From: Greg Kroah-Hartman Date: Tue, 11 Jul 2023 20:14:06 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v6.1.39~123 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=faf91df5a3b307b80c64173fff9cba31c247f19b;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: iio-accel-fxls8962af-errata-bug-only-applicable-for-fxls8962af.patch iio-accel-fxls8962af-fixup-buffer-scan-element-type.patch iio-adc-ad7192-fix-internal-external-clock-selection.patch iio-adc-ad7192-fix-null-ad7192_state-pointer-access.patch io_uring-ensure-iopoll-locks-around-deferred-work.patch phy-tegra-xusb-clear-the-driver-reference-in-usb-phy-dev.patch usb-dwc3-gadget-propagate-core-init-errors-to-udc-during-pullup.patch usb-serial-option-add-lara-r6-01b-pids.patch --- diff --git a/queue-5.15/iio-accel-fxls8962af-errata-bug-only-applicable-for-fxls8962af.patch b/queue-5.15/iio-accel-fxls8962af-errata-bug-only-applicable-for-fxls8962af.patch new file mode 100644 index 00000000000..d780cadd05c --- /dev/null +++ b/queue-5.15/iio-accel-fxls8962af-errata-bug-only-applicable-for-fxls8962af.patch @@ -0,0 +1,36 @@ +From b410a9307bc3a7cdee3c930c98f6fc9cf1d2c484 Mon Sep 17 00:00:00 2001 +From: Sean Nyekjaer +Date: Mon, 5 Jun 2023 12:32:22 +0200 +Subject: iio: accel: fxls8962af: errata bug only applicable for FXLS8962AF + +From: Sean Nyekjaer + +commit b410a9307bc3a7cdee3c930c98f6fc9cf1d2c484 upstream. + +Remove special errata handling if FXLS8964AF is used. + +Fixes: af959b7b96b8 ("iio: accel: fxls8962af: fix errata bug E3 - I2C burst reads") +Signed-off-by: Sean Nyekjaer +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230605103223.1400980-2-sean@geanix.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/fxls8962af-core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/iio/accel/fxls8962af-core.c ++++ b/drivers/iio/accel/fxls8962af-core.c +@@ -656,9 +656,10 @@ static int fxls8962af_fifo_transfer(stru + int total_length = samples * sample_length; + int ret; + +- if (i2c_verify_client(dev)) ++ if (i2c_verify_client(dev) && ++ data->chip_info->chip_id == FXLS8962AF_DEVICE_ID) + /* +- * Due to errata bug: ++ * Due to errata bug (only applicable on fxls8962af): + * E3: FIFO burst read operation error using I2C interface + * We have to avoid burst reads on I2C.. + */ diff --git a/queue-5.15/iio-accel-fxls8962af-fixup-buffer-scan-element-type.patch b/queue-5.15/iio-accel-fxls8962af-fixup-buffer-scan-element-type.patch new file mode 100644 index 00000000000..380a1f6b353 --- /dev/null +++ b/queue-5.15/iio-accel-fxls8962af-fixup-buffer-scan-element-type.patch @@ -0,0 +1,35 @@ +From d1cfbd52ede5e5fabc09992894c5733b4057f159 Mon Sep 17 00:00:00 2001 +From: Sean Nyekjaer +Date: Mon, 5 Jun 2023 12:32:21 +0200 +Subject: iio: accel: fxls8962af: fixup buffer scan element type + +From: Sean Nyekjaer + +commit d1cfbd52ede5e5fabc09992894c5733b4057f159 upstream. + +Scan elements for x,y,z channels is little endian and requires no bit shifts. +LE vs. BE is controlled in register SENS_CONFIG2 and bit LE_BE, default +value is LE. + +Fixes: a3e0b51884ee ("iio: accel: add support for FXLS8962AF/FXLS8964AF accelerometers") +Signed-off-by: Sean Nyekjaer +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230605103223.1400980-1-sean@geanix.