From 8212e3669d8f5d05db4ef7f50a4cb1bb5c1c04d7 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 12 Aug 2024 12:26:51 +0200 Subject: [PATCH] 5.10-stable patches added patches: scsi-ufs-core-fix-hba-last_dme_cmd_tstamp-timestamp-updating-logic.patch tick-broadcast-move-per-cpu-pointer-access-into-the-atomic-section.patch usb-gadget-core-check-for-unset-descriptor.patch usb-gadget-u_serial-set-start_delayed-during-suspend.patch usb-serial-debug-do-not-echo-input-by-default.patch --- ..._cmd_tstamp-timestamp-updating-logic.patch | 54 +++++++++++++++ queue-5.10/series | 5 ++ ...inter-access-into-the-atomic-section.patch | 52 ++++++++++++++ ...dget-core-check-for-unset-descriptor.patch | 47 +++++++++++++ ...ial-set-start_delayed-during-suspend.patch | 36 ++++++++++ ...l-debug-do-not-echo-input-by-default.patch | 69 +++++++++++++++++++ 6 files changed, 263 insertions(+) create mode 100644 queue-5.10/scsi-ufs-core-fix-hba-last_dme_cmd_tstamp-timestamp-updating-logic.patch create mode 100644 queue-5.10/tick-broadcast-move-per-cpu-pointer-access-into-the-atomic-section.patch create mode 100644 queue-5.10/usb-gadget-core-check-for-unset-descriptor.patch create mode 100644 queue-5.10/usb-gadget-u_serial-set-start_delayed-during-suspend.patch create mode 100644 queue-5.10/usb-serial-debug-do-not-echo-input-by-default.patch diff --git a/queue-5.10/scsi-ufs-core-fix-hba-last_dme_cmd_tstamp-timestamp-updating-logic.patch b/queue-5.10/scsi-ufs-core-fix-hba-last_dme_cmd_tstamp-timestamp-updating-logic.patch new file mode 100644 index 00000000000..39259d3c545 --- /dev/null +++ b/queue-5.10/scsi-ufs-core-fix-hba-last_dme_cmd_tstamp-timestamp-updating-logic.patch @@ -0,0 +1,54 @@ +From ab9fd06cb8f0db0854291833fc40c789e43a361f Mon Sep 17 00:00:00 2001 +From: Vamshi Gajjela +Date: Wed, 24 Jul 2024 19:21:26 +0530 +Subject: scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic + +From: Vamshi Gajjela + +commit ab9fd06cb8f0db0854291833fc40c789e43a361f upstream. + +The ufshcd_add_delay_before_dme_cmd() always introduces a delay of +MIN_DELAY_BEFORE_DME_CMDS_US between DME commands even when it's not +required. The delay is added when the UFS host controller supplies the +quirk UFSHCD_QUIRK_DELAY_BEFORE_DME_CMDS. + +Fix the logic to update hba->last_dme_cmd_tstamp to ensure subsequent DME +commands have the correct delay in the range of 0 to +MIN_DELAY_BEFORE_DME_CMDS_US. + +Update the timestamp at the end of the function to ensure it captures the +latest time after any necessary delay has been applied. + +Signed-off-by: Vamshi Gajjela +Link: https://lore.kernel.org/r/20240724135126.1786126-1-vamshigajjela@google.com +Fixes: cad2e03d8607 ("ufs: add support to allow non standard behaviours (quirks)") +Cc: stable@vger.kernel.org +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/ufs/ufshcd.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -3653,11 +3653,16 @@ static inline void ufshcd_add_delay_befo + min_sleep_time_us = + MIN_DELAY_BEFORE_DME_CMDS_US - delta; + else +- return; /* no more delay required */ ++ min_sleep_time_us = 0; /* no more delay required */ + } + +- /* allow sleep for extra 50us if needed */ +- usleep_range(min_sleep_time_us, min_sleep_time_us + 50); ++ if (min_sleep_time_us > 0) { ++ /* allow sleep for extra 50us if needed */ ++ usleep_range(min_sleep_time_us, min_sleep_time_us + 50); ++ } ++ ++ /* update the last_dme_cmd_tstamp */ ++ hba->last_dme_cmd_tstamp = ktime_get(); + } + + /** diff --git a/queue-5.10/series b/queue-5.10/series index 1a3adff0509..7e3a785dd21 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -314,3 +314,8 @@ alsa-line6-fix-racy-access-to-midibuf.patch alsa-hda-add-hp-mp9-g4-retail-system-ams-to-force-connect-list.patch alsa-hda-hdmi-yet-more-pin-fix-for-hp-elitedesk-800-g4.patch usb-vhci-hcd-do-not-drop-references-before-new-references-are-gained.patch +usb-serial-debug-do-not-echo-input-by-default.patch +usb-gadget-core-check-for-unset-descriptor.patch +usb-gadget-u_serial-set-start_delayed-during-suspend.patch +scsi-ufs-core-fix-hba-last_dme_cmd_tstamp-timestamp-updating-logic.patch +tick-broadcast-move-per-cpu-pointer-access-into-the-atomic-section.patch diff --git