From: Greg Kroah-Hartman Date: Mon, 19 May 2025 13:24:26 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.15.184~47 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ecb7a55052616760859f2a87892cce725be63cc7;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: acpi-pptt-fix-processor-subtable-walk.patch alsa-es1968-add-error-handling-for-snd_pcm_hw_constraint_pow2.patch phy-fix-error-handling-in-tegra_xusb_port_init.patch phy-renesas-rcar-gen3-usb2-fix-role-detection-on-unbind-bind.patch phy-renesas-rcar-gen3-usb2-set-timing-registers-only-once.patch --- diff --git a/queue-5.4/acpi-pptt-fix-processor-subtable-walk.patch b/queue-5.4/acpi-pptt-fix-processor-subtable-walk.patch new file mode 100644 index 0000000000..5044f781de --- /dev/null +++ b/queue-5.4/acpi-pptt-fix-processor-subtable-walk.patch @@ -0,0 +1,96 @@ +From adfab6b39202481bb43286fff94def4953793fdb Mon Sep 17 00:00:00 2001 +From: Jeremy Linton +Date: Wed, 7 May 2025 21:30:25 -0500 +Subject: ACPI: PPTT: Fix processor subtable walk + +From: Jeremy Linton + +commit adfab6b39202481bb43286fff94def4953793fdb upstream. + +The original PPTT code had a bug where the processor subtable length +was not correctly validated when encountering a truncated +acpi_pptt_processor node. + +Commit 7ab4f0e37a0f4 ("ACPI PPTT: Fix coding mistakes in a couple of +sizeof() calls") attempted to fix this by validating the size is as +large as the acpi_pptt_processor node structure. This introduced a +regression where the last processor node in the PPTT table is ignored +if it doesn't contain any private resources. That results errors like: + + ACPI PPTT: PPTT table found, but unable to locate core XX (XX) + ACPI: SPE must be homogeneous + +Furthermore, it fails in a common case where the node length isn't +equal to the acpi_pptt_processor structure size, leaving the original +bug in a modified form. + +Correct the regression by adjusting the loop termination conditions as +suggested by the bug reporters. An additional check performed after +the subtable node type is detected, validates the acpi_pptt_processor +node is fully contained in the PPTT table. Repeating the check in +acpi_pptt_leaf_node() is largely redundant as the node is already +known to be fully contained in the table. + +The case where a final truncated node's parent property is accepted, +but the node itself is rejected should not be considered a bug. + +Fixes: 7ab4f0e37a0f4 ("ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls") +Reported-by: Maximilian Heyne +Closes: https://lore.kernel.org/linux-acpi/20250506-draco-taped-15f475cd@mheyne-amazon/ +Reported-by: Yicong Yang +Closes: https://lore.kernel.org/linux-acpi/20250507035124.28071-1-yangyicong@huawei.com/ +Signed-off-by: Jeremy Linton +Tested-by: Yicong Yang +Reviewed-by: Sudeep Holla +Tested-by: Maximilian Heyne +Cc: All applicable # 7ab4f0e37a0f4: ACPI PPTT: Fix coding mistakes ... +Link: https://patch.msgid.link/20250508023025.1301030-1-jeremy.linton@arm.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/pptt.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/acpi/pptt.c ++++ b/drivers/acpi/pptt.c +@@ -218,16 +218,18 @@ static int acpi_pptt_leaf_node(struct ac + sizeof(struct acpi_table_pptt)); + proc_sz = sizeof(struct acpi_pptt_processor); + +- while ((unsigned long)entry + proc_sz < table_end) { ++ /* ignore subtable types that are smaller than a processor node */ ++ while ((unsigned long)entry + proc_sz <= table_end) { + cpu_node = (struct acpi_pptt_processor *)entry; ++ + if (entry->type == ACPI_PPTT_TYPE_PROCESSOR && + cpu_node->parent == node_entry) + return 0; + if (entry->length == 0) + return 0; ++ + entry = ACPI_ADD_PTR(struct acpi_subtable_header, entry, + entry->length); +- + } + return 1; + } +@@ -260,15 +262,18 @@ static struct acpi_pptt_processor *acpi_ + proc_sz = sizeof(struct acpi_pptt_processor); + + /* find the processor structure associated with this cpuid */ +- while ((unsigned