From: Greg Kroah-Hartman Date: Mon, 26 Aug 2024 11:47:42 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v6.1.107~46 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ae0272c1511fc78dd6ff3a1551a7c5c04c19113a;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: drm-amdgpu-sdma5.2-limit-wptr-workaround-to-sdma-5.2.1.patch drm-amdgpu-validate-ta-binary-size.patch hid-wacom-defer-calculation-of-resolution-until-resolution_code-is-known.patch ksmbd-the-buffer-of-smb2-query-dir-response-has-at-least-1-byte.patch mips-loongson64-set-timer-mode-in-cpu-probe.patch net-dsa-microchip-fix-ptp-config-failure-when-using-multiple-ports.patch scsi-core-fix-the-return-value-of-scsi_logical_block_count.patch --- diff --git a/queue-6.6/drm-amdgpu-sdma5.2-limit-wptr-workaround-to-sdma-5.2.1.patch b/queue-6.6/drm-amdgpu-sdma5.2-limit-wptr-workaround-to-sdma-5.2.1.patch new file mode 100644 index 00000000000..cc253d03356 --- /dev/null +++ b/queue-6.6/drm-amdgpu-sdma5.2-limit-wptr-workaround-to-sdma-5.2.1.patch @@ -0,0 +1,50 @@ +From e3e4bf58bad1576ac732a1429f53e3d4bfb82b4b Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 14 Aug 2024 10:28:24 -0400 +Subject: drm/amdgpu/sdma5.2: limit wptr workaround to sdma 5.2.1 + +From: Alex Deucher + +commit e3e4bf58bad1576ac732a1429f53e3d4bfb82b4b upstream. + +The workaround seems to cause stability issues on other +SDMA 5.2.x IPs. + +Fixes: a03ebf116303 ("drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3556 +Acked-by: Ruijing Dong +Signed-off-by: Alex Deucher +(cherry picked from commit 2dc3851ef7d9c5439ea8e9623fc36878f3b40649) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c +@@ -188,14 +188,16 @@ static void sdma_v5_2_ring_set_wptr(stru + DRM_DEBUG("calling WDOORBELL64(0x%08x, 0x%016llx)\n", + ring->doorbell_index, ring->wptr << 2); + WDOORBELL64(ring->doorbell_index, ring->wptr << 2); +- /* SDMA seems to miss doorbells sometimes when powergating kicks in. +- * Updating the wptr directly will wake it. This is only safe because +- * we disallow gfxoff in begin_use() and then allow it again in end_use(). +- */ +- WREG32(sdma_v5_2_get_reg_offset(adev, ring->me, mmSDMA0_GFX_RB_WPTR), +- lower_32_bits(ring->wptr << 2)); +- WREG32(sdma_v5_2_get_reg_offset(adev, ring->me, mmSDMA0_GFX_RB_WPTR_HI), +- upper_32_bits(ring->wptr << 2)); ++ if (amdgpu_ip_version(adev, SDMA0_HWIP, 0) == IP_VERSION(5, 2, 1)) { ++ /* SDMA seems to miss doorbells sometimes when powergating kicks in. ++ * Updating the wptr directly will wake it. This is only safe because ++ * we disallow gfxoff in begin_use() and then allow it again in end_use(). ++ */ ++ WREG32(sdma_v5_2_get_reg_offset(adev, ring->me, mmSDMA0_GFX_RB_WPTR), ++ lower_32_bits(ring->wptr << 2)); ++ WREG32(sdma_v5_2_get_reg_offset(adev, ring->me, mmSDMA0_GFX_RB_WPTR_HI), ++ upper_32_bits(ring->wptr << 2)); ++ } + } else { + DRM_DEBUG("Not using doorbell -- " + "mmSDMA%i_GFX_RB_WPTR == 0x%08x " diff --git a/queue-6.6/drm-amdgpu-validate-ta-binary-size.patch b/queue-6.6/drm-amdgpu-validate-ta-binary-size.patch new file mode 100644 index 00000000000..d788bef01dc --- /dev/null +++ b/queue-6.6/drm-amdgpu-validate-ta-binary-size.patch @@ -0,0 +1,33 @@ +From c99769bceab4ecb6a067b9af11f9db281eea3e2a Mon Sep 17 00:00:00 2001 +From: Candice Li +Date: Thu, 15 Aug 2024 11:37:28 +0800 +Subject: drm/amdgpu: Validate TA binary size + +From: Candice Li + +commit c99769bceab4ecb6a067b9af11f9db281eea3e2a upstream. + +Add TA binary size validation to avoid OOB write. + +Signed-off-by: Candice Li +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +(cherry