a/queue-5.10/tick-broadcast-move-per-cpu-pointer-access-into-the-atomic-section.patch b/queue-5.10/tick-broadcast-move-per-cpu-pointer-access-into-the-atomic-section.patch new file mode 100644 index 00000000000..cbeea9ce5f2 --- /dev/null +++ b/queue-5.10/tick-broadcast-move-per-cpu-pointer-access-into-the-atomic-section.patch @@ -0,0 +1,52 @@ +From 6881e75237a84093d0986f56223db3724619f26e Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Wed, 31 Jul 2024 12:23:51 +0200 +Subject: tick/broadcast: Move per CPU pointer access into the atomic section + +From: Thomas Gleixner + +commit 6881e75237a84093d0986f56223db3724619f26e upstream. + +The recent fix for making the take over of the broadcast timer more +reliable retrieves a per CPU pointer in preemptible context. + +This went unnoticed as compilers hoist the access into the non-preemptible +region where the pointer is actually used. But of course it's valid that +the compiler keeps it at the place where the code puts it which rightfully +triggers: + + BUG: using smp_processor_id() in preemptible [00000000] code: + caller is hotplug_cpu__broadcast_tick_pull+0x1c/0xc0 + +Move it to the actual usage site which is in a non-preemptible region. + +Fixes: f7d43dd206e7 ("tick/broadcast: Make takeover of broadcast hrtimer reliable") +Reported-by: David Wang <00107082@163.com> +Signed-off-by: Thomas Gleixner +Tested-by: Yu Liao +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/87ttg56ers.ffs@tglx +Signed-off-by: Greg Kroah-Hartman +--- + kernel/time/tick-broadcast.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/time/tick-broadcast.c ++++ b/kernel/time/tick-broadcast.c +@@ -944,7 +944,6 @@ void tick_broadcast_switch_to_oneshot(vo + #ifdef CONFIG_HOTPLUG_CPU + void hotplug_cpu__broadcast_tick_pull(int deadcpu) + { +- struct tick_device *td = this_cpu_ptr(&tick_cpu_device); + struct clock_event_device *bc; + unsigned long flags; + +@@ -970,6 +969,8 @@ void hotplug_cpu__broadcast_tick_pull(in + * device to avoid the starvation. + */ + if (tick_check_broadcast_expired()) { ++ struct tick_device *td = this_cpu_ptr(&tick_cpu_device); ++ + cpumask_clear_cpu(smp_processor_id(), tick_broadcast_force_mask); + tick_program_event(td->evtdev->next_event, 1); + } diff --git a/queue-5.10/usb-gadget-core-check-for-unset-descriptor.patch b/queue-5.10/usb-gadget-core-check-for-unset-descriptor.patch new file mode 100644 index 00000000000..bf37ed08486 --- /dev/null +++ b/queue-5.10/usb-gadget-core-check-for-unset-descriptor.patch @@ -0,0 +1,47 @@ +From 973a57891608a98e894db2887f278777f564de18 Mon Sep 17 00:00:00 2001 +From: Chris Wulff +Date: Wed, 24 Jul 2024 21:04:20 -0400 +Subject: usb: gadget: core: Check for unset descriptor + +From: Chris Wulff + +commit 973a57891608a98e894db2887f278777f564de18 upstream. + +Make sure the descriptor has been set before looking at maxpacket. +This fixes a null pointer panic in this case. + +This may happen if the gadget doesn't properly set up the endpoint +for the current speed, or the gadget descriptors are malformed and +the descriptor for the speed/endpoint are not found. + +No current gadget driver is known to have this problem, but this +may cause a hard-to-find bug during development of new gadgets. + +Fixes: 54f83b8c8ea9 ("USB: gadget: Reject endpoints with 0 maxpacket value") +Cc: stable@vger.kernel.org +Signed-off-by: Chris Wulff +Link: https://lore.kernel.org/r/20240725010419.314430-2-crwulff@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/core.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +--- a/drivers/usb/gadget/udc/core.c ++++ b/drivers/usb/gadget/udc/core.c +@@ -99,12 +99,10 @@ int usb_ep_enable(struct usb_ep *ep) + goto out; + + /* UDC drivers can't handle endpoints with maxpacket size 0 */ +- if (usb_endpoint_maxp(ep->desc) == 0) { +- /* +- * We should log an error message here, but we can't call +- * dev_err() because there's no way to find the gadget +- * given only ep. +- */ ++ if (!ep->desc || usb_endpoint_maxp(ep->desc) == 0) { ++ WARN_ONCE(1, "%s: ep%d (%s) has %s\n", __func__, ep->address, ep->name, ++ (!ep->desc) ? "NULL descriptor" : "maxpacket 0"); ++ + ret = -EINVAL; + goto out; + } diff --git a/queue-5.10/usb-gadget-u_serial-set-start_delayed-during-suspend.patch