From: Greg Kroah-Hartman Date: Fri, 24 Nov 2023 16:44:24 +0000 (+0000) Subject: 5.15-stable patches X-Git-Tag: v4.14.331~20 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c1eca27ab921353da21bef4e53395970f1f4b14e;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: driver-core-release-all-resources-during-unbind-before-updating-device-links.patch --- diff --git a/queue-5.15/driver-core-add-dma_cleanup-callback-in-bus_type.patch b/queue-5.15/driver-core-add-dma_cleanup-callback-in-bus_type.patch deleted file mode 100644 index 050f10616ad..00000000000 --- a/queue-5.15/driver-core-add-dma_cleanup-callback-in-bus_type.patch +++ /dev/null @@ -1,89 +0,0 @@ -From e19e821c42d0f37d64153517b29687d3819dc188 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 18 Apr 2022 08:49:51 +0800 -Subject: driver core: Add dma_cleanup callback in bus_type - -From: Lu Baolu - -[ Upstream commit 25f3bcfc54bcf7b0e45d140ec8bfbbf10ba11869 ] - -The bus_type structure defines dma_configure() callback for bus drivers -to configure DMA on the devices. This adds the paired dma_cleanup() -callback and calls it during driver unbinding so that bus drivers can do -some cleanup work. - -One use case for this paired DMA callbacks is for the bus driver to check -for DMA ownership conflicts during driver binding, where multiple devices -belonging to a same IOMMU group (the minimum granularity of isolation and -protection) may be assigned to kernel drivers or user space respectively. - -Without this change, for example, the vfio driver has to listen to a bus -BOUND_DRIVER event and then BUG_ON() in case of dma ownership conflict. -This leads to bad user experience since careless driver binding operation -may crash the system if the admin overlooks the group restriction. Aside -from bad design, this leads to a security problem as a root user, even with -lockdown=integrity, can force the kernel to BUG. - -With this change, the bus driver could check and set the DMA ownership in -driver binding process and fail on ownership conflicts. The DMA ownership -should be released during driver unbinding. - -Signed-off-by: Lu Baolu -Reviewed-by: Greg Kroah-Hartman -Reviewed-by: Jason Gunthorpe -Link: https://lore.kernel.org/r/20220418005000.897664-3-baolu.lu@linux.intel.com -Signed-off-by: Joerg Roedel -Stable-dep-of: 2e84dc379200 ("driver core: Release all resources during unbind before updating device links") -Signed-off-by: Sasha Levin ---- - drivers/base/dd.c | 5 +++++ - include/linux/device/bus.h | 3 +++ - 2 files changed, 8 insertions(+) - -diff --git a/drivers/base/dd.c b/drivers/base/dd.c -index 81683c99d6293..394ef41d732a9 100644 ---- a/drivers/base/dd.c -+++ b/drivers/base/dd.c -@@ -669,6 +669,8 @@ static int really_probe(struct device *dev, struct device_driver *drv) - if (dev->bus) - blocking_notifier_call_chain(&dev->bus->p->bus_notifier, - BUS_NOTIFY_DRIVER_NOT_BOUND, dev); -+ if (dev->bus && dev->bus->dma_cleanup) -+ dev->bus->dma_cleanup(dev); - pinctrl_bind_failed: - device_links_no_driver(dev); - device_unbind_cleanup(dev); -@@ -1225,6 +1227,9 @@ static void __device_release_driver(struct device *dev, struct device *parent) - else if (drv->remove) - drv->remove(dev); - -+ if (dev->bus && dev->bus->dma_cleanup) -+ dev->bus->dma_cleanup(dev); -+ - device_links_driver_cleanup(dev); - device_unbind_cleanup(dev); - -diff --git a/include/linux/device/bus.h b/include/linux/device/bus.h -index 062777a45a74d..a52a6fe39eec9 100644 ---- a/include/linux/device/bus.h -+++ b/include/linux/device/bus.h -@@ -59,6 +59,8 @@ struct