From: Sasha Levin Date: Sun, 1 Sep 2024 11:25:51 +0000 (-0400) Subject: Fixes for 6.10 X-Git-Tag: v4.19.321~16 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c3733ccc0f4b36fcec64990e1262413120abe9c0;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.10 Signed-off-by: Sasha Levin --- diff --git a/queue-6.10/apparmor-fix-policy_unpack_test-on-big-endian-system.patch b/queue-6.10/apparmor-fix-policy_unpack_test-on-big-endian-system.patch new file mode 100644 index 00000000000..fed910d14c0 --- /dev/null +++ b/queue-6.10/apparmor-fix-policy_unpack_test-on-big-endian-system.patch @@ -0,0 +1,69 @@ +From f5d435fe1786060ffd9ec336063376b09d705e18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2024 08:50:03 -0700 +Subject: apparmor: fix policy_unpack_test on big endian systems + +From: Guenter Roeck + +[ Upstream commit 98c0cc48e27e9d269a3e4db2acd72b486c88ec77 ] + +policy_unpack_test fails on big endian systems because data byte order +is expected to be little endian but is generated in host byte order. +This results in test failures such as: + + # policy_unpack_test_unpack_array_with_null_name: EXPECTATION FAILED at security/apparmor/policy_unpack_test.c:150 + Expected array_size == (u16)16, but + array_size == 4096 (0x1000) + (u16)16 == 16 (0x10) + # policy_unpack_test_unpack_array_with_null_name: pass:0 fail:1 skip:0 total:1 + not ok 3 policy_unpack_test_unpack_array_with_null_name + # policy_unpack_test_unpack_array_with_name: EXPECTATION FAILED at security/apparmor/policy_unpack_test.c:164 + Expected array_size == (u16)16, but + array_size == 4096 (0x1000) + (u16)16 == 16 (0x10) + # policy_unpack_test_unpack_array_with_name: pass:0 fail:1 skip:0 total:1 + +Add the missing endianness conversions when generating test data. + +Fixes: 4d944bcd4e73 ("apparmor: add AppArmor KUnit tests for policy unpack") +Cc: Brendan Higgins +Cc: Kees Cook +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + security/apparmor/policy_unpack_test.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/security/apparmor/policy_unpack_test.c b/security/apparmor/policy_unpack_test.c +index 5c9bde25e56df..2b8003eb4f463 100644 +--- a/security/apparmor/policy_unpack_test.c ++++ b/security/apparmor/policy_unpack_test.c +@@ -80,14 +80,14 @@ static struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf, + *(buf + 1) = strlen(TEST_U32_NAME) + 1; + strscpy(buf + 3, TEST_U32_NAME, e->end - (void *)(buf + 3)); + *(buf + 3 + strlen(TEST_U32_NAME) + 1) = AA_U32; +- *((u32 *)(buf + 3 + strlen(TEST_U32_NAME) + 2)) = TEST_U32_DATA; ++ *((__le32 *)(buf + 3 + strlen(TEST_U32_NAME) + 2)) = cpu_to_le32(TEST_U32_DATA); + + buf = e->start + TEST_NAMED_U64_BUF_OFFSET; + *buf = AA_NAME; + *(buf + 1) = strlen(TEST_U64_NAME) + 1; + strscpy(buf + 3, TEST_U64_NAME, e->end - (void *)(buf + 3)); + *(buf + 3 + strlen(TEST_U64_NAME) + 1) = AA_U64; +- *((u64 *)(buf + 3 + strlen(TEST_U64_NAME) + 2)) = TEST_U64_DATA; ++ *((__le64 *)(buf + 3 + strlen(TEST_U64_NAME) + 2)) = cpu_to_le64(TEST_U64_DATA); + + buf = e->start + TEST_NAMED_BLOB_BUF_OFFSET; + *buf = AA_NAME; +@@ -103,7 +103,7 @@ static struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf, + *(buf + 1) = strlen(TEST_ARRAY_NAME) + 1; + strscpy(buf + 3, TEST_ARRAY_NAME, e->end - (void *)(buf + 3)); + *(buf + 3 + strlen(TEST_ARRAY_NAME) + 1) = AA_ARRAY; +- *((u16 *)(buf + 3 + strlen(TEST_ARRAY_NAME) + 2)) = TEST_ARRAY_SIZE; ++ *((__le16 *)(buf + 3 + strlen(TEST_ARRAY_NAME) + 2)) = cpu_to_le16(TEST_ARRAY_SIZE); + + return e; + } +-- +2.43.0 + diff --git a/queue-6.10/arm-dts-omap3-n900-correct-the-accelerometer-orienta.patch b/queue-6.10/arm-dts-omap3-n900-correct-the-accelerometer-orienta.patch new file mode 100644 index 00000000000..5fb417beb58 --- /dev/null +++ b/queue-6.10/arm-dts-omap3-n900-correct-the-accelerometer-orienta.patch @@ -0,0 +1,39 @@ +From 1ae73bb96d6bacfeb3dbdbc2225757125bfccf69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jul 2024 13:31:11 +0200 +Subject: ARM: dts: omap3-n900: correct the accelerometer orientation + +From: Sicelo A. Mhlongo + +[ Upstream commit 5062d9c0cbbc202e495e9b20f147f64ef5cc2897 ] + +Negate the values reported for the accelerometer z-axis in order to +match Documentation/devicetree/bindings/iio/mount-matrix.txt. + +Fixes: 14a213dcb004 ("ARM: dts: n900: use iio driver for accelerometer") + +Signed-off-by: Sicelo A. Mhlongo +Reviewed-By: Andreas Kemnade +Link: https://lore.kernel.org/r/20240722113137.3240847-1-absicsz@gmail.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ti/omap/omap3-n900.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/ti/omap/omap3-n900.dts b/arch/arm/boot/dts/ti/omap/omap3-n900.dts +index 07c5b963af78a..4bde3342bb959 100644 +--- a/arch/arm/boot/dts/ti/omap/omap3-n900.dts ++++ b/arch/arm/boot/dts/ti/omap/omap3-n900.dts +@@ -781,7 +781,7 @@ + + mount-matrix = "-1", "0", "0", + "0", "1", "0", +- "0", "0", "1"; ++ "0", "0", "-1"; + }; + + cam1: camera@3e { +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-freescale-imx93-tqma9352-fix-cma-alloc-ran.patch b/queue-6.10/arm64-dts-freescale-imx93-tqma9352-fix-cma-alloc-ran.patch new file mode 100644 index 00000000000..9e8ba2bde49 --- /dev/null +++ b/queue-6.10/arm64-dts-freescale-imx93-tqma9352-fix-cma-alloc-ran.patch @@ -0,0 +1,37 @@ +From 1a235795507b2ad9d522bf8b68726779817cca79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jul 2024 14:58:48 +0200 +Subject: arm64: dts: freescale: imx93-tqma9352: fix CMA alloc-ranges + +From: Markus Niebel + +[ Upstream commit cd0c6872aab4d2c556a5e953e6926a1b4485e543 ] + +DRAM starts at 0x80000000. + +Fixes: c982ecfa7992 ("arm64: dts: freescale: add initial device tree for MBa93xxLA SBC board") +Signed-off-by: Markus Niebel +Signed-off-by: Alexander Stein +Reviewed-by: Peng Fan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi b/arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi +index 9d2328c185c90..fe951f86a96bd 100644 +--- a/arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi +@@ -19,7 +19,7 @@ + linux,cma { + compatible = "shared-dma-pool"; + reusable; +- alloc-ranges = <0 0x60000000 0 0x40000000>; ++ alloc-ranges = <0 0x80000000 0 0x40000000>; + size = <0 0x10000000>; + linux,cma-default; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-freescale-imx93-tqma9352-mba93xxla-fix-typ.patch b/queue-6.10/arm64-dts-freescale-imx93-tqma9352-mba93xxla-fix-typ.patch new file mode 100644 index 00000000000..7e138d18611 --- /dev/null +++ b/queue-6.10/arm64-dts-freescale-imx93-tqma9352-mba93xxla-fix-typ.patch @@ -0,0 +1,36 @@ +From 