From: Greg Kroah-Hartman Date: Sat, 13 Aug 2022 13:53:24 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v5.15.61~170 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ccf95669b01e2c7d05ee30ae8c7cf42c5e4bb008;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: iio-light-isl29028-fix-the-warning-in-isl29028_remove.patch mtd-rawnand-arasan-update-nand-bus-clock-instead-of-system-clock.patch scsi-qla2xxx-fix-incorrect-display-of-max-frame-size.patch scsi-qla2xxx-zero-undefined-mailbox-in-registers.patch scsi-sg-allow-waiting-for-commands-to-complete-on-removed-device.patch --- diff --git a/queue-5.10/iio-light-isl29028-fix-the-warning-in-isl29028_remove.patch b/queue-5.10/iio-light-isl29028-fix-the-warning-in-isl29028_remove.patch new file mode 100644 index 00000000000..1305187d523 --- /dev/null +++ b/queue-5.10/iio-light-isl29028-fix-the-warning-in-isl29028_remove.patch @@ -0,0 +1,49 @@ +From 06674fc7c003b9d0aa1d37fef7ab2c24802cc6ad Mon Sep 17 00:00:00 2001 +From: Zheyu Ma +Date: Sun, 17 Jul 2022 08:42:41 +0800 +Subject: iio: light: isl29028: Fix the warning in isl29028_remove() + +From: Zheyu Ma + +commit 06674fc7c003b9d0aa1d37fef7ab2c24802cc6ad upstream. + +The driver use the non-managed form of the register function in +isl29028_remove(). To keep the release order as mirroring the ordering +in probe, the driver should use non-managed form in probe, too. + +The following log reveals it: + +[ 32.374955] isl29028 0-0010: remove +[ 32.376861] general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI +[ 32.377676] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] +[ 32.379432] RIP: 0010:kernfs_find_and_get_ns+0x28/0xe0 +[ 32.385461] Call Trace: +[ 32.385807] sysfs_unmerge_group+0x59/0x110 +[ 32.386110] dpm_sysfs_remove+0x58/0xc0 +[ 32.386391] device_del+0x296/0xe50 +[ 32.386959] cdev_device_del+0x1d/0xd0 +[ 32.387231] devm_iio_device_unreg+0x27/0xb0 +[ 32.387542] devres_release_group+0x319/0x3d0 +[ 32.388162] i2c_device_remove+0x93/0x1f0 + +Fixes: 2db5054ac28d ("staging: iio: isl29028: add runtime power management support") +Signed-off-by: Zheyu Ma +Link: https://lore.kernel.org/r/20220717004241.2281028-1-zheyuma97@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/isl29028.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/light/isl29028.c ++++ b/drivers/iio/light/isl29028.c +@@ -627,7 +627,7 @@ static int isl29028_probe(struct i2c_cli + ISL29028_POWER_OFF_DELAY_MS); + pm_runtime_use_autosuspend(&client->dev); + +- ret = devm_iio_device_register(indio_dev->dev.parent, indio_dev); ++ ret = iio_device_register(indio_dev); + if (ret < 0) { + dev_err(&client->dev, + "%s(): iio registration failed with error %d\n", diff --git a/queue-5.10/mtd-rawnand-arasan-update-nand-bus-clock-instead-of-system-clock.patch b/queue-5.10/mtd-rawnand-arasan-update-nand-bus-clock-instead-of-system-clock.patch new file mode 100644 index 00000000000..8f2f86e2324 --- /dev/null +++ b/queue-5.10/mtd-rawnand-arasan-update-nand-bus-clock-instead-of-system-clock.patch @@ -0,0 +1,50 @@ +From 7499bfeedb47efc1ee4dc793b92c610d46e6d6a6 Mon Sep 17 00:00:00 2001 +From: Amit Kumar Mahapatra +Date: Tue, 28 Jun 2022 21:18:23 +0530 +Subject: mtd: rawnand: arasan: Update NAND bus clock instead of system clock + +From: Amit Kumar Mahapatra + +commit 7499bfeedb47efc1ee4dc793b92c610d46e6d6a6 upstream. + +In current implementation the Arasan NAND driver is updating the +system clock(i.e., anand->clk) in accordance to the timing modes +(i.e., SDR or NVDDR). But as per the Arasan NAND controller spec the +flash clock or the NAND bus clock(i.e., nfc->bus_clk), need to be +updated instead. This patch keeps the system clock unchanged and updates +the NAND bus clock as per the timing modes. + +Fixes: 197b88fecc50 ("mtd: rawnand: arasan: Add new Arasan NAND controller") +CC: stable@vger.kernel.org # 5.8+ +Signed-off-by: Amit Kumar Mahapatra +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220628154824.12222-2-amit.kumar-mahapatra@xilinx.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/arasan-nand-controller.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/mtd/nand/raw/arasan-nand-controller.c ++++ b/drivers/mtd/nand/raw/arasan-nand-controller.c +@@ -283,17 +283,17 @@ static int anfc_select_target(struct nan + + /* Update clock frequency */ + if (nfc->cur_clk != anand->clk) { +- clk_disable_unprepare(nfc->controller_clk); +- ret = clk_set_rate(nfc->controller_clk, anand->clk); ++ clk_disable_unprepare(nfc->bus_clk); ++ ret = clk_set_rate(nfc->bus_clk, anand->clk); + if (ret) { + dev_err(nfc->dev, "Failed to change clock rate\n"); + return ret; + } + +- ret = clk_prepare_enable(nfc->controller_clk); ++ ret = clk_prepare_enable(nfc->bus_clk); + if (ret) { + dev_err(nfc->dev, +- "Failed to re-enable the controller clock\n"); ++ "Failed to re-enable the bus clock\n"); + return ret; + } + diff --git a/queue-5.10/scsi-qla2xxx-fix-incorrect-display-of-max-frame-size.patch b/queue-5.10/scsi-qla2xxx-fix-incorrect-display-of-max-frame-size.patch new file mode 100644 index 00000000000..e99f7024765 --- /dev/null +++ b/queue-5.10/scsi-qla2xxx-fix-incorrect-display-of-max-frame-size.patch @@ -0,0 +1,99 @@ +From cf3b4fb655796674e605268bd4bfb47a47c8bce6 Mon Sep 17 00:00:00 2001 +From: Bikash Hazarika +Date: Tue, 12 Jul 2022 22:20:37 -0700 +Subject: scsi: qla2xxx: Fix incorrect display of max frame size + +From: Bikash Hazarika + +commit cf3b4fb655796674e605268bd4bfb47a47c8bce6 upstream. + +Replace display field with the correct field. + +Link: https://lore.kernel.org/r/20220713052045.10683-3-njavali@marvell.com +Fixes: 8777e4314d39 ("scsi: qla2xxx: Migrate NVME N2N handling into state machine") +Cc: stable@vger.kernel.org +Reviewed-by: Himanshu Madhani +Signed-off-by: Bikash Hazarika +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qla2xxx/qla_def.h | 1 + + drivers/scsi/qla2xxx/qla_gs.c | 9 +++------ + drivers/scsi/qla2xxx/qla_init.c | 2 ++ + drivers/scsi/qla2xxx/qla_isr.c | 4 +--- + 4 files changed, 7 insertions(+), 9 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -3857,6 +3857,7 @@ struct qla_hw_data { + /* SRB cache. */ + #define SRB_MIN_REQ 128 + mempool_t *srb_mempool; ++ u8 port_name[WWN_SIZE]; + + volatile struct { + uint32_t mbox_int :1; +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -1594,7 +1594,6 @@ qla2x00_hba_attributes(scsi_qla_host_t * + unsigned int callopt) + { + struct qla_hw_data *ha = vha->hw; +- struct init_cb_24xx *icb24 = (void *)ha->init_cb; + struct new_utsname *p_sysid = utsname(); + struct ct_fdmi_hba_attr *eiter; + uint16_t alen; +@@ -1756,8 +1755,8 @@ qla2x00_hba_attributes(scsi_qla_host_t * + /* MAX CT Payload Length */ + eiter = entries + size; + eiter->type = cpu_to_be16(FDMI_HBA_MAXIMUM_CT_PAYLOAD_LENGTH); +- eiter->a.max_ct_len = cpu_to_be32(le16_to_cpu(IS_FWI2_CAPABLE(ha) ? +- icb24->frame_payload_size : ha->init_cb->frame_payload_size)); ++ eiter->a.max_ct_len = cpu_to_be32(ha->frame_payload_size >> 2); ++ + alen = sizeof(eiter->a.max_ct_len); + alen += FDMI_ATTR_TYPELEN(eiter); + eiter->len = cpu_to_be16(alen); +@@ -1849,7 +1848,6 @@ qla2x00_port_attributes(scsi_qla_host_t + unsigned int callopt) + { + struct qla_hw_data *ha = vha->hw; +- struct init_cb_24xx *icb24 = (void *)ha->init_cb; + struct new_utsname *p_sysid = utsname(); + char *hostname = p_sysid ? + p_sysid->nodename : fc_host_system_hostname(vha->host); +@@ -1901,8 +1899,7 @@ qla2x00_port_attributes(scsi_qla_host_t + /* Max frame size. */ + eiter = entries + size; + eiter->type = cpu_to_be16(FDMI_PORT_MAX_FRAME_SIZE); +- eiter->a.max_frame_size = cpu_to_be32(le16_to_cpu(IS_FWI2_CAPABLE(ha) ? +- icb24->frame_payload_size : ha->init_cb->frame_payload_size)); ++ eiter->a.max_frame_size = cpu_to_be32(ha->frame_payload_size); + alen = sizeof(eiter->a.max_frame_size); + alen += FDMI_ATTR_TYPELEN(eiter); + eiter->len = cpu_to_be16(alen); +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -4328,6 +4328,8 @@ qla2x00_init_rings(scsi_qla_host_t *vha) + BIT_6) != 0; + ql_dbg(ql_dbg_init, vha, 0x00bc, "FA-WWPN Support: %s.\n", + (ha->flags.fawwpn_enabled) ? "enabled" : "disabled"); ++ /* Init_cb will be reused for other command(s). Save a backup copy of port_name */ ++ memcpy(ha->port_name, ha->init_cb->port_name, WWN_SIZE); + } + + rval = qla2x00_init_firmware(vha, ha->init_cb_size); +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -1202,9 +1202,7 @@ skip_rio: + if (!vha->vp_idx) { + if (ha->flags.fawwpn_enabled && + (ha->current_topology == ISP_CFG_F)) { +- void *wwpn = ha->init_cb->port_name; +- +- memcpy(vha->port_name, wwpn, WWN_SIZE); ++ memcpy(vha->port_name, ha->port_name, WWN_SIZE); + fc_host_port_name(vha->host) = + wwn_to_u64(vha->port_name); + ql_dbg(ql_dbg_init + ql_dbg_verbose, diff --git a/queue-5.10/scsi-qla2xxx-zero-undefined-mailbox-in-registers.patch b/queue-5.10/scsi-qla2xxx-zero-undefined-mailbox-in-registers.patch new file mode 100644 index 00000000000..26320bf3132 --- /dev/null +++ b/queue-5.10/scsi-qla2xxx-zero-undefined-mailbox-in-registers.patch @@ -0,0 +1,36 @@ +From 6c96a3c7d49593ef15805f5e497601c87695abc9 Mon Sep 17 00:00:00 2001 +From: Bikash Hazarika +Date: Tue, 12 Jul 2022 22:20:38 -0700 +Subject: scsi: qla2xxx: Zero undefined mailbox IN registers + +From: Bikash Hazarika + +commit 6c96a3c7d49593ef15805f5e497601c87695abc9 upstream. + +While requesting a new mailbox command, driver does not write any data to +unused registers. Initialize the unused register value to zero while +requesting a new mailbox command to prevent stale entry access by firmware. + +Link: https://lore.kernel.org/r/20220713052045.10683-4-njavali@marvell.com +Cc: stable@vger.kernel.org +Reviewed-by: Himanshu Madhani +Signed-off-by: Bikash Hazarika +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qla2xxx/qla_mbx.