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/fxls8962af-core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/iio/accel/fxls8962af-core.c ++++ b/drivers/iio/accel/fxls8962af-core.c +@@ -486,8 +486,7 @@ static int fxls8962af_set_watermark(stru + .sign = 's', \ + .realbits = 12, \ + .storagebits = 16, \ +- .shift = 4, \ +- .endianness = IIO_BE, \ ++ .endianness = IIO_LE, \ + }, \ + } + diff --git a/queue-5.15/iio-adc-ad7192-fix-internal-external-clock-selection.patch b/queue-5.15/iio-adc-ad7192-fix-internal-external-clock-selection.patch new file mode 100644 index 00000000000..f4af3353258 --- /dev/null +++ b/queue-5.15/iio-adc-ad7192-fix-internal-external-clock-selection.patch @@ -0,0 +1,35 @@ +From f7d9e21dd274b97dc0a8dbc136a2ea8506063a96 Mon Sep 17 00:00:00 2001 +From: Fabrizio Lamarque +Date: Tue, 30 May 2023 09:53:08 +0200 +Subject: iio: adc: ad7192: Fix internal/external clock selection + +From: Fabrizio Lamarque + +commit f7d9e21dd274b97dc0a8dbc136a2ea8506063a96 upstream. + +Fix wrong selection of internal clock when mclk is defined. + +Resolve a logical inversion introduced in c9ec2cb328e3. + +Fixes: c9ec2cb328e3 ("iio: adc: ad7192: use devm_clk_get_optional() for mclk") +Signed-off-by: Fabrizio Lamarque +Reviewed-by: Nuno Sa +Cc: +Link: https://lore.kernel.org/r/20230530075311.400686-3-fl.scratchpad@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7192.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/ad7192.c ++++ b/drivers/iio/adc/ad7192.c +@@ -327,7 +327,7 @@ static int ad7192_of_clock_select(struct + clock_sel = AD7192_CLK_INT; + + /* use internal clock */ +- if (st->mclk) { ++ if (!st->mclk) { + if (of_property_read_bool(np, "adi,int-clock-output-enable")) + clock_sel = AD7192_CLK_INT_CO; + } else { diff --git a/queue-5.15/iio-adc-ad7192-fix-null-ad7192_state-pointer-access.patch b/queue-5.15/iio-adc-ad7192-fix-null-ad7192_state-pointer-access.patch new file mode 100644 index 00000000000..272664676aa --- /dev/null +++ b/queue-5.15/iio-adc-ad7192-fix-null-ad7192_state-pointer-access.patch @@ -0,0 +1,50 @@ +From 9e58e3a6f8e1c483c86a04903b7b7aa0923e4426 Mon Sep 17 00:00:00 2001 +From: Fabrizio Lamarque +Date: Tue, 30 May 2023 09:53:07 +0200 +Subject: iio: adc: ad7192: Fix null ad7192_state pointer access + +From: Fabrizio Lamarque + +commit 9e58e3a6f8e1c483c86a04903b7b7aa0923e4426 upstream. + +Pointer to indio_dev structure is obtained via spi_get_drvdata() at +the beginning of function ad7192_setup(), but the spi->dev->driver_data +member is not initialized, hence a NULL pointer is returned. + +Fix by changing ad7192_setup() signature to take pointer to struct +iio_dev, and get ad7192_state pointer via st = iio_priv(indio_dev); + +Fixes: bd5dcdeb3fd0 ("iio: adc: ad7192: convert to device-managed functions") +Signed-off-by: Fabrizio Lamarque +Reviewed-by: Nuno Sa +Cc: +Link: https://lore.kernel.org/r/20230530075311.400686-2-fl.scratchpad@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7192.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/iio/adc/ad7192.c ++++ b/drivers/iio/adc/ad7192.c +@@ -340,9 +340,9 @@ static int ad7192_of_clock_select(struct + return clock_sel; + } + +-static int ad7192_setup(struct ad7192_state *st, struct device_node *np) ++static int ad7192_setup(struct iio_dev *indio_dev, struct device_node *np) + { +- struct iio_dev *indio_dev = spi_get_drvdata(st->sd.spi); ++ struct ad7192_state *st = iio_priv(indio_dev); + bool rej60_en, refin2_en; + bool buf_en, bipolar, burnout_curr_en; + unsigned long long scale_uv; +@@ -1015,7 +1015,7 @@ static int ad7192_probe(struct