From 75c17dbd4ba7a33ac84197e1125bfbbab8af5f03 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 11 Jan 2025 09:26:57 -0500 Subject: [PATCH] Fixes for 6.1 Signed-off-by: Sasha Levin --- ...afs-fix-the-maximum-cell-name-length.patch | 112 ++++++++++++++++++ ...i-fix-device-node-release-in-early-e.patch | 53 +++++++++ ...-return-value-check-when-reading-dpc.patch | 49 ++++++++ ...mediatek-fix-mode-valid-issue-for-dp.patch | 96 +++++++++++++++ ...x-ycbcr422-color-format-issue-for-dp.patch | 67 +++++++++++ ...iatek-stop-selecting-foreign-drivers.patch | 70 +++++++++++ ...fix-a-missing-return-value-check-bug.patch | 46 +++++++ ...ctedly-changed-path-in-ksmbd_vfs_ker.patch | 46 +++++++ queue-6.1/series | 8 ++ 9 files changed, 547 insertions(+) create mode 100644 queue-6.1/afs-fix-the-maximum-cell-name-length.patch create mode 100644 queue-6.1/cpuidle-riscv-sbi-fix-device-node-release-in-early-e.patch create mode 100644 queue-6.1/drm-mediatek-add-return-value-check-when-reading-dpc.patch create mode 100644 queue-6.1/drm-mediatek-fix-mode-valid-issue-for-dp.patch create mode 100644 queue-6.1/drm-mediatek-fix-ycbcr422-color-format-issue-for-dp.patch create mode 100644 queue-6.1/drm-mediatek-stop-selecting-foreign-drivers.patch create mode 100644 queue-6.1/ksmbd-fix-a-missing-return-value-check-bug.patch create mode 100644 queue-6.1/ksmbd-fix-unexpectedly-changed-path-in-ksmbd_vfs_ker.patch diff --git a/queue-6.1/afs-fix-the-maximum-cell-name-length.patch b/queue-6.1/afs-fix-the-maximum-cell-name-length.patch new file mode 100644 index 00000000000..a1b9af9e097 --- /dev/null +++ b/queue-6.1/afs-fix-the-maximum-cell-name-length.patch @@ -0,0 +1,112 @@ +From 2164239a2e27800675dc9e170a6641e700ebfd28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jan 2025 16:21:00 +0000 +Subject: afs: Fix the maximum cell name length + +From: David Howells + +[ Upstream commit 8fd56ad6e7c90ac2bddb0741c6b248c8c5d56ac8 ] + +The kafs filesystem limits the maximum length of a cell to 256 bytes, but a +problem occurs if someone actually does that: kafs tries to create a +directory under /proc/net/afs/ with the name of the cell, but that fails +with a warning: + + WARNING: CPU: 0 PID: 9 at fs/proc/generic.c:405 + +because procfs limits the maximum filename length to 255. + +However, the DNS limits the maximum lookup length and, by extension, the +maximum cell name, to 255 less two (length count and trailing NUL). + +Fix this by limiting the maximum acceptable cellname length to 253. This +also allows us to be sure we can create the "/afs/./" mountpoint too. + +Further, split the YFS VL record cell name maximum to be the 256 allowed by +the protocol and ignore the record retrieved by YFSVL.GetCellName if it +exceeds 253. + +Fixes: c3e9f888263b ("afs: Implement client support for the YFSVL.GetCellName RPC op") +Reported-by: syzbot+7848fee1f1e5c53f912b@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/r/6776d25d.050a0220.3a8527.0048.GAE@google.com/ +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/376236.1736180460@warthog.procyon.org.uk +Tested-by: syzbot+7848fee1f1e5c53f912b@syzkaller.appspotmail.com +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/afs/afs.h | 2 +- + fs/afs/afs_vl.h | 1 + + fs/afs/vl_alias.c | 8 ++++++-- + fs/afs/vlclient.c | 2 +- + 4 files changed, 