From 6121bf5fcec933d4a8b99a467122ae3a2b1136cb Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 30 May 2024 14:48:14 -0400 Subject: [PATCH] Fixes for 5.4 Signed-off-by: Sasha Levin --- ...4-add-check-for-dma_set_max_seg_size.patch | 40 ++ ...elect-irq_domain-instead-of-dependin.patch | 47 ++ ...ase-node-block-count-in-error-path-o.patch | 44 ++ ...i-id-add-a-release-callback-function.patch | 50 ++ ...rl-move-device-table-to-its-right-lo.patch | 66 +++ ...heck-return-of-get_channel_from_mode.patch | 59 +++ ...310-support-negative-temperature-val.patch | 67 +++ ...subcmd-fix-parse-options-memory-leak.patch | 61 +++ ...e-early-printk-call-from-cpuinfo-sta.patch | 37 ++ ...e-gcc-flag-for-non-existing-early_pr.patch | 36 ++ ...-umask-handling-from-ovl_create_uppe.patch | 39 ++ ...ate-add-demangle-and-demangle-kernel.patch | 62 +++ ...t-rid-of-duplicate-group-option-item.patch | 48 ++ ...issing-libgen.h-header-needed-for-us.patch | 53 ++ ...display-metric-header-for-non-leader.patch | 90 ++++ ...i-exit-screen-refresh-race-condition.patch | 75 +++ .../perf-ui-browser-avoid-segv-on-title.patch | 46 ++ ...r-don-t-save-pointer-to-stack-memory.patch | 143 ++++++ .../perf-ui-update-use-of-pthread-mutex.patch | 382 +++++++++++++++ ...dd-an-error-check-in-register_device.patch | 72 +++ ...ge-of-the-deprecated-ida_simple_xx-a.patch | 57 +++ .../serial-max3100-fix-bitwise-types.patch | 53 ++ ...ock-port-lock-when-calling-uart_hand.patch | 66 +++ ...pdate-uart_driver_registered-on-driv.patch | 73 +++ ...otect-invalidating-rxdma-on-shutdown.patch | 47 ++ queue-5.4/series | 31 ++ ...dwire-cadence-fix-invalid-pdi-offset.patch | 48 ++ ...ence-intel-simplify-pdi-port-mapping.patch | 458 ++++++++++++++++++ ...adence_master-improve-pdi-allocation.patch | 141 ++++++ ...ndwire-intel-don-t-filter-out-pdi0-1.patch | 124 +++++ ...a-double-free-in-stm_register_device.patch | 57 +++ ...u_audio-clear-uac-pointer-when-freed.patch | 40 ++ 32 files changed, 2712 insertions(+) create mode 100644 queue-5.4/dmaengine-idma64-add-check-for-dma_set_max_seg_size.patch create mode 100644 queue-5.4/extcon-max8997-select-irq_domain-instead-of-dependin.patch create mode 100644 queue-5.4/f2fs-fix-to-release-node-block-count-in-error-path-o.patch create mode 100644 queue-5.4/firmware-dmi-id-add-a-release-callback-function.patch create mode 100644 queue-5.4/greybus-arche-ctrl-move-device-table-to-its-right-lo.patch create mode 100644 queue-5.4/greybus-lights-check-return-of-get_channel_from_mode.patch create mode 100644 queue-5.4/iio-pressure-dps310-support-negative-temperature-val.patch create mode 100644 queue-5.4/libsubcmd-fix-parse-options-memory-leak.patch create mode 100644 queue-5.4/microblaze-remove-early-printk-call-from-cpuinfo-sta.patch create mode 100644 queue-5.4/microblaze-remove-gcc-flag-for-non-existing-early_pr.patch create mode 100644 queue-5.4/ovl-remove-upper-umask-handling-from-ovl_create_uppe.patch create mode 100644 queue-5.4/perf-annotate-add-demangle-and-demangle-kernel.patch create mode 100644 queue-5.4/perf-annotate-get-rid-of-duplicate-group-option-item.patch create mode 100644 queue-5.4/perf-probe-add-missing-libgen.h-header-needed-for-us.patch create mode 100644 queue-5.4/perf-stat-don-t-display-metric-header-for-non-leader.patch create mode 100644 queue-5.4/perf-top-fix-tui-exit-screen-refresh-race-condition.patch create mode 100644 queue-5.4/perf-ui-browser-avoid-segv-on-title.patch create mode 100644 queue-5.4/perf-ui-browser-don-t-save-pointer-to-stack-memory.patch create mode 100644 queue-5.4/perf-ui-update-use-of-pthread-mutex.patch create mode 100644 queue-5.4/ppdev-add-an-error-check-in-register_device.patch create mode 100644 queue-5.4/ppdev-remove-usage-of-the-deprecated-ida_simple_xx-a.patch create mode 100644 queue-5.4/serial-max3100-fix-bitwise-types.patch create mode 100644 queue-5.4/serial-max3100-lock-port-lock-when-calling-uart_hand.patch create mode 100644 queue-5.4/serial-max3100-update-uart_driver_registered-on-driv.patch create mode 100644 queue-5.4/serial-sh-sci-protect-invalidating-rxdma-on-shutdown.patch create mode 100644 queue-5.4/soundwire-cadence-fix-invalid-pdi-offset.patch create mode 100644 queue-5.4/soundwire-cadence-intel-simplify-pdi-port-mapping.patch create mode 100644 queue-5.4/soundwire-cadence_master-improve-pdi-allocation.patch create mode 100644 queue-5.4/soundwire-intel-don-t-filter-out-pdi0-1.patch create mode 100644 queue-5.4/stm-class-fix-a-double-free-in-stm_register_device.patch create mode 100644 queue-5.4/usb-gadget-u_audio-clear-uac-pointer-when-freed.patch diff --git a/queue-5.4/dmaengine-idma64-add-check-for-dma_set_max_seg_size.patch b/queue-5.4/dmaengine-idma64-add-check-for-dma_set_max_seg_size.patch new file mode 100644 index 00000000000..d6cdafb11bf --- /dev/null +++ b/queue-5.4/dmaengine-idma64-add-check-for-dma_set_max_seg_size.patch @@ -0,0 +1,40 @@ +From cfd1e71dc23ae29e05b0aca26f6c8e478823f615 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 02:49:32 +0000 +Subject: dmaengine: idma64: Add check for dma_set_max_seg_size + +From: Chen Ni + +[ Upstream commit 2b1c1cf08a0addb6df42f16b37133dc7a351de29 ] + +As the possible failure of the dma_set_max_seg_size(), it should be +better to check the return value of the dma_set_max_seg_size(). + +Fixes: e3fdb1894cfa ("dmaengine: idma64: set maximum allowed segment size for DMA") +Signed-off-by: Chen Ni +Acked-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20240403024932.3342606-1-nichen@iscas.ac.cn +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idma64.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/idma64.c b/drivers/dma/idma64.c +index db506e1f7ef4e..0f065ba844c00 100644 +--- a/drivers/dma/idma64.c ++++ b/drivers/dma/idma64.c +@@ -594,7 +594,9 @@ static int idma64_probe(struct idma64_chip *chip) + + idma64->dma.dev = chip->sysdev; + +- dma_set_max_seg_size(idma64->dma.dev, IDMA64C_CTLH_BLOCK_TS_MASK); ++ ret = dma_set_max_seg_size(idma64->dma.dev, IDMA64C_CTLH_BLOCK_TS_MASK); ++ if (ret) ++ return ret; + + ret = dma_async_device_register(&idma64->dma); + if (ret) +-- +2.43.0 + diff --git a/queue-5.4/extcon-max8997-select-irq_domain-instead-of-dependin.patch b/queue-5.4/extcon-max8997-select-irq_domain-instead-of-dependin.patch new file mode 100644 index 00000000000..f2150ca04a1 --- /dev/null +++ b/queue-5.4/extcon-max8997-select-irq_domain-instead-of-dependin.patch @@ -0,0 +1,47 @@ +From 965b7f18af5d0792d9845ae7a8671dbd2b2faef4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 22:00:28 -0800 +Subject: extcon: max8997: select IRQ_DOMAIN instead of depending on it + +From: Randy Dunlap + +[ Upstream commit b1781d0a1458070d40134e4f3412ec9d70099bec ] + +IRQ_DOMAIN is a hidden (not user visible) symbol. Users cannot set +it directly thru "make *config", so drivers should select it instead +of depending on it if they need it. +Relying on it being set for a dependency is risky. + +Consistently using "select" or "depends on" can also help reduce +Kconfig circular dependency issues. + +Therefore, change EXTCON_MAX8997's use of "depends on" for +IRQ_DOMAIN to "select". + +Link: https://lore.kernel.org/lkml/20240213060028.9744-1-rdunlap@infradead.org/ +Fixes: dca1a71e4108 ("extcon: Add support irq domain for MAX8997 muic") +Signed-off-by: Randy Dunlap +Acked-by: Arnd Bergmann +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/extcon/Kconfig b/drivers/extcon/Kconfig +index aac507bff135c..09485803280ef 100644 +--- a/drivers/extcon/Kconfig ++++ b/drivers/extcon/Kconfig +@@ -121,7 +121,8 @@ config EXTCON_MAX77843 + + config EXTCON_MAX8997 + tristate "Maxim MAX8997 EXTCON Support" +- depends on MFD_MAX8997 && IRQ_DOMAIN ++ depends on MFD_MAX8997 ++ select IRQ_DOMAIN + help + If you say yes here you get support for the MUIC device of + Maxim MAX8997 PMIC. The MAX8997 MUIC is a USB port accessory +-- +2.43.0 + diff --git a/queue-5.4/f2fs-fix-to-release-node-block-count-in-error-path-o.patch b/queue-5.4/f2fs-fix-to-release-node-block-count-in-error-path-o.patch new file mode 100644 index 00000000000..f724e3e55c5 --- /dev/null +++ b/queue-5.4/f2fs-fix-to-release-node-block-count-in-error-path-o.patch @@ -0,0 +1,44 @@ +From 802eb85a40f4b8290a8f6b03c3bb41fd44c6feaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 11:31:00 +0800 +Subject: f2fs: fix to release node block count in error path of + f2fs_new_node_page() + +From: Chao Yu + +[ Upstream commit 0fa4e57c1db263effd72d2149d4e21da0055c316 ] + +It missed to call dec_valid_node_count() to release node block count +in error path, fix it. + +Fixes: 141170b759e0 ("f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/node.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 8256a2dedae8c..d629b3c6546c8 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -1244,6 +1244,7 @@ struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs) + } + if (unlikely(new_ni.blk_addr != NULL_ADDR)) { + err = -EFSCORRUPTED; ++ dec_valid_node_count(sbi, dn->inode, !ofs); + set_sbi_flag(sbi, SBI_NEED_FSCK); + goto fail; + } +@@ -1269,7 +1270,6 @@ struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs) + if (ofs == 0) + inc_valid_inode_count(sbi); + return page; +- + fail: + clear_node_page_dirty(page); + f2fs_put_page(page, 1); +-- +2.43.0 + diff --git a/queue-5.4/firmware-dmi-id-add-a-release-callback-function.patch b/queue-5.4/firmware-dmi-id-add-a-release-callback-function.patch new file mode 100644 index 00000000000..fb9a4a225d2 --- /dev/null +++ b/queue-5.4/firmware-dmi-id-add-a-release-callback-function.patch @@ -0,0 +1,50 @@ +From 318568bbd2f43eb791181a59a3750a548da46b13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 09:34:24 +0200 +Subject: firmware: dmi-id: add a release callback function + +From: Arnd Bergmann + +[ Upstream commit cf770af5645a41a753c55a053fa1237105b0964a ] + +dmi_class uses kfree() as the .release function, but that now causes +a warning with clang-16 as it violates control flow integrity (KCFI) +rules: + +drivers/firmware/dmi-id.c:174:17: error: cast from 'void (*)(const void *)' to 'void (*)(struct device *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict] + 174 | .dev_release = (void(*)(struct device *)) kfree, + +Add an explicit function to call kfree() instead. + +Fixes: 4f5c791a850e ("DMI-based module autoloading") +Link: https://lore.kernel.org/lkml/20240213100238.456912-1-arnd@kernel.org/ +Signed-off-by: Arnd Bergmann +Signed-off-by: Jean Delvare +Signed-off-by: Sasha Levin +--- + drivers/firmware/dmi-id.