From 87ea4eecd0d9d658554446fa5ecbb055dc98c968 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 12 Jul 2023 22:10:03 -0400 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- ...odule_firmware-for-firmware_tg357766.patch | 37 +++ ...sing-error-check-for-rhashtable_inse.patch | 47 ++++ ...c7180-add-parent-dependency-to-all-c.patch | 88 +++++++ ...pq6018-use-floor-ops-for-sdcc-clocks.patch | 37 +++ ...k-qcom-ipq6018-fix-networking-resets.patch | 72 ++++++ ...-allow-specifying-custom-reset-delay.patch | 67 +++++ ...eset-support-resetting-multiple-bits.patch | 72 ++++++ ...ss-of-connection-info-when-a-module-.patch | 69 ++++++ ...-hw.adjusted-mode-when-calculating-i.patch | 52 ++++ ...l-doc-of-property-capability-fields-.patch | 46 ++++ ...l-doc-of-property-fields-to-avoid-wa.patch | 45 ++++ ...w-to-defragment-files-have-fi_compre.patch | 49 ++++ ...rror-path-handling-in-truncate_dnode.patch | 39 +++ ...-f2fs_ipu_honor_opu_write-ipu-policy.patch | 230 ++++++++++++++++++ ...iic_wakeup-and-__xiic_start_xfer-in-.patch | 112 +++++++++ ...ry-to-handle-more-interrupt-events-a.patch | 60 +++++ ...not-reset-dql-stats-on-non_fatal-err.patch | 82 +++++++ ...ng-kernfs_idr_lock-to-remove-an-id-f.patch | 39 +++ ...x-racy-access-of-physical-cpu-number.patch | 60 +++++ ..._s390_get_cmma_bits-for-gfns-in-mems.patch | 74 ++++++ ...0-vsie-fix-the-length-of-apcb-bitmap.patch | 52 ++++ ...r-fill-non-message-tx-data-fields-wi.patch | 75 ++++++ ...he-condition-to-call-bio_end_io_acct.patch | 63 +++++ ...in_platform-fix-out_len-in-gmin_get_.patch | 42 ++++ ...ia-cec-i2c-ch7322-also-select-regmap.patch | 69 ++++++ ...ct-format-propagation-for-st-mipid02.patch | 47 ++++ ...a-usb-check-az6007_read-return-value.patch | 38 +++ ...fix-warning-due-to-null-work_func_t-.patch | 83 +++++++ ...elpers-fix-align-of-non-power-of-two.patch | 51 ++++ ...h-fix-struct-v4l2_input-tuner-index-.patch | 62 +++++ ...dd-missing-check-for-platform_get_re.patch | 38 +++ ...t5033-drop-rt5033-battery-sub-device.patch | 41 ++++ ...fx-fix-error-path-in-stmfx_chip_init.patch | 38 +++ ...x-nullify-stmfx-vdd-in-case-of-error.patch | 41 ++++ ...isable-the-regulators-if-they-are-en.patch | 45 ++++ ...ports-without-iff_unicast_flt-in-br_.patch | 198 +++++++++++++++ ...105-fix-mac-da-patching-from-meta-fr.patch | 46 ++++ ...et-dsa-vsc73xx-fix-mtu-configuration.patch | 54 ++++ ...t-add-sanity-checks-on-table-name-an.patch | 102 ++++++++ ...dit-add-size-check-for-tca_pedit_par.patch | 57 +++++ ...bout-slab-out-of-bounds-caused-by-nt.patch | 52 ++++ .../nvmem-rmem-use-nvmem_devid_auto.patch | 41 ++++ ...fix-hardware-timestamp-configuration.patch | 42 ++++ ...-validation-before-accessing-cgx-and.patch | 63 +++++ ...-mapping-for-nix-block-from-cgx-conn.patch | 74 ++++++ ...b-check-return-value-of-devm_kzalloc.patch | 40 +++ ...c_early_debug_cpm-only-when-serial_c.patch | 46 ++++ queue-5.15/pptp-fix-fib-lookup-calls.patch | 116 +++++++++ .../pwm-ab8500-fix-error-code-in-probe.patch | 41 ++++ ...ce-real_period-to-be-zero-in-suspend.patch | 48 ++++ ...isp-fix-the-disable-flow-of-disp_pwm.patch | 57 +++++ ...-apply-state-to-already-disabled-pwm.patch | 90 +++++++ ...n-usb-conn-gpio-set-last-role-to-unk.patch | 98 ++++++++ ...ock_allow_resize-after-linear-mappin.patch | 109 +++++++++ ...se-some-resources-in-st_rtc_probe-in.patch | 40 +++ queue-5.15/s390-qeth-fix-vipa-deletion.patch | 42 ++++ ...al-deadlock-on-net-sctp.addr_wq_lock.patch | 57 +++++ ...ock-port-for-stop_rx-in-omap8250_irq.patch | 39 +++ ...-port-for-uart_ier-access-in-omap825.patch | 57 +++++ ...-fix-freeing-of-resources-on-failed-.patch | 42 ++++ ...-use-force_suspend-and-resume-for-sy.patch | 78 ++++++ queue-5.15/series | 79 ++++++ ...a-fix-dma-channel-offset-calculation.patch | 103 ++++++++ ...p-to-translate-device-tree-address-i.patch | 44 ++++ ...urn-error-if-neither-hif_mspi-nor-ms.patch | 58 +++++ ...data-races-in-__tcp_oow_rate_limited.patch | 55 +++++ ...turn-enomem-instead-of-enospc-on-fai.patch | 111 +++++++++ ...onn-gpio-set-last-role-to-unknown-be.patch | 104 ++++++++ ...b-dwc2-fix-some-error-handling-paths.patch | 81 ++++++ ...m-improve-error-reporting-for-proble.patch | 49 ++++ ...12a-fix-an-error-handling-path-in-dw.patch | 51 ++++ ...x-an-error-handling-path-in-dwc3_qco.patch | 43 ++++ ...-dwc3-qcom-fix-potential-memory-leak.patch | 53 ++++ ...lease-the-correct-resources-in-dwc3_.patch | 50 ++++ ...ial-add-null-pointer-check-in-gseria.patch | 56 +++++ ...usbfs_notify_suspend-resume-function.patch | 52 ++++ ...o-fix-memory-leak-in-tahvo_usb_probe.patch | 43 ++++ queue-5.15/w1-fix-loop-in-w1_fini.patch | 43 ++++ ...rm-fix-locking-behavior-in-convert_t.patch | 91 +++++++ .../xsk-honor-so_bindtodevice-on-bind.patch | 101 ++++++++ 80 files changed, 5158 insertions(+) create mode 100644 queue-5.15/add-module_firmware-for-firmware_tg357766.patch create mode 100644 queue-5.15/apparmor-fix-missing-error-check-for-rhashtable_inse.patch create mode 100644 queue-5.15/clk-qcom-camcc-sc7180-add-parent-dependency-to-all-c.patch create mode 100644 queue-5.15/clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch create mode 100644 queue-5.15/clk-qcom-ipq6018-fix-networking-resets.patch create mode 100644 queue-5.15/clk-qcom-reset-allow-specifying-custom-reset-delay.patch create mode 100644 queue-5.15/clk-qcom-reset-support-resetting-multiple-bits.patch create mode 100644 queue-5.15/coresight-fix-loss-of-connection-info-when-a-module-.patch create mode 100644 queue-5.15/drm-i915-psr-use-hw.adjusted-mode-when-calculating-i.patch create mode 100644 queue-5.15/extcon-fix-kernel-doc-of-property-capability-fields-.patch create mode 100644 queue-5.15/extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch create mode 100644 queue-5.15/f2fs-do-not-allow-to-defragment-files-have-fi_compre.patch create mode 100644 queue-5.15/f2fs-fix-error-path-handling-in-truncate_dnode.patch create mode 100644 queue-5.15/f2fs-introduce-f2fs_ipu_honor_opu_write-ipu-policy.patch create mode 100644 queue-5.15/i2c-xiic-defer-xiic_wakeup-and-__xiic_start_xfer-in-.patch create mode 100644 queue-5.15/i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch create mode 100644 queue-5.15/ibmvnic-do-not-reset-dql-stats-on-non_fatal-err.patch create mode 100644 queue-5.15/kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch create mode 100644 queue-5.15/kvm-s390-diag-fix-racy-access-of-physical-cpu-number.patch create mode 100644 queue-5.15/kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch create mode 100644 queue-5.15/kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch create mode 100644 queue-5.15/mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch create mode 100644 queue-5.15/md-raid10-fix-the-condition-to-call-bio_end_io_acct.patch create mode 100644 queue-5.15/media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch create mode 100644 queue-5.15/media-cec-i2c-ch7322-also-select-regmap.patch create mode 100644 queue-5.15/media-i2c-correct-format-propagation-for-st-mipid02.patch create mode 100644 queue-5.15/media-usb-check-az6007_read-return-value.patch create mode 100644 queue-5.15/media-usb-siano-fix-warning-due-to-null-work_func_t-.patch create mode 100644 queue-5.15/media-venus-helpers-fix-align-of-non-power-of-two.patch create mode 100644 queue-5.15/media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch create mode 100644 queue-5.15/mfd-intel-lpss-add-missing-check-for-platform_get_re.patch create mode 100644 queue-5.15/mfd-rt5033-drop-rt5033-battery-sub-device.patch create mode 100644 queue-5.15/mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch create mode 100644 queue-5.15/mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch create mode 100644 queue-5.15/mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch create mode 100644 queue-5.15/net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch create mode 100644 queue-5.15/net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch create mode 100644 queue-5.15/net-dsa-vsc73xx-fix-mtu-configuration.patch create mode 100644 queue-5.15/net-sched-act_ipt-add-sanity-checks-on-table-name-an.patch create mode 100644 queue-5.15/net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch create mode 100644 queue-5.15/ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch create mode 100644 queue-5.15/nvmem-rmem-use-nvmem_devid_auto.patch create mode 100644 queue-5.15/octeontx-af-fix-hardware-timestamp-configuration.patch create mode 100644 queue-5.15/octeontx2-af-add-validation-before-accessing-cgx-and.patch create mode 100644 queue-5.15/octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch create mode 100644 queue-5.15/phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch create mode 100644 queue-5.15/powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch create mode 100644 queue-5.15/pptp-fix-fib-lookup-calls.patch create mode 100644 queue-5.15/pwm-ab8500-fix-error-code-in-probe.patch create mode 100644 queue-5.15/pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch create mode 100644 queue-5.15/pwm-mtk_disp-fix-the-disable-flow-of-disp_pwm.patch create mode 100644 queue-5.15/pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch create mode 100644 queue-5.15/revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch create mode 100644 queue-5.15/riscv-move-memblock_allow_resize-after-linear-mappin.patch create mode 100644 queue-5.15/rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch create mode 100644 queue-5.15/s390-qeth-fix-vipa-deletion.patch create mode 100644 queue-5.15/sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch create mode 100644 queue-5.15/serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch create mode 100644 queue-5.15/serial-8250-lock-port-for-uart_ier-access-in-omap825.patch create mode 100644 queue-5.15/serial-8250-omap-fix-freeing-of-resources-on-failed-.patch create mode 100644 queue-5.15/serial-8250_omap-use-force_suspend-and-resume-for-sy.patch create mode 100644 queue-5.15/sh-dma-fix-dma-channel-offset-calculation.patch create mode 100644 queue-5.15/sh-j2-use-ioremap-to-translate-device-tree-address-i.patch create mode 100644 queue-5.15/spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch create mode 100644 queue-5.15/tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch create mode 100644 queue-5.15/test_firmware-return-enomem-instead-of-enospc-on-fai.patch create mode 100644 queue-5.15/usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch create mode 100644 queue-5.15/usb-dwc2-fix-some-error-handling-paths.patch create mode 100644 queue-5.15/usb-dwc2-platform-improve-error-reporting-for-proble.patch create mode 100644 queue-5.15/usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch create mode 100644 queue-5.15/usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch create mode 100644 queue-5.15/usb-dwc3-qcom-fix-potential-memory-leak.patch create mode 100644 queue-5.15/usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch create mode 100644 queue-5.15/usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch create mode 100644 queue-5.15/usb-hide-unused-usbfs_notify_suspend-resume-function.patch create mode 100644 queue-5.15/usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch create mode 100644 queue-5.15/w1-fix-loop-in-w1_fini.patch create mode 100644 queue-5.15/w1-w1_therm-fix-locking-behavior-in-convert_t.patch create mode 100644 queue-5.15/xsk-honor-so_bindtodevice-on-bind.patch diff --git a/queue-5.15/add-module_firmware-for-firmware_tg357766.patch b/queue-5.15/add-module_firmware-for-firmware_tg357766.patch new file mode 100644 index 00000000000..28bc7b8fda8 --- /dev/null +++ b/queue-5.15/add-module_firmware-for-firmware_tg357766.patch @@ -0,0 +1,37 @@ +From 4ef86d88c7295733d7bdfda40a6eb8078e510cc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 02:13:32 +0200 +Subject: Add MODULE_FIRMWARE() for FIRMWARE_TG357766. + +From: Tobias Heider + +[ Upstream commit 046f753da6143ee16452966915087ec8b0de3c70 ] + +Fixes a bug where on the M1 mac mini initramfs-tools fails to +include the necessary firmware into the initrd. + +Fixes: c4dab50697ff ("tg3: Download 57766 EEE service patch firmware") +Signed-off-by: Tobias Heider +Reviewed-by: Michael Chan +Link: https://lore.kernel.org/r/ZJt7LKzjdz8+dClx@tobhe.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index 50f86bebbc19d..70b1a855273e4 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -224,6 +224,7 @@ MODULE_AUTHOR("David S. Miller (davem@redhat.com) and Jeff Garzik (jgarzik@pobox + MODULE_DESCRIPTION("Broadcom Tigon3 ethernet driver"); + MODULE_LICENSE("GPL"); + MODULE_FIRMWARE(FIRMWARE_TG3); ++MODULE_FIRMWARE(FIRMWARE_TG357766); + MODULE_FIRMWARE(FIRMWARE_TG3TSO); + MODULE_FIRMWARE(FIRMWARE_TG3TSO5); + +-- +2.39.2 + diff --git a/queue-5.15/apparmor-fix-missing-error-check-for-rhashtable_inse.patch b/queue-5.15/apparmor-fix-missing-error-check-for-rhashtable_inse.patch new file mode 100644 index 00000000000..57a1f3d8736 --- /dev/null +++ b/queue-5.15/apparmor-fix-missing-error-check-for-rhashtable_inse.patch @@ -0,0 +1,47 @@ +From ee87fea923b7f4bcfc421f6916622415ce147431 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 19:05:49 +0000 +Subject: apparmor: fix missing error check for rhashtable_insert_fast + +From: Danila Chernetsov + +[ Upstream commit 000518bc5aef25d3f703592a0296d578c98b1517 ] + + rhashtable_insert_fast() could return err value when memory allocation is + failed. but unpack_profile() do not check values and this always returns + success value. This patch just adds error check code. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: e025be0f26d5 ("apparmor: support querying extended trusted helper extra data") + +Signed-off-by: Danila Chernetsov +Signed-off-by: John Johansen +Signed-off-by: Sasha Levin +--- + security/apparmor/policy_unpack.