9 insertions(+), 4 deletions(-) + +diff --git a/fs/afs/afs.h b/fs/afs/afs.h +index 432cb4b23961..3ea5f3e3c922 100644 +--- a/fs/afs/afs.h ++++ b/fs/afs/afs.h +@@ -10,7 +10,7 @@ + + #include + +-#define AFS_MAXCELLNAME 256 /* Maximum length of a cell name */ ++#define AFS_MAXCELLNAME 253 /* Maximum length of a cell name (DNS limited) */ + #define AFS_MAXVOLNAME 64 /* Maximum length of a volume name */ + #define AFS_MAXNSERVERS 8 /* Maximum servers in a basic volume record */ + #define AFS_NMAXNSERVERS 13 /* Maximum servers in a N/U-class volume record */ +diff --git a/fs/afs/afs_vl.h b/fs/afs/afs_vl.h +index 9c65ffb8a523..8da0899fbc08 100644 +--- a/fs/afs/afs_vl.h ++++ b/fs/afs/afs_vl.h +@@ -13,6 +13,7 @@ + #define AFS_VL_PORT 7003 /* volume location service port */ + #define VL_SERVICE 52 /* RxRPC service ID for the Volume Location service */ + #define YFS_VL_SERVICE 2503 /* Service ID for AuriStor upgraded VL service */ ++#define YFS_VL_MAXCELLNAME 256 /* Maximum length of a cell name in YFS protocol */ + + enum AFSVL_Operations { + VLGETENTRYBYID = 503, /* AFS Get VLDB entry by ID */ +diff --git a/fs/afs/vl_alias.c b/fs/afs/vl_alias.c +index f04a80e4f5c3..83cf1bfbe343 100644 +--- a/fs/afs/vl_alias.c ++++ b/fs/afs/vl_alias.c +@@ -302,6 +302,7 @@ static char *afs_vl_get_cell_name(struct afs_cell *cell, struct key *key) + static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key) + { + struct afs_cell *master; ++ size_t name_len; + char *cell_name; + + cell_name = afs_vl_get_cell_name(cell, key); +@@ -313,8 +314,11 @@ static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key) + return 0; + } + +- master = afs_lookup_cell(cell->net, cell_name, strlen(cell_name), +- NULL, false); ++ name_len = strlen(cell_name); ++ if (!name_len || name_len > AFS_MAXCELLNAME) ++ master = ERR_PTR(-EOPNOTSUPP); ++ else ++ master = afs_lookup_cell(cell->net, cell_name, name_len, NULL, false); + kfree(cell_name); + if (IS_ERR(master)) + return PTR_ERR(master); +diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c +index 00fca3c66ba6..16653f2ffe4f 100644 +--- a/fs/afs/vlclient.c ++++ b/fs/afs/vlclient.c +@@ -671,7 +671,7 @@ static int afs_deliver_yfsvl_get_cell_name(struct afs_call *call) + return ret; + + namesz = ntohl(call->tmp); +- if (namesz > AFS_MAXCELLNAME) ++ if (namesz > YFS_VL_MAXCELLNAME) + return afs_protocol_error(call, afs_eproto_cellname_len); + paddedsz = (namesz + 3) & ~3; + call->count = namesz; +-- +2.39.5 + diff --git a/queue-6.1/cpuidle-riscv-sbi-fix-device-node-release-in-early-e.patch b/queue-6.1/cpuidle-riscv-sbi-fix-device-node-release-in-early-e.patch new file mode 100644 index 00000000000..67e3a01cb0b --- /dev/null +++ b/queue-6.1/cpuidle-riscv-sbi-fix-device-node-release-in-early-e.patch @@ -0,0 +1,53 @@ +From a1cd665fe54127fcd4f57f07885640101144cf76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Nov 2024 00:32:39 +0100 +Subject: cpuidle: riscv-sbi: fix device node release in early exit of + for_each_possible_cpu + +From: Javier Carrasco + +[ Upstream commit 7e25044b804581b9c029d5a28d8800aebde18043 ] + +The 'np' device_node is initialized via of_cpu_device_node_get(), which +requires explicit calls to of_node_put() when it is no longer required +to avoid leaking the resource. + +Instead of adding the missing calls to