzbot+c8cd2d2c412b868263fb@syzkaller.appspotmail.com +Fixes: 3c56819b14b0 ("tracing: splice support for tracing_pipe") +Suggested-by: Steven Rostedt +Signed-off-by: Jeongjun Park +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -7054,13 +7054,14 @@ static ssize_t tracing_splice_read_pipe( + /* Copy the data into the page, so we can start over. */ + ret = trace_seq_to_buffer(&iter->seq, + page_address(spd.pages[i]), +- trace_seq_used(&iter->seq)); ++ min((size_t)trace_seq_used(&iter->seq), ++ PAGE_SIZE)); + if (ret < 0) { + __free_page(spd.pages[i]); + break; + } + spd.partial[i].offset = 0; +- spd.partial[i].len = trace_seq_used(&iter->seq); ++ spd.partial[i].len = ret; + + trace_seq_init(&iter->seq); + } diff --git a/queue-6.1/wifi-brcm80211-fmac-add-error-handling-for-brcmf_usb_dl_writeimage.patch b/queue-6.1/wifi-brcm80211-fmac-add-error-handling-for-brcmf_usb_dl_writeimage.patch new file mode 100644 index 0000000000..10d96903c8 --- /dev/null +++ b/queue-6.1/wifi-brcm80211-fmac-add-error-handling-for-brcmf_usb_dl_writeimage.patch @@ -0,0 +1,54 @@ +From 8e089e7b585d95122c8122d732d1d5ef8f879396 Mon Sep 17 00:00:00 2001 +From: Wentao Liang +Date: Tue, 22 Apr 2025 12:22:02 +0800 +Subject: wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() + +From: Wentao Liang + +commit 8e089e7b585d95122c8122d732d1d5ef8f879396 upstream. + +The function brcmf_usb_dl_writeimage() calls the function +brcmf_usb_dl_cmd() but dose not check its return value. The +'state.state' and the 'state.bytes' are uninitialized if the +function brcmf_usb_dl_cmd() fails. It is dangerous to use +uninitialized variables in the conditions. + +Add error handling for brcmf_usb_dl_cmd() to jump to error +handling path if the brcmf_usb_dl_cmd() fails and the +'state.state' and the 'state.bytes' are uninitialized. + +Improve the error message to report more detailed error +information. + +Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets") +Cc: stable@vger.kernel.org # v3.4+ +Signed-off-by: Wentao Liang +Acked-by: Arend van Spriel +Link: https://patch.msgid.link/20250422042203.2259-1-vulab@iscas.ac.cn +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c +@@ -903,14 +903,16 @@ brcmf_usb_dl_writeimage(struct brcmf_usb + } + + /* 1) Prepare USB boot loader for runtime image */ +- brcmf_usb_dl_cmd(devinfo, DL_START, &state, sizeof(state)); ++ err = brcmf_usb_dl_cmd(devinfo, DL_START, &state, sizeof(state)); ++ if (err) ++ goto fail; + + rdlstate = le32_to_cpu(state.state); + rdlbytes = le32_to_cpu(state.bytes); + + /* 2) Check we are in the Waiting state */ + if (rdlstate != DL_WAITING) { +- brcmf_err("Failed to DL_START\n"); ++ brcmf_err("Invalid DL state: %u\n", rdlstate); + err = -EINVAL; + goto fail; + }