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c +index d5b3a062d1d18..5f758b289ace3 100644 +--- a/security/apparmor/policy_unpack.c ++++ b/security/apparmor/policy_unpack.c +@@ -909,8 +909,13 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) + goto fail; + } + +- rhashtable_insert_fast(profile->data, &data->head, +- profile->data->p); ++ if (rhashtable_insert_fast(profile->data, &data->head, ++ profile->data->p)) { ++ kfree_sensitive(data->key); ++ kfree_sensitive(data); ++ info = "failed to insert data to table"; ++ goto fail; ++ } + } + + if (!unpack_nameX(e, AA_STRUCTEND, NULL)) { +-- +2.39.2 + diff --git a/queue-5.15/clk-qcom-camcc-sc7180-add-parent-dependency-to-all-c.patch b/queue-5.15/clk-qcom-camcc-sc7180-add-parent-dependency-to-all-c.patch new file mode 100644 index 00000000000..1b1c80cfc19 --- /dev/null +++ b/queue-5.15/clk-qcom-camcc-sc7180-add-parent-dependency-to-all-c.patch @@ -0,0 +1,88 @@ +From 94d61970a390d3c962b9ecafce9f4ade1260ef71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 May 2023 19:59:32 +0530 +Subject: clk: qcom: camcc-sc7180: Add parent dependency to all camera GDSCs + +From: Taniya Das + +[ Upstream commit 3e4d179532423f299554cd0dedabdd9d2fdd238d ] + +Camera titan top GDSC is a parent supply to all other camera GDSCs. Titan +top GDSC is required to be enabled before enabling any other camera GDSCs +and it should be disabled only after all other camera GDSCs are disabled. +Ensure this behavior by marking titan top GDSC as parent of all other +camera GDSCs. + +Fixes: 15d09e830bbc ("clk: qcom: camcc: Add camera clock controller driver for SC7180") +Signed-off-by: Taniya Das +Acked-by: Stephen Boyd +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230501142932.13049-1-quic_tdas@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/camcc-sc7180.c | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/qcom/camcc-sc7180.c b/drivers/clk/qcom/camcc-sc7180.c +index ce73ee9037cb0..4b3e3902b7eed 100644 +--- a/drivers/clk/qcom/camcc-sc7180.c ++++ b/drivers/clk/qcom/camcc-sc7180.c +@@ -1493,12 +1493,21 @@ static struct clk_branch cam_cc_sys_tmr_clk = { + }, + }; + ++static struct gdsc titan_top_gdsc = { ++ .gdscr = 0xb134, ++ .pd = { ++ .name = "titan_top_gdsc", ++ }, ++ .pwrsts = PWRSTS_OFF_ON, ++}; ++ + static struct gdsc bps_gdsc = { + .gdscr = 0x6004, + .pd = { + .name = "bps_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &titan_top_gdsc.pd, + .flags = HW_CTRL, + }; + +@@ -1508,6 +1517,7 @@ static struct gdsc ife_0_gdsc = { + .name = "ife_0_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &titan_top_gdsc.pd, + }; + + static struct gdsc ife_1_gdsc = { +@@ -1516,6 +1526,7 @@ static struct gdsc ife_1_gdsc = { + .name = "ife_1_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &titan_top_gdsc.pd, + }; + + static struct gdsc ipe_0_gdsc = { +@@ -1525,15 +1536,9 @@ static struct gdsc ipe_0_gdsc = { + }, + .pwrsts = PWRSTS_OFF_ON, + .flags = HW_CTRL, ++ .parent = &titan_top_gdsc.pd, + }; + +-static struct gdsc titan_top_gdsc = { +- .gdscr = 0xb134, +- .pd = { +- .name = "titan_top_gdsc", +- }, +- .pwrsts = PWRSTS_OFF_ON, +-}; + + static struct clk_hw *cam_cc_sc7180_hws[] = { + [CAM_CC_PLL2_OUT_EARLY] = &cam_cc_pll2_out_early.hw, +-- +2.39.2 + diff --git a/queue-5.15/clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch b/queue-5.15/clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch new file mode 100644 index 00000000000..ea2734c9645 --- /dev/null +++ b/queue-5.15/clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch @@ -0,0 +1,37 @@ +From d286b63c6fab9420f9b9d0ae28b742434ce8886c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 12:11:49 +0300 +Subject: clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks + +From: Mantas Pucka + +[ Upstream commit 56e5ae0116aef87273cf1812d608645b076e4f02 ] + +SDCC clocks must be rounded down to avoid overclocking the controller. + +Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support") +Signed-off-by: Mantas Pucka +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1682413909-24927-1-git-send-email-mantas@8devices.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq6018.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c +index 3f9c2f61a5d93..5c5d1b04ea7af 100644 +--- a/drivers/clk/qcom/gcc-ipq6018.c ++++ b/drivers/clk/qcom/gcc-ipq6018.c +@@ -1654,7 +1654,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = { + .name = "sdcc1_apps_clk_src", + .parent_data = gcc_xo_gpll0_gpll2_gpll0_out_main_div2, + .num_parents = 4, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_floor_ops, + }, + }; + +-- +2.39.2 + diff --git a/queue-5.15/clk-qcom-ipq6018-fix-networking-resets.patch b/queue-5.15/clk-qcom-ipq6018-fix-networking-resets.patch new file mode 100644 index 00000000000..a0571a1e8d6 --- /dev/null +++ b/queue-5.15/clk-qcom-ipq6018-fix-networking-resets.patch @@ -0,0 +1,72 @@ +From 509323aa8a7251432080cc08bd35789069835793 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 May 2023 21:08:55 +0200 +Subject: clk: qcom: ipq6018: fix networking resets + +From: Robert Marko + +[ Upstream commit 349b5bed539b491b7894a5186a895751fd8ba6c7 ] + +Networking resets in IPQ6018 all use bitmask as they require multiple +bits to be set and cleared instead of a single bit. + +So, current networking resets have the same register and bit 0 set which +is clearly incorrect. + +Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230526190855.2941291-2-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq6018.c | 32 ++++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c +index 5c5d1b04ea7af..cde62a11f5736 100644 +--- a/drivers/clk/qcom/gcc-ipq6018.c ++++ b/drivers/clk/qcom/gcc-ipq6018.c +@@ -4517,24 +4517,24 @@ static const struct qcom_reset_map gcc_ipq6018_resets[] = { + [GCC_PCIE0_AHB_ARES] = { 0x75040, 5 }, + [GCC_PCIE0_AXI_MASTER_STICKY_ARES] = { 0x75040, 6 }, + [GCC_PCIE0_AXI_SLAVE_STICKY_ARES] = { 0x75040, 7 }, +- [GCC_PPE_FULL_RESET] = { 0x68014, 0 }, +- [GCC_UNIPHY0_SOFT_RESET] = { 0x56004, 0 }, ++ [GCC_PPE_FULL_RESET] = { .reg = 0x68014, .bitmask = 0xf0000 }, ++ [GCC_UNIPHY0_SOFT_RESET] = { .reg = 0x56004, .bitmask = 0x3ff2 }, + [GCC_UNIPHY0_XPCS_RESET] = { 0x56004, 2 }, +- [GCC_UNIPHY1_SOFT_RESET] = { 0x56104, 0 }, ++ [GCC_UNIPHY1_SOFT_RESET] = { .reg = 0x56104, .bitmask = 0x32 }, + [GCC_UNIPHY1_XPCS_RESET] = { 0x56104, 2 }, +- [GCC_EDMA_HW_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT1_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT2_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT3_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT4_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT5_RESET] = { 0x68014, 0 }, +- [GCC_UNIPHY0_PORT1_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT2_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT3_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT4_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT5_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT_4_5_RESET] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT_4_RESET] = { 0x56004, 0 }, ++ [GCC_EDMA_HW_RESET] = { .reg = 0x68014, .bitmask = 0x300000 }, ++ [GCC_NSSPORT1_RESET] = { .reg = 0x68014, .bitmask = 0x1000003 }, ++ [GCC_NSSPORT2_RESET] = { .reg = 0x68014, .bitmask = 0x200000c }, ++ [GCC_NSSPORT3_RESET] = { .reg = 0x68014, .bitmask = 0x4000030 }, ++ [GCC_NSSPORT4_RESET] = { .reg = 0x68014, .bitmask = 0x8000300 }, ++ [GCC_NSSPORT5_RESET] = { .reg = 0x68014, .bitmask = 0x10000c00 }, ++ [GCC_UNIPHY0_PORT1_ARES] = { .reg = 0x56004, .bitmask = 0x30 }, ++ [GCC_UNIPHY0_PORT2_ARES] = { .reg = 0x56004, .bitmask = 0xc0 }, ++ [GCC_UNIPHY0_PORT3_ARES] = { .reg = 0x56004, .bitmask = 0x300 }, ++ [GCC_UNIPHY0_PORT4_ARES] = { .reg = 0x56004, .bitmask = 0xc00 }, ++ [GCC_UNIPHY0_PORT5_ARES] = { .reg = 0x56004, .bitmask = 0x3000 }, ++ [GCC_UNIPHY0_PORT_4_5_RESET] = { .reg = 0x56004, .bitmask = 0x3c02 }, ++ [GCC_UNIPHY0_PORT_4_RESET] = { .reg = 0x56004, .bitmask = 0xc02 }, + [GCC_LPASS_BCR] = {0x1F000, 0}, + [GCC_UBI32_TBU_BCR] = {0x65000, 0}, + [GCC_LPASS_TBU_BCR] = {0x6C000, 0}, +-- +2.39.2 + diff --git a/queue-5.15/clk-qcom-reset-allow-specifying-custom-reset-delay.patch b/queue-5.15/clk-qcom-reset-allow-specifying-custom-reset-delay.patch new file mode 100644 index 00000000000..729215f877c --- /dev/null +++ b/queue-5.15/clk-qcom-reset-allow-specifying-custom-reset-delay.patch @@ -0,0 +1,67 @@ +From 024faebe16f3c67ca7fc893a5f690df87f5542df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 15:41:29 +0200 +Subject: clk: qcom: reset: Allow specifying custom reset delay + +From: Stephan Gerhold + +[ Upstream commit 2cb8a39b6781ea23accd1fa93b3ad000d0948aec ] + +The amount of time required between asserting and deasserting the reset +signal can vary depending on the involved hardware component. Sometimes +1 us might not be enough and a larger delay is necessary to conform to +the specifications. + +Usually this is worked around in the consuming drivers, by replacing +reset_control_reset() with a sequence of reset_control_assert(), waiting +for a custom delay, followed by reset_control_deassert(). + +However, in some cases the driver making use of the reset is generic and +can be used with different reset controllers. In this case the reset +time requirement is better handled directly by the reset controller +driver. + +Make this possible by adding an "udelay" field to the qcom_reset_map +that allows setting a different reset delay (in microseconds). + +Signed-off-by: Stephan Gerhold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220706134132.3623415-4-stephan.gerhold@kernkonzept.com +Stable-dep-of: 349b5bed539b ("clk: qcom: ipq6018: fix networking resets") +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/reset.c | 4 +++- + drivers/clk/qcom/reset.h | 1 + + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c +index 819d194be8f7b..2a16adb572d2b 100644 +--- a/drivers/clk/qcom/reset.c ++++ b/drivers/clk/qcom/reset.c +@@ -13,8 +13,10 @@ + + static int qcom_reset(struct reset_controller_dev *rcdev, unsigned long id) + { ++ struct qcom_reset_controller *rst = to_qcom_reset_controller(rcdev); ++ + rcdev->ops->assert(rcdev, id); +- udelay(1); ++ udelay(rst->reset_map[id].udelay ?: 1); /* use 1 us as default */ + rcdev->ops->deassert(rcdev, id); + return 0; + } +diff --git a/drivers/clk/qcom/reset.h b/drivers/clk/qcom/reset.h +index 2a08b5e282c77..b8c113582072b 100644 +--- a/drivers/clk/qcom/reset.h ++++ b/drivers/clk/qcom/reset.h +@@ -11,6 +11,7 @@ + struct qcom_reset_map { + unsigned int reg; + u8 bit; ++ u8 udelay; + }; + + struct regmap; +-- +2.39.2 + diff --git a/queue-5.15/clk-qcom-reset-support-resetting-multiple-bits.patch b/queue-5.15/clk-qcom-reset-support-resetting-multiple-bits.patch new file mode 100644 index 00000000000..fff054c2c86 --- /dev/null +++ b/queue-5.15/clk-qcom-reset-support-resetting-multiple-bits.patch @@ -0,0 +1,72 @@ +From d9b92b81d6d5f8d28c46da1fe09e9689429bf80a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Nov 2022 14:28:59 +0100 +Subject: clk: qcom: reset: support resetting multiple bits + +From: Robert Marko + +[ Upstream commit 4a5210893625f89723ea210d7c630b730abb37ad ] + +This patch adds the support for giving the complete bitmask +in reset structure and reset operation will use this bitmask +for all reset operations. + +Currently, reset structure only takes a single bit for each reset +and then calculates the bitmask by using the BIT() macro. + +However, this is not sufficient anymore for newer SoC-s like IPQ8074, +IPQ6018 and more, since their networking resets require multiple bits +to be asserted in order to properly reset the HW block completely. + +So, in order to allow asserting multiple bits add "bitmask" field to +qcom_reset_map, and then use that bitmask value if its populated in the +driver, if its not populated, then we just default to existing behaviour +and calculate the bitmask on the fly. + +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221107132901.489240-1-robimarko@gmail.com +Stable-dep-of: 349b5bed539b ("clk: qcom: ipq6018: fix networking resets") +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/reset.c | 4 ++-- + drivers/clk/qcom/reset.h | 1 + + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c +index 2a16adb572d2b..0e914ec7aeae1 100644 +--- a/drivers/clk/qcom/reset.c ++++ b/drivers/clk/qcom/reset.c +@@ -30,7 +30,7 @@ qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id) + + rst = to_qcom_reset_controller(rcdev); + map = &rst->reset_map[id]; +- mask = BIT(map->bit); ++ mask = map->bitmask ? map->bitmask : BIT(map->bit); + + return regmap_update_bits(rst->regmap, map->reg, mask, mask); + } +@@ -44,7 +44,7 @@ qcom_reset_deassert(struct reset_controller_dev *rcdev, unsigned long id) + + rst = to_qcom_reset_controller(rcdev); + map = &rst->reset_map[id]; +- mask = BIT(map->bit); ++ mask = map->bitmask ? map->bitmask : BIT(map->bit); + + return regmap_update_bits(rst->regmap, map->reg, mask, 0); + } +diff --git a/drivers/clk/qcom/reset.h b/drivers/clk/qcom/reset.h +index b8c113582072b..9a47c838d9b1b 100644 +--- a/drivers/clk/qcom/reset.h ++++ b/drivers/clk/qcom/reset.h +@@ -12,6 +12,7 @@ struct qcom_reset_map { + unsigned int reg; + u8 bit; + u8 udelay; ++ u32 bitmask; + }; + + struct regmap; +-- +2.39.2 + diff --git a/queue-5.15/coresight-fix-loss-of-connection-info-when-a-module-.patch b/queue-5.15/coresight-fix-loss-of-connection-info-when-a-module-.patch new file mode 100644 index 00000000000..d6f96c84e53 --- /dev/null +++ b/queue-5.15/coresight-fix-loss-of-connection-info-when-a-module-.patch @@ -0,0 +1,69 @@ +From 7ac57d58bd9f8db9dc4e98a02e9533af1dd5a527 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 15:35:28 +0100 +Subject: coresight: Fix loss of connection info when a module is unloaded + +From: James Clark + +[ Upstream commit c45b2835e7b205783bdfe08cc98fa86a7c5eeb74 ] + +child_fwnode should be a read only property based on the DT or ACPI. If +it's cleared on the parent device when a child is unloaded, then when +the child is loaded again the connection won't be remade. + +child_dev should be cleared instead which signifies that the connection +should be remade when the child_fwnode registers a new coresight_device. + +Similarly the reference count shouldn't be decremented as long as the +parent device exists. The correct place to drop the reference is in +coresight_release_platform_data() which is already done. + +Reproducible on Juno with the following steps: + + # load all coresight modules. + $ cd /sys/bus/coresight/devices/ + $ echo 1 > tmc_etr0/enable_sink + $ echo 1 > etm0/enable_source + # Works fine ^ + + $ echo 0 > etm0/enable_source + $ rmmod coresight-funnel + $ modprobe coresight-funnel + $ echo 1 > etm0/enable_source + -bash: echo: write error: Invalid argument + +Fixes: 37ea1ffddffa ("coresight: Use fwnode handle instead of device names") +Fixes: 2af89ebacf29 ("coresight: Clear the connection field properly") +Tested-by: Suzuki K Poulose +Reviewed-by: Mike Leach +Signed-off-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230425143542.2305069-2-james.clark@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-core.