of_node_put() in all execution +paths, use the cleanup attribute for 'np' by means of the __free() +macro, which automatically calls of_node_put() when the variable goes +out of scope. Given that 'np' is only used within the +for_each_possible_cpu(), reduce its scope to release the nood after +every iteration of the loop. + +Fixes: 6abf32f1d9c5 ("cpuidle: Add RISC-V SBI CPU idle driver") +Reviewed-by: Andrew Jones +Signed-off-by: Javier Carrasco +Link: https://lore.kernel.org/r/20241116-cpuidle-riscv-sbi-cleanup-v3-1-a3a46372ce08@gmail.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/cpuidle-riscv-sbi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpuidle/cpuidle-riscv-sbi.c b/drivers/cpuidle/cpuidle-riscv-sbi.c +index af7320a768d2..963d5f171ef7 100644 +--- a/drivers/cpuidle/cpuidle-riscv-sbi.c ++++ b/drivers/cpuidle/cpuidle-riscv-sbi.c +@@ -540,12 +540,12 @@ static int sbi_cpuidle_probe(struct platform_device *pdev) + int cpu, ret; + struct cpuidle_driver *drv; + struct cpuidle_device *dev; +- struct device_node *np, *pds_node; ++ struct device_node *pds_node; + + /* Detect OSI support based on CPU DT nodes */ + sbi_cpuidle_use_osi = true; + for_each_possible_cpu(cpu) { +- np = of_cpu_device_node_get(cpu); ++ struct device_node *np __free(device_node) = of_cpu_device_node_get(cpu); + if (np && + of_find_property(np, "power-domains", NULL) && + of_find_property(np, "power-domain-names", NULL)) { +-- +2.39.5 + diff --git a/queue-6.1/drm-mediatek-add-return-value-check-when-reading-dpc.patch b/queue-6.1/drm-mediatek-add-return-value-check-when-reading-dpc.patch new file mode 100644 index 00000000000..03bd08934a5 --- /dev/null +++ b/queue-6.1/drm-mediatek-add-return-value-check-when-reading-dpc.patch @@ -0,0 +1,49 @@ +From 5d9307f355a792d450cf044cf32bafc7fcda0486 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 19:34:07 +0800 +Subject: drm/mediatek: Add return value check when reading DPCD + +From: Liankun Yang + +[ Upstream commit 522908140645865dc3e2fac70fd3b28834dfa7be ] + +Check the return value of drm_dp_dpcd_readb() to confirm that +AUX communication is successful. To simplify the code, replace +drm_dp_dpcd_readb() and DP_GET_SINK_COUNT() with drm_dp_read_sink_count(). + +Fixes: f70ac097a2cf ("drm/mediatek: Add MT8195 Embedded DisplayPort driver") +Signed-off-by: Liankun Yang +Reviewed-by: Guillaume Ranquet +Link: https://patchwork.kernel.org/project/dri-devel/patch/20241218113448.2992-1-liankun.yang@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dp.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c +index 09a496588b50..6bf50a15c9b4 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dp.c ++++ b/drivers/gpu/drm/mediatek/mtk_dp.c +@@ -1952,7 +1952,6 @@ static enum drm_connector_status mtk_dp_bdg_detect(struct drm_bridge *bridge) + struct mtk_dp *mtk_dp = mtk_dp_from_bridge(bridge); + enum drm_connector_status ret = connector_status_disconnected; + bool enabled = mtk_dp->enabled; +- u8 sink_count = 0; + + if (!mtk_dp->train_info.cable_plugged_in) + return ret; +@@ -1974,8 +1973,8 @@ static enum drm_connector_status mtk_dp_bdg_detect(struct drm_bridge *bridge) + * function, we just need to check the HPD connection to check + * whether we connect to a sink device. + */ +- drm_dp_dpcd_readb(&mtk_dp->aux, DP_SINK_COUNT, &sink_count); +- if (DP_GET_SINK_COUNT(sink_count)) ++ ++ if (drm_dp_read_sink_count(&mtk_dp->aux) > 0) + ret = connector_status_connected; + + if (!enabled) { +-- +2.39.5 + diff --git a/queue-6.1/drm-mediatek-fix-mode-valid-issue-for-dp.patch b/queue-6.1/drm-mediatek-fix-mode-valid-issue-for-dp.patch new file mode 100644 index 00000000000..78da997c0b0 --- /dev/null +++ b/queue-6.1/drm-mediatek-fix-mode-valid-issue-for-dp.patch @@ -0,0 +1,96 @@ +From 23e71880c76ed884d834aecb4efeb00496c9e037 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 16:28:28 +0800 +Subject: drm/mediatek: Fix mode valid issue for dp + +From: Liankun Yang + +[ Upstream commit 0d68b55887cedc7487036ed34cb4c2097c4228f1 ] + +Fix dp mode valid issue to avoid abnormal display of limit state. + +After DP passes link training, it can express the lane count of the +current link status is good. Calculate the maximum bandwidth supported +by DP using the current lane count. + +The color format will select the best one based on the bandwidth +requirements of the current timing mode. If the current timing mode +uses RGB and meets the DP link bandwidth requirements, RGB will be used. + +If the timing mode uses RGB but does not meet the DP link bandwidthi +requirements, it will continue to check whether YUV422 meets +the DP link bandwidth. + +FEC overhead is approximately 2.4% from DP 1.4a spec 2.2.1.4.2. +The down-spread amplitude shall either be disabled (0.0%) or up +to 0.5% from 1.4a 3.5.2.6. Add up to approximately 3% total overhead. + +Because rate is already divided by 10, +mode->clock does not need to be multiplied by 10. + +Fixes: f70ac097a2cf ("drm/mediatek: Add MT8195 Embedded DisplayPort driver") +Signed-off-by: Liankun Yang +Link: https://patchwork.kernel.org/project/dri-devel/patch/20241025083036.8829-3-liankun.yang@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dp.c | 28 +++++++++++++++++----------- + 1 file changed, 17 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c +index 04e3f72fa232..09a496588b50 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dp.c ++++ b/drivers/gpu/drm/mediatek/mtk_dp.c +@@ -2277,12 +2277,19 @@ mtk_dp_bridge_mode_valid(struct drm_bridge *bridge, + { + struct mtk_dp *mtk_dp = mtk_dp_from_bridge(bridge); + u32 bpp = info->color_formats & DRM_COLOR_FORMAT_YCBCR422 ? 16 : 24; +- u32 rate = min_t(u32, drm_dp_max_link_rate(mtk_dp->rx_cap) * +- drm_dp_max_lane_count(mtk_dp->rx_cap), +- drm_dp_bw_code_to_link_rate(mtk_dp->max_linkrate) * +- mtk_dp->max_lanes); ++ u32 lane_count_min = mtk_dp->train_info.lane_count; ++ u32 rate = drm_dp_bw_code_to_link_rate(mtk_dp->train_info.link_rate) * ++ lane_count_min; + +- if (rate < mode->clock * bpp / 8) ++ /* ++ *FEC overhead is approximately 2.4% from DP 1.4a spec 2.2.1.4.2. ++ *The down-spread amplitude shall either be disabled (0.0%) or up ++ *to 0.5% from 1.4a 3.5.2.6. Add up to approximately 3% total overhead. ++ * ++ *Because rate is already divided by 10, ++ *mode->clock does not need to be multiplied by 10 ++ */ ++ if ((rate * 97 / 100) < (mode->clock * bpp / 8)) + return MODE_CLOCK_HIGH; + + return MODE_OK; +@@ -2323,10 +2330,9 @@ static u32 *mtk_dp_bridge_atomic_get_input_bus_fmts(struct drm_bridge *bridge, + struct drm_display_mode *mode = &crtc_state->adjusted_mode; + struct drm_display_info *display_info = + &conn_state->connector->display_info; +- u32 rate = min_t(u32, drm_dp_max_link_rate(mtk_dp->rx_cap) * +- drm_dp_max_lane_count(mtk_dp->rx_cap), +- drm_dp_bw_code_to_link_rate(mtk_dp->max_linkrate) * +- mtk_dp->max_lanes); ++ u32 lane_count_min = mtk_dp->train_info.lane_count; ++ u32 rate = drm_dp_bw_code_to_link_rate(mtk_dp->train_info.link_rate) * ++ lane_count_min; + + *num_input_fmts = 0; + +@@ -2335,8 +2341,8 @@ static u32 *mtk_dp_bridge_atomic_get_input_bus_fmts(struct drm_bridge *bridge, + * datarate of YUV422 and sink device supports YUV422, we output YUV422 + * format. Use this condition, we can support more resolution. + */ +- if ((rate < (mode->clock * 24 / 8)) && +- (rate > (mode->clock * 16 / 8)) && ++ if (((rate * 97 / 100) < (mode->clock * 24 / 8)) && ++ ((rate * 97 / 100) > (mode->clock * 16 / 8)) && + (display_info->color_formats & DRM_COLOR_FORMAT_YCBCR422)) { + input_fmts = kcalloc(1, sizeof(*input_fmts), GFP_KERNEL); + if (!input_fmts) +-- +2.39.5 + diff --git a/queue-6.1/drm-mediatek-fix-ycbcr422-color-format-issue-for-dp.patch b/queue-6.1/drm-mediatek-fix-ycbcr422-color-format-issue-for-dp.patch new file mode 100644 index 00000000000..05ba8411d06 --- /dev/null +++ b/queue-6.1/drm-mediatek-fix-ycbcr422-color-format-issue-for-dp.patch @@ -0,0 +1,67 @@ +From f9ebd42d71671600870fc77b34896ba9a1379b52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 16:28:27 +0800 +Subject: drm/mediatek: Fix YCbCr422 color format issue for DP + +From: Liankun Yang + +[ Upstream commit ef24fbd8f12015ff827973fffefed3902ffd61cc ] + +Setting up misc0 for Pixel Encoding Format. + +According to the definition of YCbCr in spec 1.2a Table 2-96, +0x1 << 1 should be written to the register. + +Use switch case to distinguish RGB, YCbCr422, +and unsupported color formats. + +Fixes: f70ac097a2cf ("drm/mediatek: Add MT8195 Embedded DisplayPort driver") +Signed-off-by: Liankun Yang +Link: https://patchwork.kernel.org/project/dri-devel/patch/20241025083036.8829-2-liankun.yang@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dp.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c +index c24eeb7ffde7..04e3f72fa232 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dp.c ++++ b/drivers/gpu/drm/mediatek/mtk_dp.c +@@ -457,18 +457,16 @@ static int mtk_dp_set_color_format(struct mtk_dp *mtk_dp, + enum dp_pixelformat color_format) + { + u32 val; +- +- /* update MISC0 */ +- mtk_dp_update_bits(mtk_dp, MTK_DP_ENC0_P0_3034, +- color_format << DP_TEST_COLOR_FORMAT_SHIFT, +- DP_TEST_COLOR_FORMAT_MASK); ++ u32 misc0_color; + + switch (color_format) { + case DP_PIXELFORMAT_YUV422: + val = PIXEL_ENCODE_FORMAT_DP_ENC0_P0_YCBCR422; ++ misc0_color = DP_COLOR_FORMAT_YCbCr422; + break; + case DP_PIXELFORMAT_RGB: + val = PIXEL_ENCODE_FORMAT_DP_ENC0_P0_RGB; ++ misc0_color = DP_COLOR_FORMAT_RGB; + break; + default: + drm_warn(mtk_dp->drm_dev, "Unsupported color format: %d\n", +@@ -476,6 +474,11 @@ static int mtk_dp_set_color_format(struct mtk_dp *mtk_dp, + return -EINVAL; + } + ++ /* update MISC0 */ ++ mtk_dp_update_bits(mtk_dp, MTK_DP_ENC0_P0_3034, ++ misc0_color, ++ DP_TEST_COLOR_FORMAT_MASK); ++ + mtk_dp_update_bits(mtk_dp, MTK_DP_ENC0_P0_303C, + val, PIXEL_ENCODE_FORMAT_DP_ENC0_P0_MASK); + return 0; +-- +2.39.5 + diff --git a/queue-6.1/drm-mediatek-stop-selecting-foreign-drivers.patch