From: Greg Kroah-Hartman Date: Wed, 13 Sep 2023 19:22:49 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v5.10.195~58 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a0e35d2919968600a59004b9b046bea6e5bcd763;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: clk-imx-pll14xx-dynamically-configure-pll-for-393216000-361267200hz.patch clk-qcom-gcc-mdm9615-use-proper-parent-for-pll0_vote-clock.patch drm-ast-fix-dram-init-on-ast2200.patch dt-bindings-clock-xlnx-versal-clk-drop-select-false.patch fbdev-ep93xx-fb-do-not-assign-to-struct-fb_info.dev.patch lib-test_meminit-allocate-pages-up-to-order-max_order.patch nfs-fix-a-potential-data-corruption.patch nfsv4-pnfs-minor-fix-for-cleanup-path-in-nfs4_get_device_info.patch parisc-led-fix-lan-receive-and-transmit-leds.patch parisc-led-reduce-cpu-overhead-for-disk-lan-led-computation.patch pinctrl-cherryview-fix-address_space_handler-argument.patch soc-qcom-qmi_encdec-restrict-string-length-in-decode.patch --- diff --git a/queue-5.10/clk-imx-pll14xx-dynamically-configure-pll-for-393216000-361267200hz.patch b/queue-5.10/clk-imx-pll14xx-dynamically-configure-pll-for-393216000-361267200hz.patch new file mode 100644 index 00000000000..256ea87b384 --- /dev/null +++ b/queue-5.10/clk-imx-pll14xx-dynamically-configure-pll-for-393216000-361267200hz.patch @@ -0,0 +1,72 @@ +From 72d00e560d10665e6139c9431956a87ded6e9880 Mon Sep 17 00:00:00 2001 +From: Ahmad Fatoum +Date: Mon, 7 Aug 2023 10:47:44 +0200 +Subject: clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz + +From: Ahmad Fatoum + +commit 72d00e560d10665e6139c9431956a87ded6e9880 upstream. + +Since commit b09c68dc57c9 ("clk: imx: pll14xx: Support dynamic rates"), +the driver has the ability to dynamically compute PLL parameters to +approximate the requested rates. This is not always used, because the +logic is as follows: + + - Check if the target rate is hardcoded in the frequency table + - Check if varying only kdiv is possible, so switch over is glitch free + - Compute rate dynamically by iterating over pdiv range + +If we skip the frequency table for the 1443x PLL, we find that the +computed values differ to the hardcoded ones. This can be valid if the +hardcoded values guarantee for example an earlier lock-in or if the +divisors are chosen, so that other important rates are more likely to +be reached glitch-free. + +For rates (393216000 and 361267200, this doesn't seem to be the case: +They are only approximated by existing parameters (393215995 and +361267196 Hz, respectively) and they aren't reachable glitch-free from +other hardcoded frequencies. Dropping them from the table allows us +to lock-in to these frequencies exactly. + +This is immediately noticeable because they are the assigned-clock-rates +for IMX8MN_AUDIO_PLL1 and IMX8MN_AUDIO_PLL2, respectively and a look +into clk_summary so far showed that they were a few Hz short of the target: + +imx8mn-board:~# grep audio_pll[12]_out /sys/kernel/debug/clk/clk_summary +audio_pll2_out 0 0 0 361267196 0 0 50000 N +audio_pll1_out 1 1 0 393215995 0 0 50000 Y + +and afterwards: + +imx8mn-board:~# grep audio_pll[12]_out /sys/kernel/debug/clk/clk_summary +audio_pll2_out 0 0 0 361267200 0 0 50000 N +audio_pll1_out 1 1 0 393216000 0 0 50000 Y + +This change is equivalent to adding following hardcoded values: + + /* rate mdiv pdiv sdiv kdiv */ + PLL_1443X_RATE(393216000, 655, 5, 3, 23593), + PLL_1443X_RATE(361267200, 497, 33, 0, -16882), + +Fixes: 053a4ffe2988 ("clk: imx: imx8mm: fix audio pll setting") +Cc: stable@vger.kernel.org # v5.18+ +Signed-off-by: Ahmad Fatoum +Signed-off-by: Marco Felsch +Link: https://lore.kernel.org/r/20230807084744.1184791-2-m.felsch@pengutronix.de +Signed-off-by: Abel Vesa +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/imx/clk-pll14xx.