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -233,6 +233,8 @@ qla2x00_mailbox_command(scsi_qla_host_t + ql_dbg(ql_dbg_mbx, vha, 0x1112, + "mbox[%d]<-0x%04x\n", cnt, *iptr); + wrt_reg_word(optr, *iptr); ++ } else { ++ wrt_reg_word(optr, 0); + } + + mboxes >>= 1; diff --git a/queue-5.10/scsi-sg-allow-waiting-for-commands-to-complete-on-removed-device.patch b/queue-5.10/scsi-sg-allow-waiting-for-commands-to-complete-on-removed-device.patch new file mode 100644 index 00000000000..95c01d499cc --- /dev/null +++ b/queue-5.10/scsi-sg-allow-waiting-for-commands-to-complete-on-removed-device.patch @@ -0,0 +1,142 @@ +From 3455607fd7be10b449f5135c00dc306b85dc0d21 Mon Sep 17 00:00:00 2001 +From: Tony Battersby +Date: Mon, 11 Jul 2022 10:51:32 -0400 +Subject: scsi: sg: Allow waiting for commands to complete on removed device + +From: Tony Battersby + +commit 3455607fd7be10b449f5135c00dc306b85dc0d21 upstream. + +When a SCSI device is removed while in active use, currently sg will +immediately return -ENODEV on any attempt to wait for active commands that +were sent before the removal. This is problematic for commands that use +SG_FLAG_DIRECT_IO since the data buffer may still be in use by the kernel +when userspace frees or reuses it after getting ENODEV, leading to +corrupted userspace memory (in the case of READ-type commands) or corrupted +data being sent to the device (in the case of WRITE-type commands). This +has been seen in practice when logging out of a iscsi_tcp session, where +the iSCSI driver may still be processing commands after the device has been +marked for removal. + +Change the policy to allow userspace to wait for active sg commands even +when the device is being removed. Return -ENODEV only when there are no +more responses to read. + +Link: https://lore.kernel.org/r/5ebea46f-fe83-2d0b-233d-d0dcb362dd0a@cybernetics.com +Cc: +Acked-by: Douglas Gilbert +Signed-off-by: Tony Battersby +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/sg.c | 53 +++++++++++++++++++++++++++++++++-------------------- + 1 file changed, 33 insertions(+), 20 deletions(-) + +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -190,7 +190,7 @@ static void sg_link_reserve(Sg_fd * sfp, + static void sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp); + static Sg_fd *sg_add_sfp(Sg_device * sdp); + static void sg_remove_sfp(struct kref *); +-static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id); ++static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id, bool *busy); + static Sg_request *sg_add_request(Sg_fd * sfp); + static int sg_remove_request(Sg_fd * sfp, Sg_request * srp); + static Sg_device *sg_get_dev(int dev); +@@ -444,6 +444,7 @@ sg_read(struct file *filp, char __user * + Sg_fd *sfp; + Sg_request *srp; + int req_pack_id = -1; ++ bool busy; + sg_io_hdr_t *hp; + struct sg_header *old_hdr; + int retval; +@@ -466,20 +467,16 @@ sg_read(struct file *filp, char __user * + if (retval) + return retval; + +- srp = sg_get_rq_mark(sfp, req_pack_id); ++ srp = sg_get_rq_mark(sfp, req_pack_id, &busy); + if (!srp) { /* now wait on packet to arrive */ +- if (atomic_read(&sdp->detaching)) +- return -ENODEV; + if (filp->f_flags & O_NONBLOCK) + return -EAGAIN; + retval = wait_event_interruptible(sfp->read_wait, +- (atomic_read(&sdp->detaching) || +- (srp = sg_get_rq_mark(sfp, req_pack_id)))); +- if (atomic_read(&sdp->detaching)) +- return -ENODEV; +- if (retval) +- /* -ERESTARTSYS as signal hit process */ +- return retval; ++ ((srp = sg_get_rq_mark(sfp, req_pack_id, &busy)) || ++ (!busy && atomic_read(&sdp->detaching)))); ++ if (!srp) ++ /* signal or detaching */ ++ return retval ? retval : -ENODEV; + } + if (srp->header.interface_id != '\0') + return sg_new_read(sfp, buf, count, srp); +@@ -938,9 +935,7 @@ sg_ioctl_common(struct file *filp, Sg_de + if (result < 0) + return result; + result = wait_event_interruptible(sfp->read_wait, +- (srp_done(sfp, srp) || atomic_read(&sdp->detaching))); +- if (atomic_read(&sdp->detaching)) +- return -ENODEV; ++ srp_done(sfp, srp)); + write_lock_irq(&sfp->rq_list_lock); + if (srp->done) { + srp->done = 2; +@@ -2093,19 +2088,28 @@ sg_unlink_reserve(Sg_fd * sfp, Sg_reques + } + + static Sg_request * +-sg_get_rq_mark(Sg_fd * sfp, int pack_id) ++sg_get_rq_mark(Sg_fd * sfp, int pack_id, bool *busy) + { + Sg_request *resp; + unsigned long iflags; + ++ *busy = false; + write_lock_irqsave(&sfp->rq_list_lock, iflags); + list_for_each_entry(resp, &sfp->rq_list, entry) { +- /* look for requests that are ready + not SG_IO owned */ +- if ((1 == resp->done) && (!resp->sg_io_owned) && ++ /* look for requests that are not SG_IO owned */ ++ if ((!resp->sg_io_owned) && + ((-1 == pack_id) || (resp->header.pack_id == pack_id))) { +- resp->done = 2; /* guard against other readers */ +- write_unlock_irqrestore(&sfp->rq_list_lock, iflags); +- return resp; ++ switch (resp->done) { ++ case 0: /* request active */ ++ *busy = true; ++ break; ++ case 1: /* request done; response ready to return */ ++ resp->done = 2; /* guard against other readers */ ++ write_unlock_irqrestore(&sfp->rq_list_lock, iflags); ++ return resp; ++ case 2: /* response already being returned */ ++ break; ++ } + } + } + write_unlock_irqrestore(&sfp->rq_list_lock, iflags); +@@ -2159,6 +2163,15 @@ sg_remove_request(Sg_fd * sfp, Sg_reques + res = 1; + } + write_unlock_irqrestore(&sfp->rq_list_lock, iflags); ++ ++ /* ++ * If the device is detaching, wakeup any readers in case we just ++ * removed the last response, which would leave nothing for them to ++ * return other than -ENODEV. ++ */ ++ if (unlikely(atomic_read(&sfp->parentdp->detaching))) ++ wake_up_interruptible_all(&sfp->read_wait); ++ + return res; + } + diff --git a/queue-5.10/series b/queue-5.10/series index 66cbcf779c1..0e3270d9970 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -45,3 +45,8 @@ drm-nouveau-fix-another-off-by-one-in-nvbios_addr.patch drm-nouveau-don-t-pm_runtime_put_sync-only-pm_runtime_put_autosuspend.patch drm-nouveau-acpi-don-t-print-error-when-we-get-einprogress-from-pm_runtime.patch drm-amdgpu-check-bo-s-requested-pinning-domains-against-its-preferred_domains.patch +mtd-rawnand-arasan-update-nand-bus-clock-instead-of-system-clock.patch +iio-light-isl29028-fix-the-warning-in-isl29028_remove.patch +scsi-sg-allow-waiting-for-commands-to-complete-on-removed-device.patch +scsi-qla2xxx-fix-incorrect-display-of-max-frame-size.patch +scsi-qla2xxx-zero-undefined-mailbox-in-registers.patch