From 319b91467134d339471a77351d82590584a5db68 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 8 Aug 2022 15:57:25 +0200 Subject: [PATCH] 5.15-stable patches added patches: bluetooth-btusb-add-realtek-rtl8852c-support-id-0x04c5-0x1675.patch bluetooth-btusb-add-realtek-rtl8852c-support-id-0x04ca-0x4007.patch bluetooth-btusb-add-realtek-rtl8852c-support-id-0x0cb8-0xc558.patch bluetooth-btusb-add-realtek-rtl8852c-support-id-0x13d3-0x3586.patch bluetooth-btusb-add-realtek-rtl8852c-support-id-0x13d3-0x3587.patch bluetooth-btusb-add-support-of-imc-networks-pid-0x3568.patch bluetooth-hci_bcm-add-bcm4349b1-variant.patch bluetooth-hci_bcm-add-dt-compatible-for-cyw55572.patch btrfs-zoned-fix-critical-section-of-relocation-inode-writeback.patch btrfs-zoned-prevent-allocation-from-previous-data-relocation-bg.patch dt-bindings-bluetooth-broadcom-add-bcm4349b1-dt-binding.patch macintosh-adb-fix-oob-read-in-do_adb_query-function.patch --- ...ek-rtl8852c-support-id-0x04c5-0x1675.patch | 62 ++++++ ...ek-rtl8852c-support-id-0x04ca-0x4007.patch | 64 ++++++ ...ek-rtl8852c-support-id-0x0cb8-0xc558.patch | 62 ++++++ ...ek-rtl8852c-support-id-0x13d3-0x3586.patch | 62 ++++++ ...ek-rtl8852c-support-id-0x13d3-0x3587.patch | 62 ++++++ ...d-support-of-imc-networks-pid-0x3568.patch | 48 +++++ ...etooth-hci_bcm-add-bcm4349b1-variant.patch | 47 +++++ ...i_bcm-add-dt-compatible-for-cyw55572.patch | 29 +++ ...ection-of-relocation-inode-writeback.patch | 46 +++++ ...ion-from-previous-data-relocation-bg.patch | 187 ++++++++++++++++++ ...th-broadcom-add-bcm4349b1-dt-binding.patch | 32 +++ ...ix-oob-read-in-do_adb_query-function.patch | 37 ++++ queue-5.15/series | 12 ++ 13 files changed, 750 insertions(+) create mode 100644 queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x04c5-0x1675.patch create mode 100644 queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x04ca-0x4007.patch create mode 100644 queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x0cb8-0xc558.patch create mode 100644 queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x13d3-0x3586.patch create mode 100644 queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x13d3-0x3587.patch create mode 100644 queue-5.15/bluetooth-btusb-add-support-of-imc-networks-pid-0x3568.patch create mode 100644 queue-5.15/bluetooth-hci_bcm-add-bcm4349b1-variant.patch create mode 100644 queue-5.15/bluetooth-hci_bcm-add-dt-compatible-for-cyw55572.patch create mode 100644 queue-5.15/btrfs-zoned-fix-critical-section-of-relocation-inode-writeback.patch create mode 100644 queue-5.15/btrfs-zoned-prevent-allocation-from-previous-data-relocation-bg.patch create mode 100644 queue-5.15/dt-bindings-bluetooth-broadcom-add-bcm4349b1-dt-binding.patch create mode 100644 queue-5.15/macintosh-adb-fix-oob-read-in-do_adb_query-function.patch diff --git a/queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x04c5-0x1675.patch b/queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x04c5-0x1675.patch new file mode 100644 index 00000000000..57008be199f --- /dev/null +++ b/queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x04c5-0x1675.patch @@ -0,0 +1,62 @@ +From 893fa8bc9952a36fb682ee12f0a994b5817a36d2 Mon Sep 17 00:00:00 2001 +From: Hilda Wu +Date: Thu, 14 Jul 2022 19:25:20 +0800 +Subject: Bluetooth: btusb: Add Realtek RTL8852C support ID 0x04C5:0x1675 + +From: Hilda Wu + +commit 893fa8bc9952a36fb682ee12f0a994b5817a36d2 upstream. + +Add the support ID(0x04c5, 0x1675) to usb_device_id table for +Realtek RTL8852C. + +The device info from /sys/kernel/debug/usb/devices