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/clk/imx/clk-pll14xx.c ++++ b/drivers/clk/imx/clk-pll14xx.c +@@ -60,8 +60,6 @@ static const struct imx_pll14xx_rate_tab + PLL_1443X_RATE(650000000U, 325, 3, 2, 0), + PLL_1443X_RATE(594000000U, 198, 2, 2, 0), + PLL_1443X_RATE(519750000U, 173, 2, 2, 16384), +- PLL_1443X_RATE(393216000U, 262, 2, 3, 9437), +- PLL_1443X_RATE(361267200U, 361, 3, 3, 17511), + }; + + struct imx_pll14xx_clk imx_1443x_pll = { diff --git a/queue-5.10/clk-qcom-gcc-mdm9615-use-proper-parent-for-pll0_vote-clock.patch b/queue-5.10/clk-qcom-gcc-mdm9615-use-proper-parent-for-pll0_vote-clock.patch new file mode 100644 index 00000000000..38cc4427ec8 --- /dev/null +++ b/queue-5.10/clk-qcom-gcc-mdm9615-use-proper-parent-for-pll0_vote-clock.patch @@ -0,0 +1,35 @@ +From 1583694bb4eaf186f17131dbc1b83d6057d2749b Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Sat, 13 May 2023 00:17:23 +0300 +Subject: clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock + +From: Dmitry Baryshkov + +commit 1583694bb4eaf186f17131dbc1b83d6057d2749b upstream. + +The pll0_vote clock definitely should have pll0 as a parent (instead of +pll8). + +Fixes: 7792a8d6713c ("clk: mdm9615: Add support for MDM9615 Clock Controllers") +Cc: stable@kernel.org +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230512211727.3445575-7-dmitry.baryshkov@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/qcom/gcc-mdm9615.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/qcom/gcc-mdm9615.c ++++ b/drivers/clk/qcom/gcc-mdm9615.c +@@ -58,7 +58,7 @@ static struct clk_regmap pll0_vote = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "pll0_vote", +- .parent_names = (const char *[]){ "pll8" }, ++ .parent_names = (const char *[]){ "pll0" }, + .num_parents = 1, + .ops = &clk_pll_vote_ops, + }, diff --git a/queue-5.10/drm-ast-fix-dram-init-on-ast2200.patch b/queue-5.10/drm-ast-fix-dram-init-on-ast2200.patch new file mode 100644 index 00000000000..daf4453eaad --- /dev/null +++ b/queue-5.10/drm-ast-fix-dram-init-on-ast2200.patch @@ -0,0 +1,41 @@ +From 4cfe75f0f14f044dae66ad0e6eea812d038465d9 Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Wed, 21 Jun 2023 14:53:35 +0200 +Subject: drm/ast: Fix DRAM init on AST2200 + +From: Thomas Zimmermann + +commit 4cfe75f0f14f044dae66ad0e6eea812d038465d9 upstream. + +Fix the test for the AST2200 in the DRAM initialization. The value +in ast->chip has to be compared against an enum constant instead of +a numerical value. + +This bug got introduced when the driver was first imported into the +kernel. + +Signed-off-by: Thomas Zimmermann +Fixes: 312fec1405dd ("drm: Initial KMS driver for AST (ASpeed Technologies) 2000 series (v2)") +Cc: Dave Airlie +Cc: dri-devel@lists.freedesktop.org +Cc: # v3.5+ +Reviewed-by: Sui Jingfeng +Reviewed-by: Jocelyn Falempe +Tested-by: Jocelyn Falempe # AST2600 +Link: https://patchwork.freedesktop.org/patch/msgid/20230621130032.3568-2-tzimmermann@suse.