b/queue-5.10/usb-gadget-u_serial-set-start_delayed-during-suspend.patch new file mode 100644 index 00000000000..3f2ab174402 --- /dev/null +++ b/queue-5.10/usb-gadget-u_serial-set-start_delayed-during-suspend.patch @@ -0,0 +1,36 @@ +From 5a444bea37e2759549ef72bfe83d1c8712e76b3d Mon Sep 17 00:00:00 2001 +From: Prashanth K +Date: Tue, 30 Jul 2024 18:27:54 +0530 +Subject: usb: gadget: u_serial: Set start_delayed during suspend + +From: Prashanth K + +commit 5a444bea37e2759549ef72bfe83d1c8712e76b3d upstream. + +Upstream commit aba3a8d01d62 ("usb: gadget: u_serial: add suspend +resume callbacks") added started_delayed flag, so that new ports +which are opened after USB suspend can start IO while resuming. +But if the port was already opened, and gadget suspend kicks in +afterwards, start_delayed will never be set. This causes resume +to bail out before calling gs_start_io(). Fix this by setting +start_delayed during suspend. + +Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks") +Cc: stable@vger.kernel.org +Signed-off-by: Prashanth K +Link: https://lore.kernel.org/r/20240730125754.576326-1-quic_prashk@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/u_serial.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -1438,6 +1438,7 @@ void gserial_suspend(struct gserial *gse + spin_lock(&port->port_lock); + spin_unlock(&serial_port_lock); + port->suspended = true; ++ port->start_delayed = true; + spin_unlock_irqrestore(&port->port_lock, flags); + } + EXPORT_SYMBOL_GPL(gserial_suspend); diff --git a/queue-5.10/usb-serial-debug-do-not-echo-input-by-default.patch b/queue-5.10/usb-serial-debug-do-not-echo-input-by-default.patch new file mode 100644 index 00000000000..10caedf533d --- /dev/null +++ b/queue-5.10/usb-serial-debug-do-not-echo-input-by-default.patch @@ -0,0 +1,69 @@ +From 00af4f3dda1461ec90d892edc10bec6d3c50c554 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= + +Date: Mon, 15 Jul 2024 12:44:53 +0200 +Subject: USB: serial: debug: do not echo input by default +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Marczykowski-Górecki + +commit 00af4f3dda1461ec90d892edc10bec6d3c50c554 upstream. + +This driver is intended as a "client" end of the console connection. +When connected to a host it's supposed to receive debug logs, and +possibly allow to interact with whatever debug console is available +there. Feeding messages back, depending on a configuration may cause log +messages be executed as shell commands (which can be really bad if one +is unlucky, imagine a log message like "prevented running `rm -rf +/home`"). In case of Xen, it exposes sysrq-like debug interface, and +feeding it its own logs will pretty quickly hit 'R' for "instant +reboot". + +Contrary to a classic serial console, the USB one cannot be configured +ahead of time, as the device shows up only when target OS is up. And at +the time device is opened to execute relevant ioctl, it's already too +late, especially when logs start flowing shortly after device is +initialized. +Avoid the issue by changing default to no echo for this type of devices. + +Signed-off-by: Marek Marczykowski-Górecki +[ johan: amend summary; disable also ECHONL ] +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/usb_debug.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/serial/usb_debug.c ++++ b/drivers/usb/serial/usb_debug.c +@@ -69,6 +69,11 @@ static void usb_debug_process_read_urb(s + usb_serial_generic_process_read_urb(urb); + } + ++static void usb_debug_init_termios(struct tty_struct *tty) ++{ ++ tty->termios.c_lflag &= ~(ECHO | ECHONL); ++} ++ + static struct usb_serial_driver debug_device = { + .driver = { + .owner = THIS_MODULE, +@@ -78,6 +83,7 @@ static struct usb_serial_driver debug_de + .num_ports = 1, + .bulk_out_size = USB_DEBUG_MAX_PACKET_SIZE, + .break_ctl = usb_debug_break_ctl, ++ .init_termios = usb_debug_init_termios, + .process_read_urb = usb_debug_process_read_urb, + }; + +@@ -89,6 +95,7 @@ static struct usb_serial_driver dbc_devi + .id_table = dbc_id_table, + .num_ports = 1, + .break_ctl = usb_debug_break_ctl, ++ .init_termios = usb_debug_init_termios, + .process_read_urb = usb_debug_process_read_urb, + }; + -- 2.47.3