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c +index 6471f4232a2e0..3ea6900542223 100644 +--- a/drivers/hwtracing/coresight/coresight-core.c ++++ b/drivers/hwtracing/coresight/coresight-core.c +@@ -1421,13 +1421,8 @@ static int coresight_remove_match(struct device *dev, void *data) + if (csdev->dev.fwnode == conn->child_fwnode) { + iterator->orphan = true; + coresight_remove_links(iterator, conn); +- /* +- * Drop the reference to the handle for the remote +- * device acquired in parsing the connections from +- * platform data. +- */ +- fwnode_handle_put(conn->child_fwnode); +- conn->child_fwnode = NULL; ++ ++ conn->child_dev = NULL; + /* No need to continue */ + break; + } +-- +2.39.2 + diff --git a/queue-5.15/drm-i915-psr-use-hw.adjusted-mode-when-calculating-i.patch b/queue-5.15/drm-i915-psr-use-hw.adjusted-mode-when-calculating-i.patch new file mode 100644 index 00000000000..07d2bef698b --- /dev/null +++ b/queue-5.15/drm-i915-psr-use-hw.adjusted-mode-when-calculating-i.patch @@ -0,0 +1,52 @@ +From 8de19f6dca7ccecfae012a413f7191c373a72fef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 14:17:45 +0300 +Subject: drm/i915/psr: Use hw.adjusted mode when calculating io/fast wake + times +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jouni Högander + +[ Upstream commit 5311892a0ad1d301aafd53ca0154091b3eb407ea ] + +Encoder compute config is changing hw.adjusted mode. Uapi.adjusted mode +doesn't get updated before psr compute config gets called. This causes io +and fast wake line calculation using adjusted mode containing values before +encoder adjustments. Fix this by using hw.adjusted mode instead of +uapi.adjusted mode. + +Cc: Stanislav Lisovskiy + +Signed-off-by: Jouni Högander +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8475 +Fixes: cb42e8ede5b4 ("drm/i915/psr: Use calculated io and fast wake lines") +Reviewed-by: Mika Kahola +Link: https://patchwork.freedesktop.org/patch/msgid/20230620111745.2870706-1-jouni.hogander@intel.com +(cherry picked from commit ef0af9db2a21257885116949f471fe5565b2f0ab) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_psr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c +index cf1e92486cbc9..93d2fd4cd16b7 100644 +--- a/drivers/gpu/drm/i915/display/intel_psr.c ++++ b/drivers/gpu/drm/i915/display/intel_psr.c +@@ -862,9 +862,9 @@ static bool _compute_psr2_wake_times(struct intel_dp *intel_dp, + } + + io_wake_lines = intel_usecs_to_scanlines( +- &crtc_state->uapi.adjusted_mode, io_wake_time); ++ &crtc_state->hw.adjusted_mode, io_wake_time); + fast_wake_lines = intel_usecs_to_scanlines( +- &crtc_state->uapi.adjusted_mode, fast_wake_time); ++ &crtc_state->hw.adjusted_mode, fast_wake_time); + + if (io_wake_lines > max_wake_lines || + fast_wake_lines > max_wake_lines) +-- +2.39.2 + diff --git a/queue-5.15/extcon-fix-kernel-doc-of-property-capability-fields-.patch b/queue-5.15/extcon-fix-kernel-doc-of-property-capability-fields-.patch new file mode 100644 index 00000000000..599845525af --- /dev/null +++ b/queue-5.15/extcon-fix-kernel-doc-of-property-capability-fields-.patch @@ -0,0 +1,46 @@ +From e7d78856c9a38e92abe7e6c4187cebb13e5fb3f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 16:39:53 +0200 +Subject: extcon: Fix kernel doc of property capability fields to avoid + warnings + +From: Andy Shevchenko + +[ Upstream commit 73346b9965ebda2feb7fef8629e9b28baee820e3 ] + +Kernel documentation has to be synchronized with a code, otherwise +the validator is not happy: + + Function parameter or member 'usb_bits' not described in 'extcon_cable' + Function parameter or member 'chg_bits' not described in 'extcon_cable' + Function parameter or member 'jack_bits' not described in 'extcon_cable' + Function parameter or member 'disp_bits' not described in 'extcon_cable' + +Describe the fields added in the past. + +Fixes: ceaa98f442cf ("extcon: Add the support for the capability of each property") +Signed-off-by: Andy Shevchenko +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c +index 6b0681666e8e1..6a0d55d627ad0 100644 +--- a/drivers/extcon/extcon.c ++++ b/drivers/extcon/extcon.c +@@ -200,6 +200,10 @@ static const struct __extcon_info { + * @chg_propval: the array of charger connector properties + * @jack_propval: the array of jack connector properties + * @disp_propval: the array of display connector properties ++ * @usb_bits: the bit array of the USB connector property capabilities ++ * @chg_bits: the bit array of the charger connector property capabilities ++ * @jack_bits: the bit array of the jack connector property capabilities ++ * @disp_bits: the bit array of the display connector property capabilities + */ + struct extcon_cable { + struct extcon_dev *edev; +-- +2.39.2 + diff --git a/queue-5.15/extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch b/queue-5.15/extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch new file mode 100644 index 00000000000..95896456ff0 --- /dev/null +++ b/queue-5.15/extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch @@ -0,0 +1,45 @@ +From 2f76e7de79e1a6a99528f34fe0f8feedac8dd84d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 16:39:52 +0200 +Subject: extcon: Fix kernel doc of property fields to avoid warnings + +From: Andy Shevchenko + +[ Upstream commit 7e77e0b7a9f4cdf91cb0950749b40c840ea63efc ] + +Kernel documentation has to be synchronized with a code, otherwise +the validator is not happy: + + Function parameter or member 'usb_propval' not described in 'extcon_cable' + Function parameter or member 'chg_propval' not described in 'extcon_cable' + Function parameter or member 'jack_propval' not described in 'extcon_cable' + Function parameter or member 'disp_propval' not described in 'extcon_cable' + +Describe the fields added in the past. + +Fixes: 067c1652e7a7 ("extcon: Add the support for extcon property according to extcon type") +Signed-off-by: Andy Shevchenko +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c +index f305503ec27ed..6b0681666e8e1 100644 +--- a/drivers/extcon/extcon.c ++++ b/drivers/extcon/extcon.c +@@ -196,6 +196,10 @@ static const struct __extcon_info { + * @attr_name: "name" sysfs entry + * @attr_state: "state" sysfs entry + * @attrs: the array pointing to attr_name and attr_state for attr_g ++ * @usb_propval: the array of USB connector properties ++ * @chg_propval: the array of charger connector properties ++ * @jack_propval: the array of jack connector properties ++ * @disp_propval: the array of display connector properties + */ + struct extcon_cable { + struct extcon_dev *edev; +-- +2.39.2 + diff --git a/queue-5.15/f2fs-do-not-allow-to-defragment-files-have-fi_compre.patch b/queue-5.15/f2fs-do-not-allow-to-defragment-files-have-fi_compre.patch new file mode 100644 index 00000000000..53f66554bdc --- /dev/null +++ b/queue-5.15/f2fs-do-not-allow-to-defragment-files-have-fi_compre.patch @@ -0,0 +1,49 @@ +From 4008f7dee8b5c9cff7304fc72a24f6954949cebb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 00:47:11 +0800 +Subject: f2fs: do not allow to defragment files have FI_COMPRESS_RELEASED + +From: Yangtao Li + +[ Upstream commit 7cd2e5f75b86a1befa99834f3ed1d735eeff69e6 ] + +If a file has FI_COMPRESS_RELEASED, all writes for it should not be +allowed. + +Fixes: 5fdb322ff2c2 ("f2fs: add F2FS_IOC_DECOMPRESS_FILE and F2FS_IOC_COMPRESS_FILE") +Signed-off-by: Qi Han +Signed-off-by: Yangtao Li +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index f76d8a79716ef..a954983916c73 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2568,6 +2568,11 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, + + inode_lock(inode); + ++ if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) { ++ err = -EINVAL; ++ goto unlock_out; ++ } ++ + /* if in-place-update policy is enabled, don't waste time here */ + set_inode_flag(inode, FI_OPU_WRITE); + if (f2fs_should_update_inplace(inode, NULL)) { +@@ -2692,6 +2697,7 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, + clear_inode_flag(inode, FI_SKIP_WRITES); + out: + clear_inode_flag(inode, FI_OPU_WRITE); ++unlock_out: + inode_unlock(inode); + if (!err) + range->len = (u64)total << PAGE_SHIFT; +-- +2.39.2 + diff --git a/queue-5.15/f2fs-fix-error-path-handling-in-truncate_dnode.patch b/queue-5.15/f2fs-fix-error-path-handling-in-truncate_dnode.patch new file mode 100644 index 00000000000..83fd6e92f99 --- /dev/null +++ b/queue-5.15/f2fs-fix-error-path-handling-in-truncate_dnode.patch @@ -0,0 +1,39 @@ +From ddc1c3aae4ae5298f2f5fca132d845e4405b5788 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 09:41:02 +0800 +Subject: f2fs: fix error path handling in truncate_dnode() + +From: Chao Yu + +[ Upstream commit 0135c482fa97e2fd8245cb462784112a00ed1211 ] + +If truncate_node() fails in truncate_dnode(), it missed to call +f2fs_put_page(), fix it. + +Fixes: 7735730d39d7 ("f2fs: fix to propagate error from __get_meta_page()") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/node.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 89a7f6021c369..195658263f0a4 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -942,8 +942,10 @@ static int truncate_dnode(struct dnode_of_data *dn) + dn->ofs_in_node = 0; + f2fs_truncate_data_blocks(dn); + err = truncate_node(dn); +- if (err) ++ if (err) { ++ f2fs_put_page(page, 1); + return err; ++ } + + return 1; + } +-- +2.39.2 + diff --git a/queue-5.15/f2fs-introduce-f2fs_ipu_honor_opu_write-ipu-policy.patch b/queue-5.15/f2fs-introduce-f2fs_ipu_honor_opu_write-ipu-policy.patch new file mode 100644 index 00000000000..219b0d1798b --- /dev/null +++ b/queue-5.15/f2fs-introduce-f2fs_ipu_honor_opu_write-ipu-policy.patch @@ -0,0 +1,230 @@ +From 658d7b4e41fd38911414a031d647f24f218c6df8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Feb 2022 15:19:46 +0800 +Subject: f2fs: introduce F2FS_IPU_HONOR_OPU_WRITE ipu policy + +From: Chao Yu + +[ Upstream commit 1018a5463a063715365784704c4e8cdf2eec4b04 ] + +Once F2FS_IPU_FORCE policy is enabled in some cases: +a) f2fs forces to use F2FS_IPU_FORCE in a small-sized volume +b) user sets F2FS_IPU_FORCE policy via sysfs + +Then we may fail to defragment file due to IPU policy check, it doesn't +make sense, let's introduce a new IPU policy to allow OPU during file +defragmentation. + +In small-sized volume, let's enable F2FS_IPU_HONOR_OPU_WRITE policy +by default. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Stable-dep-of: 7cd2e5f75b86 ("f2fs: do not allow to defragment files have FI_COMPRESS_RELEASED") +Signed-off-by: Sasha Levin +--- + Documentation/ABI/testing/sysfs-fs-f2fs | 3 ++- + fs/f2fs/data.c | 18 +++++++++++++----- + fs/f2fs/f2fs.h | 3 ++- + fs/f2fs/file.c | 18 +++++++++++------- + fs/f2fs/segment.h | 5 ++++- + fs/f2fs/super.c | 3 ++- + 6 files changed, 34 insertions(+), 16 deletions(-) + +diff --git a/Documentation/ABI/testing/sysfs-fs-f2fs b/Documentation/ABI/testing/sysfs-fs-f2fs +index 48d41b6696270..89dec1f3ea6d9 100644 +--- a/Documentation/ABI/testing/sysfs-fs-f2fs ++++ b/Documentation/ABI/testing/sysfs-fs-f2fs +@@ -55,8 +55,9 @@ Description: Controls the in-place-update policy. + 0x04 F2FS_IPU_UTIL + 0x08 F2FS_IPU_SSR_UTIL + 0x10 F2FS_IPU_FSYNC +- 0x20 F2FS_IPU_ASYNC, ++ 0x20 F2FS_IPU_ASYNC + 0x40 F2FS_IPU_NOCACHE ++ 0x80 F2FS_IPU_HONOR_OPU_WRITE + ==== ================= + + Refer segment.h for details. +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 3956852ad1de0..141e59246da5d 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -2514,6 +2514,9 @@ static inline bool check_inplace_update_policy(struct inode *inode, + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + unsigned int policy = SM_I(sbi)->ipu_policy; + ++ if (policy & (0x1 << F2FS_IPU_HONOR_OPU_WRITE) && ++ is_inode_flag_set(inode, FI_OPU_WRITE)) ++ return false; + if (policy & (0x1 << F2FS_IPU_FORCE)) + return true; + if (policy & (0x1 << F2FS_IPU_SSR) && f2fs_need_SSR(sbi)) +@@ -2584,6 +2587,9 @@ bool f2fs_should_update_outplace(struct inode *inode, struct f2fs_io_info *fio) + if (is_inode_flag_set(inode, FI_ALIGNED_WRITE)) + return true; + ++ if (is_inode_flag_set(inode, FI_OPU_WRITE)) ++ return true; ++ + if (fio) { + if (page_private_gcing(fio->page)) + return true; +@@ -3209,8 +3215,8 @@ static int __f2fs_write_data_pages(struct address_space *mapping, + f2fs_available_free_memory(sbi, DIRTY_DENTS)) + goto skip_write; + +- /* skip writing during file defragment */ +- if (is_inode_flag_set(inode, FI_DO_DEFRAG)) ++ /* skip writing in file defragment preparing stage */ ++ if (is_inode_flag_set(inode, FI_SKIP_WRITES)) + goto skip_write; + + trace_f2fs_writepages(mapping->host, wbc, DATA); +@@ -3944,6 +3950,7 @@ static int f2fs_migrate_blocks(struct inode *inode, block_t start_blk, + filemap_invalidate_lock(inode->i_mapping); + + set_inode_flag(inode, FI_ALIGNED_WRITE); ++ set_inode_flag(inode, FI_OPU_WRITE); + + for (; secidx < end_sec; secidx++) { + down_write(&sbi->pin_sem); +@@ -3952,7 +3959,7 @@ static int f2fs_migrate_blocks(struct inode *inode, block_t start_blk, + f2fs_allocate_new_section(sbi, CURSEG_COLD_DATA_PINNED, false); + f2fs_unlock_op(sbi); + +- set_inode_flag(inode, FI_DO_DEFRAG); ++ set_inode_flag(inode, FI_SKIP_WRITES); + + for (blkofs = 0; blkofs < blk_per_sec; blkofs++) { + struct page *page; +@@ -3969,7 +3976,7 @@ static int f2fs_migrate_blocks(struct inode *inode, block_t start_blk, + f2fs_put_page(page, 1); + } + +- clear_inode_flag(inode, FI_DO_DEFRAG); ++ clear_inode_flag(inode, FI_SKIP_WRITES); + + ret = filemap_fdatawrite(inode->i_mapping); + +@@ -3980,7 +3987,8 @@ static int f2fs_migrate_blocks(struct inode *inode, block_t start_blk, + } + + done: +- clear_inode_flag(inode, FI_DO_DEFRAG); ++ clear_inode_flag(inode, FI_SKIP_WRITES); ++ clear_inode_flag(inode, FI_OPU_WRITE); + clear_inode_flag(inode, FI_ALIGNED_WRITE); + + filemap_invalidate_unlock(inode->i_mapping); +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 5c0920e11e4ba..cc1115b5c08de 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -712,7 +712,8 @@ enum { + FI_DROP_CACHE, /* drop dirty page cache */ + FI_DATA_EXIST, /* indicate data exists */ + FI_INLINE_DOTS, /* indicate inline dot dentries */ +- FI_DO_DEFRAG, /* indicate defragment is running */ ++ FI_SKIP_WRITES, /* should skip data page writeback */ ++ FI_OPU_WRITE, /* used for opu per file */ + FI_DIRTY_FILE, /* indicate regular/symlink has dirty pages */ + FI_NO_PREALLOC, /* indicate skipped preallocated blocks */ + FI_HOT_DATA, /* indicate file is hot */ +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 2c24162f72f0c..f76d8a79716ef 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2561,10 +2561,6 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, + bool fragmented = false; + int err; + +- /* if in-place-update policy is enabled, don't waste time here */ +- if (f2fs_should_update_inplace(inode, NULL)) +- return -EINVAL; +- + pg_start = range->start >> PAGE_SHIFT; + pg_end = (range->start + range->len) >> PAGE_SHIFT; + +@@ -2572,6 +2568,13 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, + + inode_lock(inode); + ++ /* if in-place-update policy is enabled, don't waste time here */ ++ set_inode_flag(inode, FI_OPU_WRITE); ++ if (f2fs_should_update_inplace(inode, NULL)) { ++ err = -EINVAL; ++ goto out; ++ } ++ + /* writeback all dirty pages in the range */ + err = filemap_write_and_wait_range(inode->i_mapping, range->start, + range->start + range->len - 1); +@@ -2653,7 +2656,7 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, + goto check; + } + +- set_inode_flag(inode, FI_DO_DEFRAG); ++ set_inode_flag(inode, FI_SKIP_WRITES); + + idx = map.m_lblk; + while (idx < map.m_lblk + map.m_len && cnt < blk_per_seg) { +@@ -2679,15 +2682,16 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, + if (map.m_lblk < pg_end && cnt < blk_per_seg) + goto do_map; + +- clear_inode_flag(inode, FI_DO_DEFRAG); ++ clear_inode_flag(inode, FI_SKIP_WRITES); + + err = filemap_fdatawrite(inode->i_mapping); + if (err) + goto out; + } + clear_out: +- clear_inode_flag(inode, FI_DO_DEFRAG); ++ clear_inode_flag(inode, FI_SKIP_WRITES); + out: ++ clear_inode_flag(inode, FI_OPU_WRITE); + inode_unlock(inode); + if (!err) + range->len = (u64)total << PAGE_SHIFT; +diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h +index 04f448ddf49ea..2c1165e8f1283 100644 +--- a/fs/f2fs/segment.h ++++ b/fs/f2fs/segment.h +@@ -665,7 +665,9 @@ static inline int utilization(struct f2fs_sb_info *sbi) + * pages over min_fsync_blocks. (=default option) + * F2FS_IPU_ASYNC - do IPU given by asynchronous write requests. + * F2FS_IPU_NOCACHE - disable IPU bio cache. +- * F2FS_IPUT_DISABLE - disable IPU. (=default option in LFS mode) ++ * F2FS_IPU_HONOR_OPU_WRITE - use OPU write prior to IPU write if inode has ++ * FI_OPU_WRITE flag. ++ * F2FS_IPU_DISABLE - disable IPU. (=default option in LFS mode) + */ + #define DEF_MIN_IPU_UTIL 70 + #define DEF_MIN_FSYNC_BLOCKS 8 +@@ -681,6 +683,7 @@ enum { + F2FS_IPU_FSYNC, + F2FS_IPU_ASYNC, + F2FS_IPU_NOCACHE, ++ F2FS_IPU_HONOR_OPU_WRITE, + }; + + static inline unsigned int curseg_segno(struct f2fs_sb_info *sbi, +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 5c0b2b300aa1b..f8830b00bd26e 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -3935,7 +3935,8 @@ static void f2fs_tuning_parameters(struct f2fs_sb_info *sbi) + F2FS_OPTION(sbi).alloc_mode = ALLOC_MODE_REUSE; + if (f2fs_block_unit_discard(sbi)) + sm_i->dcc_info->discard_granularity = 1; +- sm_i->ipu_policy = 1 << F2FS_IPU_FORCE; ++ sm_i->ipu_policy = 1 << F2FS_IPU_FORCE | ++ 1 << F2FS_IPU_HONOR_OPU_WRITE; + } + + sbi->readdir_ra = 1; +-- +2.39.2 + diff --git a/queue-5.15/i2c-xiic-defer-xiic_wakeup-and-__xiic_start_xfer-in-.patch b/queue-5.15/i2c-xiic-defer-xiic_wakeup-and-__xiic_start_xfer-in-.patch new file mode 100644 index 00000000000..4a1635a2bfc --- /dev/null +++ b/queue-5.15/i2c-xiic-defer-xiic_wakeup-and-__xiic_start_xfer-in-.patch @@ -0,0 +1,112 @@ +From 3a61987c8fe5de5f0c69ddbd913d080cc1566807 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Aug 2021 23:41:42 +0200 +Subject: i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in + xiic_process() + +From: Marek Vasut + +[ Upstream commit 743e227a895923c37a333eb2ebf3e391f00c406d ] + +The __xiic_start_xfer() manipulates the interrupt flags, xiic_wakeup() +may result in return from xiic_xfer() early. Defer both to the end of +the xiic_process() interrupt thread, so that they are executed after +all the other interrupt bits handling completed and once it completely +safe to perform changes to the interrupt bits in the hardware. + +Signed-off-by: Marek Vasut +Acked-by: Michal Simek +Signed-off-by: Wolfram Sang +Stable-dep-of: cb6e45c9a0ad ("i2c: xiic: Don't try to handle more interrupt events after error") +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-xiic.c | 37 ++++++++++++++++++++++++----------- + 1 file changed, 26 insertions(+), 11 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 34b8da949462a..14926b193e0ee 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -375,6 +375,9 @@ static irqreturn_t xiic_process(int irq, void *dev_id) + struct xiic_i2c *i2c = dev_id; + u32 pend, isr, ier; + u32 clr = 0; ++ int xfer_more = 0; ++ int wakeup_req = 0; ++ int wakeup_code = 0; + + /* Get the interrupt Status from the IPIF. There is no clearing of + * interrupts in the IPIF. Interrupts must be cleared at the source. +@@ -411,10 +414,14 @@ static irqreturn_t xiic_process(int irq, void *dev_id) + */ + xiic_reinit(i2c); + +- if (i2c->rx_msg) +- xiic_wakeup(i2c, STATE_ERROR); +- if (i2c->tx_msg) +- xiic_wakeup(i2c, STATE_ERROR); ++ if (i2c->rx_msg) { ++ wakeup_req = 1; ++ wakeup_code = STATE_ERROR; ++ } ++ if (i2c->tx_msg) { ++ wakeup_req = 1; ++ wakeup_code = STATE_ERROR; ++ } + } + if (pend & XIIC_INTR_RX_FULL_MASK) { + /* Receive register/FIFO is full */ +@@ -448,8 +455,7 @@ static irqreturn_t xiic_process(int irq, void *dev_id) + i2c->tx_msg++; + dev_dbg(i2c->adap.dev.parent, + "%s will start next...\n", __func__); +- +- __xiic_start_xfer(i2c); ++ xfer_more = 1; + } + } + } +@@ -463,11 +469,13 @@ static irqreturn_t xiic_process(int irq, void *dev_id) + if (!i2c->tx_msg) + goto out; + +- if ((i2c->nmsgs == 1) && !i2c->rx_msg && +- xiic_tx_space(i2c) == 0) +- xiic_wakeup(i2c, STATE_DONE); ++ wakeup_req = 1; ++ ++ if (i2c->nmsgs == 1 && !i2c->rx_msg && ++ xiic_tx_space(i2c) == 0) ++ wakeup_code = STATE_DONE; + else +- xiic_wakeup(i2c, STATE_ERROR); ++ wakeup_code = STATE_ERROR; + } + if (pend & (XIIC_INTR_TX_EMPTY_MASK | XIIC_INTR_TX_HALF_MASK)) { + /* Transmit register/FIFO is empty or ½ empty */ +@@ -491,7 +499,7 @@ static irqreturn_t xiic_process(int irq, void *dev_id) + if (i2c->nmsgs > 1) { + i2c->nmsgs--; + i2c->tx_msg++; +- __xiic_start_xfer(i2c); ++ xfer_more = 1; + } else { + xiic_irq_dis(i2c, XIIC_INTR_TX_HALF_MASK); + +@@ -509,6 +517,13 @@ static irqreturn_t xiic_process(int irq, void *dev_id) + dev_dbg(i2c->adap.dev.parent, "%s clr: 0x%x\n", __func__, clr); + + xiic_setreg32(i2c, XIIC_IISR_OFFSET, clr); ++ if (xfer_more) ++ __xiic_start_xfer(i2c); ++ if (wakeup_req) ++ xiic_wakeup(i2c, wakeup_code); ++ ++ WARN_ON(xfer_more && wakeup_req); ++ + mutex_unlock(&i2c->lock); + return IRQ_HANDLED; + } +-- +2.39.2 + diff --git a/queue-5.15/i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch b/queue-5.15/i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch new file mode 100644 index 00000000000..8b5670bbcdc --- /dev/null +++ b/queue-5.15/i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch @@ -0,0 +1,60 @@ +From b967864e6290148cd47cab312a4e5a80bc2e92b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 12:25:58 -0600 +Subject: i2c: xiic: Don't try to handle more interrupt events after error + +From: Robert Hancock + +[ Upstream commit cb6e45c9a0ad9e0f8664fd06db0227d185dc76ab ] + +In xiic_process, it is possible that error events such as arbitration +lost or TX error can be raised in conjunction with other interrupt flags +such as TX FIFO empty or bus not busy. Error events result in the +controller being reset and the error returned to the calling request, +but the function could potentially try to keep handling the other +events, such as by writing more messages into the TX FIFO. Since the +transaction has already failed, this is not helpful and will just cause +issues. + +This problem has been present ever since: + +commit 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr") + +which allowed non-error events to be handled after errors, but became +more obvious after: + +commit 743e227a8959 ("i2c: xiic: Defer xiic_wakeup() and +__xiic_start_xfer() in xiic_process()") + +which reworked the code to add a WARN_ON which triggers if both the +xfer_more and wakeup_req flags were set, since this combination is +not supposed to happen, but was occurring in this scenario. + +Skip further interrupt handling after error flags are detected to avoid +this problem. + +Fixes: 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr") +Signed-off-by: Robert Hancock +Acked-by: Andi Shyti +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-xiic.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 14926b193e0ee..9652e8bea2d0b 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -422,6 +422,8 @@ static irqreturn_t xiic_process(int irq, void *dev_id) + wakeup_req = 1; + wakeup_code = STATE_ERROR; + } ++ /* don't try to handle other events */ ++ goto out; + } + if (pend & XIIC_INTR_RX_FULL_MASK) { + /* Receive register/FIFO is full */ +-- +2.39.2 + diff --git a/queue-5.15/ibmvnic-do-not-reset-dql-stats-on-non_fatal-err.patch b/queue-5.15/ibmvnic-do-not-reset-dql-stats-on-non_fatal-err.patch new file mode 100644 index 00000000000..c434e1cfcf9 --- /dev/null +++ b/queue-5.15/ibmvnic-do-not-reset-dql-stats-on-non_fatal-err.patch @@ -0,0 +1,82 @@ +From 34e66c39add5b4fddd3244731c5e62488a1488d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 13:22:44 -0500 +Subject: ibmvnic: Do not reset dql stats on NON_FATAL err + +From: Nick Child + +[ Upstream commit 48538ccb825b05544ec308a509e2cc9c013402db ] + +All ibmvnic resets, make a call to netdev_tx_reset_queue() when +re-opening the device. netdev_tx_reset_queue() resets the num_queued +and num_completed byte counters. These stats are used in Byte Queue +Limit (BQL) algorithms. The difference between these two stats tracks +the number of bytes currently sitting on the physical NIC. ibmvnic +increases the number of queued bytes though calls to +netdev_tx_sent_queue() in the drivers xmit function. When, VIOS reports +that it is done transmitting bytes, the ibmvnic device increases the +number of completed bytes through calls to netdev_tx_completed_queue(). +It is important to note that the driver batches its transmit calls and +num_queued is increased every time that an skb is added to the next +batch, not necessarily when the batch is sent to VIOS for transmission. + +Unlike other reset types, a NON FATAL reset will not flush the sub crq +tx buffers. Therefore, it is possible for the batched skb array to be +partially full. So if there is call to netdev_tx_reset_queue() when +re-opening the device, the value of num_queued (0) would not account +for the skb's that are currently batched. Eventually, when the batch +is sent to VIOS, the call to netdev_tx_completed_queue() would increase +num_completed to a value greater than the num_queued. This causes a +BUG_ON crash: + +ibmvnic 30000002: Firmware reports error, cause: adapter problem. +Starting recovery... +ibmvnic 30000002: tx error 600 +ibmvnic 30000002: tx error 600 +ibmvnic 30000002: tx error 600 +ibmvnic 30000002: tx error 600 +------------[ cut here ]------------ +kernel BUG at lib/dynamic_queue_limits.c:27! +Oops: Exception in kernel mode, sig: 5 +[....] +NIP dql_completed+0x28/0x1c0 +LR ibmvnic_complete_tx.isra.0+0x23c/0x420 [ibmvnic] +Call Trace: +ibmvnic_complete_tx.isra.0+0x3f8/0x420 [ibmvnic] (unreliable) +ibmvnic_interrupt_tx+0x40/0x70 [ibmvnic] +__handle_irq_event_percpu+0x98/0x270 +---[ end trace ]--- + +Therefore, do not reset the dql stats when performing a NON_FATAL reset. + +Fixes: 0d973388185d ("ibmvnic: Introduce xmit_more support using batched subCRQ hcalls") +Signed-off-by: Nick Child +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 8a92c6a6e764f..765dee2e4882e 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1240,7 +1240,14 @@ static int __ibmvnic_open(struct net_device *netdev) + if (prev_state == VNIC_CLOSED) + enable_irq(adapter->tx_scrq[i]->irq); + enable_scrq_irq(adapter, adapter->tx_scrq[i]); +- netdev_tx_reset_queue(netdev_get_tx_queue(netdev, i)); ++ /* netdev_tx_reset_queue will reset dql stats. During NON_FATAL ++ * resets, don't reset the stats because there could be batched ++ * skb's waiting to be sent. If we reset dql stats, we risk ++ * num_completed being greater than num_queued. This will cause ++ * a BUG_ON in dql_completed(). ++ */ ++ if (adapter->reset_reason != VNIC_RESET_NON_FATAL) ++ netdev_tx_reset_queue(netdev_get_tx_queue(netdev, i)); + } + + rc = set_link_state(adapter, IBMVNIC_LOGICAL_LNK_UP); +-- +2.39.2 + diff --git a/queue-5.15/kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch b/queue-5.15/kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch new file mode 100644 index 00000000000..9fe6626417a --- /dev/null +++ b/queue-5.15/kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch @@ -0,0 +1,39 @@ +From 59a4599e4027a0c1c4838a34e9f0a3234f14e757 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 10:40:17 +0800 +Subject: kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR + +From: Muchun Song + +[ Upstream commit 30480b988f88c279752f3202a26b6fee5f586aef ] + +The root->ino_idr is supposed to be protected by kernfs_idr_lock, fix +it. + +Fixes: 488dee96bb62 ("kernfs: allow creating kernfs objects with arbitrary uid/gid") +Signed-off-by: Muchun Song +Acked-by: Tejun Heo +Link: https://lore.kernel.org/r/20230523024017.24851-1-songmuchun@bytedance.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + fs/kernfs/dir.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c +index 90677cfbcf9c2..6a1cb2a182b67 100644 +--- a/fs/kernfs/dir.c ++++ b/fs/kernfs/dir.c +@@ -637,7 +637,9 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, + return kn; + + err_out3: ++ spin_lock(&kernfs_idr_lock); + idr_remove(&root->ino_idr, (u32)kernfs_ino(kn)); ++ spin_unlock(&kernfs_idr_lock); + err_out2: + kmem_cache_free(kernfs_node_cache, kn); + err_out1: +-- +2.39.2 + diff --git a/queue-5.15/kvm-s390-diag-fix-racy-access-of-physical-cpu-number.patch b/queue-5.15/kvm-s390-diag-fix-racy-access-of-physical-cpu-number.patch new file mode 100644 index 00000000000..b3d319c0999 --- /dev/null +++ b/queue-5.15/kvm-s390-diag-fix-racy-access-of-physical-cpu-number.patch @@ -0,0 +1,60 @@ +From 50ba6e152ba2f09c969d4a6c1bed037ede37af40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 10:42:34 +0200 +Subject: KVM: s390/diag: fix racy access of physical cpu number in diag 9c + handler + +From: Christian Borntraeger + +[ Upstream commit 0bc380beb78aa352eadbc21d934dd9606fcee808 ] + +We do check for target CPU == -1, but this might change at the time we +are going to use it. Hold the physical target CPU in a local variable to +avoid out-of-bound accesses to the cpu arrays. + +Cc: Pierre Morel +Fixes: 87e28a15c42c ("KVM: s390: diag9c (directed yield) forwarding") +Reported-by: Marc Hartmayer +Reviewed-by: Nico Boehr +Reviewed-by: Pierre Morel +Signed-off-by: Christian Borntraeger +Signed-off-by: Janosch Frank +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/diag.