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/ast/ast_post.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/ast/ast_post.c ++++ b/drivers/gpu/drm/ast/ast_post.c +@@ -290,7 +290,7 @@ static void ast_init_dram_reg(struct drm + ; + } while (ast_read32(ast, 0x10100) != 0xa8); + } else {/* AST2100/1100 */ +- if (ast->chip == AST2100 || ast->chip == 2200) ++ if (ast->chip == AST2100 || ast->chip == AST2200) + dram_reg_info = ast2100_dram_table_data; + else + dram_reg_info = ast1100_dram_table_data; diff --git a/queue-5.10/dt-bindings-clock-xlnx-versal-clk-drop-select-false.patch b/queue-5.10/dt-bindings-clock-xlnx-versal-clk-drop-select-false.patch new file mode 100644 index 00000000000..3236dc2cfe6 --- /dev/null +++ b/queue-5.10/dt-bindings-clock-xlnx-versal-clk-drop-select-false.patch @@ -0,0 +1,35 @@ +From 172044e30b00977784269e8ab72132a48293c654 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 28 Jul 2023 18:59:23 +0200 +Subject: dt-bindings: clock: xlnx,versal-clk: drop select:false + +From: Krzysztof Kozlowski + +commit 172044e30b00977784269e8ab72132a48293c654 upstream. + +select:false makes the schema basically ignored and not effective, which +is clearly not what we want for a device binding. + +Fixes: 352546805a44 ("dt-bindings: clock: Add bindings for versal clock driver") +Cc: +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230728165923.108589-1-krzysztof.kozlowski@linaro.org +Reviewed-by: Conor Dooley +Reviewed-by: Shubhrajyoti Datta +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/clock/xlnx,versal-clk.yaml | 2 -- + 1 file changed, 2 deletions(-) + +--- a/Documentation/devicetree/bindings/clock/xlnx,versal-clk.yaml ++++ b/Documentation/devicetree/bindings/clock/xlnx,versal-clk.yaml +@@ -16,8 +16,6 @@ description: | + reads required input clock frequencies from the devicetree and acts as clock + provider for all clock consumers of PS clocks. + +-select: false +- + properties: + compatible: + const: xlnx,versal-clk diff --git a/queue-5.10/fbdev-ep93xx-fb-do-not-assign-to-struct-fb_info.dev.patch b/queue-5.10/fbdev-ep93xx-fb-do-not-assign-to-struct-fb_info.dev.patch new file mode 100644 index 00000000000..1241a9ddb58 --- /dev/null +++ b/queue-5.10/fbdev-ep93xx-fb-do-not-assign-to-struct-fb_info.dev.patch @@ -0,0 +1,40 @@ +From f90a0e5265b60cdd3c77990e8105f79aa2fac994 Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Tue, 13 Jun 2023 13:06:49 +0200 +Subject: fbdev/ep93xx-fb: Do not assign to struct fb_info.dev + +From: Thomas Zimmermann + +commit f90a0e5265b60cdd3c77990e8105f79aa2fac994 upstream. + +Do not assing the Linux device to struct fb_info.dev. The call to +register_framebuffer() initializes the field to the fbdev device. +Drivers should not override its value. + +Fixes a bug where the driver incorrectly decreases the hardware +device's reference counter and leaks the fbdev device. + +v2: + * add Fixes tag (Dan) + +Signed-off-by: Thomas Zimmermann +Fixes: 88017bda96a5 ("ep93xx video driver") +Cc: # v2.6.32+ +Reviewed-by: Javier Martinez Canillas +Reviewed-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20230613110953.24176-15-tzimmermann@suse.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/ep93xx-fb.