fwnode_handle; - * bus supports. - * @dma_configure: Called to setup DMA configuration on a device on - * this bus. -+ * @dma_cleanup: Called to cleanup DMA configuration on a device on -+ * this bus. - * @pm: Power management operations of this bus, callback the specific - * device driver's pm-ops. - * @iommu_ops: IOMMU specific operations for this bus, used to attach IOMMU -@@ -103,6 +105,7 @@ struct bus_type { - int (*num_vf)(struct device *dev); - - int (*dma_configure)(struct device *dev); -+ void (*dma_cleanup)(struct device *dev); - - const struct dev_pm_ops *pm; - --- -2.42.0 - diff --git a/queue-5.15/driver-core-move-driver_sysfs_remove-after-driver_sy.patch b/queue-5.15/driver-core-move-driver_sysfs_remove-after-driver_sy.patch deleted file mode 100644 index b325ea67416..00000000000 --- a/queue-5.15/driver-core-move-driver_sysfs_remove-after-driver_sy.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 1e0d9ee2546f9ee4faf204e4e944f24773e472ac Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 31 Dec 2021 11:39:00 +0800 -Subject: driver core: Move driver_sysfs_remove() after driver_sysfs_add() - -From: Lu Baolu - -[ Upstream commit 885e50253bfd6750327a265405461496d6af1639 ] - -The driver_sysfs_remove() should be called after driver_sysfs_add() in -really_probe(). The out-of-order driver_sysfs_remove() tries to remove -some nonexistent nodes under the device and driver sysfs nodes. This is -allowed, hence this change doesn't fix any problem, just a cleanup. - -Signed-off-by: Lu Baolu -Link: https://lore.kernel.org/r/20211231033901.2168664-2-baolu.lu@linux.intel.com -Signed-off-by: Greg Kroah-Hartman -Stable-dep-of: 2e84dc379200 ("driver core: Release all resources during unbind before updating device links") -Signed-off-by: Sasha Levin ---- - drivers/base/dd.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/drivers/base/dd.c b/drivers/base/dd.c -index ab0b2eb5fa07f..f5371daf4fd29 100644 ---- a/drivers/base/dd.c -+++ b/drivers/base/dd.c -@@ -576,14 +576,14 @@ static int really_probe(struct device *dev, struct device_driver *drv) - if (dev->bus->dma_configure) { - ret = dev->bus->dma_configure(dev); - if (ret) -- goto probe_failed; -+ goto sysfs_failed; - } - - ret = driver_sysfs_add(dev); - if (ret) { - pr_err("%s: driver_sysfs_add(%s) failed\n", - __func__, dev_name(dev)); -- goto probe_failed; -+ goto sysfs_failed; - } - - if (dev->pm_domain && dev->pm_domain->activate) { -@@ -659,6 +659,8 @@ static int really_probe(struct device *dev, struct device_driver *drv) - else if (drv->remove) - drv->remove(dev); - probe_failed: -+ driver_sysfs_remove(dev); -+sysfs_failed: - if (dev->bus) - blocking_notifier_call_chain(&dev->bus->p->bus_notifier, - BUS_NOTIFY_DRIVER_NOT_BOUND, dev); -@@ -668,7 +670,6 @@ static int really_probe(struct device *dev, struct device_driver *drv) - arch_teardown_dma_ops(dev); - kfree(dev->dma_range_map); - dev->dma_range_map = NULL; -- driver_sysfs_remove(dev); - dev->driver = NULL; - dev_set_drvdata(dev, NULL); - if (dev->pm_domain && dev->pm_domain->dismiss) --- -2.42.0 - diff --git a/queue-5.15/driver-core-refactor-multiple-copies-of-device-clean.patch b/queue-5.15/driver-core-refactor-multiple-copies-of-device-clean.patch deleted file mode 100644 index 916988be110..00000000000 --- a/queue-5.15/driver-core-refactor-multiple-copies-of-device-clean.patch +++ /dev/null @@ -1,108 +0,0 @@ -From 7026884fd91f17a98191dca0a3b00cce394226d4 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 23 Feb 2022 16:52:56 -0600 -Subject: driver core: Refactor multiple copies of device