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/firmware/dmi-id.c b/drivers/firmware/dmi-id.c +index ff39f64f2aae3..1bb3370650cf5 100644 +--- a/drivers/firmware/dmi-id.c ++++ b/drivers/firmware/dmi-id.c +@@ -160,9 +160,14 @@ static int dmi_dev_uevent(struct device *dev, struct kobj_uevent_env *env) + return 0; + } + ++static void dmi_dev_release(struct device *dev) ++{ ++ kfree(dev); ++} ++ + static struct class dmi_class = { + .name = "dmi", +- .dev_release = (void(*)(struct device *)) kfree, ++ .dev_release = dmi_dev_release, + .dev_uevent = dmi_dev_uevent, + }; + +-- +2.43.0 + diff --git a/queue-5.4/greybus-arche-ctrl-move-device-table-to-its-right-lo.patch b/queue-5.4/greybus-arche-ctrl-move-device-table-to-its-right-lo.patch new file mode 100644 index 00000000000..b0d7946024d --- /dev/null +++ b/queue-5.4/greybus-arche-ctrl-move-device-table-to-its-right-lo.patch @@ -0,0 +1,66 @@ +From 262e4adf8bbc6f25d197ba01322065873f1770a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 10:06:35 +0200 +Subject: greybus: arche-ctrl: move device table to its right location + +From: Arnd Bergmann + +[ Upstream commit 6a0b8c0da8d8d418cde6894a104cf74e6098ddfa ] + +The arche-ctrl has two platform drivers and three of_device_id tables, +but one table is only used for the the module loader, while the other +two seem to be associated with their drivers. + +This leads to a W=1 warning when the driver is built-in: + +drivers/staging/greybus/arche-platform.c:623:34: error: 'arche_combined_id' defined but not used [-Werror=unused-const-variable=] + 623 | static const struct of_device_id arche_combined_id[] = { + +Drop the extra table and register both tables that are actually +used as the ones for the module loader instead. + +Fixes: 7b62b61c752a ("greybus: arche-ctrl: Don't expose driver internals to arche-platform driver") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20240403080702.3509288-18-arnd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/greybus/arche-apb-ctrl.c | 1 + + drivers/staging/greybus/arche-platform.c | 9 +-------- + 2 files changed, 2 insertions(+), 8 deletions(-) + +diff --git a/drivers/staging/greybus/arche-apb-ctrl.c b/drivers/staging/greybus/arche-apb-ctrl.c +index bbf3ba744fc44..c7383c6c6094d 100644 +--- a/drivers/staging/greybus/arche-apb-ctrl.c ++++ b/drivers/staging/greybus/arche-apb-ctrl.c +@@ -468,6 +468,7 @@ static const struct of_device_id arche_apb_ctrl_of_match[] = { + { .compatible = "usbffff,2", }, + { }, + }; ++MODULE_DEVICE_TABLE(of, arche_apb_ctrl_of_match); + + static struct platform_driver arche_apb_ctrl_device_driver = { + .probe = arche_apb_ctrl_probe, +diff --git a/drivers/staging/greybus/arche-platform.c b/drivers/staging/greybus/arche-platform.c +index eebf0deb39f50..02a700f720e6d 100644 +--- a/drivers/staging/greybus/arche-platform.c ++++ b/drivers/staging/greybus/arche-platform.c +@@ -622,14 +622,7 @@ static const struct of_device_id arche_platform_of_match[] = { + { .compatible = "google,arche-platform", }, + { }, + }; +- +-static const struct of_device_id arche_combined_id[] = { +- /* Use PID/VID of SVC device */ +- { .compatible = "google,arche-platform", }, +- { .compatible = "usbffff,2", }, +- { }, +-}; +-MODULE_DEVICE_TABLE(of, arche_combined_id); ++MODULE_DEVICE_TABLE(of, arche_platform_of_match); + + static struct platform_driver arche_platform_device_driver = { + .probe = arche_platform_probe, +-- +2.43.0 + diff --git a/queue-5.4/greybus-lights-check-return-of-get_channel_from_mode.patch b/queue-5.4/greybus-lights-check-return-of-get_channel_from_mode.patch new file mode 100644 index 00000000000..9b2332bb812 --- /dev/null +++ b/queue-5.4/greybus-lights-check-return-of-get_channel_from_mode.patch @@ -0,0 +1,59 @@ +From 31b105df3248dbc53c92269350ff6603424b0792 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 22:09:55 +0000 +Subject: greybus: lights: check return of get_channel_from_mode + +From: Rui Miguel Silva + +[ Upstream commit a1ba19a1ae7cd1e324685ded4ab563e78fe68648 ] + +If channel for the given node is not found we return null from +get_channel_from_mode. Make sure we validate the return pointer +before using it in two of the missing places. + +This was originally reported in [0]: +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +[0] https://lore.kernel.org/all/20240301190425.120605-1-m.lobanov@rosalinux.ru + +Fixes: 2870b52bae4c ("greybus: lights: add lights implementation") +Reported-by: Mikhail Lobanov +Suggested-by: Mikhail Lobanov +Suggested-by: Alex Elder +Signed-off-by: Rui Miguel Silva +Link: https://lore.kernel.org/r/20240325221549.2185265-1-rmfrfs@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/greybus/light.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c +index e59bb27236b9f..7352d7deb8ba0 100644 +--- a/drivers/staging/greybus/light.c ++++ b/drivers/staging/greybus/light.c +@@ -147,6 +147,9 @@ static int __gb_lights_flash_brightness_set(struct gb_channel *channel) + channel = get_channel_from_mode(channel->light, + GB_CHANNEL_MODE_TORCH); + ++ if (!channel) ++ return -EINVAL; ++ + /* For not flash we need to convert brightness to intensity */ + intensity = channel->intensity_uA.min + + (channel->intensity_uA.step * channel->led->brightness); +@@ -550,7 +553,10 @@ static int gb_lights_light_v4l2_register(struct gb_light *light) + } + + channel_flash = get_channel_from_mode(light, GB_CHANNEL_MODE_FLASH); +- WARN_ON(!channel_flash); ++ if (!channel_flash) { ++ dev_err(dev, "failed to get flash channel from mode\n"); ++ return -EINVAL; ++ } + + fled = &channel_flash->fled; + +-- +2.43.0 + diff --git a/queue-5.4/iio-pressure-dps310-support-negative-temperature-val.patch b/queue-5.4/iio-pressure-dps310-support-negative-temperature-val.patch new file mode 100644 index 00000000000..e4fde0516c7 --- /dev/null +++ b/queue-5.4/iio-pressure-dps310-support-negative-temperature-val.patch @@ -0,0 +1,67 @@ +From 83c407e21cfd86331e741ac0902fa01b3af4da04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 12:50:27 +0200 +Subject: iio: pressure: dps310: support negative temperature values + +From: Thomas Haemmerle + +[ Upstream commit 9dd6b32e76ff714308964cd9ec91466a343dcb8b ] + +The current implementation interprets negative values returned from +`dps310_calculate_temp` as error codes. +This has a side effect that when negative temperature values are +calculated, they are interpreted as error. + +Fix this by using the return value only for error handling and passing a +pointer for the value. + +Fixes: ba6ec48e76bc ("iio: Add driver for Infineon DPS310") +Signed-off-by: Thomas Haemmerle +Link: https://lore.kernel.org/r/20240415105030.1161770-2-thomas.haemmerle@leica-geosystems.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/pressure/dps310.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/iio/pressure/dps310.c b/drivers/iio/pressure/dps310.c +index 2b2203eea3e90..9bb45a354d38a 100644 +--- a/drivers/iio/pressure/dps310.c ++++ b/drivers/iio/pressure/dps310.c +@@ -730,7 +730,7 @@ static int dps310_read_pressure(struct dps310_data *data, int *val, int *val2, + } + } + +-static int dps310_calculate_temp(struct dps310_data *data) ++static int dps310_calculate_temp(struct dps310_data *data, int *val) + { + s64 c0; + s64 t; +@@ -746,7 +746,9 @@ static int dps310_calculate_temp(struct dps310_data *data) + t = c0 + ((s64)data->temp_raw * (s64)data->c1); + + /* Convert to milliCelsius and scale the temperature */ +- return (int)div_s64(t * 1000LL, kt); ++ *val = (int)div_s64(t * 1000LL, kt); ++ ++ return 0; + } + + static int dps310_read_temp(struct dps310_data *data, int *val, int *val2, +@@ -768,11 +770,10 @@ static int dps310_read_temp(struct dps310_data *data, int *val, int *val2, + if (rc) + return rc; + +- rc = dps310_calculate_temp(data); +- if (rc < 0) ++ rc = dps310_calculate_temp(data, val); ++ if (rc) + return rc; + +- *val = rc; + return IIO_VAL_INT; + + case IIO_CHAN_INFO_OVERSAMPLING_RATIO: +-- +2.43.0 + diff --git a/queue-5.4/libsubcmd-fix-parse-options-memory-leak.patch b/queue-5.4/libsubcmd-fix-parse-options-memory-leak.patch new file mode 100644 index 00000000000..098db62fa79 --- /dev/null +++ b/queue-5.4/libsubcmd-fix-parse-options-memory-leak.patch @@ -0,0 +1,61 @@ +From 863be22f044d5bb7a0aec8e61ee9951e8a9cf1e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 22:20:15 -0700 +Subject: libsubcmd: Fix parse-options memory leak + +From: Ian Rogers + +[ Upstream commit 230a7a71f92212e723fa435d4ca5922de33ec88a ] + +If a usage string is built in parse_options_subcommand, also free it. + +Fixes: 901421a5bdf605d2 ("perf tools: Remove subcmd dependencies on strbuf") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Josh Poimboeuf +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20240509052015.1914670-1-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/subcmd/parse-options.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/tools/lib/subcmd/parse-options.c b/tools/lib/subcmd/parse-options.c +index dbb9efbf718a0..af440c1e80282 100644 +--- a/tools/lib/subcmd/parse-options.c ++++ b/tools/lib/subcmd/parse-options.c +@@ -630,11 +630,10 @@ int parse_options_subcommand(int argc, const char **argv, const struct option *o + const char *const subcommands[], const char *usagestr[], int flags) + { + struct parse_opt_ctx_t ctx; ++ char *buf = NULL; + + /* build usage string if it's not provided */ + if (subcommands && !usagestr[0]) { +- char *buf = NULL; +- + astrcatf(&buf, "%s %s [] {", subcmd_config.exec_name, argv[0]); + + for (int i = 0; subcommands[i]; i++) { +@@ -676,7 +675,10 @@ int parse_options_subcommand(int argc, const char **argv, const struct option *o + astrcatf(&error_buf, "unknown switch `%c'", *ctx.opt); + usage_with_options(usagestr, options); + } +- ++ if (buf) { ++ usagestr[0] = NULL; ++ free(buf); ++ } + return parse_options_end(&ctx); + } + +-- +2.43.0 + diff --git a/queue-5.4/microblaze-remove-early-printk-call-from-cpuinfo-sta.patch b/queue-5.4/microblaze-remove-early-printk-call-from-cpuinfo-sta.patch new file mode 100644 index 00000000000..4f13775e725 --- /dev/null +++ b/queue-5.4/microblaze-remove-early-printk-call-from-cpuinfo-sta.patch @@ -0,0 +1,37 @@ +From e3c9c7e73b55c510ec72ef24631766dd469a7f6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 10:27:21 +0200 +Subject: microblaze: Remove early printk call from cpuinfo-static.c + +From: Michal Simek + +[ Upstream commit 58d647506c92ccd3cfa0c453c68ddd14f40bf06f ] + +Early printk has been removed already that's why also remove calling it. +Similar change has been done in cpuinfo-pvr-full.c by commit cfbd8d1979af +("microblaze: Remove early printk setup"). + +Fixes: 96f0e6fcc9ad ("microblaze: remove redundant early_printk support") +Signed-off-by: Michal Simek +Link: https://lore.kernel.org/r/2f10db506be8188fa07b6ec331caca01af1b10f8.1712824039.git.michal.simek@amd.com +Signed-off-by: Sasha Levin +--- + arch/microblaze/kernel/cpu/cpuinfo-static.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/microblaze/kernel/cpu/cpuinfo-static.c b/arch/microblaze/kernel/cpu/cpuinfo-static.c +index 85dbda4a08a81..03da36dc6d9c9 100644 +--- a/arch/microblaze/kernel/cpu/cpuinfo-static.c ++++ b/arch/microblaze/kernel/cpu/cpuinfo-static.c +@@ -18,7 +18,7 @@ static const char family_string[] = CONFIG_XILINX_MICROBLAZE0_FAMILY; + static const char cpu_ver_string[] = CONFIG_XILINX_MICROBLAZE0_HW_VER; + + #define err_printk(x) \ +- early_printk("ERROR: Microblaze " x "-different for kernel and DTS\n"); ++ pr_err("ERROR: Microblaze " x "-different for kernel and DTS\n"); + + void __init set_cpuinfo_static(struct cpuinfo *ci, struct device_node *cpu) + { +-- +2.43.0 + diff --git a/queue-5.4/microblaze-remove-gcc-flag-for-non-existing-early_pr.patch b/queue-5.4/microblaze-remove-gcc-flag-for-non-existing-early_pr.patch new file mode 100644 index 00000000000..d45e9b47aee --- /dev/null +++ b/queue-5.4/microblaze-remove-gcc-flag-for-non-existing-early_pr.patch @@ -0,0 +1,36 @@ +From c0829b349b2eab67b052f3a14d86f2d761c24fe6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 10:21:44 +0200 +Subject: microblaze: Remove gcc flag for non existing early_printk.c file + +From: Michal Simek + +[ Upstream commit edc66cf0c4164aa3daf6cc55e970bb94383a6a57 ] + +early_printk support for removed long time ago but compilation flag for +ftrace still points to already removed file that's why remove that line +too. + +Fixes: 96f0e6fcc9ad ("microblaze: remove redundant early_printk support") +Signed-off-by: Michal Simek +Link: https://lore.kernel.org/r/5493467419cd2510a32854e2807bcd263de981a0.1712823702.git.michal.simek@amd.com +Signed-off-by: Sasha Levin +--- + arch/microblaze/kernel/Makefile | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/microblaze/kernel/Makefile b/arch/microblaze/kernel/Makefile +index dd71637437f4f..8b9d52b194cb4 100644 +--- a/arch/microblaze/kernel/Makefile ++++ b/arch/microblaze/kernel/Makefile +@@ -7,7 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER + # Do not trace early boot code and low level code + CFLAGS_REMOVE_timer.o = -pg + CFLAGS_REMOVE_intc.o = -pg +-CFLAGS_REMOVE_early_printk.o = -pg + CFLAGS_REMOVE_ftrace.o = -pg + CFLAGS_REMOVE_process.o = -pg + endif +-- +2.43.0 + diff --git a/queue-5.4/ovl-remove-upper-umask-handling-from-ovl_create_uppe.patch b/queue-5.4/ovl-remove-upper-umask-handling-from-ovl_create_uppe.patch new file mode 100644 index 00000000000..bcbe3e20d3e --- /dev/null +++ b/queue-5.4/ovl-remove-upper-umask-handling-from-ovl_create_uppe.patch @@ -0,0 +1,39 @@ +From f51143ff8a386e036c267f910239d0c52703c96d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 20:35:57 +0200 +Subject: ovl: remove upper umask handling from ovl_create_upper() + +From: Miklos Szeredi + +[ Upstream commit 096802748ea1dea8b476938e0a8dc16f4bd2f1ad ] + +This is already done by vfs_prepare_mode() when creating the upper object +by vfs_create(), vfs_mkdir() and vfs_mknod(). + +No regressions have been observed in xfstests run with posix acls turned +off for the upper filesystem. + +Fixes: 1639a49ccdce ("fs: move S_ISGID stripping into the vfs_*() helpers") +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/overlayfs/dir.