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/video/fbdev/ep93xx-fb.c ++++ b/drivers/video/fbdev/ep93xx-fb.c +@@ -474,7 +474,6 @@ static int ep93xxfb_probe(struct platfor + if (!info) + return -ENOMEM; + +- info->dev = &pdev->dev; + platform_set_drvdata(pdev, info); + fbi = info->par; + fbi->mach_info = mach_info; diff --git a/queue-5.10/lib-test_meminit-allocate-pages-up-to-order-max_order.patch b/queue-5.10/lib-test_meminit-allocate-pages-up-to-order-max_order.patch new file mode 100644 index 00000000000..87e5006263f --- /dev/null +++ b/queue-5.10/lib-test_meminit-allocate-pages-up-to-order-max_order.patch @@ -0,0 +1,44 @@ +From efb78fa86e95832b78ca0ba60f3706788a818938 Mon Sep 17 00:00:00 2001 +From: Andrew Donnellan +Date: Fri, 14 Jul 2023 11:52:38 +1000 +Subject: lib/test_meminit: allocate pages up to order MAX_ORDER + +From: Andrew Donnellan + +commit efb78fa86e95832b78ca0ba60f3706788a818938 upstream. + +test_pages() tests the page allocator by calling alloc_pages() with +different orders up to order 10. + +However, different architectures and platforms support different maximum +contiguous allocation sizes. The default maximum allocation order +(MAX_ORDER) is 10, but architectures can use CONFIG_ARCH_FORCE_MAX_ORDER +to override this. On platforms where this is less than 10, test_meminit() +will blow up with a WARN(). This is expected, so let's not do that. + +Replace the hardcoded "10" with the MAX_ORDER macro so that we test +allocations up to the expected platform limit. + +Link: https://lkml.kernel.org/r/20230714015238.47931-1-ajd@linux.ibm.com +Fixes: 5015a300a522 ("lib: introduce test_meminit module") +Signed-off-by: Andrew Donnellan +Reviewed-by: Alexander Potapenko +Cc: Xiaoke Wang +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + lib/test_meminit.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/lib/test_meminit.c ++++ b/lib/test_meminit.c +@@ -86,7 +86,7 @@ static int __init test_pages(int *total_ + int failures = 0, num_tests = 0; + int i; + +- for (i = 0; i < 10; i++) ++ for (i = 0; i <= MAX_ORDER; i++) + num_tests += do_alloc_pages_order(i, &failures); + + REPORT_FAILURES_IN_FN(); diff --git a/queue-5.10/nfs-fix-a-potential-data-corruption.patch b/queue-5.10/nfs-fix-a-potential-data-corruption.patch new file mode 100644 index 00000000000..d70d4815392 --- /dev/null +++ b/queue-5.10/nfs-fix-a-potential-data-corruption.patch @@ -0,0 +1,60 @@ +From 88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sat, 19 Aug 2023 17:22:14 -0400 +Subject: NFS: Fix a potential data corruption + +From: Trond Myklebust + +commit 88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4 upstream. + +We must ensure that the subrequests are joined back into the head before +we can retransmit a request. If the head was not on the commit lists, +because the server wrote it synchronously, we still need to add it back +to the retransmission list. +Add a call that mirrors the effect of nfs_cancel_remove_inode() for +O_DIRECT. + +Fixes: ed5d588fe47f ("NFS: Try to join page groups before an O_DIRECT retransmission") +Cc: stable@vger.kernel.org +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/direct.