picked from commit c0a04e3570d72aaf090962156ad085e37c62e442) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c +@@ -166,6 +166,9 @@ static ssize_t ta_if_load_debugfs_write( + if (ret) + return -EFAULT; + ++ if (ta_bin_len > PSP_1_MEG) ++ return -EINVAL; ++ + copy_pos += sizeof(uint32_t); + + ta_bin = kzalloc(ta_bin_len, GFP_KERNEL); diff --git a/queue-6.6/hid-wacom-defer-calculation-of-resolution-until-resolution_code-is-known.patch b/queue-6.6/hid-wacom-defer-calculation-of-resolution-until-resolution_code-is-known.patch new file mode 100644 index 00000000000..f0cfb8814bc --- /dev/null +++ b/queue-6.6/hid-wacom-defer-calculation-of-resolution-until-resolution_code-is-known.patch @@ -0,0 +1,49 @@ +From 1b8f9c1fb464968a5b18d3acc1da8c00bad24fad Mon Sep 17 00:00:00 2001 +From: Jason Gerecke +Date: Tue, 30 Jul 2024 08:51:55 -0700 +Subject: HID: wacom: Defer calculation of resolution until resolution_code is known + +From: Jason Gerecke + +commit 1b8f9c1fb464968a5b18d3acc1da8c00bad24fad upstream. + +The Wacom driver maps the HID_DG_TWIST usage to ABS_Z (rather than ABS_RZ) +for historic reasons. When the code to support twist was introduced in +commit 50066a042da5 ("HID: wacom: generic: Add support for height, tilt, +and twist usages"), we were careful to write it in such a way that it had +HID calculate the resolution of the twist axis assuming ABS_RZ instead +(so that we would get correct angular behavior). This was broken with +the introduction of commit 08a46b4190d3 ("HID: wacom: Set a default +resolution for older tablets"), which moved the resolution calculation +to occur *before* the adjustment from ABS_Z to ABS_RZ occurred. + +This commit moves the calculation of resolution after the point that +we are finished setting things up for its proper use. + +Signed-off-by: Jason Gerecke +Fixes: 08a46b4190d3 ("HID: wacom: Set a default resolution for older tablets") +Cc: stable@vger.kernel.org +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/wacom_wac.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -1924,12 +1924,14 @@ static void wacom_map_usage(struct input + int fmax = field->logical_maximum; + unsigned int equivalent_usage = wacom_equivalent_usage(usage->hid); + int resolution_code = code; +- int resolution = hidinput_calc_abs_res(field, resolution_code); ++ int resolution; + + if (equivalent_usage == HID_DG_TWIST) { + resolution_code = ABS_RZ; + } + ++ resolution = hidinput_calc_abs_res(field, resolution_code); ++ + if (equivalent_usage == HID_GD_X) { + fmin += features->offset_left; + fmax -= features->offset_right; diff --git a/queue-6.6/ksmbd-the-buffer-of-smb2-query-dir-response-has-at-least-1-byte.patch b/queue-6.6/ksmbd-the-buffer-of-smb2-query-dir-response-has-at-least-1-byte.patch new file mode 100644 index 00000000000..e77961736bf --- /dev/null +++ b/queue-6.6/ksmbd-the-buffer-of-smb2-query-dir-response-has-at-least-1-byte.patch @@ -0,0 +1,35 @@ +From ce61b605a00502c59311d0a4b1f58d62b48272d0 Mon Sep 17 00:00:00 2001 +From: Namjae Jeon +Date: Tue, 20 Aug 2024 22:07:38 +0900 +Subject: ksmbd: the buffer of smb2 query dir response has at least 1 byte + +From: Namjae Jeon + +commit ce61b605a00502c59311d0a4b1f58d62b48272d0 upstream. + +When STATUS_NO_MORE_FILES status is set to smb2 query dir response, +->StructureSize is set to 9, which mean buffer has 1 byte. +This issue occurs because ->Buffer[1] in smb2_query_directory_rsp to +flex-array. + +Fixes: eb3e28c1e89b ("smb3: Replace smb2pdu 1-element arrays with flex-arrays") +Cc: stable@vger.kernel.org # v6.1+ +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/server/smb2pdu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -4406,7 +4406,8 @@ int smb2_query_dir(struct ksmbd_work *wo + rsp->OutputBufferLength = cpu_to_le32(0); + rsp->Buffer[0] = 0; + rc = ksmbd_iov_pin_rsp(work, (void *)rsp, +- sizeof(struct smb2_query_directory_rsp)); ++ offsetof(struct smb2_query_directory_rsp, Buffer) ++ + 1); + if (rc) + goto err_out; + } else { diff --git a/queue-6.6/mips-loongson64-set-timer-mode-in-cpu-probe.patch b/queue-6.6/mips-loongson64-set-timer-mode-in-cpu-probe.patch new file mode 100644 index 00000000000..99d9d9d5b68 --- /dev/null +++ b/queue-6.6/mips-loongson64-set-timer-mode-in-cpu-probe.patch @@ -0,0 +1,47 @@ +From 1cb6ab446424649f03c82334634360c2e3043684 Mon Sep 17 00:00:00 2001 +From: Jiaxun Yang +Date: Tue, 23 Jul 2024 17:15:44 +0800 +Subject: MIPS: Loongson64: Set timer mode in cpu-probe + +From: Jiaxun Yang + +commit 1cb6ab446424649f03c82334634360c2e3043684 upstream. + +Loongson64 C and G processors have EXTIMER feature which +is conflicting with CP0 counter. + +Although the processor resets in EXTIMER disabled & INTIMER +enabled mode, which is compatible with MIPS CP0 compare, firmware +may attempt to enable EXTIMER and interfere CP0 compare. + +Set timer mode back to MIPS compatible mode to fix booting on +systems with such firmware before we have an actual driver for +EXTIMER. + +Cc: stable@vger.kernel.org +Signed-off-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/kernel/cpu-probe.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/mips/kernel/cpu-probe.c ++++ b/arch/mips/kernel/cpu-probe.c +@@ -1725,12 +1725,16 @@ static inline void cpu_probe_loongson(st + c->ases |= (MIPS_ASE_LOONGSON_MMI | MIPS_ASE_LOONGSON_CAM | + MIPS_ASE_LOONGSON_EXT | MIPS_ASE_LOONGSON_EXT2); + c->ases &= ~MIPS_ASE_VZ; /* VZ of Loongson-3A2000/3000 is incomplete */ ++ change_c0_config6(LOONGSON_CONF6_EXTIMER | LOONGSON_CONF6_INTIMER, ++ LOONGSON_CONF6_INTIMER); + break; + case PRID_IMP_LOONGSON_64G: + __cpu_name[cpu] = "ICT Loongson-3"; + set_elf_platform(cpu, "loongson3a"); + set_isa(c, MIPS_CPU_ISA_M64R2); + decode_cpucfg(c); ++ change_c0_config6(LOONGSON_CONF6_EXTIMER | LOONGSON_CONF6_INTIMER, ++ LOONGSON_CONF6_INTIMER); + break; + default: + panic("Unknown Loongson Processor ID!"); diff --git a/queue-6.6/net-dsa-microchip-fix-ptp-config-failure-when-using-multiple-ports.patch b/queue-6.6/net-dsa-microchip-fix-ptp-config-failure-when-using-multiple-ports.patch new file mode 100644 index 00000000000..f0d2a4fa337 --- /dev/null +++ b/queue-6.6/net-dsa-microchip-fix-ptp-config-failure-when-using-multiple-ports.patch @@ -0,0 +1,55 @@ +From 6efea5135417ae8194485d1d05ea79a21cf1a11c Mon Sep 17 00:00:00 2001 +From: Martin Whitaker +Date: Sat, 17 Aug 2024 10:41:41 +0100 +Subject: net: dsa: microchip: fix PTP config failure when using multiple ports + +From: Martin Whitaker + +commit 6efea5135417ae8194485d1d05ea79a21cf1a11c upstream. + +When performing the port_hwtstamp_set operation, ptp_schedule_worker() +will be called if hardware timestamoing is enabled on any of the ports. +When using multiple ports for PTP, port_hwtstamp_set is executed for +each port. When called for the first time ptp_schedule_worker() returns +0. On subsequent calls it returns 1, indicating the worker is already +scheduled. Currently the ksz driver treats 1 as an error and fails to +complete the port_hwtstamp_set operation, thus leaving the timestamping +configuration for those ports unchanged. + +This patch fixes this by ignoring the ptp_schedule_worker() return +value. + +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/7aae307a-35ca-4209-a850-7b2749d40f90@martin-whitaker.me.uk +Fixes: bb01ad30570b0 ("net: dsa: microchip: ptp: manipulating absolute time using ptp hw clock") +Signed-off-by: Martin Whitaker +Reviewed-by: Andrew Lunn +Acked-by: Arun Ramadoss +Link: https://patch.msgid.link/20240817094141.3332-1-foss@martin-whitaker.me.uk +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/microchip/ksz_ptp.