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c +index fe88ac18ad934..1cf1006678588 100644 +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -295,9 +295,6 @@ static int ovl_create_upper(struct dentry *dentry, struct inode *inode, + struct dentry *newdentry; + int err; + +- if (!attr->hardlink && !IS_POSIXACL(udir)) +- attr->mode &= ~current_umask(); +- + inode_lock_nested(udir, I_MUTEX_PARENT); + newdentry = ovl_create_real(udir, + lookup_one_len(dentry->d_name.name, +-- +2.43.0 + diff --git a/queue-5.4/perf-annotate-add-demangle-and-demangle-kernel.patch b/queue-5.4/perf-annotate-add-demangle-and-demangle-kernel.patch new file mode 100644 index 00000000000..028261a0b12 --- /dev/null +++ b/queue-5.4/perf-annotate-add-demangle-and-demangle-kernel.patch @@ -0,0 +1,62 @@ +From c5876d4dafd44d4332512ec0d912e1bb418942ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 20:33:55 +0200 +Subject: perf annotate: Add --demangle and --demangle-kernel +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin Liška + +[ Upstream commit 3406ac5347dbf64ab9f7b137ed25a18493f5ea2d ] + +'perf annotate' supports --symbol but it's impossible to filter a C++ +symbol. With --no-demangle one can filter easily by mangled function +name. + +Signed-off-by: Martin Liška +Link: http://lore.kernel.org/lkml/c3c7e959-9f7f-18e2-e795-f604275cbac3@suse.cz +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: 374af9f1f06b ("perf annotate: Get rid of duplicate --group option item") +Signed-off-by: Sasha Levin +--- + tools/perf/Documentation/perf-annotate.txt | 7 +++++++ + tools/perf/builtin-annotate.c | 4 ++++ + 2 files changed, 11 insertions(+) + +diff --git a/tools/perf/Documentation/perf-annotate.txt b/tools/perf/Documentation/perf-annotate.txt +index e8c972f89357d..066ecfffbf4ed 100644 +--- a/tools/perf/Documentation/perf-annotate.txt ++++ b/tools/perf/Documentation/perf-annotate.txt +@@ -118,6 +118,13 @@ OPTIONS + --group:: + Show event group information together + ++--demangle:: ++ Demangle symbol names to human readable form. It's enabled by default, ++ disable with --no-demangle. ++ ++--demangle-kernel:: ++ Demangle kernel symbol names to human readable form (for C++ kernels). ++ + --percent-type:: + Set annotation percent type from following choices: + global-period, local-period, global-hits, local-hits +diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c +index 8db8fc9bddef3..a6fea0be3a5d6 100644 +--- a/tools/perf/builtin-annotate.c ++++ b/tools/perf/builtin-annotate.c +@@ -537,6 +537,10 @@ int cmd_annotate(int argc, const char **argv) + "Specify disassembler style (e.g. -M intel for intel syntax)"), + OPT_STRING(0, "objdump", &annotate.opts.objdump_path, "path", + "objdump binary to use for disassembly and annotations"), ++ OPT_BOOLEAN(0, "demangle", &symbol_conf.demangle, ++ "Enable symbol demangling"), ++ OPT_BOOLEAN(0, "demangle-kernel", &symbol_conf.demangle_kernel, ++ "Enable kernel symbol demangling"), + OPT_BOOLEAN(0, "group", &symbol_conf.event_group, + "Show event group information together"), + OPT_BOOLEAN(0, "show-total-period", &symbol_conf.show_total_period, +-- +2.43.0 + diff --git a/queue-5.4/perf-annotate-get-rid-of-duplicate-group-option-item.patch b/queue-5.4/perf-annotate-get-rid-of-duplicate-group-option-item.patch new file mode 100644 index 00000000000..8e7630c7c12 --- /dev/null +++ b/queue-5.4/perf-annotate-get-rid-of-duplicate-group-option-item.patch @@ -0,0 +1,48 @@ +From e5ba0402d484bf215c79f006dd2f5552c495c18a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 15:43:12 -0700 +Subject: perf annotate: Get rid of duplicate --group option item + +From: Namhyung Kim + +[ Upstream commit 374af9f1f06b5e991c810d2e4983d6f58df32136 ] + +The options array in cmd_annotate() has duplicate --group options. It +only needs one and let's get rid of the other. + + $ perf annotate -h 2>&1 | grep group + --group Show event group information together + --group Show event group information together + +Fixes: 7ebaf4890f63eb90 ("perf annotate: Support '--group' option") +Reviewed-by: Kan Liang +Signed-off-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jin Yao +Cc: Jiri Olsa +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20240322224313.423181-1-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-annotate.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c +index a6fea0be3a5d6..31ddb128b2841 100644 +--- a/tools/perf/builtin-annotate.c ++++ b/tools/perf/builtin-annotate.c +@@ -541,8 +541,6 @@ int cmd_annotate(int argc, const char **argv) + "Enable symbol demangling"), + OPT_BOOLEAN(0, "demangle-kernel", &symbol_conf.demangle_kernel, + "Enable kernel symbol demangling"), +- OPT_BOOLEAN(0, "group", &symbol_conf.event_group, +- "Show event group information together"), + OPT_BOOLEAN(0, "show-total-period", &symbol_conf.show_total_period, + "Show a column with the sum of periods"), + OPT_BOOLEAN('n', "show-nr-samples", &symbol_conf.show_nr_samples, +-- +2.43.0 + diff --git a/queue-5.4/perf-probe-add-missing-libgen.h-header-needed-for-us.patch b/queue-5.4/perf-probe-add-missing-libgen.h-header-needed-for-us.patch new file mode 100644 index 00000000000..0dadf544636 --- /dev/null +++ b/queue-5.4/perf-probe-add-missing-libgen.h-header-needed-for-us.patch @@ -0,0 +1,53 @@ +From 638d1bdf52bbf63b312788adb16ced6f285d0ec7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 11:13:30 -0300 +Subject: perf probe: Add missing libgen.h header needed for using basename() + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 581037151910126a7934e369e4b6ac70eda9a703 ] + +This prototype is obtained indirectly, by luck, from some other header +in probe-event.c in most systems, but recently exploded on alpine:edge: + + 8 13.39 alpine:edge : FAIL gcc version 13.2.1 20240309 (Alpine 13.2.1_git20240309) + util/probe-event.c: In function 'convert_exec_to_group': + util/probe-event.c:225:16: error: implicit declaration of function 'basename' [-Werror=implicit-function-declaration] + 225 | ptr1 = basename(exec_copy); + | ^~~~~~~~ + util/probe-event.c:225:14: error: assignment to 'char *' from 'int' makes pointer from integer without a cast [-Werror=int-conversion] + 225 | ptr1 = basename(exec_copy); + | ^ + cc1: all warnings being treated as errors + make[3]: *** [/git/perf-6.8.0/tools/build/Makefile.build:158: util] Error 2 + +Fix it by adding the libgen.h header where basename() is prototyped. + +Fixes: fb7345bbf7fad9bf ("perf probe: Support basic dwarf-based operations on uprobe events") +Cc: Masami Hiramatsu +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: https://lore.kernel.org/lkml/ +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/probe-event.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c +index 67b7d2af1755d..1fe1c3ac2e4c9 100644 +--- a/tools/perf/util/probe-event.c ++++ b/tools/perf/util/probe-event.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + #include + #include + #include +-- +2.43.0 + diff --git a/queue-5.4/perf-stat-don-t-display-metric-header-for-non-leader.patch b/queue-5.4/perf-stat-don-t-display-metric-header-for-non-leader.patch new file mode 100644 index 00000000000..6cc36e0107c --- /dev/null +++ b/queue-5.4/perf-stat-don-t-display-metric-header-for-non-leader.patch @@ -0,0 +1,90 @@ +From 6039024cb460ee472fc91472af31293a2a2f92b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 22:13:09 -0700 +Subject: perf stat: Don't display metric header for non-leader uncore events + +From: Ian Rogers + +[ Upstream commit 193a9e30207f54777ff42d0d8be8389edc522277 ] + +On an Intel tigerlake laptop a metric like: + + { + "BriefDescription": "Test", + "MetricExpr": "imc_free_running@data_read@ + imc_free_running@data_write@", + "MetricGroup": "Test", + "MetricName": "Test", + "ScaleUnit": "6.103515625e-5MiB" + }, + +Will have 4 events: + + uncore_imc_free_running_0/data_read/ + uncore_imc_free_running_0/data_write/ + uncore_imc_free_running_1/data_read/ + uncore_imc_free_running_1/data_write/ + +If aggregration is disabled with metric-only 2 column headers are +needed: + + $ perf stat -M test --metric-only -A -a sleep 1 + + Performance counter stats for 'system wide': + + MiB Test MiB Test + CPU0 1821.0 1820.5 + +But when not, the counts aggregated in the metric leader and only 1 +column should be shown: + + $ perf stat -M test --metric-only -a sleep 1 + Performance counter stats for 'system wide': + + MiB Test + 5909.4 + + 1.001258915 seconds time elapsed + +Achieve this by skipping events that aren't metric leaders when +printing column headers and aggregation isn't disabled. + +The bug is long standing, the fixes tag is set to a refactor as that +is as far back as is reasonable to backport. + +Fixes: 088519f318be3a41 ("perf stat: Move the display functions to stat-display.c") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kaige Ye +Cc: Kan Liang +Cc: K Prateek Nayak +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Yicong Yang +Link: https://lore.kernel.org/r/20240510051309.2452468-1-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/stat-display.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/perf/util/stat-display.c b/tools/perf/util/stat-display.c +index 70612ec583f35..7ea2bddd75d51 100644 +--- a/tools/perf/util/stat-display.c ++++ b/tools/perf/util/stat-display.c +@@ -931,6 +931,9 @@ static void print_metric_headers(struct perf_stat_config *config, + + /* Print metrics headers only */ + evlist__for_each_entry(evlist, counter) { ++ if (config->aggr_mode != AGGR_NONE && counter->metric_leader != counter) ++ continue; ++ + os.evsel = counter; + out.ctx = &os; + out.print_metric = print_metric_header; +-- +2.43.0 + diff --git a/queue-5.4/perf-top-fix-tui-exit-screen-refresh-race-condition.patch b/queue-5.4/perf-top-fix-tui-exit-screen-refresh-race-condition.patch new file mode 100644 index 00000000000..890388c1d7c --- /dev/null +++ b/queue-5.4/perf-top-fix-tui-exit-screen-refresh-race-condition.patch @@ -0,0 +1,75 @@ +From 0f907d33ea61bf9c76ba7351f3ceaf5ab82d3923 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Dec 2021 16:55:19 +0800 +Subject: perf top: Fix TUI exit screen refresh race condition + +From: yaowenbin + +[ Upstream commit 64f18d2d043015b3f835ce4c9f3beb97cfd19b6e ] + +When the following command is executed several times, a coredump file is +generated. + + $ timeout -k 9 5 perf top -e task-clock + ******* + ******* + ******* + 0.01% [kernel] [k] __do_softirq + 0.01% libpthread-2.28.so [.] __pthread_mutex_lock + 0.01% [kernel] [k] __ll_sc_atomic64_sub_return + double free or corruption (!prev) perf top --sort comm,dso + timeout: the monitored command dumped core + +When we terminate "perf top" using sending signal method, +SLsmg_reset_smg() called. SLsmg_reset_smg() resets the SLsmg screen +management routines by freeing all memory allocated while it was active. + +However SLsmg_reinit_smg() maybe be called by another thread. + +SLsmg_reinit_smg() will free the same memory accessed by +SLsmg_reset_smg(), thus it results in a double free. + +SLsmg_reinit_smg() is called already protected by ui__lock, so we fix +the problem by adding pthread_mutex_trylock of ui__lock when calling +SLsmg_reset_smg(). + +Signed-off-by: Wenyu Liu +Tested-by: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: wuxu.wu@huawei.com +Link: http://lore.kernel.org/lkml/a91e3943-7ddc-f5c0-a7f5-360f073c20e6@huawei.com +Signed-off-by: Hewenliang +Signed-off-by: yaowenbin +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: 769e6a1e15bd ("perf ui browser: Don't save pointer to stack memory") +Signed-off-by: Sasha Levin +--- + tools/perf/ui/tui/setup.