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -509,13 +509,31 @@ out: + return result; + } + ++static void nfs_direct_add_page_head(struct list_head *list, ++ struct nfs_page *req) ++{ ++ struct nfs_page *head = req->wb_head; ++ ++ if (!list_empty(&head->wb_list) || !nfs_lock_request(head)) ++ return; ++ if (!list_empty(&head->wb_list)) { ++ nfs_unlock_request(head); ++ return; ++ } ++ list_add(&head->wb_list, list); ++ kref_get(&head->wb_kref); ++ kref_get(&head->wb_kref); ++} ++ + static void nfs_direct_join_group(struct list_head *list, struct inode *inode) + { + struct nfs_page *req, *subreq; + + list_for_each_entry(req, list, wb_list) { +- if (req->wb_head != req) ++ if (req->wb_head != req) { ++ nfs_direct_add_page_head(&req->wb_list, req); + continue; ++ } + subreq = req->wb_this_page; + if (subreq == req) + continue; diff --git a/queue-5.10/nfsv4-pnfs-minor-fix-for-cleanup-path-in-nfs4_get_device_info.patch b/queue-5.10/nfsv4-pnfs-minor-fix-for-cleanup-path-in-nfs4_get_device_info.patch new file mode 100644 index 00000000000..cc6dd363a2f --- /dev/null +++ b/queue-5.10/nfsv4-pnfs-minor-fix-for-cleanup-path-in-nfs4_get_device_info.patch @@ -0,0 +1,35 @@ +From 96562c45af5c31b89a197af28f79bfa838fb8391 Mon Sep 17 00:00:00 2001 +From: Fedor Pchelkin +Date: Thu, 20 Jul 2023 18:37:51 +0300 +Subject: NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info + +From: Fedor Pchelkin + +commit 96562c45af5c31b89a197af28f79bfa838fb8391 upstream. + +It is an almost improbable error case but when page allocating loop in +nfs4_get_device_info() fails then we should only free the already +allocated pages, as __free_page() can't deal with NULL arguments. + +Found by Linux Verification Center (linuxtesting.org). + +Cc: stable@vger.kernel.org +Signed-off-by: Fedor Pchelkin +Reviewed-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/pnfs_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nfs/pnfs_dev.c ++++ b/fs/nfs/pnfs_dev.c +@@ -152,7 +152,7 @@ nfs4_get_device_info(struct nfs_server * + set_bit(NFS_DEVICEID_NOCACHE, &d->flags); + + out_free_pages: +- for (i = 0; i < max_pages; i++) ++ while (--i >= 0) + __free_page(pages[i]); + kfree(pages); + out_free_pdev: diff --git a/queue-5.10/parisc-led-fix-lan-receive-and-transmit-leds.patch b/queue-5.10/parisc-led-fix-lan-receive-and-transmit-leds.patch new file mode 100644 index 00000000000..79cffe05820 --- /dev/null +++ b/queue-5.10/parisc-led-fix-lan-receive-and-transmit-leds.patch @@ -0,0 +1,32 @@ +From 4db89524b084f712a887256391fc19d9f66c8e55 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sun, 27 Aug 2023 13:46:11 +0200 +Subject: parisc: led: Fix LAN receive and transmit LEDs + +From: Helge Deller + +commit 4db89524b084f712a887256391fc19d9f66c8e55 upstream. + +Fix the LAN receive and LAN transmit LEDs, which where swapped +up to now. + +Signed-off-by: Helge Deller +Cc: +Signed-off-by: Greg Kroah-Hartman +--- + arch/parisc/include/asm/led.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/parisc/include/asm/led.h ++++ b/arch/parisc/include/asm/led.h +@@ -11,8 +11,8 @@ + #define LED1 0x02 + #define LED0 0x01 /* bottom (or furthest left) LED */ + +-#define LED_LAN_TX LED0 /* for LAN transmit activity */ +-#define LED_LAN_RCV LED1 /* for LAN receive activity */ ++#define LED_LAN_RCV LED0 /* for LAN receive activity */ ++#define LED_LAN_TX LED1 /* for LAN transmit activity */ + #define LED_DISK_IO LED2 /* for disk activity */ + #define LED_HEARTBEAT LED3 /* heartbeat */ + diff --git a/queue-5.10/parisc-led-reduce-cpu-overhead-for-disk-lan-led-computation.patch