spi_devic + } + } + +- ret = ad7192_setup(st, spi->dev.of_node); ++ ret = ad7192_setup(indio_dev, spi->dev.of_node); + if (ret) + return ret; + diff --git a/queue-5.15/io_uring-ensure-iopoll-locks-around-deferred-work.patch b/queue-5.15/io_uring-ensure-iopoll-locks-around-deferred-work.patch new file mode 100644 index 00000000000..41b38c86271 --- /dev/null +++ b/queue-5.15/io_uring-ensure-iopoll-locks-around-deferred-work.patch @@ -0,0 +1,82 @@ +From dc27db64bb7d431a853e5dcc5da01718b58bdd29 Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Tue, 11 Jul 2023 09:35:30 -0600 +Subject: io_uring: ensure IOPOLL locks around deferred work + +From: Jens Axboe + +No direct upstream commit exists for this issue. It was fixed in +5.18 as part of a larger rework of the completion side. + +io_commit_cqring() writes the CQ ring tail to make it visible, but it +also kicks off any deferred work we have. A ring setup with IOPOLL +does not need any locking around the CQ ring updates, as we're always +under the ctx uring_lock. But if we have deferred work that needs +processing, then io_queue_deferred() assumes that the completion_lock +is held, as it is for !IOPOLL. + +Add a lockdep assertion to check and document this fact, and have +io_iopoll_complete() check if we have deferred work and run that +separately with the appropriate lock grabbed. + +Cc: stable@vger.kernel.org # 5.10, 5.15 +Reported-by: dghost david +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/io_uring.c | 25 +++++++++++++++++++++---- + 1 file changed, 21 insertions(+), 4 deletions(-) + +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -1524,6 +1524,8 @@ static void io_kill_timeout(struct io_ki + + static void io_queue_deferred(struct io_ring_ctx *ctx) + { ++ lockdep_assert_held(&ctx->completion_lock); ++ + while (!list_empty(&ctx->defer_list)) { + struct io_defer_entry *de = list_first_entry(&ctx->defer_list, + struct io_defer_entry, list); +@@ -1575,14 +1577,24 @@ static void __io_commit_cqring_flush(str + io_queue_deferred(ctx); + } + +-static inline void io_commit_cqring(struct io_ring_ctx *ctx) ++static inline bool io_commit_needs_flush(struct io_ring_ctx *ctx) ++{ ++ return ctx->off_timeout_used || ctx->drain_active; ++} ++ ++static inline void __io_commit_cqring(struct io_ring_ctx *ctx) + { +- if (unlikely(ctx->off_timeout_used || ctx->drain_active)) +- __io_commit_cqring_flush(ctx); + /* order cqe stores with ring update */ + smp_store_release(&ctx->rings->cq.tail, ctx->cached_cq_tail); + } + ++static inline void io_commit_cqring(struct io_ring_ctx *ctx) ++{ ++ if (unlikely(io_commit_needs_flush(ctx))) ++ __io_commit_cqring_flush(ctx); ++ __io_commit_cqring(ctx); ++} ++ + static inline bool io_sqring_full(struct io_ring_ctx *ctx) + { + struct io_rings *r = ctx->rings; +@@ -2521,7 +2533,12 @@ static void io_iopoll_complete(struct io + io_req_free_batch(&rb, req, &ctx->submit_state); + } + +- io_commit_cqring(ctx); ++ if (io_commit_needs_flush(ctx)) { ++ spin_lock(&ctx->completion_lock); ++ __io_commit_cqring_flush(ctx); ++ spin_unlock(&ctx->completion_lock); ++ } ++ __io_commit_cqring(ctx); + io_cqring_ev_posted_iopoll(ctx); + io_req_free_batch_finish(ctx, &rb); + } diff --git a/queue-5.15/phy-tegra-xusb-clear-the-driver-reference-in-usb-phy-dev.patch b/queue-5.15/phy-tegra-xusb-clear-the-driver-reference-in-usb-phy-dev.patch new file mode 100644 index 00000000000..530050d69cc --- /dev/null +++ b/queue-5.15/phy-tegra-xusb-clear-the-driver-reference-in-usb-phy-dev.patch @@ -0,0 +1,40 @@ +From c0c2fcb1325d0d4f3b322b5ee49385f8eca2560d Mon Sep 17 00:00:00 2001 +From: EJ Hsu +Date: Fri, 9 Jun 2023 14:29:32 +0800 +Subject: phy: tegra: xusb: Clear the driver reference in usb-phy dev + +From: EJ Hsu + +commit c0c2fcb1325d0d4f3b322b5ee49385f8eca2560d upstream. + +For the dual-role port, it will assign the phy dev to usb-phy dev and +use the port dev driver as the dev driver of usb-phy. + +When we try to destroy the port dev, it will destroy its dev driver +as well. But we did not remove the reference from usb-phy dev. This +might cause the use-after-free issue in KASAN. + +Fixes: e8f7d2f409a1 ("phy: tegra: xusb: Add usb-phy support") +Cc: stable@vger.kernel.org + +Signed-off-by: EJ Hsu +Signed-off-by: Haotien Hsu +Acked-by: Thierry Reding +Acked-by: Jon Hunter +Link: https://lore.kernel.org/r/20230609062932.3276509-1-haotienh@nvidia.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/tegra/xusb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -562,6 +562,7 @@ static void tegra_xusb_port_unregister(s + usb_role_switch_unregister(port->usb_role_sw); + cancel_work_sync(&port->usb_phy_work); + usb_remove_phy(&port->usb_phy); ++ port->usb_phy.dev->driver = NULL; + } + + if (port->ops->remove) diff --git a/queue-5.15/series b/queue-5.15/series index ccef3d10691..9eb55f87889 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -256,3 +256,11 @@ efi-libstub-disable-pci-dma-before-grabbing-the-efi-.patch ksmbd-avoid-field-overflow-warning.patch acpi-utils-fix-acpi_evaluate_dsm_typed-redefinition-.patch bootmem-remove-the-vmemmap-pages-from-kmemleak-in-free_bootmem_page.patch +io_uring-ensure-iopoll-locks-around-deferred-work.patch +usb-serial-option-add-lara-r6-01b-pids.patch +usb-dwc3-gadget-propagate-core-init-errors-to-udc-during-pullup.patch +phy-tegra-xusb-clear-the-driver-reference-in-usb-phy-dev.patch +iio-adc-ad7192-fix-null-ad7192_state-pointer-access.patch +iio-adc-ad7192-fix-internal-external-clock-selection.patch +iio-accel-fxls8962af-errata-bug-only-applicable-for-fxls8962af.patch +iio-accel-fxls8962af-fixup-buffer-scan-element-type.patch diff --git a/queue-5.15/usb-dwc3-gadget-propagate-core-init-errors-to-udc-during-pullup.patch b/queue-5.15/usb-dwc3-gadget-propagate-core-init-errors-to-udc-during-pullup.patch new file mode 100644 index 00000000000..80e42fcee14 --- /dev/null +++ b/queue-5.15/usb-dwc3-gadget-propagate-core-init-errors-to-udc-during-pullup.patch @@ -0,0 +1,52 @@ +From c0aabed9cabe057309779a9e26fe86a113d24dad Mon Sep 17 00:00:00 2001 +From: Krishna Kurapati +Date: Sun, 18 Jun 2023 17:39:49 +0530 +Subject: usb: dwc3: gadget: Propagate core init errors to UDC during pullup + +From: Krishna Kurapati + +commit c0aabed9cabe057309779a9e26fe86a113d24dad upstream. + +In scenarios where pullup relies on resume (get sync) to initialize +the controller and set the run stop bit, then core_init is followed by +gadget_resume which will eventually set run stop bit. + +But in cases where the core_init fails, the return value is not sent +back to udc appropriately. So according to UDC the controller has +started but in reality we never set the run stop bit. + +On systems like Android, there are uevents sent to HAL depending on +whether the configfs_bind / configfs_disconnect were invoked. In the +above mentioned scnenario, if the core init