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/ui/tui/setup.c b/tools/perf/ui/tui/setup.c +index e9bfe856a5dee..b1be59b4e2a4f 100644 +--- a/tools/perf/ui/tui/setup.c ++++ b/tools/perf/ui/tui/setup.c +@@ -170,9 +170,11 @@ void ui__exit(bool wait_for_ok) + "Press any key...", 0); + + SLtt_set_cursor_visibility(1); +- SLsmg_refresh(); +- SLsmg_reset_smg(); ++ if (!pthread_mutex_trylock(&ui__lock)) { ++ SLsmg_refresh(); ++ SLsmg_reset_smg(); ++ pthread_mutex_unlock(&ui__lock); ++ } + SLang_reset_tty(); +- + perf_error__unregister(&perf_tui_eops); + } +-- +2.43.0 + diff --git a/queue-5.4/perf-ui-browser-avoid-segv-on-title.patch b/queue-5.4/perf-ui-browser-avoid-segv-on-title.patch new file mode 100644 index 00000000000..579663039cd --- /dev/null +++ b/queue-5.4/perf-ui-browser-avoid-segv-on-title.patch @@ -0,0 +1,46 @@ +From 5a6b22440cdcbca71dc63053b17fac526bce1af4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 20:52:58 -0700 +Subject: perf ui browser: Avoid SEGV on title + +From: Ian Rogers + +[ Upstream commit 90f01afb0dfafbc9b094bb61e61a4ac297d9d0d2 ] + +If the title is NULL then it can lead to a SEGV. + +Fixes: 769e6a1e15bdbbaf ("perf ui browser: Don't save pointer to stack memory") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Leo Yan +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20240508035301.1554434-2-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/ui/browser.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/ui/browser.c b/tools/perf/ui/browser.c +index 6fa4f123d5ff7..b84b87b939573 100644 +--- a/tools/perf/ui/browser.c ++++ b/tools/perf/ui/browser.c +@@ -203,7 +203,7 @@ void ui_browser__refresh_dimensions(struct ui_browser *browser) + void ui_browser__handle_resize(struct ui_browser *browser) + { + ui__refresh_dimensions(false); +- ui_browser__show(browser, browser->title, ui_helpline__current); ++ ui_browser__show(browser, browser->title ?: "", ui_helpline__current); + ui_browser__refresh(browser); + } + +-- +2.43.0 + diff --git a/queue-5.4/perf-ui-browser-don-t-save-pointer-to-stack-memory.patch b/queue-5.4/perf-ui-browser-don-t-save-pointer-to-stack-memory.patch new file mode 100644 index 00000000000..961e5e3d244 --- /dev/null +++ b/queue-5.4/perf-ui-browser-don-t-save-pointer-to-stack-memory.patch @@ -0,0 +1,143 @@ +From 6738e4fc1c3a899b9648cf62ecad5dd48c4e1cd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 11:35:38 -0700 +Subject: perf ui browser: Don't save pointer to stack memory + +From: Ian Rogers + +[ Upstream commit 769e6a1e15bdbbaf2b0d2f37c24f2c53268bd21f ] + +ui_browser__show() is capturing the input title that is stack allocated +memory in hist_browser__run(). + +Avoid a use after return by strdup-ing the string. + +Committer notes: + +Further explanation from Ian Rogers: + +My command line using tui is: +$ sudo bash -c 'rm /tmp/asan.log*; export +ASAN_OPTIONS="log_path=/tmp/asan.log"; /tmp/perf/perf mem record -a +sleep 1; /tmp/perf/perf mem report' +I then go to the perf annotate view and quit. This triggers the asan +error (from the log file): +``` +==1254591==ERROR: AddressSanitizer: stack-use-after-return on address +0x7f2813331920 at pc 0x7f28180 +65991 bp 0x7fff0a21c750 sp 0x7fff0a21bf10 +READ of size 80 at 0x7f2813331920 thread T0 + #0 0x7f2818065990 in __interceptor_strlen +../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:461 + #1 0x7f2817698251 in SLsmg_write_wrapped_string +(/lib/x86_64-linux-gnu/libslang.so.2+0x98251) + #2 0x7f28176984b9 in SLsmg_write_nstring +(/lib/x86_64-linux-gnu/libslang.so.2+0x984b9) + #3 0x55c94045b365 in ui_browser__write_nstring ui/browser.c:60 + #4 0x55c94045c558 in __ui_browser__show_title ui/browser.c:266 + #5 0x55c94045c776 in ui_browser__show ui/browser.c:288 + #6 0x55c94045c06d in ui_browser__handle_resize ui/browser.c:206 + #7 0x55c94047979b in do_annotate ui/browsers/hists.c:2458 + #8 0x55c94047fb17 in evsel__hists_browse ui/browsers/hists.c:3412 + #9 0x55c940480a0c in perf_evsel_menu__run ui/browsers/hists.c:3527 + #10 0x55c940481108 in __evlist__tui_browse_hists ui/browsers/hists.c:3613 + #11 0x55c9404813f7 in evlist__tui_browse_hists ui/browsers/hists.c:3661 + #12 0x55c93ffa253f in report__browse_hists tools/perf/builtin-report.c:671 + #13 0x55c93ffa58ca in __cmd_report tools/perf/builtin-report.c:1141 + #14 0x55c93ffaf159 in cmd_report tools/perf/builtin-report.c:1805 + #15 0x55c94000c05c in report_events tools/perf/builtin-mem.c:374 + #16 0x55c94000d96d in cmd_mem tools/perf/builtin-mem.c:516 + #17 0x55c9400e44ee in run_builtin tools/perf/perf.c:350 + #18 0x55c9400e4a5a in handle_internal_command tools/perf/perf.c:403 + #19 0x55c9400e4e22 in run_argv tools/perf/perf.c:447 + #20 0x55c9400e53ad in main tools/perf/perf.c:561 + #21 0x7f28170456c9 in __libc_start_call_main +../sysdeps/nptl/libc_start_call_main.h:58 + #22 0x7f2817045784 in __libc_start_main_impl ../csu/libc-start.c:360 + #23 0x55c93ff544c0 in _start (/tmp/perf/perf+0x19a4c0) (BuildId: +84899b0e8c7d3a3eaa67b2eb35e3d8b2f8cd4c93) + +Address 0x7f2813331920 is located in stack of thread T0 at offset 32 in frame + #0 0x55c94046e85e in hist_browser__run ui/browsers/hists.c:746 + + This frame has 1 object(s): + [32, 192) 'title' (line 747) <== Memory access at offset 32 is +inside this variable +HINT: this may be a false positive if your program uses some custom +stack unwind mechanism, swapcontext or vfork +``` +hist_browser__run isn't on the stack so the asan error looks legit. +There's no clean init/exit on struct ui_browser so I may be trading a +use-after-return for a memory leak, but that seems look a good trade +anyway. + +Fixes: 05e8b0804ec4 ("perf ui browser: Stop using 'self'") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Athira Rajeev +Cc: Ben Gainey +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kajol Jain +Cc: Kan Liang +Cc: K Prateek Nayak +Cc: Li Dong +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Oliver Upton +Cc: Paran Lee +Cc: Peter Zijlstra +Cc: Ravi Bangoria +Cc: Sun Haiyong +Cc: Tim Chen +Cc: Yanteng Si +Cc: Yicong Yang +Link: https://lore.kernel.org/r/20240507183545.1236093-2-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/ui/browser.c | 4 +++- + tools/perf/ui/browser.h | 2 +- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/ui/browser.c b/tools/perf/ui/browser.c +index 9dc808020e824..6fa4f123d5ff7 100644 +--- a/tools/perf/ui/browser.c ++++ b/tools/perf/ui/browser.c +@@ -287,7 +287,8 @@ int ui_browser__show(struct ui_browser *browser, const char *title, + mutex_lock(&ui__lock); + __ui_browser__show_title(browser, title); + +- browser->title = title; ++ free(browser->title); ++ browser->title = strdup(title); + zfree(&browser->helpline); + + va_start(ap, helpline); +@@ -304,6 +305,7 @@ void ui_browser__hide(struct ui_browser *browser) + mutex_lock(&ui__lock); + ui_helpline__pop(); + zfree(&browser->helpline); ++ zfree(&browser->title); + mutex_unlock(&ui__lock); + } + +diff --git a/tools/perf/ui/browser.h b/tools/perf/ui/browser.h +index 3678eb88f119c..815e6bf7ee531 100644 +--- a/tools/perf/ui/browser.h ++++ b/tools/perf/ui/browser.h +@@ -21,7 +21,7 @@ struct ui_browser { + u8 extra_title_lines; + int current_color; + void *priv; +- const char *title; ++ char *title; + char *helpline; + const char *no_samples_msg; + void (*refresh_dimensions)(struct ui_browser *browser); +-- +2.43.0 + diff --git a/queue-5.4/perf-ui-update-use-of-pthread-mutex.patch b/queue-5.4/perf-ui-update-use-of-pthread-mutex.patch new file mode 100644 index 00000000000..0909fa7c96a --- /dev/null +++ b/queue-5.4/perf-ui-update-use-of-pthread-mutex.patch @@ -0,0 +1,382 @@ +From 76094a3a77d89c224d3de716cb86f54f595c6025 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 09:42:33 -0700 +Subject: perf ui: Update use of pthread mutex +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ian Rogers + +[ Upstream commit 82aff6cc070417f26f9b02b26e63c17ff43b4044 ] + +Switch to the use of mutex wrappers that provide better error checking. + +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Alexandre Truong +Cc: Alexey Bayduraev +Cc: Andi Kleen +Cc: Andres Freund +Cc: Andrii Nakryiko +Cc: André Almeida +Cc: Athira Jajeev +Cc: Christophe JAILLET +Cc: Colin Ian King +Cc: Dario Petrillo +Cc: Darren Hart +Cc: Dave Marchevsky +Cc: Davidlohr Bueso +Cc: Fangrui Song +Cc: Hewenliang +Cc: Ingo Molnar +Cc: James Clark +Cc: Jason Wang +Cc: Jiri Olsa +Cc: Kajol Jain +Cc: Kim Phillips +Cc: Leo Yan +Cc: Mark Rutland +Cc: Martin Liška +Cc: Masami Hiramatsu +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Pavithra Gurushankar +Cc: Peter Zijlstra +Cc: Quentin Monnet +Cc: Ravi Bangoria +Cc: Remi Bernon +Cc: Riccardo Mancini +Cc: Song Liu +Cc: Stephane Eranian +Cc: Thomas Gleixner +Cc: Thomas Richter +Cc: Tom Rix +Cc: Weiguo Li +Cc: Wenyu Liu +Cc: William Cohen +Cc: Zechuan Chen +Cc: bpf@vger.kernel.org +Cc: llvm@lists.linux.dev +Cc: yaowenbin +Link: https://lore.kernel.org/r/20220826164242.43412-10-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: 769e6a1e15bd ("perf ui browser: Don't save pointer to stack memory") +Signed-off-by: Sasha Levin +--- + tools/perf/ui/browser.c | 20 ++++++++++---------- + tools/perf/ui/browsers/annotate.c | 2 +- + tools/perf/ui/setup.c | 5 +++-- + tools/perf/ui/tui/helpline.c | 5 ++--- + tools/perf/ui/tui/progress.c | 8 ++++---- + tools/perf/ui/tui/setup.c | 8 ++++---- + tools/perf/ui/tui/util.c | 18 +++++++++--------- + tools/perf/ui/ui.h | 4 ++-- + 8 files changed, 35 insertions(+), 35 deletions(-) + +diff --git a/tools/perf/ui/browser.c b/tools/perf/ui/browser.c +index 781afe42e90e0..9dc808020e824 100644 +--- a/tools/perf/ui/browser.c ++++ b/tools/perf/ui/browser.c +@@ -268,9 +268,9 @@ void __ui_browser__show_title(struct ui_browser *browser, const char *title) + + void ui_browser__show_title(struct ui_browser *browser, const char *title) + { +- pthread_mutex_lock(&ui__lock); ++ mutex_lock(&ui__lock); + __ui_browser__show_title(browser, title); +- pthread_mutex_unlock(&ui__lock); ++ mutex_unlock(&ui__lock); + } + + int ui_browser__show(struct ui_browser *browser, const char *title, +@@ -284,7 +284,7 @@ int ui_browser__show(struct ui_browser *browser, const char *title, + + browser->refresh_dimensions(browser); + +- pthread_mutex_lock(&ui__lock); ++ mutex_lock(&ui__lock); + __ui_browser__show_title(browser, title); + + browser->title = title; +@@ -295,16 +295,16 @@ int ui_browser__show(struct ui_browser *browser, const char *title, + va_end(ap); + if (err > 0) + ui_helpline__push(browser->helpline); +- pthread_mutex_unlock(&ui__lock); ++ mutex_unlock(&ui__lock); + return err ? 