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/s390/kvm/diag.c b/arch/s390/kvm/diag.c +index 807fa9da1e721..3c65b8258ae67 100644 +--- a/arch/s390/kvm/diag.c ++++ b/arch/s390/kvm/diag.c +@@ -166,6 +166,7 @@ static int diag9c_forwarding_overrun(void) + static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu) + { + struct kvm_vcpu *tcpu; ++ int tcpu_cpu; + int tid; + + tid = vcpu->run->s.regs.gprs[(vcpu->arch.sie_block->ipa & 0xf0) >> 4]; +@@ -181,14 +182,15 @@ static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu) + goto no_yield; + + /* target guest VCPU already running */ +- if (READ_ONCE(tcpu->cpu) >= 0) { ++ tcpu_cpu = READ_ONCE(tcpu->cpu); ++ if (tcpu_cpu >= 0) { + if (!diag9c_forwarding_hz || diag9c_forwarding_overrun()) + goto no_yield; + + /* target host CPU already running */ +- if (!vcpu_is_preempted(tcpu->cpu)) ++ if (!vcpu_is_preempted(tcpu_cpu)) + goto no_yield; +- smp_yield_cpu(tcpu->cpu); ++ smp_yield_cpu(tcpu_cpu); + VCPU_EVENT(vcpu, 5, + "diag time slice end directed to %d: yield forwarded", + tid); +-- +2.39.2 + diff --git a/queue-5.15/kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch b/queue-5.15/kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch new file mode 100644 index 00000000000..5d571432000 --- /dev/null +++ b/queue-5.15/kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch @@ -0,0 +1,74 @@ +From 2ed2f47ec3a586505efd3f46b8de7445c074c969 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 15:54:23 +0100 +Subject: KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes + +From: Nico Boehr + +[ Upstream commit 285cff4c0454340a4dc53f46e67f2cb1c293bd74 ] + +The KVM_S390_GET_CMMA_BITS ioctl may return incorrect values when userspace +specifies a start_gfn outside of memslots. + +This can occur when a VM has multiple memslots with a hole in between: + ++-----+----------+--------+--------+ +| ... | Slot N-1 | | Slot N | ++-----+----------+--------+--------+ + ^ ^ ^ ^ + | | | | +GFN A A+B | | + A+B+C | + A+B+C+D + +When userspace specifies a GFN in [A+B, A+B+C), it would expect to get the +CMMA values of the first dirty page in Slot N. However, userspace may get a +start_gfn of A+B+C+D with a count of 0, hence completely skipping over any +dirty pages in slot N. + +The error is in kvm_s390_next_dirty_cmma(), which assumes +gfn_to_memslot_approx() will return the memslot _below_ the specified GFN +when the specified GFN lies outside a memslot. In reality it may return +either the memslot below or above the specified GFN. + +When a memslot above the specified GFN is returned this happens: + +- ofs is calculated, but since the memslot's base_gfn is larger than the + specified cur_gfn, ofs will underflow to a huge number. +- ofs is passed to find_next_bit(). Since ofs will exceed the memslot's + number of pages, the number of pages in the memslot is returned, + completely skipping over all bits in the memslot userspace would be + interested in. + +Fix this by resetting ofs to zero when a memslot _above_ cur_gfn is +returned (cur_gfn < ms->base_gfn). + +Signed-off-by: Nico Boehr +Reviewed-by: Claudio Imbrenda +Fixes: afdad61615cc ("KVM: s390: Fix storage attributes migration with memory slots") +Message-Id: <20230324145424.293889-2-nrb@linux.ibm.com> +Signed-off-by: Claudio Imbrenda +Signed-off-by: Janosch Frank +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/kvm-s390.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index d7aa442ceaf1c..eb97db59b2365 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -2030,6 +2030,10 @@ static unsigned long kvm_s390_next_dirty_cmma(struct kvm_memslots *slots, + ms = slots->memslots + slotidx; + ofs = 0; + } ++ ++ if (cur_gfn < ms->base_gfn) ++ ofs = 0; ++ + ofs = find_next_bit(kvm_second_dirty_bitmap(ms), ms->npages, ofs); + while ((slotidx > 0) && (ofs >= ms->npages)) { + slotidx--; +-- +2.39.2 + diff --git a/queue-5.15/kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch b/queue-5.15/kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch new file mode 100644 index 00000000000..84f32c333f2 --- /dev/null +++ b/queue-5.15/kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch @@ -0,0 +1,52 @@ +From 1e9721bd09cf098f30a47427bb222be198e75aff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 May 2023 17:42:58 +0200 +Subject: KVM: s390: vsie: fix the length of APCB bitmap + +From: Pierre Morel + +[ Upstream commit 246be7d2720ea9a795b576067ecc5e5c7a1e7848 ] + +bit_and() uses the count of bits as the woking length. +Fix the previous implementation and effectively use +the right bitmap size. + +Fixes: 19fd83a64718 ("KVM: s390: vsie: allow CRYCB FORMAT-1") +Fixes: 56019f9aca22 ("KVM: s390: vsie: Allow CRYCB FORMAT-2") + +Signed-off-by: Pierre Morel +Reviewed-by: Janosch Frank +Link: https://lore.kernel.org/kvm/20230511094719.9691-1-pmorel@linux.ibm.com/ +Signed-off-by: Janosch Frank +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/vsie.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c +index 2c0704f5eb3c6..e07bc0d3df6ff 100644 +--- a/arch/s390/kvm/vsie.c ++++ b/arch/s390/kvm/vsie.c +@@ -169,7 +169,8 @@ static int setup_apcb00(struct kvm_vcpu *vcpu, unsigned long *apcb_s, + sizeof(struct kvm_s390_apcb0))) + return -EFAULT; + +- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb0)); ++ bitmap_and(apcb_s, apcb_s, apcb_h, ++ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb0)); + + return 0; + } +@@ -191,7 +192,8 @@ static int setup_apcb11(struct kvm_vcpu *vcpu, unsigned long *apcb_s, + sizeof(struct kvm_s390_apcb1))) + return -EFAULT; + +- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb1)); ++ bitmap_and(apcb_s, apcb_s, apcb_h, ++ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb1)); + + return 0; + } +-- +2.39.2 + diff --git a/queue-5.15/mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch b/queue-5.15/mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch new file mode 100644 index 00000000000..87a06dbda10 --- /dev/null +++ b/queue-5.15/mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch @@ -0,0 +1,75 @@ +From 68fe1516e979ab0fc6cebe9a316d2bfea9b3b8a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 20:00:22 -0500 +Subject: mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 + +From: Nishanth Menon + +[ Upstream commit 1b712f18c461bd75f018033a15cf381e712806b5 ] + +Sec proxy/message manager data buffer is 60 bytes with the last of the +registers indicating transmission completion. This however poses a bit +of a challenge. + +The backing memory for sec_proxy / message manager is regular memory, +and all sec proxy does is to trigger a burst of all 60 bytes of data +over to the target thread backing ring accelerator. It doesn't do a +memory scrub when it moves data out in the burst. When we transmit +multiple messages, remnants of previous message is also transmitted +which results in some random data being set in TISCI fields of +messages that have been expanded forward. + +The entire concept of backward compatibility hinges on the fact that +the unused message fields remain 0x0 allowing for 0x0 value to be +specially considered when backward compatibility of message extension +is done. + +So, instead of just writing the completion register, we continue +to fill the message buffer up with 0x0 (note: for partial message +involving completion, we already do this). + +This allows us to scale and introduce ABI changes back also work with +other boot stages that may have left data in the internal memory. + +While at this, be consistent and explicit with the data_reg pointer +increment. + +Fixes: aace66b170ce ("mailbox: Introduce TI message manager driver") +Signed-off-by: Nishanth Menon +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/ti-msgmgr.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/mailbox/ti-msgmgr.c b/drivers/mailbox/ti-msgmgr.c +index efb43b0385960..fa71ae837d235 100644 +--- a/drivers/mailbox/ti-msgmgr.c ++++ b/drivers/mailbox/ti-msgmgr.c +@@ -385,14 +385,20 @@ static int ti_msgmgr_send_data(struct mbox_chan *chan, void *data) + /* Ensure all unused data is 0 */ + data_trail &= 0xFFFFFFFF >> (8 * (sizeof(u32) - trail_bytes)); + writel(data_trail, data_reg); +- data_reg++; ++ data_reg += sizeof(u32); + } ++ + /* + * 'data_reg' indicates next register to write. If we did not already + * write on tx complete reg(last reg), we must do so for transmit ++ * In addition, we also need to make sure all intermediate data ++ * registers(if any required), are reset to 0 for TISCI backward ++ * compatibility to be maintained. + */ +- if (data_reg <= qinst->queue_buff_end) +- writel(0, qinst->queue_buff_end); ++ while (data_reg <= qinst->queue_buff_end) { ++ writel(0, data_reg); ++ data_reg += sizeof(u32); ++ } + + return 0; + } +-- +2.39.2 + diff --git a/queue-5.15/md-raid10-fix-the-condition-to-call-bio_end_io_acct.patch b/queue-5.15/md-raid10-fix-the-condition-to-call-bio_end_io_acct.patch new file mode 100644 index 00000000000..ab1c3cbaf85 --- /dev/null +++ b/queue-5.15/md-raid10-fix-the-condition-to-call-bio_end_io_acct.patch @@ -0,0 +1,63 @@ +From deca65742adba92263ad73dc884b663a45815333 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 17:43:20 +0800 +Subject: md/raid10: fix the condition to call bio_end_io_acct() + +From: Li Nan + +[ Upstream commit 125bfc7cd750e68c99f1d446e2c22abea08c237f ] + +/sys/block/[device]/queue/iostats is used to control whether to count io +stat. Write 0 to it will clear queue_flags QUEUE_FLAG_IO_STAT which means +iostats is disabled. If we disable iostats and later endable it, the io +issued during this period will be counted incorrectly, inflight will be +decreased to -1. + + //T1 set iostats + echo 0 > /sys/block/md0/queue/iostats + clear QUEUE_FLAG_IO_STAT + + //T2 issue io + if (QUEUE_FLAG_IO_STAT) -> false + bio_start_io_acct + inflight++ + + echo 1 > /sys/block/md0/queue/iostats + set QUEUE_FLAG_IO_STAT + + //T3 io end + if (QUEUE_FLAG_IO_STAT) -> true + bio_end_io_acct + inflight-- -> -1 + +Also, if iostats is enabled while issuing io but disabled while io end, +inflight will never be decreased. + +Fix it by checking start_time when io end. If start_time is not 0, call +bio_end_io_acct(). + +Fixes: 528bc2cf2fcc ("md/raid10: enable io accounting") +Signed-off-by: Li Nan +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230609094320.2397604-1-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 99607d51d128d..edd3b65c447db 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -297,7 +297,7 @@ static void raid_end_bio_io(struct r10bio *r10_bio) + if (!test_bit(R10BIO_Uptodate, &r10_bio->state)) + bio->bi_status = BLK_STS_IOERR; + +- if (blk_queue_io_stat(bio->bi_bdev->bd_disk->queue)) ++ if (r10_bio->start_time) + bio_end_io_acct(bio, r10_bio->start_time); + bio_endio(bio); + /* +-- +2.39.2 + diff --git a/queue-5.15/media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch b/queue-5.15/media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch new file mode 100644 index 00000000000..4151c434343 --- /dev/null +++ b/queue-5.15/media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch @@ -0,0 +1,42 @@ +From 59ecd8a7ed31e38464c20b55899d07ffa740f067 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 May 2023 12:53:23 +0100 +Subject: media: atomisp: gmin_platform: fix out_len in + gmin_get_config_dsm_var() + +From: Dan Carpenter + +[ Upstream commit 1657f2934daf89e8d9fa4b2697008909eb22c73e ] + +Ideally, strlen(cur->string.pointer) and strlen(out) would be the same. +But this code is using strscpy() to avoid a potential buffer overflow. +So in the same way we should take the strlen() of the smaller string to +avoid a buffer overflow in the caller, gmin_get_var_int(). + +Link: https://lore.kernel.org/r/26124bcd-8132-4483-9d67-225c87d424e8@kili.mountain + +Fixes: 387041cda44e ("media: atomisp: improve sensor detection code to use _DSM table") +Signed-off-by: Dan Carpenter +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c +index cd0a771454da4..2a8ef766b25a4 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c +@@ -1198,7 +1198,7 @@ static int gmin_get_config_dsm_var(struct device *dev, + dev_info(dev, "found _DSM entry for '%s': %s\n", var, + cur->string.pointer); + strscpy(out, cur->string.pointer, *out_len); +- *out_len = strlen(cur->string.pointer); ++ *out_len = strlen(out); + + ACPI_FREE(obj); + return 0; +-- +2.39.2 + diff --git a/queue-5.15/media-cec-i2c-ch7322-also-select-regmap.patch b/queue-5.15/media-cec-i2c-ch7322-also-select-regmap.patch new file mode 100644 index 00000000000..a61799ce625 --- /dev/null +++ b/queue-5.15/media-cec-i2c-ch7322-also-select-regmap.patch @@ -0,0 +1,69 @@ +From 86b4ecbd416280cbd8aceadeff4aadbb4f84ba19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 04:54:35 +0200 +Subject: media: cec: i2c: ch7322: also select REGMAP + +From: Randy Dunlap + +[ Upstream commit 29f96ac23648b2259f42d40703c47dd18fd172ca ] + +Selecting only REGMAP_I2C can leave REGMAP unset, causing build errors, +so also select REGMAP to prevent the build errors. + +../drivers/media/cec/i2c/ch7322.c:158:21: error: variable 'ch7322_regmap' has initializer but incomplete type + 158 | static const struct regmap_config ch7322_regmap = { +../drivers/media/cec/i2c/ch7322.c:159:10: error: 'const struct regmap_config' has no member named 'reg_bits' + 159 | .reg_bits = 8, +../drivers/media/cec/i2c/ch7322.c:159:21: warning: excess elements in struct initializer + 159 | .reg_bits = 8, +../drivers/media/cec/i2c/ch7322.c:160:10: error: 'const struct regmap_config' has no member named 'val_bits' + 160 | .val_bits = 8, +../drivers/media/cec/i2c/ch7322.c:160:21: warning: excess elements in struct initializer + 160 | .val_bits = 8, +../drivers/media/cec/i2c/ch7322.c:161:10: error: 'const struct regmap_config' has no member named 'max_register' + 161 | .max_register = 0x7f, +../drivers/media/cec/i2c/ch7322.c:161:25: warning: excess elements in struct initializer + 161 | .max_register = 0x7f, +../drivers/media/cec/i2c/ch7322.c:162:10: error: 'const struct regmap_config' has no member named 'disable_locking' + 162 | .disable_locking = true, +../drivers/media/cec/i2c/ch7322.c:162:28: warning: excess elements in struct initializer + 162 | .disable_locking = true, +../drivers/media/cec/i2c/ch7322.c: In function 'ch7322_probe': +../drivers/media/cec/i2c/ch7322.c:468:26: error: implicit declaration of function 'devm_regmap_init_i2c' [-Werror=implicit-function-declaration] + 468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap); +../drivers/media/cec/i2c/ch7322.c:468:24: warning: assignment to 'struct regmap *' from 'int' makes pointer from integer without a cast [-Wint-conversion] + 468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap); +../drivers/media/cec/i2c/ch7322.c: At top level: +../drivers/media/cec/i2c/ch7322.c:158:35: error: storage size of 'ch7322_regmap' isn't known + 158 | static const struct regmap_config ch7322_regmap = { + +Link: https://lore.kernel.org/linux-media/20230608025435.29249-1-rdunlap@infradead.org +Fixes: 21b9a47e0ec7 ("media: cec: i2c: ch7322: Add ch7322 CEC controller driver") +Signed-off-by: Randy Dunlap +Cc: Jeff Chase +Cc: Hans Verkuil +Cc: Joe Tessler +Cc: Arnd Bergmann +Cc: Mark Brown +Cc: Masahiro Yamada +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/i2c/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/cec/i2c/Kconfig b/drivers/media/cec/i2c/Kconfig +index 70432a1d69186..d912d143fb312 100644 +--- a/drivers/media/cec/i2c/Kconfig ++++ b/drivers/media/cec/i2c/Kconfig +@@ -5,6 +5,7 @@ + config CEC_CH7322 + tristate "Chrontel CH7322 CEC controller" + depends on I2C ++ select REGMAP + select REGMAP_I2C + select CEC_CORE + help +-- +2.39.2 + diff --git a/queue-5.15/media-i2c-correct-format-propagation-for-st-mipid02.patch b/queue-5.15/media-i2c-correct-format-propagation-for-st-mipid02.patch new file mode 100644 index 00000000000..9f308863ea4 --- /dev/null +++ b/queue-5.15/media-i2c-correct-format-propagation-for-st-mipid02.patch @@ -0,0 +1,47 @@ +From 47cf7a946b0f4d8717fb4e3cf32e3d51ca4a5fdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 May 2023 11:35:46 +0100 +Subject: media: i2c: Correct format propagation for st-mipid02 + +From: Daniel Scally + +[ Upstream commit 306c3190b30d4d6a098888b9d7d4cefaa0ddcb91 ] + +Format propagation in the st-mipid02 driver is incorrect in that when +setting format for V4L2_SUBDEV_FORMAT_TRY on the source pad, the +_active_ rather than _try_ format from the sink pad is propagated. +This causes problems with format negotiation - update the function to +propagate the correct format. + +Fixes: 642bb5e88fed ("media: st-mipid02: MIPID02 CSI-2 to PARALLEL bridge driver") +Signed-off-by: Daniel Scally +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/st-mipid02.