fails, the run stop won't +be set and the cable plug-out won't result in generation of any +disconnect event and userspace would never get any uevent regarding +cable plug out and we never call pullup(0) again. Furthermore none of +the next Plug-In/Plug-Out's would be known to configfs. + +Return back the appropriate result to UDC to let the userspace/ +configfs know that the pullup failed so they can take appropriate +action. + +Fixes: 77adb8bdf422 ("usb: dwc3: gadget: Allow runtime suspend if UDC unbinded") +Cc: stable +Signed-off-by: Krishna Kurapati +Acked-by: Thinh Nguyen +Message-ID: <20230618120949.14868-1-quic_kriskura@quicinc.com> +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2530,7 +2530,9 @@ static int dwc3_gadget_pullup(struct usb + ret = pm_runtime_get_sync(dwc->dev); + if (!ret || ret < 0) { + pm_runtime_put(dwc->dev); +- return 0; ++ if (ret < 0) ++ pm_runtime_set_suspended(dwc->dev); ++ return ret; + } + + if (dwc->pullups_connected == is_on) { diff --git a/queue-5.15/usb-serial-option-add-lara-r6-01b-pids.patch b/queue-5.15/usb-serial-option-add-lara-r6-01b-pids.patch new file mode 100644 index 00000000000..2e014e97597 --- /dev/null +++ b/queue-5.15/usb-serial-option-add-lara-r6-01b-pids.patch @@ -0,0 +1,65 @@ +From ffa5f7a3bf28c1306eef85d4056539c2d4b8eb09 Mon Sep 17 00:00:00 2001 +From: Davide Tronchin +Date: Thu, 22 Jun 2023 11:29:21 +0200 +Subject: USB: serial: option: add LARA-R6 01B PIDs + +From: Davide Tronchin + +commit ffa5f7a3bf28c1306eef85d4056539c2d4b8eb09 upstream. + +The new LARA-R6 product variant identified by the "01B" string can be +configured (by AT interface) in three different USB modes: + +* Default mode (Vendor ID: 0x1546 Product ID: 0x1311) with 4 serial +interfaces + +* RmNet mode (Vendor ID: 0x1546 Product ID: 0x1312) with 4 serial +interfaces and 1 RmNet virtual network interface + +* CDC-ECM mode (Vendor ID: 0x1546 Product ID: 0x1313) with 4 serial +interface and 1 CDC-ECM virtual network interface +The first 4 interfaces of all the 3 USB configurations (default, RmNet, +CDC-ECM) are the same. + +In default mode LARA-R6 01B exposes the following interfaces: +If 0: Diagnostic +If 1: AT parser +If 2: AT parser +If 3: AT parser/alternative functions + +In RmNet mode LARA-R6 01B exposes the following interfaces: +If 0: Diagnostic +If 1: AT parser +If 2: AT parser +If 3: AT parser/alternative functions +If 4: RMNET interface + +In CDC-ECM mode LARA-R6 01B exposes the following interfaces: +If 0: Diagnostic +If 1: AT parser +If 2: AT parser +If 3: AT parser/alternative functions +If 4: CDC-ECM interface + +Signed-off-by: Davide Tronchin +Link: https://lore.kernel.org/r/20230622092921.12651-1-davide.tronchin.94@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1151,6 +1151,10 @@ static const struct usb_device_id option + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x90fa), + .driver_info = RSVD(3) }, + /* u-blox products */ ++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1311) }, /* u-blox LARA-R6 01B */ ++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1312), /* u-blox LARA-R6 01B (RMNET) */ ++ .driver_info = RSVD(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(UBLOX_VENDOR_ID, 0x1313, 0xff) }, /* u-blox LARA-R6 01B (ECM) */ + { USB_DEVICE(UBLOX_VENDOR_ID, 0x1341) }, /* u-blox LARA-L6 */ + { USB_DEVICE(UBLOX_VENDOR_ID, 0x1342), /* u-blox LARA-L6 (RMNET) */ + .driver_info = RSVD(4) },