b/queue-5.10/parisc-led-reduce-cpu-overhead-for-disk-lan-led-computation.patch new file mode 100644 index 00000000000..c138b435ac4 --- /dev/null +++ b/queue-5.10/parisc-led-reduce-cpu-overhead-for-disk-lan-led-computation.patch @@ -0,0 +1,38 @@ +From 358ad816e52d4253b38c2f312e6b1cbd89e0dbf7 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Fri, 25 Aug 2023 17:46:39 +0200 +Subject: parisc: led: Reduce CPU overhead for disk & lan LED computation + +From: Helge Deller + +commit 358ad816e52d4253b38c2f312e6b1cbd89e0dbf7 upstream. + +Older PA-RISC machines have LEDs which show the disk- and LAN-activity. +The computation is done in software and takes quite some time, e.g. on a +J6500 this may take up to 60% time of one CPU if the machine is loaded +via network traffic. + +Since most people don't care about the LEDs, start with LEDs disabled and +just show a CPU heartbeat LED. The disk and LAN LEDs can be turned on +manually via /proc/pdc/led. + +Signed-off-by: Helge Deller +Cc: +Signed-off-by: Greg Kroah-Hartman +--- + drivers/parisc/led.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/parisc/led.c ++++ b/drivers/parisc/led.c +@@ -56,8 +56,8 @@ + static int led_type __read_mostly = -1; + static unsigned char lastleds; /* LED state from most recent update */ + static unsigned int led_heartbeat __read_mostly = 1; +-static unsigned int led_diskio __read_mostly = 1; +-static unsigned int led_lanrxtx __read_mostly = 1; ++static unsigned int led_diskio __read_mostly; ++static unsigned int led_lanrxtx __read_mostly; + static char lcd_text[32] __read_mostly; + static char lcd_text_default[32] __read_mostly; + static int lcd_no_led_support __read_mostly = 0; /* KittyHawk doesn't support LED on its LCD */ diff --git a/queue-5.10/pinctrl-cherryview-fix-address_space_handler-argument.patch b/queue-5.10/pinctrl-cherryview-fix-address_space_handler-argument.patch new file mode 100644 index 00000000000..5e9744d8a90 --- /dev/null +++ b/queue-5.10/pinctrl-cherryview-fix-address_space_handler-argument.patch @@ -0,0 +1,52 @@ +From d5301c90716a8e20bc961a348182daca00c8e8f0 Mon Sep 17 00:00:00 2001 +From: Raag Jadav +Date: Tue, 22 Aug 2023 12:53:40 +0530 +Subject: pinctrl: cherryview: fix address_space_handler() argument + +From: Raag Jadav + +commit d5301c90716a8e20bc961a348182daca00c8e8f0 upstream. + +First argument of acpi_*_address_space_handler() APIs is acpi_handle of +the device, which is incorrectly passed in driver ->remove() path here. +Fix it by passing the appropriate argument and while at it, make both +API calls consistent using ACPI_HANDLE(). + +Fixes: a0b028597d59 ("pinctrl: cherryview: Add support for GMMR GPIO opregion") +Cc: stable@vger.kernel.org +Signed-off-by: Raag Jadav +Acked-by: Mika Westerberg +Signed-off-by: Andy Shevchenko +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/intel/pinctrl-cherryview.