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/st-mipid02.c b/drivers/media/i2c/st-mipid02.c +index f630b88cbfaa9..cf55c57a79707 100644 +--- a/drivers/media/i2c/st-mipid02.c ++++ b/drivers/media/i2c/st-mipid02.c +@@ -710,8 +710,13 @@ static void mipid02_set_fmt_source(struct v4l2_subdev *sd, + { + struct mipid02_dev *bridge = to_mipid02_dev(sd); + +- /* source pad mirror active sink pad */ +- format->format = bridge->fmt; ++ /* source pad mirror sink pad */ ++ if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) ++ format->format = bridge->fmt; ++ else ++ format->format = *v4l2_subdev_get_try_format(sd, sd_state, ++ MIPID02_SINK_0); ++ + /* but code may need to be converted */ + format->format.code = serial_to_parallel_code(format->format.code); + +-- +2.39.2 + diff --git a/queue-5.15/media-usb-check-az6007_read-return-value.patch b/queue-5.15/media-usb-check-az6007_read-return-value.patch new file mode 100644 index 00000000000..52dbb57611d --- /dev/null +++ b/queue-5.15/media-usb-check-az6007_read-return-value.patch @@ -0,0 +1,38 @@ +From 3a1bd1afcc075894034ed5fe7160eea9430ad448 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 10:04:49 -0700 +Subject: media: usb: Check az6007_read() return value + +From: Daniil Dulov + +[ Upstream commit fdaca63186f59fc664b346c45b76576624b48e57 ] + +If az6007_read() returns error, there is no sence to continue. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 3af2f4f15a61 ("[media] az6007: Change the az6007 read/write routine parameter") +Signed-off-by: Daniil Dulov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb-v2/az6007.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c +index 62ee09f28a0bc..7524c90f5da61 100644 +--- a/drivers/media/usb/dvb-usb-v2/az6007.c ++++ b/drivers/media/usb/dvb-usb-v2/az6007.c +@@ -202,7 +202,8 @@ static int az6007_rc_query(struct dvb_usb_device *d) + unsigned code; + enum rc_proto proto; + +- az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10); ++ if (az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10) < 0) ++ return -EIO; + + if (st->data[1] == 0x44) + return 0; +-- +2.39.2 + diff --git a/queue-5.15/media-usb-siano-fix-warning-due-to-null-work_func_t-.patch b/queue-5.15/media-usb-siano-fix-warning-due-to-null-work_func_t-.patch new file mode 100644 index 00000000000..f2f7b707245 --- /dev/null +++ b/queue-5.15/media-usb-siano-fix-warning-due-to-null-work_func_t-.patch @@ -0,0 +1,83 @@ +From b75506b583796f373673241c5f4eae9bd6cbc91a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 07:59:32 +0800 +Subject: media: usb: siano: Fix warning due to null work_func_t function + pointer + +From: Duoming Zhou + +[ Upstream commit 6f489a966fbeb0da63d45c2c66a8957eab604bf6 ] + +The previous commit ebad8e731c1c ("media: usb: siano: Fix use after +free bugs caused by do_submit_urb") adds cancel_work_sync() in +smsusb_stop_streaming(). But smsusb_stop_streaming() may be called, +even if the work_struct surb->wq has not been initialized. As a result, +the warning will occur. One of the processes that could lead to warning +is shown below: + +smsusb_probe() + smsusb_init_device() + if (!dev->in_ep || !dev->out_ep || align < 0) { + smsusb_term_device(intf); + smsusb_stop_streaming() + cancel_work_sync(&dev->surbs[i].wq); + __cancel_work_timer() + __flush_work() + if (WARN_ON(!work->func)) // work->func is null + +The log reported by syzbot is shown below: + +WARNING: CPU: 0 PID: 897 at kernel/workqueue.c:3066 __flush_work+0x798/0xa80 kernel/workqueue.c:3063 +Modules linked in: +CPU: 0 PID: 897 Comm: kworker/0:2 Not tainted 6.2.0-rc1-syzkaller #0 +RIP: 0010:__flush_work+0x798/0xa80 kernel/workqueue.c:3066 +... +RSP: 0018:ffffc9000464ebf8 EFLAGS: 00010246 +RAX: 1ffff11002dbb420 RBX: 0000000000000021 RCX: 1ffffffff204fa4e +RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff888016dda0e8 +RBP: ffffc9000464ed98 R08: 0000000000000001 R09: ffffffff90253b2f +R10: 0000000000000001 R11: 0000000000000000 R12: ffff888016dda0e8 +R13: ffff888016dda0e8 R14: ffff888016dda100 R15: 0000000000000001 +FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007ffd4331efe8 CR3: 000000000b48e000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + __cancel_work_timer+0x315/0x460 kernel/workqueue.c:3160 + smsusb_stop_streaming drivers/media/usb/siano/smsusb.c:182 [inline] + smsusb_term_device+0xda/0x2d0 drivers/media/usb/siano/smsusb.c:344 + smsusb_init_device+0x400/0x9ce drivers/media/usb/siano/smsusb.c:419 + smsusb_probe+0xbbd/0xc55 drivers/media/usb/siano/smsusb.c:567 +... + +This patch adds check before cancel_work_sync(). If surb->wq has not +been initialized, the cancel_work_sync() will not be executed. + +Reported-by: syzbot+27b0b464864741b18b99@syzkaller.appspotmail.com +Fixes: ebad8e731c1c ("media: usb: siano: Fix use after free bugs caused by do_submit_urb") +Signed-off-by: Duoming Zhou +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/siano/smsusb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c +index 1babfe6e2c361..5c223b5498b4b 100644 +--- a/drivers/media/usb/siano/smsusb.c ++++ b/drivers/media/usb/siano/smsusb.c +@@ -179,7 +179,8 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev) + + for (i = 0; i < MAX_URBS; i++) { + usb_kill_urb(&dev->surbs[i].urb); +- cancel_work_sync(&dev->surbs[i].wq); ++ if (dev->surbs[i].wq.func) ++ cancel_work_sync(&dev->surbs[i].wq); + + if (dev->surbs[i].cb) { + smscore_putbuffer(dev->coredev, dev->surbs[i].cb); +-- +2.39.2 + diff --git a/queue-5.15/media-venus-helpers-fix-align-of-non-power-of-two.patch b/queue-5.15/media-venus-helpers-fix-align-of-non-power-of-two.patch new file mode 100644 index 00000000000..f323dffa75e --- /dev/null +++ b/queue-5.15/media-venus-helpers-fix-align-of-non-power-of-two.patch @@ -0,0 +1,51 @@ +From b097b170b34945fffdfba39be6f1987ca89a12d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Sep 2020 20:03:01 +0100 +Subject: media: venus: helpers: Fix ALIGN() of non power of two + +From: Rikard Falkeborn + +[ Upstream commit 927e78ac8bc58155316cf6f46026e1912bbbbcfc ] + +ALIGN() expects its second argument to be a power of 2, otherwise +incorrect results are produced for some inputs. The output can be +both larger or smaller than what is expected. + +For example, ALIGN(304, 192) equals 320 instead of 384, and +ALIGN(65, 192) equals 256 instead of 192. + +However, nestling two ALIGN() as is done in this case seem to only +produce results equal to or bigger than the expected result if ALIGN() +had handled non powers of two, and that in turn results in framesizes +that are either the correct size or too large. + +Fortunately, since 192 * 4 / 3 equals 256, it turns out that one ALIGN() +is sufficient. + +Fixes: ab1eda449c6e ("media: venus: vdec: handle 10bit bitstreams") +Signed-off-by: Rikard Falkeborn +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/helpers.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c +index 8012f5c7bf344..ff705d513aae4 100644 +--- a/drivers/media/platform/qcom/venus/helpers.c ++++ b/drivers/media/platform/qcom/venus/helpers.c +@@ -981,8 +981,8 @@ static u32 get_framesize_raw_yuv420_tp10_ubwc(u32 width, u32 height) + u32 extradata = SZ_16K; + u32 size; + +- y_stride = ALIGN(ALIGN(width, 192) * 4 / 3, 256); +- uv_stride = ALIGN(ALIGN(width, 192) * 4 / 3, 256); ++ y_stride = ALIGN(width * 4 / 3, 256); ++ uv_stride = ALIGN(width * 4 / 3, 256); + y_sclines = ALIGN(height, 16); + uv_sclines = ALIGN((height + 1) >> 1, 16); + +-- +2.39.2 + diff --git a/queue-5.15/media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch b/queue-5.15/media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch new file mode 100644 index 00000000000..82ab60952fc --- /dev/null +++ b/queue-5.15/media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch @@ -0,0 +1,62 @@ +From 14d1ac96ac9f9507a2bf8eed22c17642935f6ed5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 15:36:49 +0200 +Subject: media: videodev2.h: Fix struct v4l2_input tuner index comment + +From: Marek Vasut + +[ Upstream commit 26ae58f65e64fa7ba61d64bae752e59e08380c6a ] + +VIDIOC_ENUMINPUT documentation describes the tuner field of +struct v4l2_input as index: + +Documentation/userspace-api/media/v4l/vidioc-enuminput.rst +" +* - __u32 + - ``tuner`` + - Capture devices can have zero or more tuners (RF demodulators). + When the ``type`` is set to ``V4L2_INPUT_TYPE_TUNER`` this is an + RF connector and this field identifies the tuner. It corresponds + to struct :c:type:`v4l2_tuner` field ``index``. For + details on tuners see :ref:`tuner`. +" + +Drivers I could find also use the 'tuner' field as an index, e.g.: +drivers/media/pci/bt8xx/bttv-driver.c bttv_enum_input() +drivers/media/usb/go7007/go7007-v4l2.c vidioc_enum_input() + +However, the UAPI comment claims this field is 'enum v4l2_tuner_type': +include/uapi/linux/videodev2.h + +This field being 'enum v4l2_tuner_type' is unlikely as it seems to be +never used that way in drivers, and documentation confirms it. It seem +this comment got in accidentally in the commit which this patch fixes. +Fix the UAPI comment to stop confusion. + +This was pointed out by Dmitry while reviewing VIDIOC_ENUMINPUT +support for strace. + +Fixes: 6016af82eafc ("[media] v4l2: use __u32 rather than enums in ioctl() structs") +Signed-off-by: Marek Vasut +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + include/uapi/linux/videodev2.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h +index 61c5011dfc13d..f5c6758464f25 100644 +--- a/include/uapi/linux/videodev2.h ++++ b/include/uapi/linux/videodev2.h +@@ -1652,7 +1652,7 @@ struct v4l2_input { + __u8 name[32]; /* Label */ + __u32 type; /* Type of input */ + __u32 audioset; /* Associated audios (bitfield) */ +- __u32 tuner; /* enum v4l2_tuner_type */ ++ __u32 tuner; /* Tuner index */ + v4l2_std_id std; + __u32 status; + __u32 capabilities; +-- +2.39.2 + diff --git a/queue-5.15/mfd-intel-lpss-add-missing-check-for-platform_get_re.patch b/queue-5.15/mfd-intel-lpss-add-missing-check-for-platform_get_re.patch new file mode 100644 index 00000000000..c40f6372c3c --- /dev/null +++ b/queue-5.15/mfd-intel-lpss-add-missing-check-for-platform_get_re.patch @@ -0,0 +1,38 @@ +From 06f16f5a388fa5e6700abcdccab50d498ea263a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 09:48:18 +0800 +Subject: mfd: intel-lpss: Add missing check for platform_get_resource + +From: Jiasheng Jiang + +[ Upstream commit d918e0d5824495a75d00b879118b098fcab36fdb ] + +Add the missing check for platform_get_resource and return error +if it fails. + +Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20230609014818.28475-1-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/mfd/intel-lpss-acpi.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/mfd/intel-lpss-acpi.c b/drivers/mfd/intel-lpss-acpi.c +index f2ea6540a01e1..4c43d71cddbdc 100644 +--- a/drivers/mfd/intel-lpss-acpi.c ++++ b/drivers/mfd/intel-lpss-acpi.c +@@ -148,6 +148,9 @@ static int intel_lpss_acpi_probe(struct platform_device *pdev) + return -ENOMEM; + + info->mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!info->mem) ++ return -ENODEV; ++ + info->irq = platform_get_irq(pdev, 0); + + ret = intel_lpss_probe(&pdev->dev, info); +-- +2.39.2 + diff --git a/queue-5.15/mfd-rt5033-drop-rt5033-battery-sub-device.patch b/queue-5.15/mfd-rt5033-drop-rt5033-battery-sub-device.patch new file mode 100644 index 00000000000..602ae0877fc --- /dev/null +++ b/queue-5.15/mfd-rt5033-drop-rt5033-battery-sub-device.patch @@ -0,0 +1,41 @@ +From afe04a5b83386a59de4da3e9cab48f3a39678aad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 22:57:10 +0200 +Subject: mfd: rt5033: Drop rt5033-battery sub-device + +From: Stephan Gerhold + +[ Upstream commit 43db1344e0f8c1eb687a1d6cd5b0de3009ab66cb ] + +The fuel gauge in the RT5033 PMIC (rt5033-battery) has its own I2C bus +and interrupt lines. Therefore, it is not part of the MFD device +and needs to be specified separately in the device tree. + +Fixes: 0b271258544b ("mfd: rt5033: Add Richtek RT5033 driver core.") +Signed-off-by: Stephan Gerhold +Signed-off-by: Jakob Hauser +Reviewed-by: Linus Walleij +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/6a8a19bc67b5be3732882e8131ad2ffcb546ac03.1684182964.git.jahau@rocketmail.com +Signed-off-by: Sasha Levin +--- + drivers/mfd/rt5033.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/mfd/rt5033.c b/drivers/mfd/rt5033.c +index f1236a9acf304..df095e91e2666 100644 +--- a/drivers/mfd/rt5033.c ++++ b/drivers/mfd/rt5033.c +@@ -41,9 +41,6 @@ static const struct mfd_cell rt5033_devs[] = { + { + .name = "rt5033-charger", + .of_compatible = "richtek,rt5033-charger", +- }, { +- .name = "rt5033-battery", +- .of_compatible = "richtek,rt5033-battery", + }, { + .name = "rt5033-led", + .of_compatible = "richtek,rt5033-led", +-- +2.39.2 + diff --git a/queue-5.15/mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch b/queue-5.15/mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch new file mode 100644 index 00000000000..12422f6c145 --- /dev/null +++ b/queue-5.15/mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch @@ -0,0 +1,38 @@ +From d6ce24d98ffabcacb97dfc0d0d99235e97e63ac4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 11:28:03 +0200 +Subject: mfd: stmfx: Fix error path in stmfx_chip_init + +From: Amelie Delaunay + +[ Upstream commit f592cf624531286f8b52e40dcfc157a5a7fb115c ] + +In error path, disable vdd regulator if it exists, but don't overload ret. +Because if regulator_disable() is successful, stmfx_chip_init will exit +successfully while chip init failed. + +Fixes: 06252ade9156 ("mfd: Add ST Multi-Function eXpander (STMFX) core driver") +Signed-off-by: Amelie Delaunay +Link: https://lore.kernel.org/r/20230609092804.793100-1-amelie.delaunay@foss.st.