as below. + +T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=04c5 ProdID=1675 Rev= 0.00 +S: Manufacturer=Realtek +S: Product=Bluetooth Radio +S: SerialNumber=00e04c000001 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms + +Signed-off-by: Hilda Wu +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -423,6 +423,8 @@ static const struct usb_device_id blackl + /* Realtek 8852CE Bluetooth devices */ + { USB_DEVICE(0x04ca, 0x4007), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x04c5, 0x1675), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + + /* Realtek Bluetooth devices */ + { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01), diff --git a/queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x04ca-0x4007.patch b/queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x04ca-0x4007.patch new file mode 100644 index 00000000000..03bee929aac --- /dev/null +++ b/queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x04ca-0x4007.patch @@ -0,0 +1,64 @@ +From c379c96cc221767af9688a5d4758a78eea30883a Mon Sep 17 00:00:00 2001 +From: Hilda Wu +Date: Thu, 14 Jul 2022 19:25:19 +0800 +Subject: Bluetooth: btusb: Add Realtek RTL8852C support ID 0x04CA:0x4007 + +From: Hilda Wu + +commit c379c96cc221767af9688a5d4758a78eea30883a upstream. + +Add the support ID(0x04CA, 0x4007) to usb_device_id table for +Realtek RTL8852C. + +The device info from /sys/kernel/debug/usb/devices as below. + +T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=04ca ProdID=4007 Rev= 0.00 +S: Manufacturer=Realtek +S: Product=Bluetooth Radio +S: SerialNumber=00e04c000001 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms + +Signed-off-by: Hilda Wu +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -420,6 +420,10 @@ static const struct usb_device_id blackl + { USB_DEVICE(0x04ca, 0x4006), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, + ++ /* Realtek 8852CE Bluetooth devices */ ++ { USB_DEVICE(0x04ca, 0x4007), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, ++ + /* Realtek Bluetooth devices */ + { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01), + .driver_info = BTUSB_REALTEK }, diff --git a/queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x0cb8-0xc558.patch b/queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x0cb8-0xc558.patch new file mode 100644 index 00000000000..586190f2db3 --- /dev/null +++ b/queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x0cb8-0xc558.patch @@ -0,0 +1,62 @@ +From 5b75ee37ebb73f58468d4cca172434324af203f1 Mon Sep 17 00:00:00 2001 +From: Hilda Wu +Date: Thu, 14 Jul 2022 19:25:21 +0800 +Subject: Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0CB8:0xC558 + +From: Hilda Wu + +commit 5b75ee37ebb73f58468d4cca172434324af203f1 upstream. + +Add the support ID(0x0CB8, 0xC558) to usb_device_id table for +Realtek RTL8852C. + +The device info from /sys/kernel/debug/usb/devices as below. + +T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0cb8 ProdID=c558 Rev= 0.00 +S: Manufacturer=Realtek +S: Product=Bluetooth Radio +S: SerialNumber=00e04c000001 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms + +Signed-off-by: Hilda Wu +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -425,6 +425,8 @@ static const struct usb_device_id blackl + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x04c5, 0x1675), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x0cb8, 0xc558), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + + /* Realtek Bluetooth devices */ + { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01), diff --git a/queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x13d3-0x3586.patch b/queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x13d3-0x3586.patch new file mode 100644 index 00000000000..3588898eef2 --- /dev/null +++ b/queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x13d3-0x3586.patch @@ -0,0 +1,62 @@ +From 6ad353dfc8ee3230a5e123c21da50f1b64cc4b39 Mon Sep 17 00:00:00 2001 +From: Hilda Wu +Date: Thu, 14 Jul 2022 19:25:23 +0800 +Subject: Bluetooth: btusb: Add Realtek RTL8852C support ID 0x13D3:0x3586 + +From: Hilda Wu + +commit 6ad353dfc8ee3230a5e123c21da50f1b64cc4b39 upstream. + +Add the support ID(0x13D3, 0x3586) to usb_device_id table for +Realtek RTL8852C. + +The device info from /sys/kernel/debug/usb/devices as below. + +T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=13d3 ProdID=3586 Rev= 0.00 +S: Manufacturer=Realtek +S: Product=Bluetooth Radio +S: SerialNumber=00e04c000001 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms + +Signed-off-by: Hilda Wu +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -429,6 +429,8 @@ static const struct usb_device_id blackl + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3587), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x13d3, 0x3586), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + + /* Realtek Bluetooth devices */ + { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01), diff --git a/queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x13d3-0x3587.patch b/queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x13d3-0x3587.patch new file mode 100644 index 00000000000..9f407cc8de3 --- /dev/null +++ b/queue-5.15/bluetooth-btusb-add-realtek-rtl8852c-support-id-0x13d3-0x3587.patch @@ -0,0 +1,62 @@ +From 8f0054dd29373cd877db87751c143610561d549d Mon Sep 17 00:00:00 2001 +From: Hilda Wu +Date: Thu, 14 Jul 2022 19:25:22 +0800 +Subject: Bluetooth: btusb: Add Realtek RTL8852C support ID 0x13D3:0x3587 + +From: Hilda Wu + +commit 8f0054dd29373cd877db87751c143610561d549d upstream. + +Add the support ID(0x13D3, 0x3587) to usb_device_id table for +Realtek RTL8852C. + +The device info from /sys/kernel/debug/usb/devices as below. + +T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=13d3 ProdID=3587 Rev= 0.00 +S: Manufacturer=Realtek +S: Product=Bluetooth Radio +S: SerialNumber=00e04c000001 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms + +Signed-off-by: Hilda Wu +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -427,6 +427,8 @@ static const struct usb_device_id blackl + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0cb8, 0xc558), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x13d3, 0x3587), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + + /* Realtek Bluetooth devices */ + { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01), diff --git a/queue-5.15/bluetooth-btusb-add-support-of-imc-networks-pid-0x3568.patch b/queue-5.15/bluetooth-btusb-add-support-of-imc-networks-pid-0x3568.patch new file mode 100644 index 00000000000..6b70b30b7f1 --- /dev/null +++ b/queue-5.15/bluetooth-btusb-add-support-of-imc-networks-pid-0x3568.patch @@ -0,0 +1,48 @@ +From c69ecb0ea4c96b8b191cbaa0b420222a37867655 Mon Sep 17 00:00:00 2001 +From: Aaron Ma +Date: Thu, 2 Jun 2022 17:28:22 +0800 +Subject: Bluetooth: btusb: Add support of IMC Networks PID 0x3568 + +From: Aaron Ma + +commit c69ecb0ea4c96b8b191cbaa0b420222a37867655 upstream. + +It is 13d3:3568 for MediaTek MT7922 USB Bluetooth chip. + +T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=13d3 ProdID=3568 Rev=01.00 +S: Manufacturer=MediaTek Inc. +S: Product=Wireless_Device +S: SerialNumber=... +C: #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us +E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us + +Signed-off-by: Aaron Ma +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -459,6 +459,9 @@ static const struct usb_device_id blackl + { USB_DEVICE(0x0489, 0xe0d9), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, ++ { USB_DEVICE(0x13d3, 0x3568), .driver_info = BTUSB_MEDIATEK | ++ BTUSB_WIDEBAND_SPEECH | ++ BTUSB_VALID_LE_STATES }, + + /* Additional Realtek 8723AE Bluetooth devices */ + { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK }, diff --git a/queue-5.15/bluetooth-hci_bcm-add-bcm4349b1-variant.patch b/queue-5.15/bluetooth-hci_bcm-add-bcm4349b1-variant.patch new file mode 100644 index 00000000000..b025ae2f378 --- /dev/null +++ b/queue-5.15/bluetooth-hci_bcm-add-bcm4349b1-variant.patch @@ -0,0 +1,47 @@ +From 4f17c2b6694d0c4098f33b07ee3a696976940aa5 Mon Sep 17 00:00:00 2001 +From: Ahmad Fatoum +Date: Tue, 24 May 2022 07:56:41 +0200 +Subject: Bluetooth: hci_bcm: Add BCM4349B1 variant + +From: Ahmad Fatoum + +commit 4f17c2b6694d0c4098f33b07ee3a696976940aa5 upstream. + +The BCM4349B1, aka CYW/BCM89359, is a WiFi+BT chip and its Bluetooth +portion can be controlled over serial. + +Two subversions are added for the chip, because ROM firmware reports +002.002.013 (at least for the chips I have here), while depending on +patchram firmware revision, either 002.002.013 or 002.002.014 is +reported. + +Signed-off-by: Ahmad Fatoum +Reviewed-by: Linus Walleij +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btbcm.c | 2 ++ + drivers/bluetooth/hci_bcm.c | 1 + + 2 files changed, 3 insertions(+) + +--- a/drivers/bluetooth/btbcm.c ++++ b/drivers/bluetooth/btbcm.c +@@ -453,6 +453,8 @@ static const struct bcm_subver_table bcm + { 0x6606, "BCM4345C5" }, /* 003.006.006 */ + { 0x230f, "BCM4356A2" }, /* 001.003.015 */ + { 0x220e, "BCM20702A1" }, /* 001.002.014 */ ++ { 0x420d, "BCM4349B1" }, /* 002.002.013 */ ++ { 0x420e, "BCM4349B1" }, /* 002.002.014 */ + { 0x4217, "BCM4329B1" }, /* 002.002.023 */ + { 0x6106, "BCM4359C0" }, /* 003.001.006 */ + { 0x4106, "BCM4335A0" }, /* 002.001.006 */ +--- a/drivers/bluetooth/hci_bcm.c ++++ b/drivers/bluetooth/hci_bcm.c +@@ -1515,6 +1515,7 @@ static const struct of_device_id bcm_blu + { .compatible = "brcm,bcm4345c5" }, + { .compatible = "brcm,bcm4330-bt" }, + { .compatible = "brcm,bcm43438-bt", .data = &bcm43438_device_data }, ++ { .compatible = "brcm,bcm4349-bt", .data = &bcm43438_device_data }, + { .compatible = "brcm,bcm43540-bt", .data = &bcm4354_device_data }, + { .compatible = "brcm,bcm4335a0" }, + { }, diff --git a/queue-5.15/bluetooth-hci_bcm-add-dt-compatible-for-cyw55572.patch b/queue-5.15/bluetooth-hci_bcm-add-dt-compatible-for-cyw55572.patch new file mode 100644 index 00000000000..5ce66549ca7 --- /dev/null +++ b/queue-5.15/bluetooth-hci_bcm-add-dt-compatible-for-cyw55572.patch @@ -0,0 +1,29 @@ +From f8cad62002a7699fd05a23b558b980b5a77defe0 Mon Sep 17 00:00:00 2001 +From: Hakan Jansson +Date: Thu, 30 Jun 2022 14:45:22 +0200 +Subject: Bluetooth: hci_bcm: Add DT compatible for CYW55572 + +From: Hakan Jansson + +commit f8cad62002a7699fd05a23b558b980b5a77defe0 upstream. + +CYW55572 is a Wi-Fi + Bluetooth combo device from Infineon. + +Signed-off-by: Hakan Jansson +Reviewed-by: Linus Walleij +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/hci_bcm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/bluetooth/hci_bcm.c ++++ b/drivers/bluetooth/hci_bcm.c +@@ -1518,6 +1518,7 @@ static const struct of_device_id bcm_blu + { .compatible = "brcm,bcm4349-bt", .data = &bcm43438_device_data }, + { .compatible = "brcm,bcm43540-bt", .data = &bcm4354_device_data }, + { .compatible = "brcm,bcm4335a0" }, ++ { .compatible = "infineon,cyw55572-bt" }, + { }, + }; + MODULE_DEVICE_TABLE(of, bcm_bluetooth_of_match); diff --git a/queue-5.15/btrfs-zoned-fix-critical-section-of-relocation-inode-writeback.patch b/queue-5.15/btrfs-zoned-fix-critical-section-of-relocation-inode-writeback.patch new file mode 100644 index 00000000000..e99f1ce924d --- /dev/null +++ b/queue-5.15/btrfs-zoned-fix-critical-section-of-relocation-inode-writeback.patch @@ -0,0 +1,46 @@ +From 19ab78ca86981e0e1e73036fb73a508731a7c078 Mon Sep 17 00:00:00 2001 +From: Naohiro Aota +Date: Tue, 7 Jun 2022 16:08:30 +0900 +Subject: btrfs: zoned: fix critical section of relocation inode writeback + +From: Naohiro Aota + +commit 19ab78ca86981e0e1e73036fb73a508731a7c078 upstream. + +We use btrfs_zoned_data_reloc_{lock,unlock} to allow only one process to +write out to the relocation inode. That critical section must include all +the IO submission for the inode. However, flush_write_bio() in +extent_writepages() is out of the critical section, causing an IO +submission outside of the lock. This leads to an out of the order IO +submission and fail the relocation process. + +Fix it by extending the critical section. + +Fixes: 35156d852762 ("btrfs: zoned: only allow one process to add pages to a relocation inode") +CC: stable@vger.kernel.org # 5.16+ +Reviewed-by: Johannes Thumshirn +Signed-off-by: Naohiro Aota +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/extent_io.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -5152,13 +5152,14 @@ int extent_writepages(struct address_spa + */ + btrfs_zoned_data_reloc_lock(BTRFS_I(inode)); + ret = extent_write_cache_pages(mapping, wbc, &epd); +- btrfs_zoned_data_reloc_unlock(BTRFS_I(inode)); + ASSERT(ret <= 0); + if (ret < 0) { ++ btrfs_zoned_data_reloc_unlock(BTRFS_I(inode)); + end_write_bio(&epd, ret); + return ret; + } + ret = flush_write_bio(&epd); ++ btrfs_zoned_data_reloc_unlock(BTRFS_I(inode)); + return ret; + } + diff --git a/queue-5.15/btrfs-zoned-prevent-allocation-from-previous-data-relocation-bg.patch b/queue-5.15/btrfs-zoned-prevent-allocation-from-previous-data-relocation-bg.patch new file mode 100644 index 00000000000..5be341f1d0a --- /dev/null +++ b/queue-5.15/btrfs-zoned-prevent-allocation-from-previous-data-relocation-bg.patch @@ -0,0 +1,187 @@ +From 343d8a30851c48a4ef0f5ef61d5e9fbd847a6883 Mon Sep 17 00:00:00 2001 +From: Naohiro Aota +Date: Tue, 7 Jun 2022 16:08:29 +0900 +Subject: btrfs: zoned: prevent allocation from previous data relocation BG + +From: Naohiro Aota + +commit 343d8a30851c48a4ef0f5ef61d5e9fbd847a6883 upstream. + +After commit 5f0addf7b890 ("btrfs: zoned: use dedicated lock for data +relocation"), we observe IO errors on e.g, btrfs/232 like below. + + [09.0][T4038707] WARNING: CPU: 3 PID: 4038707 at fs/btrfs/extent-tree.c:2381 btrfs_cross_ref_exist+0xfc/0x120 [btrfs] + + [09.9][T4038707] Call Trace: + [09.5][T4038707] + [09.3][T4038707] run_delalloc_nocow+0x7f1/0x11a0 [btrfs] + [09.6][T4038707] ? test_range_bit+0x174/0x320 [btrfs] + [09.2][T4038707] ? fallback_to_cow+0x980/0x980 [btrfs] + [09.3][T4038707] ? find_lock_delalloc_range+0x33e/0x3e0 [btrfs] + [09.5][T4038707] btrfs_run_delalloc_range+0x445/0x1320 [btrfs] + [09.2][T4038707] ? test_range_bit+0x320/0x320 [btrfs] + [09.4][T4038707] ? lock_downgrade+0x6a0/0x6a0 + [09.2][T4038707] ? orc_find.part.0+0x1ed/0x300 + [09.5][T4038707] ? __module_address.part.0+0x25/0x300 + [09.0][T4038707] writepage_delalloc+0x159/0x310 [btrfs] + + [09.4][ C3] sd 10:0:1:0: [sde] tag#2620 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s + [09.5][ C3] sd 10:0:1:0: [sde] tag#2620 Sense Key : Illegal Request [current] + [09.9][ C3] sd 10:0:1:0: [sde] tag#2620 Add. Sense: Unaligned write command + [09.5][ C3] sd 10:0:1:0: [sde] tag#2620 CDB: Write(16) 8a 00 00 00 00 00 02 f3 63 87 00 00 00 2c 00 00 + [09.4][ C3] critical target error, dev sde, sector 396041272 op 0x1:(WRITE) flags 0x800 phys_seg 3 prio class 0 + [09.9][ C3] BTRFS error (device dm-1): bdev /dev/mapper/dml_102_2 errs: wr 1, rd 0, flush 0, corrupt 0, gen 0 + +The IO errors occur when we allocate a regular extent in previous data +relocation block group. + +On zoned btrfs, we use a dedicated block group to relocate a data +extent. Thus, we allocate relocating data extents (pre-alloc) only from +the dedicated block group and vice versa. Once the free space in the +dedicated block group gets tight, a relocating extent may not fit into +the block group. In that case, we need to switch the dedicated block +group to the next one. Then, the previous one is now freed up for +allocating a regular extent. The BG is already not enough to allocate +the relocating extent, but there is still room to allocate a smaller +extent. Now the problem happens. By allocating a regular extent while +nocow IOs for the relocation is still on-going, we will issue WRITE IOs +(for relocation) and ZONE APPEND IOs (for the regular writes) at the +same time. That mixed IOs confuses the write pointer and arises the +unaligned write errors. + +This commit introduces a new bit 'zoned_data_reloc_ongoing' to the +btrfs_block_group. We set this bit before releasing the dedicated block +group, and no extent are allocated from a block group having this bit +set. This bit is similar to setting block_group->ro, but is different from +it by allowing nocow writes to start. + +Once all the nocow IO for relocation is done (hooked from +btrfs_finish_ordered_io), we reset the bit to release the block group for +further allocation. + +Fixes: c2707a255623 ("btrfs: zoned: add a dedicated data relocation block group") +CC: stable@vger.kernel.org # 5.16+ +Signed-off-by: Naohiro Aota +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/block-group.h | 1 + + fs/btrfs/extent-tree.c | 20 ++++++++++++++++++-- + fs/btrfs/inode.c | 2 ++ + fs/btrfs/zoned.c | 27 +++++++++++++++++++++++++++ + fs/btrfs/zoned.h | 5 +++++ + 5 files changed, 53 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/block-group.h ++++ b/fs/btrfs/block-group.h +@@ -98,6 +98,7 @@ struct btrfs_block_group { + unsigned int to_copy:1; + unsigned int relocating_repair:1; + unsigned int chunk_item_inserted:1; ++ unsigned int zoned_data_reloc_ongoing:1; + + int disk_cache_state; + +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -3804,7 +3804,7 @@ static int do_allocation_zoned(struct bt + block_group->start == fs_info->data_reloc_bg || + fs_info->data_reloc_bg == 0); + +- if (block_group->ro) { ++ if (block_group->ro || block_group->zoned_data_reloc_ongoing) { + ret = 1; + goto out; + } +@@ -3865,8 +3865,24 @@ static int do_allocation_zoned(struct bt + out: + if (ret && ffe_ctl->for_treelog) + fs_info->treelog_bg = 0; +- if (ret && ffe_ctl->for_data_reloc) ++ if (ret && ffe_ctl->for_data_reloc && ++ fs_info->data_reloc_bg == block_group->start) { ++ /* ++ * Do not allow