0 : -1; + } + + void ui_browser__hide(struct ui_browser *browser) + { +- pthread_mutex_lock(&ui__lock); ++ mutex_lock(&ui__lock); + ui_helpline__pop(); + zfree(&browser->helpline); +- pthread_mutex_unlock(&ui__lock); ++ mutex_unlock(&ui__lock); + } + + static void ui_browser__scrollbar_set(struct ui_browser *browser) +@@ -352,9 +352,9 @@ static int __ui_browser__refresh(struct ui_browser *browser) + + int ui_browser__refresh(struct ui_browser *browser) + { +- pthread_mutex_lock(&ui__lock); ++ mutex_lock(&ui__lock); + __ui_browser__refresh(browser); +- pthread_mutex_unlock(&ui__lock); ++ mutex_unlock(&ui__lock); + + return 0; + } +@@ -390,10 +390,10 @@ int ui_browser__run(struct ui_browser *browser, int delay_secs) + while (1) { + off_t offset; + +- pthread_mutex_lock(&ui__lock); ++ mutex_lock(&ui__lock); + err = __ui_browser__refresh(browser); + SLsmg_refresh(); +- pthread_mutex_unlock(&ui__lock); ++ mutex_unlock(&ui__lock); + if (err < 0) + break; + +diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c +index 82207db8f97c5..d4c27ebb4b848 100644 +--- a/tools/perf/ui/browsers/annotate.c ++++ b/tools/perf/ui/browsers/annotate.c +@@ -8,11 +8,11 @@ + #include "../../util/hist.h" + #include "../../util/sort.h" + #include "../../util/map.h" ++#include "../../util/mutex.h" + #include "../../util/symbol.h" + #include "../../util/evsel.h" + #include "../../util/evlist.h" + #include +-#include + #include + #include + #include +diff --git a/tools/perf/ui/setup.c b/tools/perf/ui/setup.c +index 700335cde6180..25ded88801a3d 100644 +--- a/tools/perf/ui/setup.c ++++ b/tools/perf/ui/setup.c +@@ -1,5 +1,4 @@ + // SPDX-License-Identifier: GPL-2.0 +-#include + #include + #include + +@@ -8,7 +7,7 @@ + #include "../util/hist.h" + #include "ui.h" + +-pthread_mutex_t ui__lock = PTHREAD_MUTEX_INITIALIZER; ++struct mutex ui__lock; + void *perf_gtk_handle; + int use_browser = -1; + +@@ -76,6 +75,7 @@ int stdio__config_color(const struct option *opt __maybe_unused, + + void setup_browser(bool fallback_to_pager) + { ++ mutex_init(&ui__lock); + if (use_browser < 2 && (!isatty(1) || dump_trace)) + use_browser = 0; + +@@ -118,4 +118,5 @@ void exit_browser(bool wait_for_ok) + default: + break; + } ++ mutex_destroy(&ui__lock); + } +diff --git a/tools/perf/ui/tui/helpline.c b/tools/perf/ui/tui/helpline.c +index 298d6af82fddd..db4952f5990bd 100644 +--- a/tools/perf/ui/tui/helpline.c ++++ b/tools/perf/ui/tui/helpline.c +@@ -2,7 +2,6 @@ + #include + #include + #include +-#include + #include + #include + +@@ -33,7 +32,7 @@ static int tui_helpline__show(const char *format, va_list ap) + int ret; + static int backlog; + +- pthread_mutex_lock(&ui__lock); ++ mutex_lock(&ui__lock); + ret = vscnprintf(ui_helpline__last_msg + backlog, + sizeof(ui_helpline__last_msg) - backlog, format, ap); + backlog += ret; +@@ -45,7 +44,7 @@ static int tui_helpline__show(const char *format, va_list ap) + SLsmg_refresh(); + backlog = 0; + } +- pthread_mutex_unlock(&ui__lock); ++ mutex_unlock(&ui__lock); + + return ret; + } +diff --git a/tools/perf/ui/tui/progress.c b/tools/perf/ui/tui/progress.c +index 3d74af5a7ece6..71b6c8d9474fb 100644 +--- a/tools/perf/ui/tui/progress.c ++++ b/tools/perf/ui/tui/progress.c +@@ -45,7 +45,7 @@ static void tui_progress__update(struct ui_progress *p) + } + + ui__refresh_dimensions(false); +- pthread_mutex_lock(&ui__lock); ++ mutex_lock(&ui__lock); + y = SLtt_Screen_Rows / 2 - 2; + SLsmg_set_color(0); + SLsmg_draw_box(y, 0, 3, SLtt_Screen_Cols); +@@ -56,7 +56,7 @@ static void tui_progress__update(struct ui_progress *p) + bar = ((SLtt_Screen_Cols - 2) * p->curr) / p->total; + SLsmg_fill_region(y, 1, 1, bar, ' '); + SLsmg_refresh(); +- pthread_mutex_unlock(&ui__lock); ++ mutex_unlock(&ui__lock); + } + + static void tui_progress__finish(void) +@@ -67,12 +67,12 @@ static void tui_progress__finish(void) + return; + + ui__refresh_dimensions(false); +- pthread_mutex_lock(&ui__lock); ++ mutex_lock(&ui__lock); + y = SLtt_Screen_Rows / 2 - 2; + SLsmg_set_color(0); + SLsmg_fill_region(y, 0, 3, SLtt_Screen_Cols, ' '); + SLsmg_refresh(); +- pthread_mutex_unlock(&ui__lock); ++ mutex_unlock(&ui__lock); + } + + static struct ui_progress_ops tui_progress__ops = { +diff --git a/tools/perf/ui/tui/setup.c b/tools/perf/ui/tui/setup.c +index b1be59b4e2a4f..a3b8c397c24d5 100644 +--- a/tools/perf/ui/tui/setup.c ++++ b/tools/perf/ui/tui/setup.c +@@ -29,10 +29,10 @@ void ui__refresh_dimensions(bool force) + { + if (force || ui__need_resize) { + ui__need_resize = 0; +- pthread_mutex_lock(&ui__lock); ++ mutex_lock(&ui__lock); + SLtt_get_screen_size(); + SLsmg_reinit_smg(); +- pthread_mutex_unlock(&ui__lock); ++ mutex_unlock(&ui__lock); + } + } + +@@ -170,10 +170,10 @@ void ui__exit(bool wait_for_ok) + "Press any key...", 0); + + SLtt_set_cursor_visibility(1); +- if (!pthread_mutex_trylock(&ui__lock)) { ++ if (mutex_trylock(&ui__lock)) { + SLsmg_refresh(); + SLsmg_reset_smg(); +- pthread_mutex_unlock(&ui__lock); ++ mutex_unlock(&ui__lock); + } + SLang_reset_tty(); + perf_error__unregister(&perf_tui_eops); +diff --git a/tools/perf/ui/tui/util.c b/tools/perf/ui/tui/util.c +index b98dd0e31dc1a..8f8d00c2c1b82 100644 +--- a/tools/perf/ui/tui/util.c ++++ b/tools/perf/ui/tui/util.c +@@ -91,7 +91,7 @@ int ui_browser__input_window(const char *title, const char *text, char *input, + t = sep + 1; + } + +- pthread_mutex_lock(&ui__lock); ++ mutex_lock(&ui__lock); + + max_len += 2; + nr_lines += 8; +@@ -121,17 +121,17 @@ int ui_browser__input_window(const char *title, const char *text, char *input, + SLsmg_write_nstring((char *)exit_msg, max_len); + SLsmg_refresh(); + +- pthread_mutex_unlock(&ui__lock); ++ mutex_unlock(&ui__lock); + + x += 2; + len = 0; + key = ui__getch(delay_secs); + while (key != K_TIMER && key != K_ENTER && key != K_ESC) { +- pthread_mutex_lock(&ui__lock); ++ mutex_lock(&ui__lock); + + if (key == K_BKSPC) { + if (len == 0) { +- pthread_mutex_unlock(&ui__lock); ++ mutex_unlock(&ui__lock); + goto next_key; + } + SLsmg_gotorc(y, x + --len); +@@ -143,7 +143,7 @@ int ui_browser__input_window(const char *title, const char *text, char *input, + } + SLsmg_refresh(); + +- pthread_mutex_unlock(&ui__lock); ++ mutex_unlock(&ui__lock); + + /* XXX more graceful overflow handling needed */ + if (len == sizeof(buf) - 1) { +@@ -211,19 +211,19 @@ void __ui__info_window(const char *title, const char *text, const char *exit_msg + + void ui__info_window(const char *title, const char *text) + { +- pthread_mutex_lock(&ui__lock); ++ mutex_lock(&ui__lock); + __ui__info_window(title, text, NULL); + SLsmg_refresh(); +- pthread_mutex_unlock(&ui__lock); ++ mutex_unlock(&ui__lock); + } + + int ui__question_window(const char *title, const char *text, + const char *exit_msg, int delay_secs) + { +- pthread_mutex_lock(&ui__lock); ++ mutex_lock(&ui__lock); + __ui__info_window(title, text, exit_msg); + SLsmg_refresh(); +- pthread_mutex_unlock(&ui__lock); ++ mutex_unlock(&ui__lock); + return ui__getch(delay_secs); + } + +diff --git a/tools/perf/ui/ui.h b/tools/perf/ui/ui.h +index 9b6fdf06e1d2f..99f8d2fe9bc55 100644 +--- a/tools/perf/ui/ui.h ++++ b/tools/perf/ui/ui.h +@@ -2,11 +2,11 @@ + #ifndef _PERF_UI_H_ + #define _PERF_UI_H_ 1 + +-#include ++#include "../util/mutex.h" + #include + #include + +-extern pthread_mutex_t ui__lock; ++extern struct mutex ui__lock; + extern void *perf_gtk_handle; + + extern int use_browser; +-- +2.43.0 + diff --git a/queue-5.4/ppdev-add-an-error-check-in-register_device.patch b/queue-5.4/ppdev-add-an-error-check-in-register_device.patch new file mode 100644 index 00000000000..65889c095da --- /dev/null +++ b/queue-5.4/ppdev-add-an-error-check-in-register_device.patch @@ -0,0 +1,72 @@ +From ef62bfbaf5f07d47afd1ad7a42e2d977bc077cd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 16:38:40 +0800 +Subject: ppdev: Add an error check in register_device + +From: Huai-Yuan Liu + +[ Upstream commit fbf740aeb86a4fe82ad158d26d711f2f3be79b3e ] + +In register_device, the return value of ida_simple_get is unchecked, +in witch ida_simple_get will use an invalid index value. + +To address this issue, index should be checked after ida_simple_get. When +the index value is abnormal, a warning message should be printed, the port +should be dropped, and the value should be recorded. + +Fixes: 9a69645dde11 ("ppdev: fix registering same device name") +Signed-off-by: Huai-Yuan Liu +Link: https://lore.kernel.org/r/20240412083840.234085-1-qq810974084@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/char/ppdev.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c +index 5246e0faaf9ae..fb51430e1d5c6 100644 +--- a/drivers/char/ppdev.c ++++ b/drivers/char/ppdev.c +@@ -296,28 +296,35 @@ static int register_device(int minor, struct pp_struct *pp) + if (!port) { + pr_warn("%s: no associated port!\n", name); + rc = -ENXIO; +- goto err; ++ goto err_free_name; + } + + index = ida_alloc(&ida_index, GFP_KERNEL); ++ if (index < 0) { ++ pr_warn("%s: failed to get index!\n", name); ++ rc = index; ++ goto err_put_port; ++ } ++ + memset(&ppdev_cb, 0, sizeof(ppdev_cb)); + ppdev_cb.irq_func = pp_irq; + ppdev_cb.flags = (pp->flags & PP_EXCL) ? PARPORT_FLAG_EXCL : 0; + ppdev_cb.private = pp; + pdev = parport_register_dev_model(port, name, &ppdev_cb, index); +- parport_put_port(port); + + if (!pdev) { + pr_warn("%s: failed to register device!\n", name); + rc = -ENXIO; + ida_free(&ida_index, index); +- goto err; ++ goto err_put_port; + } + + pp->pdev = pdev; + pp->index = index; + dev_dbg(&pdev->dev, "registered pardevice\n"); +-err: ++err_put_port: ++ parport_put_port(port); ++err_free_name: + kfree(name); + return rc; + } +-- +2.43.0 + diff --git a/queue-5.4/ppdev-remove-usage-of-the-deprecated-ida_simple_xx-a.patch b/queue-5.4/ppdev-remove-usage-of-the-deprecated-ida_simple_xx-a.patch new file mode 100644 index 00000000000..9aa40f1774b --- /dev/null +++ b/queue-5.4/ppdev-remove-usage-of-the-deprecated-ida_simple_xx-a.patch @@ -0,0 +1,57 @@ +From d37ea299e497382ea8b8dba2b2646c31df1e017b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 06:01:47 +0100 +Subject: ppdev: Remove usage of the deprecated ida_simple_xx() API + +From: Christophe JAILLET + +[ Upstream commit d8407f71ebeaeb6f50bd89791837873e44609708 ] + +ida_alloc() and ida_free() should be preferred to the deprecated +ida_simple_get() and ida_simple_remove(). + +This is less verbose. + +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/ba9da12fdd5cdb2c28180b7160af5042447d803f.1702962092.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: fbf740aeb86a ("ppdev: Add an error check in register_device") +Signed-off-by: Sasha Levin +--- + drivers/char/ppdev.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c +index 34bb88fe0b0a6..5246e0faaf9ae 100644 +--- a/drivers/char/ppdev.c ++++ b/drivers/char/ppdev.c +@@ -299,7 +299,7 @@ static int register_device(int minor, struct pp_struct *pp) + goto err; + } + +- index = ida_simple_get(&ida_index, 0, 0, GFP_KERNEL); ++ index = ida_alloc(&ida_index, GFP_KERNEL); + memset(&ppdev_cb, 0, sizeof(ppdev_cb)); + ppdev_cb.irq_func = pp_irq; + ppdev_cb.flags = (pp->flags & PP_EXCL) ? PARPORT_FLAG_EXCL : 0; +@@ -310,7 +310,7 @@ static int register_device(int minor, struct pp_struct *pp) + if (!pdev) { + pr_warn("%s: failed to register device!\n", name); + rc = -ENXIO; +- ida_simple_remove(&ida_index, index); ++ ida_free(&ida_index, index); + goto err; + } + +@@ -762,7 +762,7 @@ static int pp_release(struct inode *inode, struct file *file) + + if (pp->pdev) { + parport_unregister_device(pp->pdev); +- ida_simple_remove(&ida_index, pp->index); ++ ida_free(&ida_index, pp->index); + pp->pdev = NULL; + pr_debug(CHRDEV "%x: unregistered pardevice\n", minor); + } +-- +2.43.0 + diff --git a/queue-5.4/serial-max3100-fix-bitwise-types.patch b/queue-5.4/serial-max3100-fix-bitwise-types.patch new file mode 100644 index 00000000000..d68558e5586 --- /dev/null +++ b/queue-5.4/serial-max3100-fix-bitwise-types.patch @@ -0,0 +1,53 @@ +From 85d14120902a4c6c3d05123815dd1dfa043679ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 22:50:30 +0300 +Subject: serial: max3100: Fix bitwise types + +From: Andy Shevchenko + +[ Upstream commit e60955dbecb97f080848a57524827e2db29c70fd ] + +Sparse is not happy about misuse of bitwise types: + + .../max3100.c:194:13: warning: incorrect type in assignment (different base types) + .../max3100.c:194:13: expected unsigned short [addressable] [usertype] etx + .../max3100.c:194:13: got restricted __be16 [usertype] + .../max3100.c:202:15: warning: cast to restricted __be16 + +Fix this by choosing proper types for the respective variables. + +Fixes: 7831d56b0a35 ("tty: MAX3100") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20240402195306.269276-4-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max3100.