cleanup - -From: Rob Herring - -[ Upstream commit 9ad307213fa4081f4bc2f2daa31d4f2d35d7a213 ] - -There are 3 copies of the same device cleanup code used for probe failure, -testing re-probing, and device unbinding. Changes to this code often miss -at least one of the copies of the code. See commits d0243bbd5dd3 ("drivers -core: Free dma_range_map when driver probe failed") and d8f7a5484f21 -("driver core: Free DMA range map when device is released") for example. - -Let's refactor the code to its own function. - -Signed-off-by: Rob Herring -Link: https://lore.kernel.org/r/20220223225257.1681968-2-robh@kernel.org -Signed-off-by: Greg Kroah-Hartman -Stable-dep-of: 2e84dc379200 ("driver core: Release all resources during unbind before updating device links") -Signed-off-by: Sasha Levin ---- - drivers/base/dd.c | 46 ++++++++++++++++------------------------------ - 1 file changed, 16 insertions(+), 30 deletions(-) - -diff --git a/drivers/base/dd.c b/drivers/base/dd.c -index f5371daf4fd29..81683c99d6293 100644 ---- a/drivers/base/dd.c -+++ b/drivers/base/dd.c -@@ -505,6 +505,19 @@ static ssize_t state_synced_show(struct device *dev, - } - static DEVICE_ATTR_RO(state_synced); - -+static void device_unbind_cleanup(struct device *dev) -+{ -+ devres_release_all(dev); -+ arch_teardown_dma_ops(dev); -+ kfree(dev->dma_range_map); -+ dev->dma_range_map = NULL; -+ dev->driver = NULL; -+ dev_set_drvdata(dev, NULL); -+ if (dev->pm_domain && dev->pm_domain->dismiss) -+ dev->pm_domain->dismiss(dev); -+ pm_runtime_reinit(dev); -+ dev_pm_set_driver_flags(dev, 0); -+} - - static int call_driver_probe(struct device *dev, struct device_driver *drv) - { -@@ -627,16 +640,8 @@ static int really_probe(struct device *dev, struct device_driver *drv) - else if (drv->remove) - drv->remove(dev); - -- devres_release_all(dev); -- arch_teardown_dma_ops(dev); -- kfree(dev->dma_range_map); -- dev->dma_range_map = NULL; - driver_sysfs_remove(dev); -- dev->driver = NULL; -- dev_set_drvdata(dev, NULL); -- if (dev->pm_domain && dev->pm_domain->dismiss) -- dev->pm_domain->dismiss(dev); -- pm_runtime_reinit(dev); -+ device_unbind_cleanup(dev); - - goto re_probe; - } -@@ -666,16 +671,7 @@ static int really_probe(struct device *dev, struct device_driver *drv) - BUS_NOTIFY_DRIVER_NOT_BOUND, dev); - pinctrl_bind_failed: - device_links_no_driver(dev); -- devres_release_all(dev); -- arch_teardown_dma_ops(dev); -- kfree(dev->dma_range_map); -- dev->dma_range_map = NULL; -- dev->driver = NULL; -- dev_set_drvdata(dev, NULL); -- if (dev->pm_domain && dev->pm_domain->dismiss) -- dev->pm_domain->dismiss(dev); -- pm_runtime_reinit(dev); -- dev_pm_set_driver_flags(dev, 0); -+ device_unbind_cleanup(dev); - done: - return ret; - } -@@ -1230,17 +1226,7 @@ static void __device_release_driver(struct device *dev, struct device *parent) - drv->remove(dev); - - device_links_driver_cleanup(dev); -- -- devres_release_all(dev); -- arch_teardown_dma_ops(dev); -- kfree(dev->dma_range_map); -- dev->dma_range_map = NULL; -- dev->driver = NULL; -- dev_set_drvdata(dev, NULL); -- if (dev->pm_domain && dev->pm_domain->dismiss) -- dev->pm_domain->dismiss(dev); -- pm_runtime_reinit(dev); -- dev_pm_set_driver_flags(dev, 0); -+ device_unbind_cleanup(dev); - - klist_remove(&dev->p->knode_driver); - device_pm_check_callbacks(dev); --- -2.42.0 - diff --git a/queue-5.15/driver-core-release-all-resources-during-unbind-befo.patch b/queue-5.15/driver-core-release-all-resources-during-unbind-before-updating-device-links.patch similarity index 69% rename from