7dcd5e296bc1e4a357cc86d34f0caf79a140cde4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jul 2024 14:58:52 +0200 +Subject: arm64: dts: freescale: imx93-tqma9352-mba93xxla: fix typo + +From: Markus Niebel + +[ Upstream commit 5f0a894bfa3c26ce61deda4c52b12e8ec84d876a ] + +Fix typo in assignment of SD-Card cd-gpios. + +Fixes: c982ecfa7992 ("arm64: dts: freescale: add initial device tree for MBa93xxLA SBC board") +Signed-off-by: Markus Niebel +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts b/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts +index eb3f4cfb69863..ad77a96c5617b 100644 +--- a/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts ++++ b/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts +@@ -438,7 +438,7 @@ + pinctrl-0 = <&pinctrl_usdhc2_hs>, <&pinctrl_usdhc2_gpio>; + pinctrl-1 = <&pinctrl_usdhc2_uhs>, <&pinctrl_usdhc2_gpio>; + pinctrl-2 = <&pinctrl_usdhc2_uhs>, <&pinctrl_usdhc2_gpio>; +- cd-gpios = <&gpio3 00 GPIO_ACTIVE_LOW>; ++ cd-gpios = <&gpio3 0 GPIO_ACTIVE_LOW>; + vmmc-supply = <®_usdhc2_vmmc>; + bus-width = <4>; + no-sdio; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-imx8mp-beacon-kit-fix-stereo-audio-on-wm89.patch b/queue-6.10/arm64-dts-imx8mp-beacon-kit-fix-stereo-audio-on-wm89.patch new file mode 100644 index 00000000000..c509042bb02 --- /dev/null +++ b/queue-6.10/arm64-dts-imx8mp-beacon-kit-fix-stereo-audio-on-wm89.patch @@ -0,0 +1,61 @@ +From 5ac4763129c94dfcd01a14843079ec78f19800d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jul 2024 12:20:17 -0500 +Subject: arm64: dts: imx8mp-beacon-kit: Fix Stereo Audio on WM8962 + +From: Adam Ford + +[ Upstream commit 4e69cd835a2d5c3915838491f59a68ee697a87d0 ] + +The L/R clock needs to be controlled by the SAI3 instead of the +CODEC to properly achieve stereo sound. Doing this allows removes +the need for unnecessary clock manipulation to try to get the +CODEC's clock in sync with the SAI3 clock, since the CODEC can cope +with a wide variety of clock inputs. + +Fixes: 161af16c18f3 ("arm64: dts: imx8mp-beacon-kit: Fix audio_pll2 clock") +Fixes: 69e2f37a6ddc ("arm64: dts: imx8mp-beacon-kit: Enable WM8962 Audio CODEC") +Signed-off-by: Adam Ford +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts b/arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts +index e5d3901f29136..e1f59bdcae497 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts +@@ -211,13 +211,12 @@ + + simple-audio-card,cpu { + sound-dai = <&sai3>; ++ frame-master; ++ bitclock-master; + }; + + simple-audio-card,codec { + sound-dai = <&wm8962>; +- clocks = <&clk IMX8MP_CLK_IPP_DO_CLKO1>; +- frame-master; +- bitclock-master; + }; + }; + }; +@@ -499,10 +498,9 @@ + &sai3 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_sai3>; +- assigned-clocks = <&clk IMX8MP_CLK_SAI3>, +- <&clk IMX8MP_AUDIO_PLL2> ; +- assigned-clock-parents = <&clk IMX8MP_AUDIO_PLL2_OUT>; +- assigned-clock-rates = <12288000>, <361267200>; ++ assigned-clocks = <&clk IMX8MP_CLK_SAI3>; ++ assigned-clock-parents = <&clk IMX8MP_AUDIO_PLL1_OUT>; ++ assigned-clock-rates = <12288000>; + fsl,sai-mclk-direction-output; + status = "okay"; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-imx93-update-default-value-for-snps-clk-cs.patch b/queue-6.10/arm64-dts-imx93-update-default-value-for-snps-clk-cs.patch new file mode 100644 