b/queue-6.1/drm-mediatek-stop-selecting-foreign-drivers.patch new file mode 100644 index 00000000000..f884fcd3e8f --- /dev/null +++ b/queue-6.1/drm-mediatek-stop-selecting-foreign-drivers.patch @@ -0,0 +1,70 @@ +From 356ffeccef0fa499662e47a8349a560dee6d8910 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 09:58:31 +0100 +Subject: drm/mediatek: stop selecting foreign drivers + +From: Arnd Bergmann + +[ Upstream commit 924d66011f2401a4145e2e814842c5c4572e439f ] + +The PHY portion of the mediatek hdmi driver was originally part of +the driver it self and later split out into drivers/phy, which a +'select' to keep the prior behavior. + +However, this leads to build failures when the PHY driver cannot +be built: + +WARNING: unmet direct dependencies detected for PHY_MTK_HDMI + Depends on [n]: (ARCH_MEDIATEK || COMPILE_TEST [=y]) && COMMON_CLK [=y] && OF [=y] && REGULATOR [=n] + Selected by [m]: + - DRM_MEDIATEK_HDMI [=m] && HAS_IOMEM [=y] && DRM [=m] && DRM_MEDIATEK [=m] +ERROR: modpost: "devm_regulator_register" [drivers/phy/mediatek/phy-mtk-hdmi-drv.ko] undefined! +ERROR: modpost: "rdev_get_drvdata" [drivers/phy/mediatek/phy-mtk-hdmi-drv.ko] undefined! + +The best option here is to just not select the phy driver and leave that +up to the defconfig. Do the same for the other PHY and memory drivers +selected here as well for consistency. + +Fixes: a481bf2f0ca4 ("drm/mediatek: Separate mtk_hdmi_phy to an independent module") +Signed-off-by: Arnd Bergmann +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: CK Hu +Link: https://patchwork.kernel.org/project/dri-devel/patch/20241218085837.2670434-1-arnd@kernel.org/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/Kconfig | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/Kconfig b/drivers/gpu/drm/mediatek/Kconfig +index d1eededee943..d663869bfce1 100644 +--- a/drivers/gpu/drm/mediatek/Kconfig ++++ b/drivers/gpu/drm/mediatek/Kconfig +@@ -11,9 +11,6 @@ config DRM_MEDIATEK + select DRM_KMS_HELPER + select DRM_MIPI_DSI + select DRM_PANEL +- select MEMORY +- select MTK_SMI +- select PHY_MTK_MIPI_DSI + select VIDEOMODE_HELPERS + help + Choose this option if you have a Mediatek SoCs. +@@ -24,7 +21,6 @@ config DRM_MEDIATEK + config DRM_MEDIATEK_DP + tristate "DRM DPTX Support for MediaTek SoCs" + depends on DRM_MEDIATEK +- select PHY_MTK_DP + select DRM_DISPLAY_HELPER + select DRM_DISPLAY_DP_HELPER + select DRM_DP_AUX_BUS +@@ -35,6 +31,5 @@ config DRM_MEDIATEK_HDMI + tristate "DRM HDMI Support for Mediatek SoCs" + depends on DRM_MEDIATEK + select SND_SOC_HDMI_CODEC if SND_SOC +- select PHY_MTK_HDMI + help + DRM/KMS HDMI driver for Mediatek SoCs +-- +2.39.5 + diff --git a/queue-6.1/ksmbd-fix-a-missing-return-value-check-bug.patch b/queue-6.1/ksmbd-fix-a-missing-return-value-check-bug.patch new file mode 100644 index 00000000000..450612fda59 --- /dev/null +++ b/queue-6.1/ksmbd-fix-a-missing-return-value-check-bug.patch @@ -0,0 +1,46 @@ +From ac68886161040b5ea76b3da7fa7f1bbaf3904b53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Dec 2024 23:30:50 +0800 +Subject: ksmbd: fix a missing return value check bug + +From: Wentao Liang + +[ Upstream commit 4c16e1cadcbcaf3c82d5fc310fbd34d0f5d0db7c ] + +In the smb2_send_interim_resp(), if ksmbd_alloc_work_struct() +fails to allocate a node, it