From: Greg Kroah-Hartman Date: Fri, 3 Jan 2025 14:54:46 +0000 (+0100) Subject: 6.12-stable patches X-Git-Tag: v5.4.289~65 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=edd231e77445f7293004a6059bec5717b618ce5f;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: drm-amdgpu-fix-backport-of-commit-73dae652dcac.patch mmc-sdhci-msm-fix-crypto-key-eviction.patch platform-x86-hp-wmi-mark-8a15-board-for-timed-omen-thermal-profile.patch platform-x86-thinkpad-acpi-add-support-for-hotkey-0x1401.patch pmdomain-core-add-dummy-release-function-to-genpd-device.patch pmdomain-imx-gpcv2-fix-an-of-node-reference-leak-in-imx_gpcv2_probe.patch selinux-ignore-unknown-extended-permissions.patch tracing-have-process_string-also-allow-arrays.patch --- diff --git a/queue-6.12/drm-amdgpu-fix-backport-of-commit-73dae652dcac.patch b/queue-6.12/drm-amdgpu-fix-backport-of-commit-73dae652dcac.patch new file mode 100644 index 00000000000..f6d69988d0c --- /dev/null +++ b/queue-6.12/drm-amdgpu-fix-backport-of-commit-73dae652dcac.patch @@ -0,0 +1,42 @@ +From alexander.deucher@amd.com Fri Jan 3 15:36:56 2025 +From: Alex Deucher +Date: Fri, 27 Dec 2024 02:37:00 -0500 +Subject: drm/amdgpu: fix backport of commit 73dae652dcac +To: , , +Cc: Alex Deucher +Message-ID: <20241227073700.3102801-1-alexander.deucher@amd.com> + +From: Alex Deucher + +Commit 73dae652dcac ("drm/amdgpu: rework resume handling for display (v2)") +missed a small code change when it was backported resulting in an automatic +backlight control breakage. Fix the backport. + +Note that this patch is not in Linus' tree as it is not required there; +the bug was introduced in the backport. + +Fixes: 99a02eab8251 ("drm/amdgpu: rework resume handling for display (v2)") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3853 +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.11.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -3721,8 +3721,12 @@ static int amdgpu_device_ip_resume_phase + continue; + if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_DCE) { + r = adev->ip_blocks[i].version->funcs->resume(adev); +- if (r) ++ if (r) { ++ DRM_ERROR("resume of IP block <%s> failed %d\n", ++ adev->ip_blocks[i].version->funcs->name, r); + return r; ++ } ++ adev->ip_blocks[i].status.hw = true; + } + } + diff --git a/queue-6.12/mmc-sdhci-msm-fix-crypto-key-eviction.patch b/queue-6.12/mmc-sdhci-msm-fix-crypto-key-eviction.patch new file mode 100644 index 00000000000..a97863eaf83 --- /dev/null +++ b/queue-6.12/mmc-sdhci-msm-fix-crypto-key-eviction.patch @@ -0,0 +1,55 @@ +From 8d90a86ed053226a297ce062f4d9f4f521e05c4c Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Thu, 12 Dec 2024 20:19:48 -0800 +Subject: mmc: sdhci-msm: fix crypto key eviction + +From: Eric Biggers + +commit 8d90a86ed053226a297ce062f4d9f4f521e05c4c upstream. + +Commit c7eed31e235c ("mmc: sdhci-msm: Switch to the new ICE API") +introduced an incorrect check of the algorithm ID into the key eviction +path, and thus qcom_ice_evict_key() is no longer ever called. Fix it. + +Fixes: c7eed31e235c ("mmc: sdhci-msm: Switch to the new ICE API") +Cc: stable@vger.kernel.org +Cc: Abel Vesa +Signed-off-by: Eric Biggers +Message-ID: <20241213041958.202565-6-ebiggers@kernel.org> +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-msm.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/mmc/host/sdhci-msm.c ++++ b/drivers/mmc/host/sdhci-msm.c +@@ -1867,20 +1867,20 @@ static int sdhci_msm_program_key(struct + struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host); + union cqhci_crypto_cap_entry cap; + ++ if (!