queue-5.15/driver-core-release-all-resources-during-unbind-befo.patch rename to queue-5.15/driver-core-release-all-resources-during-unbind-before-updating-device-links.patch index b8870474da0..4d2a167fd7c 100644 --- a/queue-5.15/driver-core-release-all-resources-during-unbind-befo.patch +++ b/queue-5.15/driver-core-release-all-resources-during-unbind-before-updating-device-links.patch @@ -1,15 +1,14 @@ -From 5ed42eeb1f404d6f001d14a3b0351142aae3119c Mon Sep 17 00:00:00 2001 -From: Sasha Levin +From 2e84dc37920012b458e9458b19fc4ed33f81bc74 Mon Sep 17 00:00:00 2001 +From: Saravana Kannan Date: Tue, 17 Oct 2023 18:38:50 -0700 -Subject: driver core: Release all resources during unbind before updating - device links +Subject: driver core: Release all resources during unbind before updating device links MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Saravana Kannan -[ Upstream commit 2e84dc37920012b458e9458b19fc4ed33f81bc74 ] +commit 2e84dc37920012b458e9458b19fc4ed33f81bc74 upstream. This commit fixes a bug in commit 9ed9895370ae ("driver core: Functional dependencies tracking support") where the device link status was @@ -31,26 +30,29 @@ Acked-by: "Rafael J. Wysocki" Tested-by: Uwe Kleine-König Acked-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20231018013851.3303928-1-saravanak@google.com +Signed-off-by: Uwe Kleine-König Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Sasha Levin --- - drivers/base/dd.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) + drivers/base/dd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) -diff --git a/drivers/base/dd.c b/drivers/base/dd.c -index 394ef41d732a9..5f521def6b7c0 100644 --- a/drivers/base/dd.c +++ b/drivers/base/dd.c -@@ -1230,8 +1230,8 @@ static void __device_release_driver(struct device *dev, struct device *parent) - if (dev->bus && dev->bus->dma_cleanup) - dev->bus->dma_cleanup(dev); +@@ -1228,8 +1228,6 @@ static void __device_release_driver(stru + else if (drv->remove) + drv->remove(dev); - device_links_driver_cleanup(dev); - device_unbind_cleanup(dev); -+ device_links_driver_cleanup(dev); +- + devres_release_all(dev); + arch_teardown_dma_ops(dev); + kfree(dev->dma_range_map); +@@ -1241,6 +1239,8 @@ static void __device_release_driver(stru + pm_runtime_reinit(dev); + dev_pm_set_driver_flags(dev, 0); ++ device_links_driver_cleanup(dev); ++ klist_remove(&dev->p->knode_driver); device_pm_check_callbacks(dev); --- -2.42.0 - + if (dev->bus) diff --git a/queue-5.15/series b/queue-5.15/series index bc80bdf2bb8..de75fe53457 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -252,10 +252,6 @@ bluetooth-btusb-add-0bda-b85b-for-fn-link-rtl8852be.patch ksmbd-fix-slab-out-of-bounds-write-in-smb_inherit_da.patch arm64-dts-qcom-ipq6018-switch-tcsr-mutex-to-mmio.patch arm64-dts-qcom-ipq6018-fix-tcsr_mutex-register-size.patch -driver-core-move-driver_sysfs_remove-after-driver_sy.patch -driver-core-refactor-multiple-copies-of-device-clean.patch -driver-core-add-dma_cleanup-callback-in-bus_type.patch -driver-core-release-all-resources-during-unbind-befo.patch powerpc-pseries-ddw-simplify-enable_ddw.patch powerpc-pseries-iommu-enable_ddw-incorrectly-returns.patch revert-ncsi-propagate-carrier-gain-loss-events-to-the-ncsi-controller.patch @@ -303,3 +299,4 @@ io_uring-fdinfo-lock-sq-thread-while-retrieving-thread-cpu-pid.patch powerpc-powernv-fix-fortify-source-warnings-in-opal-prd.c.patch tracing-have-trace_event_file-have-ref-counters.patch input-xpad-add-vid-for-turtle-beach-controllers.patch +driver-core-release-all-resources-during-unbind-before-updating-device-links.patch