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/max3100.c b/drivers/tty/serial/max3100.c +index c1ee88f530334..17b6f4a872d6a 100644 +--- a/drivers/tty/serial/max3100.c ++++ b/drivers/tty/serial/max3100.c +@@ -45,6 +45,9 @@ + #include + #include + #include ++#include ++ ++#include + + #include + +@@ -191,7 +194,7 @@ static void max3100_timeout(struct timer_list *t) + static int max3100_sr(struct max3100_port *s, u16 tx, u16 *rx) + { + struct spi_message message; +- u16 etx, erx; ++ __be16 etx, erx; + int status; + struct spi_transfer tran = { + .tx_buf = &etx, +-- +2.43.0 + diff --git a/queue-5.4/serial-max3100-lock-port-lock-when-calling-uart_hand.patch b/queue-5.4/serial-max3100-lock-port-lock-when-calling-uart_hand.patch new file mode 100644 index 00000000000..e487ad40771 --- /dev/null +++ b/queue-5.4/serial-max3100-lock-port-lock-when-calling-uart_hand.patch @@ -0,0 +1,66 @@ +From 6f6565f9e888492dd01eb8f941e3c94623dc56b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 22:50:28 +0300 +Subject: serial: max3100: Lock port->lock when calling + uart_handle_cts_change() + +From: Andy Shevchenko + +[ Upstream commit 77ab53371a2066fdf9b895246505f5ef5a4b5d47 ] + +uart_handle_cts_change() has to be called with port lock taken, +Since we run it in a separate work, the lock may not be taken at +the time of running. Make sure that it's taken by explicitly doing +that. Without it we got a splat: + + WARNING: CPU: 0 PID: 10 at drivers/tty/serial/serial_core.c:3491 uart_handle_cts_change+0xa6/0xb0 + ... + Workqueue: max3100-0 max3100_work [max3100] + RIP: 0010:uart_handle_cts_change+0xa6/0xb0 + ... + max3100_handlerx+0xc5/0x110 [max3100] + max3100_work+0x12a/0x340 [max3100] + +Fixes: 7831d56b0a35 ("tty: MAX3100") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20240402195306.269276-2-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max3100.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/max3100.c b/drivers/tty/serial/max3100.c +index 371569a0fd00a..915d7753eec2f 100644 +--- a/drivers/tty/serial/max3100.c ++++ b/drivers/tty/serial/max3100.c +@@ -213,7 +213,7 @@ static int max3100_sr(struct max3100_port *s, u16 tx, u16 *rx) + return 0; + } + +-static int max3100_handlerx(struct max3100_port *s, u16 rx) ++static int max3100_handlerx_unlocked(struct max3100_port *s, u16 rx) + { + unsigned int ch, flg, status = 0; + int ret = 0, cts; +@@ -253,6 +253,17 @@ static int max3100_handlerx(struct max3100_port *s, u16 rx) + return ret; + } + ++static int max3100_handlerx(struct max3100_port *s, u16 rx) ++{ ++ unsigned long flags; ++ int ret; ++ ++ uart_port_lock_irqsave(&s->port, &flags); ++ ret = max3100_handlerx_unlocked(s, rx); ++ uart_port_unlock_irqrestore(&s->port, flags); ++ return ret; ++} ++ + static void max3100_work(struct work_struct *w) + { + struct max3100_port *s = container_of(w, struct max3100_port, work); +-- +2.43.0 + diff --git a/queue-5.4/serial-max3100-update-uart_driver_registered-on-driv.patch b/queue-5.4/serial-max3100-update-uart_driver_registered-on-driv.patch new file mode 100644 index 00000000000..2ac250d8359 --- /dev/null +++ b/queue-5.4/serial-max3100-update-uart_driver_registered-on-driv.patch @@ -0,0 +1,73 @@ +From abc45deba92dac44322c9169106604f032143839 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 22:50:29 +0300 +Subject: serial: max3100: Update uart_driver_registered on driver removal +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Shevchenko + +[ Upstream commit 712a1fcb38dc7cac6da63ee79a88708fbf9c45ec ] + +The removal of the last MAX3100 device triggers the removal of +the driver. However, code doesn't update the respective global +variable and after insmod — rmmod — insmod cycle the kernel +oopses: + + max3100 spi-PRP0001:01: max3100_probe: adding port 0 + BUG: kernel NULL pointer dereference, address: 0000000000000408 + ... + RIP: 0010:serial_core_register_port+0xa0/0x840 + ... + max3100_probe+0x1b6/0x280 [max3100] + spi_probe+0x8d/0xb0 + +Update the actual state so next time UART driver will be registered +again. + +Hugo also noticed, that the error path in the probe also affected +by having the variable set, and not cleared. Instead of clearing it +move the assignment after the successfull uart_register_driver() call. + +Fixes: 7831d56b0a35 ("tty: MAX3100") +Signed-off-by: Andy Shevchenko +Reviewed-by: Hugo Villeneuve +Link: https://lore.kernel.org/r/20240402195306.269276-3-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max3100.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/max3100.c b/drivers/tty/serial/max3100.c +index 915d7753eec2f..c1ee88f530334 100644 +--- a/drivers/tty/serial/max3100.c ++++ b/drivers/tty/serial/max3100.c +@@ -754,13 +754,14 @@ static int max3100_probe(struct spi_device *spi) + mutex_lock(&max3100s_lock); + + if (!uart_driver_registered) { +- uart_driver_registered = 1; + retval = uart_register_driver(&max3100_uart_driver); + if (retval) { + printk(KERN_ERR "Couldn't register max3100 uart driver\n"); + mutex_unlock(&max3100s_lock); + return retval; + } ++ ++ uart_driver_registered = 1; + } + + for (i = 0; i < MAX_MAX3100; i++) +@@ -846,6 +847,7 @@ static int max3100_remove(struct spi_device *spi) + } + pr_debug("removing max3100 driver\n"); + uart_unregister_driver(&max3100_uart_driver); ++ uart_driver_registered = 0; + + mutex_unlock(&max3100s_lock); + return 0; +-- +2.43.0 + diff --git a/queue-5.4/serial-sh-sci-protect-invalidating-rxdma-on-shutdown.patch b/queue-5.4/serial-sh-sci-protect-invalidating-rxdma-on-shutdown.patch new file mode 100644 index 00000000000..ef879cc7676 --- /dev/null +++ b/queue-5.4/serial-sh-sci-protect-invalidating-rxdma-on-shutdown.patch @@ -0,0 +1,47 @@ +From adc3ed44b059e3209b8b6eb6a4c65fc684960e3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 13:40:17 +0200 +Subject: serial: sh-sci: protect invalidating RXDMA on shutdown + +From: Wolfram Sang + +[ Upstream commit aae20f6e34cd0cbd67a1d0e5877561c40109a81b ] + +The to-be-fixed commit removed locking when invalidating the DMA RX +descriptors on shutdown. It overlooked that there is still a rx_timer +running which may still access the protected data. So, re-add the +locking. + +Reported-by: Dirk Behme +Closes: https://lore.kernel.org/r/ee6c9e16-9f29-450e-81da-4a8dceaa8fc7@de.bosch.com +Fixes: 2c4ee23530ff ("serial: sh-sci: Postpone DMA release when falling back to PIO") +Signed-off-by: Wolfram Sang +Link: https://lore.kernel.org/r/20240506114016.30498-7-wsa+renesas@sang-engineering.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sh-sci.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 95db67c07c340..d570edf21239d 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -1259,9 +1259,14 @@ static void sci_dma_rx_chan_invalidate(struct sci_port *s) + static void sci_dma_rx_release(struct sci_port *s) + { + struct dma_chan *chan = s->chan_rx_saved; ++ struct uart_port *port = &s->port; ++ unsigned long flags; + ++ uart_port_lock_irqsave(port, &flags); + s->chan_rx_saved = NULL; + sci_dma_rx_chan_invalidate(s); ++ uart_port_unlock_irqrestore(port, flags); ++ + dmaengine_terminate_sync(chan); + dma_free_coherent(chan->device->dev, s->buf_len_rx * 2, s->rx_buf[0], + sg_dma_address(&s->sg_rx[0])); +-- +2.43.0 + diff --git a/queue-5.4/series b/queue-5.4/series index 8ccb891951b..dedfec5bb5d 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -91,3 +91,34 @@ netrom-fix-possible-dead-lock-in-nr_rt_ioctl.patch af_packet-do-not-call-packet_read_pending-from-tpack.patch sched-topology-don-t-set-sd_balance_wake-on-cpuset-d.patch sched-fair-allow-disabling-sched_balance_newidle-wit.patch +perf-probe-add-missing-libgen.h-header-needed-for-us.patch +greybus-lights-check-return-of-get_channel_from_mode.patch +perf-annotate-add-demangle-and-demangle-kernel.patch +perf-annotate-get-rid-of-duplicate-group-option-item.patch +soundwire-cadence-intel-simplify-pdi-port-mapping.patch +soundwire-intel-don-t-filter-out-pdi0-1.patch +soundwire-cadence_master-improve-pdi-allocation.patch +soundwire-cadence-fix-invalid-pdi-offset.patch +dmaengine-idma64-add-check-for-dma_set_max_seg_size.patch +firmware-dmi-id-add-a-release-callback-function.patch +serial-max3100-lock-port-lock-when-calling-uart_hand.patch +serial-max3100-update-uart_driver_registered-on-driv.patch +serial-max3100-fix-bitwise-types.patch +greybus-arche-ctrl-move-device-table-to-its-right-lo.patch +iio-pressure-dps310-support-negative-temperature-val.patch +microblaze-remove-gcc-flag-for-non-existing-early_pr.patch +microblaze-remove-early-printk-call-from-cpuinfo-sta.patch +ovl-remove-upper-umask-handling-from-ovl_create_uppe.patch +usb-gadget-u_audio-clear-uac-pointer-when-freed.patch +stm-class-fix-a-double-free-in-stm_register_device.patch +ppdev-remove-usage-of-the-deprecated-ida_simple_xx-a.patch +ppdev-add-an-error-check-in-register_device.patch +perf-top-fix-tui-exit-screen-refresh-race-condition.patch +perf-ui-update-use-of-pthread-mutex.patch +perf-ui-browser-don-t-save-pointer-to-stack-memory.patch +extcon-max8997-select-irq_domain-instead-of-dependin.patch +perf-ui-browser-avoid-segv-on-title.patch +f2fs-fix-to-release-node-block-count-in-error-path-o.patch +serial-sh-sci-protect-invalidating-rxdma-on-shutdown.patch +libsubcmd-fix-parse-options-memory-leak.patch +perf-stat-don-t-display-metric-header-for-non-leader.patch diff --git a/queue-5.4/soundwire-cadence-fix-invalid-pdi-offset.patch b/queue-5.4/soundwire-cadence-fix-invalid-pdi-offset.patch new file mode 100644 index 00000000000..986db156c33 --- /dev/null +++ b/queue-5.4/soundwire-cadence-fix-invalid-pdi-offset.patch @@ -0,0 +1,48 @@ +From 4bd2c9531754fc64bf4c1af4ba7deafa1f0bbaac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 09:01:16 +0000 +Subject: soundwire: cadence: fix invalid PDI offset + +From: Pierre-Louis Bossart + +[ Upstream commit 8ee1b439b1540ae543149b15a2a61b9dff937d91 ] + +For some reason, we add an offset to the PDI, presumably to skip the +PDI0 and PDI1 which are reserved for BPT. + +This code is however completely wrong and leads to an out-of-bounds +access. We were just lucky so far since we used only a couple of PDIs +and remained within the PDI array bounds. + +A Fixes: tag is not provided since there are no known platforms where +the out-of-bounds would be accessed, and the initial code had problems +as well. + +A follow-up patch completely removes this useless offset. + +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Rander Wang +Signed-off-by: Bard Liao +Link: https://lore.kernel.org/r/20240326090122.1051806-2-yung-chuan.liao@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/cadence_master.