long)entry + proc_sz < table_end) { ++ while ((unsigned long)entry + proc_sz <= table_end) { + cpu_node = (struct acpi_pptt_processor *)entry; + + if (entry->length == 0) { + pr_warn("Invalid zero length subtable\n"); + break; + } ++ /* entry->length may not equal proc_sz, revalidate the processor structure length */ + if (entry->type == ACPI_PPTT_TYPE_PROCESSOR && + acpi_cpu_id == cpu_node->acpi_processor_id && ++ (unsigned long)entry + entry->length <= table_end && ++ entry->length == proc_sz + cpu_node->number_of_priv_resources * sizeof(u32) && + acpi_pptt_leaf_node(table_hdr, cpu_node)) { + return (struct acpi_pptt_processor *)entry; + } diff --git a/queue-5.4/alsa-es1968-add-error-handling-for-snd_pcm_hw_constraint_pow2.patch b/queue-5.4/alsa-es1968-add-error-handling-for-snd_pcm_hw_constraint_pow2.patch new file mode 100644 index 0000000000..5e5f18324a --- /dev/null +++ b/queue-5.4/alsa-es1968-add-error-handling-for-snd_pcm_hw_constraint_pow2.patch @@ -0,0 +1,48 @@ +From 9e000f1b7f31684cc5927e034360b87ac7919593 Mon Sep 17 00:00:00 2001 +From: Wentao Liang +Date: Wed, 14 May 2025 17:24:44 +0800 +Subject: ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() + +From: Wentao Liang + +commit 9e000f1b7f31684cc5927e034360b87ac7919593 upstream. + +The function snd_es1968_capture_open() calls the function +snd_pcm_hw_constraint_pow2(), but does not check its return +value. A proper implementation can be found in snd_cx25821_pcm_open(). + +Add error handling for snd_pcm_hw_constraint_pow2() and propagate its +error code. + +Fixes: b942cf815b57 ("[ALSA] es1968 - Fix stuttering capture") +Cc: stable@vger.kernel.org # v2.6.22 +Signed-off-by: Wentao Liang +Link: https://patch.msgid.link/20250514092444.331-1-vulab@iscas.ac.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/es1968.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/sound/pci/es1968.c ++++ b/sound/pci/es1968.c +@@ -1575,7 +1575,7 @@ static int snd_es1968_capture_open(struc + struct snd_pcm_runtime *runtime = substream->runtime; + struct es1968 *chip = snd_pcm_substream_chip(substream); + struct esschan *es; +- int apu1, apu2; ++ int err, apu1, apu2; + + apu1 = snd_es1968_alloc_apu_pair(chip, ESM_APU_PCM_CAPTURE); + if (apu1 < 0) +@@ -1618,7 +1618,9 @@ static int snd_es1968_capture_open(struc + runtime->hw = snd_es1968_capture; + runtime->hw.buffer_bytes_max = runtime->hw.period_bytes_max = + calc_available_memory_size(chip) - 1024; /* keep MIXBUF size */ +- snd_pcm_hw_constraint_pow2(runtime, 0, SNDRV_PCM_HW_PARAM_BUFFER_BYTES); ++ err = snd_pcm_hw_constraint_pow2(runtime, 0, SNDRV_PCM_HW_PARAM_BUFFER_BYTES); ++ if (err < 0) ++ return err; + + spin_lock_irq(&chip->substream_lock); + list_add(&es->list, &chip->substream_list); diff --git a/queue-5.4/phy-fix-error-handling-in-tegra_xusb_port_init.patch b/queue-5.4/phy-fix-error-handling-in-tegra_xusb_port_init.patch new file mode 100644 index 0000000000..661d63895f --- /dev/null +++ b/queue-5.4/phy-fix-error-handling-in-tegra_xusb_port_init.patch @@ -0,0 +1,56 @@ +From b2ea5f49580c0762d17d80d8083cb89bc3acf74f Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Mon, 3 Mar 2025 15:27:39 +0800 +Subject: phy: Fix error handling in tegra_xusb_port_init + +From: Ma Ke + +commit b2ea5f49580c0762d17d80d8083cb89bc3acf74f upstream. + +If device_add() fails, do not use device_unregister() for error +handling. device_unregister() consists two functions: device_del() and +put_device(). device_unregister() should only be called after +device_add() succeeded because device_del() undoes what device_add() +does if successful. Change device_unregister() to put_device() call +before returning from the function. + +As comment of device_add() says, 'if device_add() succeeds, you should +call device_del() when you want to get rid of it. If device_add() has +not succeeded, use only put_device() to drop the reference count'. + +Found by code review. + +Cc: stable@vger.kernel.org +Fixes: 53d2a715c240 ("phy: Add Tegra XUSB pad controller support") +Signed-off-by: Ma Ke +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20250303072739.3874987-1-make24@iscas.ac.cn +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/tegra/xusb.