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/drivers/net/dsa/microchip/ksz_ptp.c ++++ b/drivers/net/dsa/microchip/ksz_ptp.c +@@ -266,7 +266,6 @@ static int ksz_ptp_enable_mode(struct ks + struct ksz_port *prt; + struct dsa_port *dp; + bool tag_en = false; +- int ret; + + dsa_switch_for_each_user_port(dp, dev->ds) { + prt = &dev->ports[dp->index]; +@@ -277,9 +276,7 @@ static int ksz_ptp_enable_mode(struct ks + } + + if (tag_en) { +- ret = ptp_schedule_worker(ptp_data->clock, 0); +- if (ret) +- return ret; ++ ptp_schedule_worker(ptp_data->clock, 0); + } else { + ptp_cancel_worker_sync(ptp_data->clock); + } diff --git a/queue-6.6/scsi-core-fix-the-return-value-of-scsi_logical_block_count.patch b/queue-6.6/scsi-core-fix-the-return-value-of-scsi_logical_block_count.patch new file mode 100644 index 00000000000..ede5b972835 --- /dev/null +++ b/queue-6.6/scsi-core-fix-the-return-value-of-scsi_logical_block_count.patch @@ -0,0 +1,36 @@ +From f03e94f23b04c2b71c0044c1534921b3975ef10c Mon Sep 17 00:00:00 2001 +From: Chaotian Jing +Date: Tue, 13 Aug 2024 13:34:10 +0800 +Subject: scsi: core: Fix the return value of scsi_logical_block_count() + +From: Chaotian Jing + +commit f03e94f23b04c2b71c0044c1534921b3975ef10c upstream. + +scsi_logical_block_count() should return the block count of a given SCSI +command. The original implementation ended up shifting twice, leading to an +incorrect count being returned. Fix the conversion between bytes and +logical blocks. + +Cc: stable@vger.kernel.org +Fixes: 6a20e21ae1e2 ("scsi: core: Add helper to return number of logical blocks in a request") +Signed-off-by: Chaotian Jing +Link: https://lore.kernel.org/r/20240813053534.7720-1-chaotian.jing@mediatek.com +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + include/scsi/scsi_cmnd.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/scsi/scsi_cmnd.h ++++ b/include/scsi/scsi_cmnd.h +@@ -234,7 +234,7 @@ static inline sector_t scsi_get_lba(stru + + static inline unsigned int scsi_logical_block_count(struct scsi_cmnd *scmd) + { +- unsigned int shift = ilog2(scmd->device->sector_size) - SECTOR_SHIFT; ++ unsigned int shift = ilog2(scmd->device->sector_size); + + return blk_rq_bytes(scsi_cmd_to_rq(scmd)) >> shift; + } diff --git a/queue-6.6/series b/queue-6.6/series index f7ccae29ed1..7d75b5c8dff 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -292,3 +292,10 @@ drm-msm-fix-the-highest_bank_bit-for-sc7180.patch mmc-mmc_test-fix-null-dereference-on-allocation-fail.patch smb-client-ignore-unhandled-reparse-tags.patch bluetooth-mgmt-add-error-handling-to-pair_device.patch +scsi-core-fix-the-return-value-of-scsi_logical_block_count.patch +ksmbd-the-buffer-of-smb2-query-dir-response-has-at-least-1-byte.patch +drm-amdgpu-validate-ta-binary-size.patch +drm-amdgpu-sdma5.2-limit-wptr-workaround-to-sdma-5.2.1.patch +net-dsa-microchip-fix-ptp-config-failure-when-using-multiple-ports.patch +mips-loongson64-set-timer-mode-in-cpu-probe.patch +hid-wacom-defer-calculation-of-resolution-until-resolution_code-is-known.patch