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/pinctrl/intel/pinctrl-cherryview.c ++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c +@@ -1625,7 +1625,6 @@ static int chv_pinctrl_probe(struct plat + const struct intel_pinctrl_soc_data *soc_data; + struct intel_community *community; + struct device *dev = &pdev->dev; +- struct acpi_device *adev = ACPI_COMPANION(dev); + struct intel_pinctrl *pctrl; + acpi_status status; + int ret, irq; +@@ -1688,7 +1687,7 @@ static int chv_pinctrl_probe(struct plat + if (ret) + return ret; + +- status = acpi_install_address_space_handler(adev->handle, ++ status = acpi_install_address_space_handler(ACPI_HANDLE(dev), + community->acpi_space_id, + chv_pinctrl_mmio_access_handler, + NULL, pctrl); +@@ -1705,7 +1704,7 @@ static int chv_pinctrl_remove(struct pla + struct intel_pinctrl *pctrl = platform_get_drvdata(pdev); + const struct intel_community *community = &pctrl->communities[0]; + +- acpi_remove_address_space_handler(ACPI_COMPANION(&pdev->dev), ++ acpi_remove_address_space_handler(ACPI_HANDLE(&pdev->dev), + community->acpi_space_id, + chv_pinctrl_mmio_access_handler); + diff --git a/queue-5.10/series b/queue-5.10/series index 87c108a87d6..61821a2dd72 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -319,3 +319,15 @@ scsi-qla2xxx-fix-inconsistent-tmf-timeout.patch scsi-qla2xxx-fix-erroneous-link-up-failure.patch scsi-qla2xxx-turn-off-noisy-message-log.patch scsi-qla2xxx-remove-unsupported-ql2xenabledif-option.patch +fbdev-ep93xx-fb-do-not-assign-to-struct-fb_info.dev.patch +drm-ast-fix-dram-init-on-ast2200.patch +lib-test_meminit-allocate-pages-up-to-order-max_order.patch +parisc-led-fix-lan-receive-and-transmit-leds.patch +parisc-led-reduce-cpu-overhead-for-disk-lan-led-computation.patch +pinctrl-cherryview-fix-address_space_handler-argument.patch +dt-bindings-clock-xlnx-versal-clk-drop-select-false.patch +clk-imx-pll14xx-dynamically-configure-pll-for-393216000-361267200hz.patch +clk-qcom-gcc-mdm9615-use-proper-parent-for-pll0_vote-clock.patch +soc-qcom-qmi_encdec-restrict-string-length-in-decode.patch +nfs-fix-a-potential-data-corruption.patch +nfsv4-pnfs-minor-fix-for-cleanup-path-in-nfs4_get_device_info.patch diff --git a/queue-5.10/soc-qcom-qmi_encdec-restrict-string-length-in-decode.patch b/queue-5.10/soc-qcom-qmi_encdec-restrict-string-length-in-decode.patch new file mode 100644 index 00000000000..cbba8e3cbe7 --- /dev/null +++ b/queue-5.10/soc-qcom-qmi_encdec-restrict-string-length-in-decode.patch @@ -0,0 +1,38 @@ +From 8d207400fd6b79c92aeb2f33bb79f62dff904ea2 Mon Sep 17 00:00:00 2001 +From: Chris Lew +Date: Tue, 1 Aug 2023 12:17:12 +0530 +Subject: soc: qcom: qmi_encdec: Restrict string length in decode + +From: Chris Lew + +commit 8d207400fd6b79c92aeb2f33bb79f62dff904ea2 upstream. + +The QMI TLV value for strings in a lot of qmi element info structures +account for null terminated strings with MAX_LEN + 1. If a string is +actually MAX_LEN + 1 length, this will cause an out of bounds access +when the NULL character is appended in decoding. + +Fixes: 9b8a11e82615 ("soc: qcom: Introduce QMI encoder/decoder") +Cc: stable@vger.kernel.org +Signed-off-by: Chris Lew +Signed-off-by: Praveenkumar I +Link: https://lore.kernel.org/r/20230801064712.3590128-1-quic_ipkumar@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/qcom/qmi_encdec.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/soc/qcom/qmi_encdec.c ++++ b/drivers/soc/qcom/qmi_encdec.c +@@ -534,8 +534,8 @@ static int qmi_decode_string_elem(struct + decoded_bytes += rc; + } + +- if (string_len > temp_ei->elem_len) { +- pr_err("%s: String len %d > Max Len %d\n", ++ if (string_len >= temp_ei->elem_len) { ++ pr_err("%s: String len %d >= Max Len %d\n", + __func__, string_len, temp_ei->elem_len); + return -ETOOSMALL; + } else if (string_len > tlv_len) {