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c +index e589aa99e4292..07c2526033809 100644 +--- a/drivers/soundwire/cadence_master.c ++++ b/drivers/soundwire/cadence_master.c +@@ -1263,7 +1263,7 @@ struct sdw_cdns_pdi *sdw_cdns_alloc_pdi(struct sdw_cdns *cdns, + + /* check if we found a PDI, else find in bi-directional */ + if (!pdi) +- pdi = cdns_find_pdi(cdns, 2, stream->num_bd, stream->bd, ++ pdi = cdns_find_pdi(cdns, 0, stream->num_bd, stream->bd, + dai_id); + + if (pdi) { +-- +2.43.0 + diff --git a/queue-5.4/soundwire-cadence-intel-simplify-pdi-port-mapping.patch b/queue-5.4/soundwire-cadence-intel-simplify-pdi-port-mapping.patch new file mode 100644 index 00000000000..238a295c8b8 --- /dev/null +++ b/queue-5.4/soundwire-cadence-intel-simplify-pdi-port-mapping.patch @@ -0,0 +1,458 @@ +From c12be649527ad15d34427977b10818f6d666d7d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Sep 2019 14:23:46 -0500 +Subject: soundwire: cadence/intel: simplify PDI/port mapping + +From: Pierre-Louis Bossart + +[ Upstream commit 57a34790cd2cab02c3336fe96cfa33b9b65ed2ee ] + +The existing Linux code uses a 1:1 mapping between ports and PDIs, but +still has an independent allocation of ports and PDIs. + +Let's simplify the code and remove the port layer by only using PDIs. + +This patch does not change any functionality, just removes unnecessary +code. + +This will also allow for further simplifications where the PDIs are +not dynamically allocated but instead described in a topology file. + +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20190916192348.467-5-pierre-louis.bossart@linux.intel.com +Signed-off-by: Vinod Koul +Stable-dep-of: 8ee1b439b154 ("soundwire: cadence: fix invalid PDI offset") +Signed-off-by: Sasha Levin +--- + drivers/soundwire/cadence_master.c | 110 ++++-------------------- + drivers/soundwire/cadence_master.h | 32 ++----- + drivers/soundwire/intel.c | 133 ++++++----------------------- + 3 files changed, 51 insertions(+), 224 deletions(-) + +diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c +index f7d0f63921dc2..62b8f233cdcf8 100644 +--- a/drivers/soundwire/cadence_master.c ++++ b/drivers/soundwire/cadence_master.c +@@ -869,7 +869,8 @@ int sdw_cdns_pdi_init(struct sdw_cdns *cdns, + struct sdw_cdns_stream_config config) + { + struct sdw_cdns_streams *stream; +- int offset, i, ret; ++ int offset; ++ int ret; + + cdns->pcm.num_bd = config.pcm_bd; + cdns->pcm.num_in = config.pcm_in; +@@ -936,18 +937,6 @@ int sdw_cdns_pdi_init(struct sdw_cdns *cdns, + stream->num_pdi = stream->num_bd + stream->num_in + stream->num_out; + cdns->num_ports += stream->num_pdi; + +- cdns->ports = devm_kcalloc(cdns->dev, cdns->num_ports, +- sizeof(*cdns->ports), GFP_KERNEL); +- if (!cdns->ports) { +- ret = -ENOMEM; +- return ret; +- } +- +- for (i = 0; i < cdns->num_ports; i++) { +- cdns->ports[i].assigned = false; +- cdns->ports[i].num = i + 1; /* Port 0 reserved for bulk */ +- } +- + return 0; + } + EXPORT_SYMBOL(sdw_cdns_pdi_init); +@@ -1239,13 +1228,11 @@ static struct sdw_cdns_pdi *cdns_find_pdi(struct sdw_cdns *cdns, + * sdw_cdns_config_stream: Configure a stream + * + * @cdns: Cadence instance +- * @port: Cadence data port + * @ch: Channel count + * @dir: Data direction + * @pdi: PDI to be used + */ + void sdw_cdns_config_stream(struct sdw_cdns *cdns, +- struct sdw_cdns_port *port, + u32 ch, u32 dir, struct sdw_cdns_pdi *pdi) + { + u32 offset, val = 0; +@@ -1253,89 +1240,26 @@ void sdw_cdns_config_stream(struct sdw_cdns *cdns, + if (dir == SDW_DATA_DIR_RX) + val = CDNS_PORTCTRL_DIRN; + +- offset = CDNS_PORTCTRL + port->num * CDNS_PORT_OFFSET; ++ offset = CDNS_PORTCTRL + pdi->num * CDNS_PORT_OFFSET; + cdns_updatel(cdns, offset, CDNS_PORTCTRL_DIRN, val); + +- val = port->num; ++ val = pdi->num; + val |= ((1 << ch) - 1) << SDW_REG_SHIFT(CDNS_PDI_CONFIG_CHANNEL); + cdns_writel(cdns, CDNS_PDI_CONFIG(pdi->num), val); + } + EXPORT_SYMBOL(sdw_cdns_config_stream); + + /** +- * cdns_get_num_pdi() - Get number of PDIs required +- * +- * @cdns: Cadence instance +- * @pdi: PDI to be used +- * @num: Number of PDIs +- * @ch_count: Channel count +- */ +-static int cdns_get_num_pdi(struct sdw_cdns *cdns, +- struct sdw_cdns_pdi *pdi, +- unsigned int num, u32 ch_count) +-{ +- int i, pdis = 0; +- +- for (i = 0; i < num; i++) { +- if (pdi[i].assigned) +- continue; +- +- if (pdi[i].ch_count < ch_count) +- ch_count -= pdi[i].ch_count; +- else +- ch_count = 0; +- +- pdis++; +- +- if (!ch_count) +- break; +- } +- +- if (ch_count) +- return 0; +- +- return pdis; +-} +- +-/** +- * sdw_cdns_get_stream() - Get stream information +- * +- * @cdns: Cadence instance +- * @stream: Stream to be allocated +- * @ch: Channel count +- * @dir: Data direction +- */ +-int sdw_cdns_get_stream(struct sdw_cdns *cdns, +- struct sdw_cdns_streams *stream, +- u32 ch, u32 dir) +-{ +- int pdis = 0; +- +- if (dir == SDW_DATA_DIR_RX) +- pdis = cdns_get_num_pdi(cdns, stream->in, stream->num_in, ch); +- else +- pdis = cdns_get_num_pdi(cdns, stream->out, stream->num_out, ch); +- +- /* check if we found PDI, else find in bi-directional */ +- if (!pdis) +- pdis = cdns_get_num_pdi(cdns, stream->bd, stream->num_bd, ch); +- +- return pdis; +-} +-EXPORT_SYMBOL(sdw_cdns_get_stream); +- +-/** +- * sdw_cdns_alloc_stream() - Allocate a stream ++ * sdw_cdns_alloc_pdi() - Allocate a PDI + * + * @cdns: Cadence instance + * @stream: Stream to be allocated +- * @port: Cadence data port + * @ch: Channel count + * @dir: Data direction + */ +-int sdw_cdns_alloc_stream(struct sdw_cdns *cdns, +- struct sdw_cdns_streams *stream, +- struct sdw_cdns_port *port, u32 ch, u32 dir) ++struct sdw_cdns_pdi *sdw_cdns_alloc_pdi(struct sdw_cdns *cdns, ++ struct sdw_cdns_streams *stream, ++ u32 ch, u32 dir) + { + struct sdw_cdns_pdi *pdi = NULL; + +@@ -1348,18 +1272,16 @@ int sdw_cdns_alloc_stream(struct sdw_cdns *cdns, + if (!pdi) + pdi = cdns_find_pdi(cdns, stream->num_bd, stream->bd); + +- if (!pdi) +- return -EIO; +- +- port->pdi = pdi; +- pdi->l_ch_num = 0; +- pdi->h_ch_num = ch - 1; +- pdi->dir = dir; +- pdi->ch_count = ch; ++ if (pdi) { ++ pdi->l_ch_num = 0; ++ pdi->h_ch_num = ch - 1; ++ pdi->dir = dir; ++ pdi->ch_count = ch; ++ } + +- return 0; ++ return pdi; + } +-EXPORT_SYMBOL(sdw_cdns_alloc_stream); ++EXPORT_SYMBOL(sdw_cdns_alloc_pdi); + + MODULE_LICENSE("Dual BSD/GPL"); + MODULE_DESCRIPTION("Cadence Soundwire Library"); +diff --git a/drivers/soundwire/cadence_master.h b/drivers/soundwire/cadence_master.h +index 1a67728c5000f..3e963614a216b 100644 +--- a/drivers/soundwire/cadence_master.h ++++ b/drivers/soundwire/cadence_master.h +@@ -28,23 +28,6 @@ struct sdw_cdns_pdi { + enum sdw_stream_type type; + }; + +-/** +- * struct sdw_cdns_port: Cadence port structure +- * +- * @num: port number +- * @assigned: port assigned +- * @ch: channel count +- * @direction: data port direction +- * @pdi: pdi for this port +- */ +-struct sdw_cdns_port { +- unsigned int num; +- bool assigned; +- unsigned int ch; +- enum sdw_data_direction direction; +- struct sdw_cdns_pdi *pdi; +-}; +- + /** + * struct sdw_cdns_streams: Cadence stream data structure + * +@@ -95,8 +78,8 @@ struct sdw_cdns_stream_config { + * struct sdw_cdns_dma_data: Cadence DMA data + * + * @name: SoundWire stream name +- * @nr_ports: Number of ports +- * @port: Ports ++ * @stream: stream runtime ++ * @pdi: PDI used for this dai + * @bus: Bus handle + * @stream_type: Stream type + * @link_id: Master link id +@@ -104,8 +87,7 @@ struct sdw_cdns_stream_config { + struct sdw_cdns_dma_data { + char *name; + struct sdw_stream_runtime *stream; +- int nr_ports; +- struct sdw_cdns_port **port; ++ struct sdw_cdns_pdi *pdi; + struct sdw_bus *bus; + enum sdw_stream_type stream_type; + int link_id; +@@ -171,10 +153,10 @@ void sdw_cdns_debugfs_init(struct sdw_cdns *cdns, struct dentry *root); + int sdw_cdns_get_stream(struct sdw_cdns *cdns, + struct sdw_cdns_streams *stream, + u32 ch, u32 dir); +-int sdw_cdns_alloc_stream(struct sdw_cdns *cdns, +- struct sdw_cdns_streams *stream, +- struct sdw_cdns_port *port, u32 ch, u32 dir); +-void sdw_cdns_config_stream(struct sdw_cdns *cdns, struct sdw_cdns_port *port, ++struct sdw_cdns_pdi *sdw_cdns_alloc_pdi(struct sdw_cdns *cdns, ++ struct sdw_cdns_streams *stream, ++ u32 ch, u32 dir); ++void sdw_cdns_config_stream(struct sdw_cdns *cdns, + u32 ch, u32 dir, struct sdw_cdns_pdi *pdi); + + int sdw_cdns_pcm_set_stream(struct snd_soc_dai *dai, +diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c +index a2da04946f0b4..9ac45e6dbe9df 100644 +--- a/drivers/soundwire/intel.c ++++ b/drivers/soundwire/intel.c +@@ -609,66 +609,6 @@ static int intel_post_bank_switch(struct sdw_bus *bus) + * DAI routines + */ + +-static struct sdw_cdns_port *intel_alloc_port(struct sdw_intel *sdw, +- u32 ch, u32 dir, bool pcm) +-{ +- struct sdw_cdns *cdns = &sdw->cdns; +- struct sdw_cdns_port *port = NULL; +- int i, ret = 0; +- +- for (i = 0; i < cdns->num_ports; i++) { +- if (cdns->ports[i].assigned) +- continue; +- +- port = &cdns->ports[i]; +- port->assigned = true; +- port->direction = dir; +- port->ch = ch; +- break; +- } +- +- if (!port) { +- dev_err(cdns->dev, "Unable to find a free port\n"); +- return NULL; +- } +- +- if (pcm) { +- ret = sdw_cdns_alloc_stream(cdns, &cdns->pcm, port, ch, dir); +- if (ret) +- goto out; +- +- intel_pdi_shim_configure(sdw, port->pdi); +- sdw_cdns_config_stream(cdns, port, ch, dir, port->pdi); +- +- intel_pdi_alh_configure(sdw, port->pdi); +- +- } else { +- ret = sdw_cdns_alloc_stream(cdns, &cdns->pdm, port, ch, dir); +- } +- +-out: +- if (ret) { +- port->assigned = false; +- port = NULL; +- } +- +- return port; +-} +- +-static void intel_port_cleanup(struct sdw_cdns_dma_data *dma) +-{ +- int i; +- +- for (i = 0; i < dma->nr_ports; i++) { +- if (dma->port[i]) { +- dma->port[i]->pdi->assigned = false; +- dma->port[i]->pdi = NULL; +- dma->port[i]->assigned = false; +- dma->port[i] = NULL; +- } +- } +-} +- + static int intel_hw_params(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *params, + struct snd_soc_dai *dai) +@@ -676,9 +616,11 @@ static int intel_hw_params(struct snd_pcm_substream *substream, + struct sdw_cdns *cdns = snd_soc_dai_get_drvdata(dai); + struct sdw_intel *sdw = cdns_to_intel(cdns); + struct sdw_cdns_dma_data *dma; ++ struct sdw_cdns_pdi *pdi; + struct sdw_stream_config sconfig; + struct sdw_port_config *pconfig; +- int ret, i, ch, dir; ++ int ch, dir; ++ int ret; + bool pcm = true; + + dma = snd_soc_dai_get_dma_data(dai, substream); +@@ -691,38 +633,31 @@ static int intel_hw_params(struct snd_pcm_substream *substream, + else + dir = SDW_DATA_DIR_TX; + +- if (dma->stream_type == SDW_STREAM_PDM) { +- /* TODO: Check whether PDM decimator is already in use */ +- dma->nr_ports = sdw_cdns_get_stream(cdns, &cdns->pdm, ch, dir); ++ if (dma->stream_type == SDW_STREAM_PDM) + pcm = false; +- } else { +- dma->nr_ports = sdw_cdns_get_stream(cdns, &cdns->pcm, ch, dir); +- } + +- if (!dma->nr_ports) { +- dev_err(dai->dev, "ports/resources not available\n"); +- return -EINVAL; ++ /* FIXME: We would need to get PDI info from topology */ ++ if (pcm) ++ pdi = sdw_cdns_alloc_pdi(cdns, &cdns->pcm, ch, dir); ++ else ++ pdi = sdw_cdns_alloc_pdi(cdns, &cdns->pdm, ch, dir); ++ ++ if (!pdi) { ++ ret = -EINVAL; ++ goto error; + } + +- dma->port = kcalloc(dma->nr_ports, sizeof(*dma->port), GFP_KERNEL); +- if (!dma->port) +- return -ENOMEM; ++ /* do run-time configurations for SHIM, ALH and PDI/PORT */ ++ intel_pdi_shim_configure(sdw, pdi); ++ intel_pdi_alh_configure(sdw, pdi); ++ sdw_cdns_config_stream(cdns, ch, dir, pdi); + +- for (i = 0; i < dma->nr_ports; i++) { +- dma->port[i] = intel_alloc_port(sdw, ch, dir, pcm); +- if (!dma->port[i]) { +- ret = -EINVAL; +- goto port_error; +- } +- } + + /* Inform DSP about PDI stream number */ +- for (i = 0; i < dma->nr_ports; i++) { +- ret = intel_config_stream(sdw, substream, dai, params, +- dma->port[i]->pdi->intel_alh_id); +- if (ret) +- goto port_error; +- } ++ ret = intel_config_stream(sdw, substream, dai, params, ++ pdi->intel_alh_id); ++ if (ret) ++ goto error; + + sconfig.direction = dir; + sconfig.ch_count = ch; +@@ -737,32 +672,22 @@ static int intel_hw_params(struct snd_pcm_substream *substream, + } + + /* Port configuration */ +- pconfig = kcalloc(dma->nr_ports, sizeof(*pconfig), GFP_KERNEL); ++ pconfig = kcalloc(1, sizeof(*pconfig), GFP_KERNEL); + if (!pconfig) { + ret = -ENOMEM; +- goto port_error; ++ goto error; + } + +- for (i = 0; i < dma->nr_ports; i++) { +- pconfig[i].num = dma->port[i]->num; +- pconfig[i].ch_mask = (1 << ch) - 1; +- } ++ pconfig->num = pdi->num; ++ pconfig->ch_mask = (1 << ch) - 1; + + ret = sdw_stream_add_master(&cdns->bus, &sconfig, +- pconfig, dma->nr_ports, dma->stream); +- if (ret) { ++ pconfig, 1, dma->stream); ++ if (ret) + dev_err(cdns->dev, "add master to stream failed:%d\n", ret); +- goto stream_error; +- } +- +- kfree(pconfig); +- return ret; + +-stream_error: + kfree(pconfig); +-port_error: +- intel_port_cleanup(dma); +- kfree(dma->port); ++error: + return ret; + } + +@@ -782,8 +707,6 @@ intel_hw_free(struct snd_pcm_substream *substream, struct snd_soc_dai *dai) + dev_err(dai->dev, "remove master from stream %s failed: %d\n", + dma->stream->name, ret); + +- intel_port_cleanup(dma); +- kfree(dma->port); + return ret; + } + +-- +2.43.0 + diff --git a/queue-5.4/soundwire-cadence_master-improve-pdi-allocation.patch b/queue-5.4/soundwire-cadence_master-improve-pdi-allocation.patch new file mode 100644 index 00000000000..7fdf661e654 --- /dev/null +++ b/queue-5.4/soundwire-cadence_master-improve-pdi-allocation.patch @@ -0,0 +1,141 @@ +From cc8e39069cba85edf66c979b496e918f71107fc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Sep 2019 14:23:48 -0500 +Subject: soundwire: cadence_master: improve PDI allocation + +From: Bard Liao + +[ Upstream commit 1b53385e7938d5a093e92044f9c89e4e76106f1b ] + +PDI number should match dai->id, there is no need to track if a PDI is +allocated or not. + +Signed-off-by: Bard Liao +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20190916192348.467-7-pierre-louis.bossart@linux.intel.com +Signed-off-by: Vinod Koul +Stable-dep-of: 8ee1b439b154 ("soundwire: cadence: fix invalid PDI offset") +Signed-off-by: Sasha Levin +--- + drivers/soundwire/cadence_master.c | 27 ++++++++++++++------------- + drivers/soundwire/cadence_master.h | 4 +--- + drivers/soundwire/intel.c | 5 ++--- + 3 files changed, 17 insertions(+), 19 deletions(-) + +diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c +index 95dcdac008bb0..e589aa99e4292 100644 +--- a/drivers/soundwire/cadence_master.c ++++ b/drivers/soundwire/cadence_master.c +@@ -845,7 +845,6 @@ static int cdns_allocate_pdi(struct sdw_cdns *cdns, + + for (i = 0; i < num; i++) { + pdi[i].num = i + pdi_offset; +- pdi[i].assigned = false; + } + + *stream = pdi; +@@ -1198,21 +1197,20 @@ EXPORT_SYMBOL(cdns_set_sdw_stream); + * @num: Number of PDIs + * @pdi: PDI instances + * +- * Find and return a free PDI for a given PDI array ++ * Find a PDI for a given PDI array. The PDI num and dai_id are ++ * expected to match, return NULL otherwise. + */ + static struct sdw_cdns_pdi *cdns_find_pdi(struct sdw_cdns *cdns, + unsigned int offset, + unsigned int num, +- struct sdw_cdns_pdi *pdi) ++ struct sdw_cdns_pdi *pdi, ++ int dai_id) + { + int i; + +- for (i = offset; i < num; i++) { +- if (pdi[i].assigned) +- continue; +- pdi[i].assigned = true; +- return &pdi[i]; +- } ++ for (i = offset; i < offset + num; i++) ++ if (pdi[i].num == dai_id) ++ return &pdi[i]; + + return NULL; + } +@@ -1252,18 +1250,21 @@ EXPORT_SYMBOL(sdw_cdns_config_stream); + */ + struct sdw_cdns_pdi *sdw_cdns_alloc_pdi(struct sdw_cdns *cdns, + struct sdw_cdns_streams *stream, +- u32 ch, u32 dir) ++ u32 ch, u32 dir, int dai_id) + { + struct sdw_cdns_pdi *pdi = NULL; + + if (dir == SDW_DATA_DIR_RX) +- pdi = cdns_find_pdi(cdns, 0, stream->num_in, stream->in); ++ pdi = cdns_find_pdi(cdns, 0, stream->num_in, stream->in, ++ dai_id); + else +- pdi = cdns_find_pdi(cdns, 0, stream->num_out, stream->out); ++ pdi = cdns_find_pdi(cdns, 0, stream->num_out, stream->out, ++ dai_id); + + /* check if we found a PDI, else find in bi-directional */ + if (!pdi) +- pdi = cdns_find_pdi(cdns, 2, stream->num_bd, stream->bd); ++ pdi = cdns_find_pdi(cdns, 2, stream->num_bd, stream->bd, ++ dai_id); + + if (pdi) { + pdi->l_ch_num = 0; +diff --git a/drivers/soundwire/cadence_master.h b/drivers/soundwire/cadence_master.h +index 3e963614a216b..6199e71edeab7 100644 +--- a/drivers/soundwire/cadence_master.h ++++ b/drivers/soundwire/cadence_master.h +@@ -8,7 +8,6 @@ + /** + * struct sdw_cdns_pdi: PDI (Physical Data Interface) instance + * +- * @assigned: pdi assigned + * @num: pdi number + * @intel_alh_id: link identifier + * @l_ch_num: low channel for PDI +@@ -18,7 +17,6 @@ + * @type: stream type, PDM or PCM + */ + struct sdw_cdns_pdi { +- bool assigned; + int num; + int intel_alh_id; + int l_ch_num; +@@ -155,7 +153,7 @@ int sdw_cdns_get_stream(struct sdw_cdns *cdns, + u32 ch, u32 dir); + struct sdw_cdns_pdi *sdw_cdns_alloc_pdi(struct sdw_cdns *cdns, + struct sdw_cdns_streams *stream, +- u32 ch, u32 dir); ++ u32 ch, u32 dir, int dai_id); + void sdw_cdns_config_stream(struct sdw_cdns *cdns, + u32 ch, u32 dir, struct sdw_cdns_pdi *pdi); + +diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c +index 9ac45e6dbe9df..7470adfaabf37 100644 +--- a/drivers/soundwire/intel.c ++++ b/drivers/soundwire/intel.c +@@ -636,11 +636,10 @@ static int intel_hw_params(struct snd_pcm_substream *substream, + if (dma->stream_type == SDW_STREAM_PDM) + pcm = false; + +- /* FIXME: We would need to get PDI info from topology */ + if (pcm) +- pdi = sdw_cdns_alloc_pdi(cdns, &cdns->pcm, ch, dir); ++ pdi = sdw_cdns_alloc_pdi(cdns, &cdns->pcm, ch, dir, dai->id); + else +- pdi = sdw_cdns_alloc_pdi(cdns, &cdns->pdm, ch, dir); ++ pdi = sdw_cdns_alloc_pdi(cdns, &cdns->pdm, ch, dir, dai->id); + + if (!pdi) { + ret = -EINVAL; +-- +2.43.0 + diff --git a/queue-5.4/soundwire-intel-don-t-filter-out-pdi0-1.patch b/queue-5.4/soundwire-intel-don-t-filter-out-pdi0-1.patch new file mode 100644 index 00000000000..66dab561f70 --- /dev/null +++ b/queue-5.4/soundwire-intel-don-t-filter-out-pdi0-1.patch @@ -0,0 +1,124 @@ +From 0300ab37f0cc31c90504e72fff9707dec0311828 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Sep 2019 14:23:47 -0500 +Subject: soundwire: intel: don't filter out PDI0/1 + +From: Pierre-Louis Bossart + +[ Upstream commit 807c15bc77871c695e254423f5e3839b2175db03 ] + +PDI0/1 are reserved for Bulk and filtered out in the existing code. +That leads to endless confusions on whether the index is the raw or +corrected one. In addition we will need support for Bulk at some point +so it's just simpler to expose those PDIs and not use it for now than +try to be smart unless we have to remove the smarts. + +This patch requires a topology change to use PDIs starting at offset 2 +explicitly. + +Note that there is a known discrepancy between hardware documentation +and what ALH stream works in practice, future fixes are likely. + +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20190916192348.467-6-pierre-louis.bossart@linux.intel.com +Signed-off-by: Vinod Koul +Stable-dep-of: 8ee1b439b154 ("soundwire: cadence: fix invalid PDI offset") +Signed-off-by: Sasha Levin +--- + drivers/soundwire/cadence_master.c | 29 +++++++++++------------------ + 1 file changed, 11 insertions(+), 18 deletions(-) + +diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c +index 62b8f233cdcf8..95dcdac008bb0 100644 +--- a/drivers/soundwire/cadence_master.c ++++ b/drivers/soundwire/cadence_master.c +@@ -183,9 +183,6 @@ MODULE_PARM_DESC(cdns_mcp_int_mask, "Cadence MCP IntMask"); + #define CDNS_DEFAULT_SSP_INTERVAL 0x18 + #define CDNS_TX_TIMEOUT 2000 + +-#define CDNS_PCM_PDI_OFFSET 0x2 +-#define CDNS_PDM_PDI_OFFSET 0x6 +- + #define CDNS_SCP_RX_FIFOLEVEL 0x2 + + /* +@@ -295,11 +292,7 @@ static int cdns_reg_show(struct seq_file *s, void *data) + ret += scnprintf(buf + ret, RD_BUF - ret, + "\nDPn B0 Registers\n"); + +- /* +- * in sdw_cdns_pdi_init() we filter out the Bulk PDIs, +- * so the indices need to be corrected again +- */ +- num_ports = cdns->num_ports + CDNS_PCM_PDI_OFFSET; ++ num_ports = cdns->num_ports; + + for (i = 0; i < num_ports; i++) { + ret += scnprintf(buf + ret, RD_BUF - ret, +@@ -882,11 +875,8 @@ int sdw_cdns_pdi_init(struct sdw_cdns *cdns, + /* Allocate PDIs for PCMs */ + stream = &cdns->pcm; + +- /* First two PDIs are reserved for bulk transfers */ +- if (stream->num_bd < CDNS_PCM_PDI_OFFSET) +- return -EINVAL; +- stream->num_bd -= CDNS_PCM_PDI_OFFSET; +- offset = CDNS_PCM_PDI_OFFSET; ++ /* we allocate PDI0 and PDI1 which are used for Bulk */ ++ offset = 0; + + ret = cdns_allocate_pdi(cdns, &stream->bd, + stream->num_bd, offset); +@@ -913,7 +903,6 @@ int sdw_cdns_pdi_init(struct sdw_cdns *cdns, + + /* Allocate PDIs for PDMs */ + stream = &cdns->pdm; +- offset = CDNS_PDM_PDI_OFFSET; + ret = cdns_allocate_pdi(cdns, &stream->bd, + stream->num_bd, offset); + if (ret) +@@ -930,6 +919,9 @@ int sdw_cdns_pdi_init(struct sdw_cdns *cdns, + + ret = cdns_allocate_pdi(cdns, &stream->out, + stream->num_out, offset); ++ ++ offset += stream->num_out; ++ + if (ret) + return ret; + +@@ -1209,12 +1201,13 @@ EXPORT_SYMBOL(cdns_set_sdw_stream); + * Find and return a free PDI for a given PDI array + */ + static struct sdw_cdns_pdi *cdns_find_pdi(struct sdw_cdns *cdns, ++ unsigned int offset, + unsigned int num, + struct sdw_cdns_pdi *pdi) + { + int i; + +- for (i = 0; i < num; i++) { ++ for (i = offset; i < num; i++) { + if (pdi[i].assigned) + continue; + pdi[i].assigned = true; +@@ -1264,13 +1257,13 @@ struct sdw_cdns_pdi *sdw_cdns_alloc_pdi(struct sdw_cdns *cdns, + struct sdw_cdns_pdi *pdi = NULL; + + if (dir == SDW_DATA_DIR_RX) +- pdi = cdns_find_pdi(cdns, stream->num_in, stream->in); ++ pdi = cdns_find_pdi(cdns, 0, stream->num_in, stream->in); + else +- pdi = cdns_find_pdi(cdns, stream->num_out, stream->out); ++ pdi = cdns_find_pdi(cdns, 0, stream->num_out, stream->out); + + /* check if we found a PDI, else find in bi-directional */ + if (!pdi) +- pdi = cdns_find_pdi(cdns, stream->num_bd, stream->bd); ++ pdi = cdns_find_pdi(cdns, 2, stream->num_bd, stream->bd); + + if (pdi) { + pdi->l_ch_num = 0; +-- +2.43.0 + diff --git a/queue-5.4/stm-class-fix-a-double-free-in-stm_register_device.patch b/queue-5.4/stm-class-fix-a-double-free-in-stm_register_device.patch new file mode 100644 index 00000000000..f39b341b919 --- /dev/null +++ b/queue-5.4/stm-class-fix-a-double-free-in-stm_register_device.patch @@ -0,0 +1,57 @@ +From e55dc5db36b637580268edb2cb6944f59a23e68b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2024 16:01:05 +0300 +Subject: stm class: Fix a double free in stm_register_device() + +From: Dan Carpenter + +[ Upstream commit 3df463865ba42b8f88a590326f4c9ea17a1ce459 ] + +The put_device(&stm->dev) call will trigger stm_device_release() which +frees "stm" so the vfree(stm) on the next line is a double free. + +Fixes: 389b6699a2aa ("stm class: Fix stm device initialization order") +Signed-off-by: Dan Carpenter +Reviewed-by: Amelie Delaunay +Reviewed-by: Andy Shevchenko +Signed-off-by: Alexander Shishkin +Link: https://lore.kernel.org/r/20240429130119.1518073-2-alexander.shishkin@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/stm/core.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c +index 603b83ac50852..1cfae56c4fdbd 100644 +--- a/drivers/hwtracing/stm/core.c ++++ b/drivers/hwtracing/stm/core.c +@@ -878,8 +878,11 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data, + return -ENOMEM; + + stm->major = register_chrdev(0, stm_data->name, &stm_fops); +- if (stm->major < 0) +- goto err_free; ++ if (stm->major < 0) { ++ err = stm->major; ++ vfree(stm); ++ return err; ++ } + + device_initialize(&stm->dev); + stm->dev.devt = MKDEV(stm->major, 0); +@@ -923,10 +926,8 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data, + err_device: + unregister_chrdev(stm->major, stm_data->name); + +- /* matches device_initialize() above */ ++ /* calls stm_device_release() */ + put_device(&stm->dev); +-err_free: +- vfree(stm); + + return err; + } +-- +2.43.0 + diff --git a/queue-5.4/usb-gadget-u_audio-clear-uac-pointer-when-freed.patch b/queue-5.4/usb-gadget-u_audio-clear-uac-pointer-when-freed.patch new file mode 100644 index 00000000000..2df06585633 --- /dev/null +++ b/queue-5.4/usb-gadget-u_audio-clear-uac-pointer-when-freed.patch @@ -0,0 +1,40 @@ +From 059c4da064ad5a2cfe6a00779a97052d8cb37bd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 15:20:20 +0000 +Subject: usb: gadget: u_audio: Clear uac pointer when freed. + +From: Chris Wulff + +[ Upstream commit a2cf936ebef291ef7395172b9e2f624779fb6dc0 ] + +This prevents use of a stale pointer if functions are called after +g_cleanup that shouldn't be. This doesn't fix any races, but converts +a possibly silent kernel memory corruption into an obvious NULL pointer +dereference report. + +Fixes: eb9fecb9e69b ("usb: gadget: f_uac2: split out audio core") +Signed-off-by: Chris Wulff +Link: https://lore.kernel.org/stable/CO1PR17MB54194226DA08BFC9EBD8C163E1172%40CO1PR17MB5419.namprd17.prod.outlook.com +Link: https://lore.kernel.org/r/CO1PR17MB54194226DA08BFC9EBD8C163E1172@CO1PR17MB5419.namprd17.prod.outlook.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/u_audio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c +index 53b30de16a896..994316d51a0e1 100644 +--- a/drivers/usb/gadget/function/u_audio.c ++++ b/drivers/usb/gadget/function/u_audio.c +@@ -624,6 +624,8 @@ void g_audio_cleanup(struct g_audio *g_audio) + return; + + uac = g_audio->uac; ++ g_audio->uac = NULL; ++ + card = uac->card; + if (card) + snd_card_free_when_closed(card); +-- +2.43.0 + -- 2.47.3