index 00000000000..2773330ec4b --- /dev/null +++ b/queue-6.10/arm64-dts-imx93-update-default-value-for-snps-clk-cs.patch @@ -0,0 +1,46 @@ +From 8d18bac23f34ea3c7f9baaa60ec3df6546ba158c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 08:17:22 -0500 +Subject: arm64: dts: imx93: update default value for snps,clk-csr + +From: Shenwei Wang + +[ Upstream commit 109f256285dd6a5f8c3bd0d80d39b2ccd4fe314e ] + +For the i.MX93 SoC, the default clock rate for the IP of STMMAC EQOS is +312.5 MHz. According to the following mapping table from the i.MX93 +reference manual, this clock rate corresponds to a CSR value of 6. + + 0000: CSR clock = 60-100 MHz; MDC clock = CSR clock/42 + 0001: CSR clock = 100-150 MHz; MDC clock = CSR clock/62 + 0010: CSR clock = 20-35 MHz; MDC clock = CSR clock/16 + 0011: CSR clock = 35-60 MHz; MDC clock = CSR clock/26 + 0100: CSR clock = 150-250 MHz; MDC clock = CSR clock/102 + 0101: CSR clock = 250-300 MHz; MDC clock = CSR clock/124 + 0110: CSR clock = 300-500 MHz; MDC clock = CSR clock/204 + 0111: CSR clock = 500-800 MHz; MDC clock = CSR clock/324 + +Fixes: f2d03ba997cb ("arm64: dts: imx93: reorder device nodes") +Signed-off-by: Shenwei Wang +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx93.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx93.dtsi b/arch/arm64/boot/dts/freescale/imx93.dtsi +index 4a3f42355cb8f..a0993022c102d 100644 +--- a/arch/arm64/boot/dts/freescale/imx93.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx93.dtsi +@@ -1105,7 +1105,7 @@ + <&clk IMX93_CLK_SYS_PLL_PFD0_DIV2>; + assigned-clock-rates = <100000000>, <250000000>; + intf_mode = <&wakeupmix_gpr 0x28>; +- snps,clk-csr = <0>; ++ snps,clk-csr = <6>; + nvmem-cells = <ð_mac2>; + nvmem-cell-names = "mac-address"; + status = "disabled"; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-ipq5332-fix-interrupt-trigger-type-fo.patch b/queue-6.10/arm64-dts-qcom-ipq5332-fix-interrupt-trigger-type-fo.patch new file mode 100644 index 00000000000..ec28c3ef710 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-ipq5332-fix-interrupt-trigger-type-fo.patch @@ -0,0 +1,41 @@ +From 511f79557fa244e0e90a2231f945a75ed0ba6d1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jul 2024 15:31:51 +0530 +Subject: arm64: dts: qcom: ipq5332: Fix interrupt trigger type for usb + +From: Varadarajan Narayanan + +[ Upstream commit 60a76f7826b88ebf7697a56fdcd9596b23c2b616 ] + +Trigger type is incorrectly specified as IRQ_TYPE_EDGE_BOTH +instead of IRQ_TYPE_LEVEL_HIGH. This trigger type is not +supported for SPIs and results in probe failure with -EINVAL. + +Reviewed-by: Konrad Dybcio +Fixes: 927173bf8a0e ("arm64: dts: qcom: Add missing interrupts for qcs404/ipq5332") +Signed-off-by: Varadarajan Narayanan +Link: https://lore.kernel.org/r/20240723100151.402300-3-quic_varada@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq5332.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq5332.dtsi b/arch/arm64/boot/dts/qcom/ipq5332.dtsi +index 770d9c2fb4562..e3064568f0221 100644 +--- a/arch/arm64/boot/dts/qcom/ipq5332.