returns a NULL pointer to the +in_work pointer. This can lead to an illegal memory write of +in_work->response_buf when allocate_interim_rsp_buf() attempts +to perform a kzalloc() on it. + +To address this issue, incorporating a check for the return +value of ksmbd_alloc_work_struct() ensures that the function +returns immediately upon allocation failure, thereby preventing +the aforementioned illegal memory access. + +Fixes: 041bba4414cd ("ksmbd: fix wrong interim response on compound") +Signed-off-by: Wentao Liang +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 71478a590e83..9d041fc558e3 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -712,6 +712,9 @@ void smb2_send_interim_resp(struct ksmbd_work *work, __le32 status) + struct smb2_hdr *rsp_hdr; + struct ksmbd_work *in_work = ksmbd_alloc_work_struct(); + ++ if (!in_work) ++ return; ++ + if (allocate_interim_rsp_buf(in_work)) { + pr_err("smb_allocate_rsp_buf failed!\n"); + ksmbd_free_work_struct(in_work); +-- +2.39.5 + diff --git a/queue-6.1/ksmbd-fix-unexpectedly-changed-path-in-ksmbd_vfs_ker.patch b/queue-6.1/ksmbd-fix-unexpectedly-changed-path-in-ksmbd_vfs_ker.patch new file mode 100644 index 00000000000..90f49d3034c --- /dev/null +++ b/queue-6.1/ksmbd-fix-unexpectedly-changed-path-in-ksmbd_vfs_ker.patch @@ -0,0 +1,46 @@ +From 4e0f543ebea232c25092b1a17619be3c1667fba4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jan 2025 03:39:54 +0000 +Subject: ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked + +From: He Wang + +[ Upstream commit 2ac538e40278a2c0c051cca81bcaafc547d61372 ] + +When `ksmbd_vfs_kern_path_locked` met an error and it is not the last +entry, it will exit without restoring changed path buffer. But later this +buffer may be used as the filename for creation. + +Fixes: c5a709f08d40 ("ksmbd: handle caseless file creation") +Signed-off-by: He Wang +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/vfs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c +index eaae67a2f720..396d4ea77d34 100644 +--- a/fs/smb/server/vfs.c ++++ b/fs/smb/server/vfs.c +@@ -1249,6 +1249,8 @@ int ksmbd_vfs_kern_path_locked(struct ksmbd_work *work, char *name, + filepath, + flags, + path); ++ if (!is_last) ++ next[0] = '/'; + if (err) + goto out2; + else if (is_last) +@@ -1256,7 +1258,6 @@ int ksmbd_vfs_kern_path_locked(struct ksmbd_work *work, char *name, + path_put(parent_path); + *parent_path = *path; + +- next[0] = '/'; + remain_len -= filename_len + 1; + } + +-- +2.39.5 + diff --git a/queue-6.1/series b/queue-6.1/series index 3d1d081161f..1eb550e0f49 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -29,3 +29,11 @@ netfilter-nf_tables-imbalance-in-flowtable-binding.patch netfilter-conntrack-clamp-maximum-hashtable-size-to-.patch sched-sch_cake-add-bounds-checks-to-host-bulk-flow-f.patch net-mlx5-fix-variable-not-being-completed-when-funct.patch +drm-mediatek-stop-selecting-foreign-drivers.patch +drm-mediatek-fix-ycbcr422-color-format-issue-for-dp.patch +drm-mediatek-fix-mode-valid-issue-for-dp.patch +drm-mediatek-add-return-value-check-when-reading-dpc.patch +ksmbd-fix-a-missing-return-value-check-bug.patch +afs-fix-the-maximum-cell-name-length.patch +ksmbd-fix-unexpectedly-changed-path-in-ksmbd_vfs_ker.patch +cpuidle-riscv-sbi-fix-device-node-release-in-early-e.patch -- 2.47.3