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -526,16 +526,16 @@ static int tegra_xusb_port_init(struct t + + err = dev_set_name(&port->dev, "%s-%u", name, index); + if (err < 0) +- goto unregister; ++ goto put_device; + + err = device_add(&port->dev); + if (err < 0) +- goto unregister; ++ goto put_device; + + return 0; + +-unregister: +- device_unregister(&port->dev); ++put_device: ++ put_device(&port->dev); + return err; + } + diff --git a/queue-5.4/phy-renesas-rcar-gen3-usb2-fix-role-detection-on-unbind-bind.patch b/queue-5.4/phy-renesas-rcar-gen3-usb2-fix-role-detection-on-unbind-bind.patch new file mode 100644 index 0000000000..dcad9380dd --- /dev/null +++ b/queue-5.4/phy-renesas-rcar-gen3-usb2-fix-role-detection-on-unbind-bind.patch @@ -0,0 +1,122 @@ +From 54c4c58713aaff76c2422ff5750e557ab3b100d7 Mon Sep 17 00:00:00 2001 +From: Claudiu Beznea +Date: Wed, 7 May 2025 15:50:28 +0300 +Subject: phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind + +From: Claudiu Beznea + +commit 54c4c58713aaff76c2422ff5750e557ab3b100d7 upstream. + +It has been observed on the Renesas RZ/G3S SoC that unbinding and binding +the PHY driver leads to role autodetection failures. This issue occurs when +PHY 3 is the first initialized PHY. PHY 3 does not have an interrupt +associated with the USB2_INT_ENABLE register (as +rcar_gen3_int_enable[3] = 0). As a result, rcar_gen3_init_otg() is called +to initialize OTG without enabling PHY interrupts. + +To resolve this, add rcar_gen3_is_any_otg_rphy_initialized() and call it in +role_store(), role_show(), and rcar_gen3_init_otg(). At the same time, +rcar_gen3_init_otg() is only called when initialization for a PHY with +interrupt bits is in progress. As a result, the +struct rcar_gen3_phy::otg_initialized is no longer needed. + +Fixes: 549b6b55b005 ("phy: renesas: rcar-gen3-usb2: enable/disable independent irqs") +Cc: stable@vger.kernel.org +Reviewed-by: Yoshihiro Shimoda +Tested-by: Yoshihiro Shimoda +Reviewed-by: Lad Prabhakar +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20250507125032.565017-2-claudiu.beznea.uj@bp.renesas.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/renesas/phy-rcar-gen3-usb2.c | 33 +++++++++++++------------------ + 1 file changed, 14 insertions(+), 19 deletions(-) + +--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c ++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +@@ -98,7 +98,6 @@ struct rcar_gen3_phy { + struct rcar_gen3_chan *ch; + u32 int_enable_bits; + bool initialized; +- bool otg_initialized; + bool powered; + }; + +@@ -288,16 +287,15 @@ static bool rcar_gen3_is_any_rphy_initia + return false; + } + +-static bool rcar_gen3_needs_init_otg(struct rcar_gen3_chan *ch) ++static bool rcar_gen3_is_any_otg_rphy_initialized(struct rcar_gen3_chan *ch) + { +- int i; +- +- for (i = 0; i < NUM_OF_PHYS; i++) { +- if (ch->rphys[i].otg_initialized) +- return false; ++ for (enum rcar_gen3_phy_index i = PHY_INDEX_BOTH_HC; i <= PHY_INDEX_EHCI; ++ i++) { ++ if (ch->rphys[i].initialized) ++ return true; + } + +- return true; ++ return false; + } + + static bool rcar_gen3_are_all_rphys_power_off(struct rcar_gen3_chan *ch) +@@ -319,7 +317,7 @@ static ssize_t role_store(struct device + bool is_b_device; + enum phy_mode cur_mode, new_mode; + +- if (!ch->is_otg_channel || !rcar_gen3_is_any_rphy_initialized(ch)) ++ if (!ch->is_otg_channel || !rcar_gen3_is_any_otg_rphy_initialized(ch)) + return -EIO; + + if (sysfs_streq(buf, "host")) +@@ -357,7 +355,7 @@ static ssize_t role_show(struct device * + { + struct rcar_gen3_chan *ch = dev_get_drvdata(dev); + +- if (!ch->is_otg_channel || !rcar_gen3_is_any_rphy_initialized(ch)) ++ if (!ch->is_otg_channel || !rcar_gen3_is_any_otg_rphy_initialized(ch)) + return -EIO; + + return sprintf(buf, "%s\n", rcar_gen3_is_host(ch) ? "host" : +@@ -370,6 +368,9 @@ static void rcar_gen3_init_otg(struct rc + void __iomem *usb2_base = ch->base; + u32 val; + ++ if (!ch->is_otg_channel || rcar_gen3_is_any_otg_rphy_initialized(ch)) ++ return; ++ + /* Should not use functions of read-modify-write a register */ + val = readl(usb2_base + USB2_LINECTRL1); + val = (val & ~USB2_LINECTRL1_DP_RPD) | USB2_LINECTRL1_DPRPD_EN | +@@ -430,12 +431,9 @@ static int rcar_gen3_phy_usb2_init(struc + writel(USB2_SPD_RSM_TIMSET_INIT, usb2_base + USB2_SPD_RSM_TIMSET); + writel(USB2_OC_TIMSET_INIT, usb2_base + USB2_OC_TIMSET); + +- /* Initialize otg part */ +- if (channel->is_otg_channel) { +- if (rcar_gen3_needs_init_otg(channel)) +- rcar_gen3_init_otg(channel); +- rphy->otg_initialized = true; +- } ++ /* Initialize otg part (only if we initialize a PHY with IRQs). */ ++ if (rphy->int_enable_bits) ++ rcar_gen3_init_otg(channel); + + rphy->initialized = true; + +@@ -451,9 +449,6 @@ static int rcar_gen3_phy_usb2_exit(struc + + rphy->initialized = false; + +- if (channel->is_otg_channel) +- rphy->otg_initialized = false; +- + val = readl(usb2_base + USB2_INT_ENABLE); + val &= ~rphy->int_enable_bits; + if (!rcar_gen3_is_any_rphy_initialized(channel)) diff --git a/queue-5.4/phy-renesas-rcar-gen3-usb2-set-timing-registers-only-once.patch b/queue-5.4/phy-renesas-rcar-gen3-usb2-set-timing-registers-only-once.patch new file mode 100644 index 0000000000..38cb079579 --- /dev/null +++ b/queue-5.4/phy-renesas-rcar-gen3-usb2-set-timing-registers-only-once.patch @@ -0,0 +1,42 @@ +From 86e70849f4b2b4597ac9f7c7931f2a363774be25 Mon Sep 17 00:00:00 2001 +From: Claudiu Beznea +Date: Wed, 7 May 2025 15:50:32 +0300 +Subject: phy: renesas: rcar-gen3-usb2: Set timing registers only once + +From: Claudiu Beznea + +commit 86e70849f4b2b4597ac9f7c7931f2a363774be25 upstream. + +phy-rcar-gen3-usb2 driver exports 4 PHYs. The timing registers are common +to all PHYs. There is no need to set them every time a PHY is initialized. +Set timing register only when the 1st PHY is initialized. + +Fixes: f3b5a8d9b50d ("phy: rcar-gen3-usb2: Add R-Car Gen3 USB2 PHY driver") +Cc: stable@vger.kernel.org +Reviewed-by: Yoshihiro Shimoda +Tested-by: Yoshihiro Shimoda +Reviewed-by: Lad Prabhakar +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20250507125032.565017-6-claudiu.beznea.uj@bp.renesas.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/renesas/phy-rcar-gen3-usb2.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c ++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +@@ -428,8 +428,11 @@ static int rcar_gen3_phy_usb2_init(struc + val = readl(usb2_base + USB2_INT_ENABLE); + val |= USB2_INT_ENABLE_UCOM_INTEN | rphy->int_enable_bits; + writel(val, usb2_base + USB2_INT_ENABLE); +- writel(USB2_SPD_RSM_TIMSET_INIT, usb2_base + USB2_SPD_RSM_TIMSET); +- writel(USB2_OC_TIMSET_INIT, usb2_base + USB2_OC_TIMSET); ++ ++ if (!rcar_gen3_is_any_rphy_initialized(channel)) { ++ writel(USB2_SPD_RSM_TIMSET_INIT, usb2_base + USB2_SPD_RSM_TIMSET); ++ writel(USB2_OC_TIMSET_INIT, usb2_base + USB2_OC_TIMSET); ++ } + + /* Initialize otg part (only if we initialize a PHY with IRQs). */ + if (rphy->int_enable_bits) diff --git a/queue-5.4/series b/queue-5.4/series index b53e91b18b..830ff745ea 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -75,3 +75,8 @@ qlcnic-fix-memory-leak-in-qlcnic_sriov_channel_cfg_c.patch nfsv4-pnfs-pnfs_set_layout_stateid-should-update-the.patch nfsv4-pnfs-reset-the-layout-state-after-a-layoutretu.patch dmaengine-revert-dmaengine-dmatest-fix-dmatest-waiting-less-when-interrupted.patch +acpi-pptt-fix-processor-subtable-walk.patch +alsa-es1968-add-error-handling-for-snd_pcm_hw_constraint_pow2.patch +phy-fix-error-handling-in-tegra_xusb_port_init.patch +phy-renesas-rcar-gen3-usb2-fix-role-detection-on-unbind-bind.patch +phy-renesas-rcar-gen3-usb2-set-timing-registers-only-once.patch