further allocations from this block group. ++ * Compared to increasing the ->ro, setting the ++ * ->zoned_data_reloc_ongoing flag still allows nocow ++ * writers to come in. See btrfs_inc_nocow_writers(). ++ * ++ * We need to disable an allocation to avoid an allocation of ++ * regular (non-relocation data) extent. With mix of relocation ++ * extents and regular extents, we can dispatch WRITE commands ++ * (for relocation extents) and ZONE APPEND commands (for ++ * regular extents) at the same time to the same zone, which ++ * easily break the write pointer. ++ */ ++ block_group->zoned_data_reloc_ongoing = 1; + fs_info->data_reloc_bg = 0; ++ } + spin_unlock(&fs_info->relocation_bg_lock); + spin_unlock(&fs_info->treelog_bg_lock); + spin_unlock(&block_group->lock); +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -3069,6 +3069,8 @@ static int btrfs_finish_ordered_io(struc + ordered_extent->file_offset, + ordered_extent->file_offset + + logical_len); ++ btrfs_zoned_release_data_reloc_bg(fs_info, ordered_extent->disk_bytenr, ++ ordered_extent->disk_num_bytes); + } else { + BUG_ON(root == fs_info->tree_root); + ret = insert_ordered_extent_file_extent(trans, ordered_extent); +--- a/fs/btrfs/zoned.c ++++ b/fs/btrfs/zoned.c +@@ -1623,3 +1623,30 @@ void btrfs_free_zone_cache(struct btrfs_ + } + mutex_unlock(&fs_devices->device_list_mutex); + } ++ ++void btrfs_zoned_release_data_reloc_bg(struct btrfs_fs_info *fs_info, u64 logical, ++ u64 length) ++{ ++ struct btrfs_block_group *block_group; ++ ++ if (!btrfs_is_zoned(fs_info)) ++ return; ++ ++ block_group = btrfs_lookup_block_group(fs_info, logical); ++ /* It should be called on a previous data relocation block group. */ ++ ASSERT(block_group && (block_group->flags & BTRFS_BLOCK_GROUP_DATA)); ++ ++ spin_lock(&block_group->lock); ++ if (!block_group->zoned_data_reloc_ongoing) ++ goto out; ++ ++ /* All relocation extents are written. */ ++ if (block_group->start + block_group->alloc_offset == logical + length) { ++ /* Now, release this block group for further allocations. */ ++ block_group->zoned_data_reloc_ongoing = 0; ++ } ++ ++out: ++ spin_unlock(&block_group->lock); ++ btrfs_put_block_group(block_group); ++} +--- a/fs/btrfs/zoned.h ++++ b/fs/btrfs/zoned.h +@@ -70,6 +70,8 @@ struct btrfs_device *btrfs_zoned_get_dev + u64 logical, u64 length); + void btrfs_clear_data_reloc_bg(struct btrfs_block_group *bg); + void btrfs_free_zone_cache(struct btrfs_fs_info *fs_info); ++void btrfs_zoned_release_data_reloc_bg(struct btrfs_fs_info *fs_info, u64 logical, ++ u64 length); + #else /* CONFIG_BLK_DEV_ZONED */ + static inline int btrfs_get_dev_zone(struct btrfs_device *device, u64 pos, + struct blk_zone *zone) +@@ -207,6 +209,9 @@ static inline struct btrfs_device *btrfs + static inline void btrfs_clear_data_reloc_bg(struct btrfs_block_group *bg) { } + + static inline void btrfs_free_zone_cache(struct btrfs_fs_info *fs_info) { } ++ ++static inline void btrfs_zoned_release_data_reloc_bg(struct btrfs_fs_info *fs_info, ++ u64 logical, u64 length) { } + #endif + + static inline bool btrfs_dev_is_sequential(struct btrfs_device *device, u64 pos) diff --git a/queue-5.15/dt-bindings-bluetooth-broadcom-add-bcm4349b1-dt-binding.patch b/queue-5.15/dt-bindings-bluetooth-broadcom-add-bcm4349b1-dt-binding.patch new file mode 100644 index 00000000000..be602273f9c --- /dev/null +++ b/queue-5.15/dt-bindings-bluetooth-broadcom-add-bcm4349b1-dt-binding.patch @@ -0,0 +1,32 @@ +From 88b65887aa1b76cd8649a97824fb9904c1d79254 Mon Sep 17 00:00:00 2001 +From: Ahmad Fatoum +Date: Tue, 24 May 2022 07:56:40 +0200 +Subject: dt-bindings: bluetooth: broadcom: Add BCM4349B1 DT binding + +From: Ahmad Fatoum + +commit 88b65887aa1b76cd8649a97824fb9904c1d79254 upstream. + +The BCM4349B1, aka CYW/BCM89359, is a WiFi+BT chip and its Bluetooth +portion can be controlled over serial. +Extend the binding with its DT compatible. + +Acked-by: Krzysztof Kozlowski +Reviewed-by: Linus Walleij +Signed-off-by: Ahmad Fatoum +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/net/broadcom-bluetooth.yaml | 1 + + 1 file changed, 1 insertion(+) + +--- a/Documentation/devicetree/bindings/net/broadcom-bluetooth.yaml ++++ b/Documentation/devicetree/bindings/net/broadcom-bluetooth.yaml +@@ -23,6 +23,7 @@ properties: + - brcm,bcm4345c5 + - brcm,bcm43540-bt + - brcm,bcm4335a0 ++ - brcm,bcm4349-bt + + shutdown-gpios: + maxItems: 1 diff --git a/queue-5.15/macintosh-adb-fix-oob-read-in-do_adb_query-function.patch b/queue-5.15/macintosh-adb-fix-oob-read-in-do_adb_query-function.patch new file mode 100644 index 00000000000..8870d24ea97 --- /dev/null +++ b/queue-5.15/macintosh-adb-fix-oob-read-in-do_adb_query-function.patch @@ -0,0 +1,37 @@ +From fd97e4ad6d3b0c9fce3bca8ea8e6969d9ce7423b Mon Sep 17 00:00:00 2001 +From: Ning Qiang +Date: Wed, 13 Jul 2022 23:37:34 +0800 +Subject: macintosh/adb: fix oob read in do_adb_query() function + +From: Ning Qiang + +commit fd97e4ad6d3b0c9fce3bca8ea8e6969d9ce7423b upstream. + +In do_adb_query() function of drivers/macintosh/adb.c, req->data is copied +form userland. The parameter "req->data[2]" is missing check, the array +size of adb_handler[] is 16, so adb_handler[req->data[2]].original_address and +adb_handler[req->data[2]].handler_id will lead to oob read. + +Cc: stable +Signed-off-by: Ning Qiang +Reviewed-by: Kees Cook +Reviewed-by: Greg Kroah-Hartman +Acked-by: Benjamin Herrenschmidt +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220713153734.2248-1-sohu0106@126.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/macintosh/adb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/macintosh/adb.c ++++ b/drivers/macintosh/adb.c +@@ -647,7 +647,7 @@ do_adb_query(struct adb_request *req) + + switch(req->data[1]) { + case ADB_QUERY_GETDEVINFO: +- if (req->nbytes < 3) ++ if (req->nbytes < 3 || req->data[2] >= 16) + break; + mutex_lock(&adb_handler_mutex); + req->reply[0] = adb_handler[req->data[2]].original_address; diff --git a/queue-5.15/series b/queue-5.15/series index fab669f3b71..db7f0400f7a 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -14,3 +14,15 @@ tools-kvm_stat-fix-display-of-error-when-multiple-pr.patch selftests-kvm-handle-compiler-optimizations-in-ucall.patch kvm-x86-svm-add-__gfp_account-to-__sev_dbg_-en-de-cr.patch arm64-set-uxn-on-swapper-page-tables.patch +btrfs-zoned-prevent-allocation-from-previous-data-relocation-bg.patch +btrfs-zoned-fix-critical-section-of-relocation-inode-writeback.patch +bluetooth-hci_bcm-add-bcm4349b1-variant.patch +bluetooth-hci_bcm-add-dt-compatible-for-cyw55572.patch +dt-bindings-bluetooth-broadcom-add-bcm4349b1-dt-binding.patch +bluetooth-btusb-add-support-of-imc-networks-pid-0x3568.patch +bluetooth-btusb-add-realtek-rtl8852c-support-id-0x04ca-0x4007.patch +bluetooth-btusb-add-realtek-rtl8852c-support-id-0x04c5-0x1675.patch +bluetooth-btusb-add-realtek-rtl8852c-support-id-0x0cb8-0xc558.patch +bluetooth-btusb-add-realtek-rtl8852c-support-id-0x13d3-0x3587.patch +bluetooth-btusb-add-realtek-rtl8852c-support-id-0x13d3-0x3586.patch +macintosh-adb-fix-oob-read-in-do_adb_query-function.patch -- 2.47.3