(cfg->config_enable & CQHCI_CRYPTO_CONFIGURATION_ENABLE)) ++ return qcom_ice_evict_key(msm_host->ice, slot); ++ + /* Only AES-256-XTS has been tested so far. */ + cap = cq_host->crypto_cap_array[cfg->crypto_cap_idx]; + if (cap.algorithm_id != CQHCI_CRYPTO_ALG_AES_XTS || + cap.key_size != CQHCI_CRYPTO_KEY_SIZE_256) + return -EINVAL; + +- if (cfg->config_enable & CQHCI_CRYPTO_CONFIGURATION_ENABLE) +- return qcom_ice_program_key(msm_host->ice, +- QCOM_ICE_CRYPTO_ALG_AES_XTS, +- QCOM_ICE_CRYPTO_KEY_SIZE_256, +- cfg->crypto_key, +- cfg->data_unit_size, slot); +- else +- return qcom_ice_evict_key(msm_host->ice, slot); ++ return qcom_ice_program_key(msm_host->ice, ++ QCOM_ICE_CRYPTO_ALG_AES_XTS, ++ QCOM_ICE_CRYPTO_KEY_SIZE_256, ++ cfg->crypto_key, ++ cfg->data_unit_size, slot); + } + + #else /* CONFIG_MMC_CRYPTO */ diff --git a/queue-6.12/platform-x86-hp-wmi-mark-8a15-board-for-timed-omen-thermal-profile.patch b/queue-6.12/platform-x86-hp-wmi-mark-8a15-board-for-timed-omen-thermal-profile.patch new file mode 100644 index 00000000000..ecd7128797c --- /dev/null +++ b/queue-6.12/platform-x86-hp-wmi-mark-8a15-board-for-timed-omen-thermal-profile.patch @@ -0,0 +1,64 @@ +From 032fe9b0516702599c2dd990a4703f783d5716b8 Mon Sep 17 00:00:00 2001 +From: Mingcong Bai +Date: Thu, 26 Dec 2024 14:22:05 +0800 +Subject: platform/x86: hp-wmi: mark 8A15 board for timed OMEN thermal profile +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mingcong Bai + +commit 032fe9b0516702599c2dd990a4703f783d5716b8 upstream. + +The HP OMEN 8 (2022), corresponding to a board ID of 8A15, supports OMEN +thermal profile and requires the timed profile quirk. + +Upon adding this ID to both the omen_thermal_profile_boards and +omen_timed_thermal_profile_boards, significant bump in performance can be +observed. For instance, SilverBench (https://silver.urih.com/) results +improved from ~56,000 to ~69,000, as a result of higher power draws (and +thus core frequencies) whilst under load: + +Package Power: + +- Before the patch: ~65W (dropping to about 55W under sustained load). +- After the patch: ~115W (dropping to about 105W under sustained load). + +Core Power: + +- Before: ~60W (ditto above). +- After: ~108W (ditto above). + +Add 8A15 to omen_thermal_profile_boards and +omen_timed_thermal_profile_boards to improve performance. + +Signed-off-by: Xi Xiao <1577912515@qq.com> +Signed-off-by: Mingcong Bai +Link: https://lore.kernel.org/r/20241226062207.3352629-1-jeffbai@aosc.io +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/hp/hp-wmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/platform/x86/hp/hp-wmi.c ++++ b/drivers/platform/x86/hp/hp-wmi.c +@@ -64,7 +64,7 @@ static const char * const omen_thermal_p + "874A", "8603", "8604", "8748", "886B", "886C", "878A", "878B", "878C", + "88C8", "88CB", "8786", "8787", "8788", "88D1", "88D2", "88F4", "88FD", + "88F5", "88F6", "88F7", "88FE", "88FF", "8900", "8901", "8902", "8912", +- "8917", "8918", "8949", "894A", "89EB", "8BAD", "8A42" ++ "8917", "8918", "8949", "894A", "89EB", "8BAD", "8A42", "8A15" + }; + + /* DMI Board names of Omen laptops that are specifically set to be thermal +@@ -80,7 +80,7 @@ static const char * const omen_thermal_p + * "balanced" when reaching zero. + */ + static const char * const omen_timed_thermal_profile_boards[] = { +- "8BAD", "8A42" ++ "8BAD", "8A42", "8A15" + }; + + /* DMI Board names of Victus laptops */ diff --git a/queue-6.12/platform-x86-thinkpad-acpi-add-support-for-hotkey-0x1401.patch b/queue-6.12/platform-x86-thinkpad-acpi-add-support-for-hotkey-0x1401.patch new file mode 100644 index 00000000000..be996adb841 --- /dev/null +++ b/queue-6.12/platform-x86-thinkpad-acpi-add-support-for-hotkey-0x1401.patch @@ -0,0 +1,76 @@ +From 7e16ae558a87ac9099b6a93a43f19b42d809fd78 Mon Sep 17 00:00:00 2001 +From: Vishnu Sankar +Date: Sat, 28 Dec 2024 08:18:40 +0900 +Subject: platform/x86: thinkpad-acpi: Add support for hotkey 0x1401 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vishnu Sankar + +commit 7e16ae558a87ac9099b6a93a43f19b42d809fd78 upstream. + +F8 mode key on Lenovo 2025 platforms use a different key code. +Adding support for the new keycode 0x1401. + +Tested on X1 Carbon Gen 13 and X1 2-in-1 Gen 10. + +Signed-off-by: Vishnu Sankar +Reviewed-by: Mark Pearson +Link: https://lore.kernel.org/r/20241227231840.21334-1-vishnuocv@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/admin-guide/laptops/thinkpad-acpi.rst | 10 +++++++--- + drivers/platform/x86/thinkpad_acpi.c | 4 +++- + 2 files changed, 10 insertions(+), 4 deletions(-) + +--- a/Documentation/admin-guide/laptops/thinkpad-acpi.rst ++++ b/Documentation/admin-guide/laptops/thinkpad-acpi.rst +@@ -445,8 +445,10 @@ event code Key Notes + 0x1008 0x07 FN+F8 IBM: toggle screen expand + Lenovo: configure UltraNav, + or toggle screen expand. +- On newer platforms (2024+) +- replaced by 0x131f (see below) ++ On 2024 platforms replaced by ++ 0x131f (see below) and on newer ++ platforms (2025 +) keycode is ++ replaced by 0x1401 (see below). + + 0x1009 0x08 FN+F9 - + +@@ -506,9 +508,11 @@ event code Key Notes + + 0x1019 0x18 unknown + +-0x131f ... FN+F8 Platform Mode change. ++0x131f ... FN+F8 Platform Mode change (2024 systems). + Implemented in driver. + ++0x1401 ... FN+F8 Platform Mode change (2025 + systems). ++ Implemented in driver. + ... ... ... + + 0x1020 0x1F unknown +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -184,7 +184,8 @@ enum tpacpi_hkey_event_t { + */ + TP_HKEY_EV_AMT_TOGGLE = 0x131a, /* Toggle AMT on/off */ + TP_HKEY_EV_DOUBLETAP_TOGGLE = 0x131c, /* Toggle trackpoint doubletap on/off */ +- TP_HKEY_EV_PROFILE_TOGGLE = 0x131f, /* Toggle platform profile */ ++ TP_HKEY_EV_PROFILE_TOGGLE = 0x131f, /* Toggle platform profile in 2024 systems */ ++ TP_HKEY_EV_PROFILE_TOGGLE2 = 0x1401, /* Toggle platform profile in 2025 + systems */ + + /* Reasons for waking up from S3/S4 */ + TP_HKEY_EV_WKUP_S3_UNDOCK = 0x2304, /* undock requested, S3 */ +@@ -11200,6 +11201,7 @@ static bool tpacpi_driver_event(const un + tp_features.trackpoint_doubletap = !tp_features.trackpoint_doubletap; + return true; + case TP_HKEY_EV_PROFILE_TOGGLE: ++ case TP_HKEY_EV_PROFILE_TOGGLE2: + platform_profile_cycle(); + return true; + } diff --git a/queue-6.12/pmdomain-core-add-dummy-release-function-to-genpd-device.patch b/queue-6.12/pmdomain-core-add-dummy-release-function-to-genpd-device.patch new file mode 100644 index 00000000000..2fc9817d541 --- /dev/null +++ b/queue-6.12/pmdomain-core-add-dummy-release-function-to-genpd-device.patch @@ -0,0 +1,51 @@ +From f64f610ec6ab59dd0391b03842cea3a4cd8ee34f Mon Sep 17 00:00:00 2001 +From: Lucas Stach +Date: Wed, 18 Dec 2024 19:44:33 +0100 +Subject: pmdomain: core: add dummy release function to genpd device + +From: Lucas Stach + +commit f64f610ec6ab59dd0391b03842cea3a4cd8ee34f upstream. + +The genpd device, which is really only used as a handle to lookup +OPP, but not even registered to the device core otherwise and thus +lifetime linked to the genpd struct it is contained in, is missing +a release function. After b8f7bbd1f4ec ("pmdomain: core: Add +missing put_device()") the device will be cleaned up going through +the driver core device_release() function, which will warn when no +release callback is present for the device. Add a dummy release +function to shut up the warning. + +Signed-off-by: Lucas Stach +Tested-by: Luca Ceresoli +Fixes: b8f7bbd1f4ec ("pmdomain: core: Add missing put_device()") +Cc: stable@vger.kernel.org +Message-ID: <20241218184433.1930532-1-l.stach@pengutronix.de> +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/pmdomain/core.c ++++ b/drivers/pmdomain/core.c +@@ -2141,6 +2141,11 @@ static int genpd_set_default_power_state + return 0; + } + ++static void genpd_provider_release(struct device *dev) ++{ ++ /* nothing to be done here */ ++} ++ + static int genpd_alloc_data(struct generic_pm_domain *genpd) + { + struct genpd_governor_data *gd = NULL; +@@ -2172,6 +2177,7 @@ static int genpd_alloc_data(struct gener + + genpd->gd = gd; + device_initialize(&genpd->dev); ++ genpd->dev.release = genpd_provider_release; + + if (!genpd_is_dev_name_fw(genpd)) { + dev_set_name(&genpd->dev, "%s", genpd->name); diff --git a/queue-6.12/pmdomain-imx-gpcv2-fix-an-of-node-reference-leak-in-imx_gpcv2_probe.patch b/queue-6.12/pmdomain-imx-gpcv2-fix-an-of-node-reference-leak-in-imx_gpcv2_probe.patch new file mode 100644 index 00000000000..7418002ce49 --- /dev/null +++ b/queue-6.12/pmdomain-imx-gpcv2-fix-an-of-node-reference-leak-in-imx_gpcv2_probe.patch @@ -0,0 +1,43 @@ +From 469c0682e03d67d8dc970ecaa70c2d753057c7c0 Mon Sep 17 00:00:00 2001 +From: Joe Hattori +Date: Sun, 15 Dec 2024 12:01:59 +0900 +Subject: pmdomain: imx: gpcv2: fix an OF node reference leak in imx_gpcv2_probe() + +From: Joe Hattori + +commit 469c0682e03d67d8dc970ecaa70c2d753057c7c0 upstream. + +imx_gpcv2_probe() leaks an OF node reference obtained by +of_get_child_by_name(). Fix it by declaring the device node with the +__free(device_node) cleanup construct. + +This bug was found by an experimental static analysis tool that I am +developing. + +Fixes: 03aa12629fc4 ("soc: imx: Add GPCv2 power gating driver") +Signed-off-by: Joe Hattori +Cc: stable@vger.kernel.org +Message-ID: <20241215030159.1526624-1-joe@pf.is.s.u-tokyo.ac.jp> +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/imx/gpcv2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/pmdomain/imx/gpcv2.c ++++ b/drivers/pmdomain/imx/gpcv2.c +@@ -1458,12 +1458,12 @@ static int imx_gpcv2_probe(struct platfo + .max_register = SZ_4K, + }; + struct device *dev = &pdev->dev; +- struct device_node *pgc_np; ++ struct device_node *pgc_np __free(device_node) = ++ of_get_child_by_name(dev->of_node, "pgc"); + struct regmap *regmap; + void __iomem *base; + int ret; + +- pgc_np = of_get_child_by_name(dev->of_node, "pgc"); + if (!pgc_np) { + dev_err(dev, "No power domains specified in DT\n"); + return -EINVAL; diff --git a/queue-6.12/selinux-ignore-unknown-extended-permissions.patch b/queue-6.12/selinux-ignore-unknown-extended-permissions.patch new file mode 100644 index 00000000000..db6097d5e58 --- /dev/null +++ b/queue-6.12/selinux-ignore-unknown-extended-permissions.patch @@ -0,0 +1,50 @@ +From 900f83cf376bdaf798b6f5dcb2eae0c822e908b6 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Thi=C3=A9baud=20Weksteen?= +Date: Thu, 5 Dec 2024 12:09:19 +1100 +Subject: selinux: ignore unknown extended permissions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thiébaud Weksteen + +commit 900f83cf376bdaf798b6f5dcb2eae0c822e908b6 upstream. + +When evaluating extended permissions, ignore unknown permissions instead +of calling BUG(). This commit ensures that future permissions can be +added without interfering with older kernels. + +Cc: stable@vger.kernel.org +Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls") +Signed-off-by: Thiébaud Weksteen +Signed-off-by: Paul Moore +Acked-by: Paul Moore +Signed-off-by: Greg Kroah-Hartman +--- + security/selinux/ss/services.