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq5332.dtsi +@@ -321,8 +321,8 @@ + reg = <0x08af8800 0x400>; + + interrupts = , +- , +- ; ++ , ++ ; + interrupt-names = "pwr_event", + "dp_hs_phy_irq", + "dm_hs_phy_irq"; +-- +2.43.0 + diff --git a/queue-6.10/firmware-microchip-fix-incorrect-error-report-of-pro.patch b/queue-6.10/firmware-microchip-fix-incorrect-error-report-of-pro.patch new file mode 100644 index 00000000000..2941e009d4f --- /dev/null +++ b/queue-6.10/firmware-microchip-fix-incorrect-error-report-of-pro.patch @@ -0,0 +1,39 @@ +From 9a301f8eaec5c5e63c92576101051e1ac34e1897 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 14:47:44 +0100 +Subject: firmware: microchip: fix incorrect error report of + programming:timeout on success + +From: Steve Wilkins + +[ Upstream commit 591940e22e287fb64ac07be275e343d860cb72d6 ] + +After successfully programming the SPI flash with an MFPS auto update +image, the error sysfs attribute reports programming:timeout. +This is caused by an incorrect check on the return value from +wait_for_completion_timeout() in mpfs_auto_update_poll_complete(). + +Fixes: ec5b0f1193ad ("firmware: microchip: add PolarFire SoC Auto Update support") +Signed-off-by: Steve Wilkins +Signed-off-by: Conor Dooley +Signed-off-by: Sasha Levin +--- + drivers/firmware/microchip/mpfs-auto-update.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/microchip/mpfs-auto-update.c b/drivers/firmware/microchip/mpfs-auto-update.c +index 835a19a7a3a09..4a95fbbf4733e 100644 +--- a/drivers/firmware/microchip/mpfs-auto-update.c ++++ b/drivers/firmware/microchip/mpfs-auto-update.c +@@ -153,7 +153,7 @@ static enum fw_upload_err mpfs_auto_update_poll_complete(struct fw_upload *fw_up + */ + ret = wait_for_completion_timeout(&priv->programming_complete, + msecs_to_jiffies(AUTO_UPDATE_TIMEOUT_MS)); +- if (ret) ++ if (!ret) + return FW_UPLOAD_ERR_TIMEOUT; + + return FW_UPLOAD_ERR_NONE; +-- +2.43.0 + diff --git a/queue-6.10/nfsd-fix-nfsd4_deleg_getattr_conflict-in-presence-of.patch b/queue-6.10/nfsd-fix-nfsd4_deleg_getattr_conflict-in-presence-of.patch new file mode 100644 index 00000000000..36cd23ff5b4 --- /dev/null +++ b/queue-6.10/nfsd-fix-nfsd4_deleg_getattr_conflict-in-presence-of.patch @@ -0,0 +1,60 @@ +From c732ca9198e217d54084b5305f40d5674dfab5cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Aug 2024 09:06:28 +1000 +Subject: nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party + lease + +From: NeilBrown + +[ Upstream commit 40927f3d0972bf86357a32a5749be71a551241b6 ] + +It is not safe to dereference fl->c.flc_owner without first confirming +fl->fl_lmops is the expected manager. nfsd4_deleg_getattr_conflict() +tests fl_lmops but largely ignores the result and assumes that flc_owner +is an nfs4_delegation anyway. This is wrong. + +With this patch we restore the "!= &nfsd_lease_mng_ops" case to behave +as it did before the change mentioned below. This is the same as the +current code, but without any reference to a possible delegation. + +Fixes: c5967721e106 ("NFSD: handle GETATTR conflict with write delegation") +Signed-off-by: NeilBrown +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 07f2496850c4c..a366fb1c1b9b4 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -8859,7 +8859,15 @@ nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct dentry *dentry, + */ + if (type == F_RDLCK) + break; +- goto break_lease; ++ ++ nfsd_stats_wdeleg_getattr_inc(nn); ++ spin_unlock(&ctx->flc_lock); ++ ++ status = nfserrno(nfsd_open_break_lease(inode, NFSD_MAY_READ)); ++ if (status != nfserr_jukebox || ++ !nfsd_wait_for_delegreturn(rqstp, inode)) ++ return status; ++ return 0; + } + if (type == F_WRLCK) { + struct nfs4_delegation *dp = fl->c.flc_owner; +@@ -8868,7 +8876,6 @@ nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct dentry *dentry, + spin_unlock(&ctx->flc_lock); + return 0; + } +-break_lease: + nfsd_stats_wdeleg_getattr_inc(nn); + dp = fl->c.flc_owner; + refcount_inc(&dp->dl_stid.sc_count); +-- +2.43.0 + diff --git a/queue-6.10/scsi-aacraid-fix-double-free-on-probe-failure.patch b/queue-6.10/scsi-aacraid-fix-double-free-on-probe-failure.patch new file mode 100644 index 00000000000..88301fc2809 --- /dev/null +++ b/queue-6.10/scsi-aacraid-fix-double-free-on-probe-failure.patch @@ -0,0 +1,54 @@ +From 8df1c65efb4acad084a6e48f75bdfc0042b4019d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2024 00:51:42 +0200 +Subject: scsi: aacraid: Fix double-free on probe failure + +From: Ben Hutchings + +[ Upstream commit 919ddf8336f0b84c0453bac583808c9f165a85c2 ] + +aac_probe_one() calls hardware-specific init functions through the +aac_driver_ident::init pointer, all of which eventually call down to +aac_init_adapter(). + +If aac_init_adapter() fails after allocating memory for aac_dev::queues, +it frees the memory but does not clear that member. + +After the hardware-specific init function returns an error, +aac_probe_one() goes down an error path that frees the memory pointed to +by aac_dev::queues, resulting.in a double-free. + +Reported-by: Michael Gordon +Link: https://bugs.debian.org/1075855 +Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support") +Signed-off-by: Ben Hutchings +Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/aacraid/comminit.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c +index bd99c5492b7d4..0f64b02443037 100644 +--- a/drivers/scsi/aacraid/comminit.c ++++ b/drivers/scsi/aacraid/comminit.c +@@ -642,6 +642,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) + + if (aac_comm_init(dev)<0){ + kfree(dev->queues); ++ dev->queues = NULL; + return NULL; + } + /* +@@ -649,6 +650,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) + */ + if (aac_fib_setup(dev) < 0) { + kfree(dev->queues); ++ dev->queues = NULL; + return NULL; + } + +-- +2.43.0 + diff --git a/queue-6.10/series b/queue-6.10/series index 82036f417fa..b10c11b2902 100644 --- a/queue-6.10/series +++ b/queue-6.10/series @@ -137,3 +137,13 @@ usb-core-sysfs-unmerge-usb3_hardware_lpm_attr_group-in-remove_power_attributes.p usb-cdnsp-fix-incorrect-index-in-cdnsp_get_hw_deq-function.patch usb-cdnsp-fix-for-link-trb-with-tc.patch usb-typec-ucsi-move-unregister-out-of-atomic-section.patch +arm64-dts-qcom-ipq5332-fix-interrupt-trigger-type-fo.patch +arm-dts-omap3-n900-correct-the-accelerometer-orienta.patch +arm64-dts-imx8mp-beacon-kit-fix-stereo-audio-on-wm89.patch +arm64-dts-imx93-update-default-value-for-snps-clk-cs.patch +arm64-dts-freescale-imx93-tqma9352-fix-cma-alloc-ran.patch +arm64-dts-freescale-imx93-tqma9352-mba93xxla-fix-typ.patch +firmware-microchip-fix-incorrect-error-report-of-pro.patch +scsi-aacraid-fix-double-free-on-probe-failure.patch +apparmor-fix-policy_unpack_test-on-big-endian-system.patch +nfsd-fix-nfsd4_deleg_getattr_conflict-in-presence-of.patch