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/security/selinux/ss/services.c ++++ b/security/selinux/ss/services.c +@@ -955,7 +955,10 @@ void services_compute_xperms_decision(st + xpermd->driver)) + return; + } else { +- BUG(); ++ pr_warn_once( ++ "SELinux: unknown extended permission (%u) will be ignored\n", ++ node->datum.u.xperms->specified); ++ return; + } + + if (node->key.specified == AVTAB_XPERMS_ALLOWED) { +@@ -992,7 +995,8 @@ void services_compute_xperms_decision(st + node->datum.u.xperms->perms.p[i]; + } + } else { +- BUG(); ++ pr_warn_once("SELinux: unknown specified key (%u)\n", ++ node->key.specified); + } + } + diff --git a/queue-6.12/series b/queue-6.12/series index b2d485096bf..8d536db5373 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -1 +1,9 @@ platform-x86-mlx-platform-call-pci_dev_put-to-balanc.patch +drm-amdgpu-fix-backport-of-commit-73dae652dcac.patch +platform-x86-thinkpad-acpi-add-support-for-hotkey-0x1401.patch +platform-x86-hp-wmi-mark-8a15-board-for-timed-omen-thermal-profile.patch +selinux-ignore-unknown-extended-permissions.patch +mmc-sdhci-msm-fix-crypto-key-eviction.patch +pmdomain-imx-gpcv2-fix-an-of-node-reference-leak-in-imx_gpcv2_probe.patch +pmdomain-core-add-dummy-release-function-to-genpd-device.patch +tracing-have-process_string-also-allow-arrays.patch diff --git a/queue-6.12/tracing-have-process_string-also-allow-arrays.patch b/queue-6.12/tracing-have-process_string-also-allow-arrays.patch new file mode 100644 index 00000000000..1b780aba764 --- /dev/null +++ b/queue-6.12/tracing-have-process_string-also-allow-arrays.patch @@ -0,0 +1,67 @@ +From afc6717628f959941d7b33728570568b4af1c4b8 Mon Sep 17 00:00:00 2001 +From: Steven Rostedt +Date: Tue, 31 Dec 2024 00:06:46 -0500 +Subject: tracing: Have process_string() also allow arrays + +From: Steven Rostedt + +commit afc6717628f959941d7b33728570568b4af1c4b8 upstream. + +In order to catch a common bug where a TRACE_EVENT() TP_fast_assign() +assigns an address of an allocated string to the ring buffer and then +references it in TP_printk(), which can be executed hours later when the +string is free, the function test_event_printk() runs on all events as +they are registered to make sure there's no unwanted dereferencing. + +It calls process_string() to handle cases in TP_printk() format that has +"%s". It returns whether or not the string is safe. But it can have some +false positives. + +For instance, xe_bo_move() has: + + TP_printk("move_lacks_source:%s, migrate object %p [size %zu] from %s to %s device_id:%s", + __entry->move_lacks_source ? "yes" : "no", __entry->bo, __entry->size, + xe_mem_type_to_name[__entry->old_placement], + xe_mem_type_to_name[__entry->new_placement], __get_str(device_id)) + +Where the "%s" references into xe_mem_type_to_name[]. This is an array of +pointers that should be safe for the event to access. Instead of flagging +this as a bad reference, if a reference points to an array, where the +record field is the index, consider it safe. + +Link: https://lore.kernel.org/all/9dee19b6185d325d0e6fa5f7cbba81d007d99166.camel@sapience.com/ + +Cc: stable@vger.kernel.org +Cc: Masami Hiramatsu +Cc: Mathieu Desnoyers +Link: https://lore.kernel.org/20241231000646.324fb5f7@gandalf.local.home +Fixes: 65a25d9f7ac02 ("tracing: Add "%s" check in test_event_printk()") +Reported-by: Genes Lists +Tested-by: Gene C +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_events.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -365,6 +365,18 @@ static bool process_string(const char *f + } while (s < e); + + /* ++ * Check for arrays. If the argument has: foo[REC->val] ++ * then it is very likely that foo is an array of strings ++ * that are safe to use. ++ */ ++ r = strstr(s, "["); ++ if (r && r < e) { ++ r = strstr(r, "REC->"); ++ if (r && r < e) ++ return true; ++ } ++ ++ /* + * If there's any strings in the argument consider this arg OK as it + * could be: REC->field ? "foo" : "bar" and we don't want to get into + * verifying that logic here.