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/stmfx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c +index e095a39301423..6e1629beb8094 100644 +--- a/drivers/mfd/stmfx.c ++++ b/drivers/mfd/stmfx.c +@@ -387,7 +387,7 @@ static int stmfx_chip_init(struct i2c_client *client) + + err: + if (stmfx->vdd) +- return regulator_disable(stmfx->vdd); ++ regulator_disable(stmfx->vdd); + + return ret; + } +-- +2.39.2 + diff --git a/queue-5.15/mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch b/queue-5.15/mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch new file mode 100644 index 00000000000..660e3cba6ac --- /dev/null +++ b/queue-5.15/mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch @@ -0,0 +1,41 @@ +From 9bf86e63220e6fbd4954093f4fd4fd8d472d76b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 11:28:04 +0200 +Subject: mfd: stmfx: Nullify stmfx->vdd in case of error + +From: Amelie Delaunay + +[ Upstream commit 7c81582c0bccb4757186176f0ee12834597066ad ] + +Nullify stmfx->vdd in case devm_regulator_get_optional() returns an error. +And simplify code by returning an error only if return code is not -ENODEV, +which means there is no vdd regulator and it is not an issue. + +Fixes: d75846ed08e6 ("mfd: stmfx: Fix dev_err_probe() call in stmfx_chip_init()") +Signed-off-by: Amelie Delaunay +Link: https://lore.kernel.org/r/20230609092804.793100-2-amelie.delaunay@foss.st.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/stmfx.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c +index 6e1629beb8094..9852f49c3f881 100644 +--- a/drivers/mfd/stmfx.c ++++ b/drivers/mfd/stmfx.c +@@ -330,9 +330,8 @@ static int stmfx_chip_init(struct i2c_client *client) + stmfx->vdd = devm_regulator_get_optional(&client->dev, "vdd"); + ret = PTR_ERR_OR_ZERO(stmfx->vdd); + if (ret) { +- if (ret == -ENODEV) +- stmfx->vdd = NULL; +- else ++ stmfx->vdd = NULL; ++ if (ret != -ENODEV) + return dev_err_probe(&client->dev, ret, "Failed to get VDD regulator\n"); + } + +-- +2.39.2 + diff --git a/queue-5.15/mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch b/queue-5.15/mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch new file mode 100644 index 00000000000..e090ddbddcf --- /dev/null +++ b/queue-5.15/mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch @@ -0,0 +1,45 @@ +From 406092e067bc68a17ad048f027b10e5ce5772511 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jun 2023 12:43:16 +0200 +Subject: mfd: stmpe: Only disable the regulators if they are enabled + +From: Christophe JAILLET + +[ Upstream commit 104d32bd81f620bb9f67fbf7d1159c414e89f05f ] + +In stmpe_probe(), if some regulator_enable() calls fail, probing continues +and there is only a dev_warn(). + +So, if stmpe_probe() is called the regulator may not be enabled. It is +cleaner to test it before calling regulator_disable() in the remove +function. + +Fixes: 9c9e321455fb ("mfd: stmpe: add optional regulators") +Signed-off-by: Christophe JAILLET +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/8de3aaf297931d655b9ad6aed548f4de8b85425a.1686998575.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/stmpe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c +index 58d09c615e673..743afbe4e99b7 100644 +--- a/drivers/mfd/stmpe.c ++++ b/drivers/mfd/stmpe.c +@@ -1498,9 +1498,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum) + + int stmpe_remove(struct stmpe *stmpe) + { +- if (!IS_ERR(stmpe->vio)) ++ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio)) + regulator_disable(stmpe->vio); +- if (!IS_ERR(stmpe->vcc)) ++ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc)) + regulator_disable(stmpe->vcc); + + __stmpe_disable(stmpe, STMPE_BLOCK_ADC); +-- +2.39.2 + diff --git a/queue-5.15/net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch b/queue-5.15/net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch new file mode 100644 index 00000000000..2380252117d --- /dev/null +++ b/queue-5.15/net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch @@ -0,0 +1,198 @@ +From 3d369ba7d8c1e0bf120050bdbc20c7fc2f81d60a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 19:41:18 +0300 +Subject: net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode + +From: Vladimir Oltean + +[ Upstream commit 6ca3c005d0604e8d2b439366e3923ea58db99641 ] + +According to the synchronization rules for .ndo_get_stats() as seen in +Documentation/networking/netdevices.rst, acquiring a plain spin_lock() +should not be illegal, but the bridge driver implementation makes it so. + +After running these commands, I am being faced with the following +lockdep splat: + +$ ip link add link swp0 name macsec0 type macsec encrypt on && ip link set swp0 up +$ ip link add dev br0 type bridge vlan_filtering 1 && ip link set br0 up +$ ip link set macsec0 master br0 && ip link set macsec0 up + + ======================================================== + WARNING: possible irq lock inversion dependency detected + 6.4.0-04295-g31b577b4bd4a #603 Not tainted + -------------------------------------------------------- + swapper/1/0 just changed the state of lock: + ffff6bd348724cd8 (&br->lock){+.-.}-{3:3}, at: br_forward_delay_timer_expired+0x34/0x198 + but this lock took another, SOFTIRQ-unsafe lock in the past: + (&ocelot->stats_lock){+.+.}-{3:3} + + and interrupts could create inverse lock ordering between them. + + other info that might help us debug this: + Chain exists of: + &br->lock --> &br->hash_lock --> &ocelot->stats_lock + + Possible interrupt unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&ocelot->stats_lock); + local_irq_disable(); + lock(&br->lock); + lock(&br->hash_lock); + + lock(&br->lock); + + *** DEADLOCK *** + +(details about the 3 locks skipped) + +swp0 is instantiated by drivers/net/dsa/ocelot/felix.c, and this +only matters to the extent that its .ndo_get_stats64() method calls +spin_lock(&ocelot->stats_lock). + +Documentation/locking/lockdep-design.rst says: + +| A lock is irq-safe means it was ever used in an irq context, while a lock +| is irq-unsafe means it was ever acquired with irq enabled. + +(...) + +| Furthermore, the following usage based lock dependencies are not allowed +| between any two lock-classes:: +| +| -> +| -> + +Lockdep marks br->hash_lock as softirq-safe, because it is sometimes +taken in softirq context (for example br_fdb_update() which runs in +NET_RX softirq), and when it's not in softirq context it blocks softirqs +by using spin_lock_bh(). + +Lockdep marks ocelot->stats_lock as softirq-unsafe, because it never +blocks softirqs from running, and it is never taken from softirq +context. So it can always be interrupted by softirqs. + +There is a call path through which a function that holds br->hash_lock: +fdb_add_hw_addr() will call a function that acquires ocelot->stats_lock: +ocelot_port_get_stats64(). This can be seen below: + +ocelot_port_get_stats64+0x3c/0x1e0 +felix_get_stats64+0x20/0x38 +dsa_slave_get_stats64+0x3c/0x60 +dev_get_stats+0x74/0x2c8 +rtnl_fill_stats+0x4c/0x150 +rtnl_fill_ifinfo+0x5cc/0x7b8 +rtmsg_ifinfo_build_skb+0xe4/0x150 +rtmsg_ifinfo+0x5c/0xb0 +__dev_notify_flags+0x58/0x200 +__dev_set_promiscuity+0xa0/0x1f8 +dev_set_promiscuity+0x30/0x70 +macsec_dev_change_rx_flags+0x68/0x88 +__dev_set_promiscuity+0x1a8/0x1f8 +__dev_set_rx_mode+0x74/0xa8 +dev_uc_add+0x74/0xa0 +fdb_add_hw_addr+0x68/0xd8 +fdb_add_local+0xc4/0x110 +br_fdb_add_local+0x54/0x88 +br_add_if+0x338/0x4a0 +br_add_slave+0x20/0x38 +do_setlink+0x3a4/0xcb8 +rtnl_newlink+0x758/0x9d0 +rtnetlink_rcv_msg+0x2f0/0x550 +netlink_rcv_skb+0x128/0x148 +rtnetlink_rcv+0x24/0x38 + +the plain English explanation for it is: + +The macsec0 bridge port is created without p->flags & BR_PROMISC, +because it is what br_manage_promisc() decides for a VLAN filtering +bridge with a single auto port. + +As part of the br_add_if() procedure, br_fdb_add_local() is called for +the MAC address of the device, and this results in a call to +dev_uc_add() for macsec0 while the softirq-safe br->hash_lock is taken. + +Because macsec0 does not have IFF_UNICAST_FLT, dev_uc_add() ends up +calling __dev_set_promiscuity() for macsec0, which is propagated by its +implementation, macsec_dev_change_rx_flags(), to the lower device: swp0. +This triggers the call path: + +dev_set_promiscuity(swp0) +-> rtmsg_ifinfo() + -> dev_get_stats() + -> ocelot_port_get_stats64() + +with a calling context that lockdep doesn't like (br->hash_lock held). + +Normally we don't see this, because even though many drivers that can be +bridge ports don't support IFF_UNICAST_FLT, we need a driver that + +(a) doesn't support IFF_UNICAST_FLT, *and* +(b) it forwards the IFF_PROMISC flag to another driver, and +(c) *that* driver implements ndo_get_stats64() using a softirq-unsafe + spinlock. + +Condition (b) is necessary because the first __dev_set_rx_mode() calls +__dev_set_promiscuity() with "bool notify=false", and thus, the +rtmsg_ifinfo() code path won't be entered. + +The same criteria also hold true for DSA switches which don't report +IFF_UNICAST_FLT. When the DSA master uses a spin_lock() in its +ndo_get_stats64() method, the same lockdep splat can be seen. + +I think the deadlock possibility is real, even though I didn't reproduce +it, and I'm thinking of the following situation to support that claim: + +fdb_add_hw_addr() runs on a CPU A, in a context with softirqs locally +disabled and br->hash_lock held, and may end up attempting to acquire +ocelot->stats_lock. + +In parallel, ocelot->stats_lock is currently held by a thread B (say, +ocelot_check_stats_work()), which is interrupted while holding it by a +softirq which attempts to lock br->hash_lock. + +Thread B cannot make progress because br->hash_lock is held by A. Whereas +thread A cannot make progress because ocelot->stats_lock is held by B. + +When taking the issue at face value, the bridge can avoid that problem +by simply making the ports promiscuous from a code path with a saner +calling context (br->hash_lock not held). A bridge port without +IFF_UNICAST_FLT is going to become promiscuous as soon as we call +dev_uc_add() on it (which we do unconditionally), so why not be +preemptive and make it promiscuous right from the beginning, so as to +not be taken by surprise. + +With this, we've broken the links between code that holds br->hash_lock +or br->lock and code that calls into the ndo_change_rx_flags() or +ndo_get_stats64() ops of the bridge port. + +Fixes: 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode.") +Signed-off-by: Vladimir Oltean +Reviewed-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_if.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c +index 4a02f8bb278a1..1f70441cbada8 100644 +--- a/net/bridge/br_if.c ++++ b/net/bridge/br_if.c +@@ -157,8 +157,9 @@ void br_manage_promisc(struct net_bridge *br) + * This lets us disable promiscuous mode and write + * this config to hw. + */ +- if (br->auto_cnt == 0 || +- (br->auto_cnt == 1 && br_auto_port(p))) ++ if ((p->dev->priv_flags & IFF_UNICAST_FLT) && ++ (br->auto_cnt == 0 || ++ (br->auto_cnt == 1 && br_auto_port(p)))) + br_port_clear_promisc(p); + else + br_port_set_promisc(p); +-- +2.39.2 + diff --git a/queue-5.15/net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch b/queue-5.15/net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch new file mode 100644 index 00000000000..f221b654b63 --- /dev/null +++ b/queue-5.15/net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch @@ -0,0 +1,46 @@ +From e54e490e7bae9fed6f4a525a5dba125914bdb1fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 01:05:44 +0300 +Subject: net: dsa: tag_sja1105: fix MAC DA patching from meta frames + +From: Vladimir Oltean + +[ Upstream commit 1dcf6efd5f0c1f4496b3ef7ec5a7db104a53b38c ] + +The SJA1105 manual says that at offset 4 into the meta frame payload we +have "MAC destination byte 2" and at offset 5 we have "MAC destination +byte 1". These are counted from the LSB, so byte 1 is h_dest[ETH_HLEN-2] +aka h_dest[4] and byte 2 is h_dest[ETH_HLEN-3] aka h_dest[3]. + +The sja1105_meta_unpack() function decodes these the other way around, +so a frame with MAC DA 01:80:c2:11:22:33 is received by the network +stack as having 01:80:c2:22:11:33. + +Fixes: e53e18a6fe4d ("net: dsa: sja1105: Receive and decode meta frames") +Signed-off-by: Vladimir Oltean +Reviewed-by: Simon Horman +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dsa/tag_sja1105.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c +index d43feadd5fa6b..a163f535697e1 100644 +--- a/net/dsa/tag_sja1105.c ++++ b/net/dsa/tag_sja1105.c +@@ -100,8 +100,8 @@ static void sja1105_meta_unpack(const struct sk_buff *skb, + * a unified unpacking command for both device series. + */ + packing(buf, &meta->tstamp, 31, 0, 4, UNPACK, 0); +- packing(buf + 4, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0); +- packing(buf + 5, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0); ++ packing(buf + 4, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0); ++ packing(buf + 5, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0); + packing(buf + 6, &meta->source_port, 7, 0, 1, UNPACK, 0); + packing(buf + 7, &meta->switch_id, 7, 0, 1, UNPACK, 0); + } +-- +2.39.2 + diff --git a/queue-5.15/net-dsa-vsc73xx-fix-mtu-configuration.patch b/queue-5.15/net-dsa-vsc73xx-fix-mtu-configuration.patch new file mode 100644 index 00000000000..0a55f671080 --- /dev/null +++ b/queue-5.15/net-dsa-vsc73xx-fix-mtu-configuration.patch @@ -0,0 +1,54 @@ +From 6120626742fb36397bd1202e7aa182b1f4f89166 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 21:43:27 +0200 +Subject: net: dsa: vsc73xx: fix MTU configuration + +From: Pawel Dembicki + +[ Upstream commit 3cf62c8177adb0db9e15c8b898c44f997acf3ebf ] + +Switch in MAXLEN register stores the maximum size of a data frame. +The MTU size is 18 bytes smaller than the frame size. + +The current settings are causing problems with packet forwarding. +This patch fixes the MTU settings to proper values. + +Fixes: fb77ffc6ec86 ("net: dsa: vsc73xx: make the MTU configurable") +Reviewed-by: Linus Walleij +Signed-off-by: Pawel Dembicki +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20230628194327.1765644-1-paweldembicki@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/vitesse-vsc73xx-core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c +index a4b1447ff0557..0c0bc78b1788e 100644 +--- a/drivers/net/dsa/vitesse-vsc73xx-core.c ++++ b/drivers/net/dsa/vitesse-vsc73xx-core.c +@@ -1025,17 +1025,17 @@ static int vsc73xx_change_mtu(struct dsa_switch *ds, int port, int new_mtu) + struct vsc73xx *vsc = ds->priv; + + return vsc73xx_write(vsc, VSC73XX_BLOCK_MAC, port, +- VSC73XX_MAXLEN, new_mtu); ++ VSC73XX_MAXLEN, new_mtu + ETH_HLEN + ETH_FCS_LEN); + } + + /* According to application not "VSC7398 Jumbo Frames" setting +- * up the MTU to 9.6 KB does not affect the performance on standard ++ * up the frame size to 9.6 KB does not affect the performance on standard + * frames. It is clear from the application note that + * "9.6 kilobytes" == 9600 bytes. + */ + static int vsc73xx_get_max_mtu(struct dsa_switch *ds, int port) + { +- return 9600; ++ return 9600 - ETH_HLEN - ETH_FCS_LEN; + } + + static const struct dsa_switch_ops vsc73xx_ds_ops = { +-- +2.39.2 + diff --git a/queue-5.15/net-sched-act_ipt-add-sanity-checks-on-table-name-an.patch b/queue-5.15/net-sched-act_ipt-add-sanity-checks-on-table-name-an.patch new file mode 100644 index 00000000000..f23330fbbac --- /dev/null +++ b/queue-5.15/net-sched-act_ipt-add-sanity-checks-on-table-name-an.patch @@ -0,0 +1,102 @@ +From 2a3b47b329ea7be64065202a99b3223084d625d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 14:38:11 +0200 +Subject: net/sched: act_ipt: add sanity checks on table name and hook + locations + +From: Florian Westphal + +[ Upstream commit b4ee93380b3c891fea996af8d1d3ca0e36ad31f0 ] + +Looks like "tc" hard-codes "mangle" as the only supported table +name, but on kernel side there are no checks. + +This is wrong. Not all xtables targets are safe to call from tc. +E.g. "nat" targets assume skb has a conntrack object assigned to it. +Normally those get called from netfilter nat core which consults the +nat table to obtain the address mapping. + +"tc" userspace either sets PRE or POSTROUTING as hook number, but there +is no validation of this on kernel side, so update netlink policy to +reject bogus numbers. Some targets may assume skb_dst is set for +input/forward hooks, so prevent those from being used. + +act_ipt uses the hook number in two places: +1. the state hook number, this is fine as-is +2. to set par.hook_mask + +The latter is a bit mask, so update the assignment to make +xt_check_target() to the right thing. + +Followup patch adds required checks for the skb/packet headers before +calling the targets evaluation function. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Florian Westphal +Reviewed-by: Simon Horman +Acked-by: Jamal Hadi Salim +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sched/act_ipt.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c +index 2f3d507c24a1f..ebd403f571ea5 100644 +--- a/net/sched/act_ipt.c ++++ b/net/sched/act_ipt.c +@@ -50,7 +50,7 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t, + par.entryinfo = &e; + par.target = target; + par.targinfo = t->data; +- par.hook_mask = hook; ++ par.hook_mask = 1 << hook; + par.family = NFPROTO_IPV4; + + ret = xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false); +@@ -87,7 +87,8 @@ static void tcf_ipt_release(struct tc_action *a) + + static const struct nla_policy ipt_policy[TCA_IPT_MAX + 1] = { + [TCA_IPT_TABLE] = { .type = NLA_STRING, .len = IFNAMSIZ }, +- [TCA_IPT_HOOK] = { .type = NLA_U32 }, ++ [TCA_IPT_HOOK] = NLA_POLICY_RANGE(NLA_U32, NF_INET_PRE_ROUTING, ++ NF_INET_NUMHOOKS), + [TCA_IPT_INDEX] = { .type = NLA_U32 }, + [TCA_IPT_TARG] = { .len = sizeof(struct xt_entry_target) }, + }; +@@ -160,15 +161,27 @@ static int __tcf_ipt_init(struct net *net, unsigned int id, struct nlattr *nla, + return -EEXIST; + } + } ++ ++ err = -EINVAL; + hook = nla_get_u32(tb[TCA_IPT_HOOK]); ++ switch (hook) { ++ case NF_INET_PRE_ROUTING: ++ break; ++ case NF_INET_POST_ROUTING: ++ break; ++ default: ++ goto err1; ++ } ++ ++ if (tb[TCA_IPT_TABLE]) { ++ /* mangle only for now */ ++ if (nla_strcmp(tb[TCA_IPT_TABLE], "mangle")) ++ goto err1; ++ } + +- err = -ENOMEM; +- tname = kmalloc(IFNAMSIZ, GFP_KERNEL); ++ tname = kstrdup("mangle", GFP_KERNEL); + if (unlikely(!tname)) + goto err1; +- if (tb[TCA_IPT_TABLE] == NULL || +- nla_strscpy(tname, tb[TCA_IPT_TABLE], IFNAMSIZ) >= IFNAMSIZ) +- strcpy(tname, "mangle"); + + t = kmemdup(td, td->u.target_size, GFP_KERNEL); + if (unlikely(!t)) +-- +2.39.2 + diff --git a/queue-5.15/net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch b/queue-5.15/net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch new file mode 100644 index 00000000000..ec307f81844 --- /dev/null +++ b/queue-5.15/net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch @@ -0,0 +1,57 @@ +From c15fe17a52a6cb976863d0141c4ff8a71db30f56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 19:08:42 +0800 +Subject: net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX + +From: Lin Ma + +[ Upstream commit 30c45b5361d39b4b793780ffac5538090b9e2eb1 ] + +The attribute TCA_PEDIT_PARMS_EX is not be included in pedit_policy and +one malicious user could fake a TCA_PEDIT_PARMS_EX whose length is +smaller than the intended sizeof(struct tc_pedit). Hence, the +dereference in tcf_pedit_init() could access dirty heap data. + +static int tcf_pedit_init(...) +{ + // ... + pattr = tb[TCA_PEDIT_PARMS]; // TCA_PEDIT_PARMS is included + if (!pattr) + pattr = tb[TCA_PEDIT_PARMS_EX]; // but this is not + + // ... + parm = nla_data(pattr); + + index = parm->index; // parm is able to be smaller than 4 bytes + // and this dereference gets dirty skb_buff + // data created in netlink_sendmsg +} + +This commit adds TCA_PEDIT_PARMS_EX length in pedit_policy which avoid +the above case, just like the TCA_PEDIT_PARMS. + +Fixes: 71d0ed7079df ("net/act_pedit: Support using offset relative to the conventional network headers") +Signed-off-by: Lin Ma +Reviewed-by: Pedro Tammela +Link: https://lore.kernel.org/r/20230703110842.590282-1-linma@zju.edu.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sched/act_pedit.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c +index e77da0545b553..df9ff123a7eec 100644 +--- a/net/sched/act_pedit.c ++++ b/net/sched/act_pedit.c +@@ -29,6 +29,7 @@ static struct tc_action_ops act_pedit_ops; + + static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = { + [TCA_PEDIT_PARMS] = { .len = sizeof(struct tc_pedit) }, ++ [TCA_PEDIT_PARMS_EX] = { .len = sizeof(struct tc_pedit) }, + [TCA_PEDIT_KEYS_EX] = { .type = NLA_NESTED }, + }; + +-- +2.39.2 + diff --git a/queue-5.15/ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch b/queue-5.15/ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch new file mode 100644 index 00000000000..3fd252e660e --- /dev/null +++ b/queue-5.15/ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch @@ -0,0 +1,52 @@ +From f6b6203b8a9f0b4278b32ba610295fe25f2990e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 00:28:07 +0800 +Subject: ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() + +From: Zeng Heng + +[ Upstream commit 3c675ddffb17a8b1e32efad5c983254af18b12c2 ] + +Here is a BUG report from syzbot: + +BUG: KASAN: slab-out-of-bounds in ntfs_list_ea fs/ntfs3/xattr.c:191 [inline] +BUG: KASAN: slab-out-of-bounds in ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710 +Read of size 1 at addr ffff888021acaf3d by task syz-executor128/3632 + +Call Trace: + ntfs_list_ea fs/ntfs3/xattr.c:191 [inline] + ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710 + vfs_listxattr fs/xattr.c:457 [inline] + listxattr+0x293/0x2d0 fs/xattr.c:804 + +Fix the logic of ea_all iteration. When the ea->name_len is 0, +return immediately, or Add2Ptr() would visit invalid memory +in the next loop. + +Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations") +Reported-by: syzbot+9fcea5ef6dc4dc72d334@syzkaller.appspotmail.com +Signed-off-by: Zeng Heng +[almaz.alexandrovich@paragon-software.com: lines of the patch have changed] +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/xattr.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c +index 8847db0159084..63250a5aae0aa 100644 +--- a/fs/ntfs3/xattr.c ++++ b/fs/ntfs3/xattr.c +@@ -178,6 +178,9 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer, + for (ret = 0, off = 0; off < size; off += unpacked_ea_size(ea)) { + ea = Add2Ptr(ea_all, off); + ++ if (!ea->name_len) ++ break; ++ + if (buffer) { + if (ret + ea->name_len + 1 > bytes_per_buffer) { + err = -ERANGE; +-- +2.39.2 + diff --git a/queue-5.15/nvmem-rmem-use-nvmem_devid_auto.patch b/queue-5.15/nvmem-rmem-use-nvmem_devid_auto.patch new file mode 100644 index 00000000000..a1abfcda37a --- /dev/null +++ b/queue-5.15/nvmem-rmem-use-nvmem_devid_auto.patch @@ -0,0 +1,41 @@ +From f5036f7b31524bce7acf31dcee83df7159ce44bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jun 2023 15:03:09 +0100 +Subject: nvmem: rmem: Use NVMEM_DEVID_AUTO + +From: Phil Elwell + +[ Upstream commit 09dd7b993eddb3b48634fd5ddf27aa799785a9ee ] + +It is reasonable to declare multiple nvmem blocks. Unless a unique 'id' +is passed in for each block there may be name clashes. + +Avoid this by using the magic token NVMEM_DEVID_AUTO. + +Fixes: 5a3fa75a4d9c ("nvmem: Add driver to expose reserved memory as nvmem") +Signed-off-by: Phil Elwell +Signed-off-by: Ivan T. Ivanov +Reviewed-by: Stefan Wahren +Signed-off-by: Srinivas Kandagatla +Message-ID: <20230611140330.154222-6-srinivas.kandagatla@linaro.org> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/rmem.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvmem/rmem.c b/drivers/nvmem/rmem.c +index 80cb187f14817..752d0bf4445ee 100644 +--- a/drivers/nvmem/rmem.c ++++ b/drivers/nvmem/rmem.c +@@ -71,6 +71,7 @@ static int rmem_probe(struct platform_device *pdev) + config.dev = dev; + config.priv = priv; + config.name = "rmem"; ++ config.id = NVMEM_DEVID_AUTO; + config.size = mem->size; + config.reg_read = rmem_read; + +-- +2.39.2 + diff --git a/queue-5.15/octeontx-af-fix-hardware-timestamp-configuration.patch b/queue-5.15/octeontx-af-fix-hardware-timestamp-configuration.patch new file mode 100644 index 00000000000..1966bfe7f6a --- /dev/null +++ b/queue-5.15/octeontx-af-fix-hardware-timestamp-configuration.patch @@ -0,0 +1,42 @@ +From eef3c2bbd68ddf093895dcef658f4a16e4a02610 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 09:56:53 +0530 +Subject: octeontx-af: fix hardware timestamp configuration + +From: Hariprasad Kelam + +[ Upstream commit 14bb236b29922c4f57d8c05bfdbcb82677f917c9 ] + +MAC block on CN10K (RPM) supports hardware timestamp configuration. The +previous patch which added timestamp configuration support has a bug. +Though the netdev driver requests to disable timestamp configuration, +the driver is always enabling it. + +This patch fixes the same. + +Fixes: d1489208681d ("octeontx2-af: cn10k: RPM hardware timestamp configuration") +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Goutham +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +index 5ca4ab5770542..f4c7bb6bf053a 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +@@ -724,7 +724,7 @@ static int rvu_cgx_ptp_rx_cfg(struct rvu *rvu, u16 pcifunc, bool enable) + cgxd = rvu_cgx_pdata(cgx_id, rvu); + + mac_ops = get_mac_ops(cgxd); +- mac_ops->mac_enadis_ptp_config(cgxd, lmac_id, true); ++ mac_ops->mac_enadis_ptp_config(cgxd, lmac_id, enable); + /* If PTP is enabled then inform NPC that packets to be + * parsed by this PF will have their data shifted by 8 bytes + * and if PTP is disabled then no shift is required +-- +2.39.2 + diff --git a/queue-5.15/octeontx2-af-add-validation-before-accessing-cgx-and.patch b/queue-5.15/octeontx2-af-add-validation-before-accessing-cgx-and.patch new file mode 100644 index 00000000000..535e9f131a4 --- /dev/null +++ b/queue-5.15/octeontx2-af-add-validation-before-accessing-cgx-and.patch @@ -0,0 +1,63 @@ +From a2c415e84a00ab33d3c02d5a7420f3c4536a7bc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 11:58:44 +0530 +Subject: octeontx2-af: Add validation before accessing cgx and lmac + +From: Hariprasad Kelam + +[ Upstream commit 79ebb53772c95d3a6ae51b3c65f9985fdd430df6 ] + +with the addition of new MAC blocks like CN10K RPM and CN10KB +RPM_USX, LMACs are noncontiguous and CGX blocks are also +noncontiguous. But during RVU driver initialization, the driver +is assuming they are contiguous and trying to access +cgx or lmac with their id which is resulting in kernel panic. + +This patch fixes the issue by adding proper checks. + +[ 23.219150] pc : cgx_lmac_read+0x38/0x70 +[ 23.219154] lr : rvu_program_channels+0x3f0/0x498 +[ 23.223852] sp : ffff000100d6fc80 +[ 23.227158] x29: ffff000100d6fc80 x28: ffff00010009f880 x27: +000000000000005a +[ 23.234288] x26: ffff000102586768 x25: 0000000000002500 x24: +fffffffffff0f000 + +Fixes: 91c6945ea1f9 ("octeontx2-af: cn10k: Add RPM MAC support") +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Goutham +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +index fd0a31bf94fea..8ac95cb7bbb74 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +@@ -167,6 +167,9 @@ void cgx_lmac_write(int cgx_id, int lmac_id, u64 offset, u64 val) + { + struct cgx *cgx_dev = cgx_get_pdata(cgx_id); + ++ /* Software must not access disabled LMAC registers */ ++ if (!is_lmac_valid(cgx_dev, lmac_id)) ++ return; + cgx_write(cgx_dev, lmac_id, offset, val); + } + +@@ -174,6 +177,10 @@ u64 cgx_lmac_read(int cgx_id, int lmac_id, u64 offset) + { + struct cgx *cgx_dev = cgx_get_pdata(cgx_id); + ++ /* Software must not access disabled LMAC registers */ ++ if (!is_lmac_valid(cgx_dev, lmac_id)) ++ return 0; ++ + return cgx_read(cgx_dev, lmac_id, offset); + } + +-- +2.39.2 + diff --git a/queue-5.15/octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch b/queue-5.15/octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch new file mode 100644 index 00000000000..929c2669919 --- /dev/null +++ b/queue-5.15/octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch @@ -0,0 +1,74 @@ +From 73d73151f9a3309c4fdec13394498b26e304f5f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 11:58:43 +0530 +Subject: octeontx2-af: Fix mapping for NIX block from CGX connection + +From: Hariprasad Kelam + +[ Upstream commit 2e7bc57b976bb016c6569a54d95c1b8d88f9450a ] + +Firmware configures NIX block mapping for all MAC blocks. +The current implementation reads the configuration and +creates the mapping between RVU PF and NIX blocks. But +this configuration is only valid for silicons that support +multiple blocks. For all other silicons, all MAC blocks +map to NIX0. + +This patch corrects the mapping by adding a check for the same. + +Fixes: c5a73b632b90 ("octeontx2-af: Map NIX block from CGX connection") +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Goutham +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 11 +++++++++++ + drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 +- + 2 files changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +index fed49d6a178d0..9d517e6dac2f0 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +@@ -23,6 +23,7 @@ + #define PCI_DEVID_OCTEONTX2_LBK 0xA061 + + /* Subsystem Device ID */ ++#define PCI_SUBSYS_DEVID_98XX 0xB100 + #define PCI_SUBSYS_DEVID_96XX 0xB200 + #define PCI_SUBSYS_DEVID_CN10K_A 0xB900 + +@@ -614,6 +615,16 @@ static inline u16 rvu_nix_chan_cpt(struct rvu *rvu, u8 chan) + return rvu->hw->cpt_chan_base + chan; + } + ++static inline bool is_rvu_supports_nix1(struct rvu *rvu) ++{ ++ struct pci_dev *pdev = rvu->pdev; ++ ++ if (pdev->subsystem_device == PCI_SUBSYS_DEVID_98XX) ++ return true; ++ ++ return false; ++} ++ + /* Function Prototypes + * RVU + */ +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +index 28ff67819566c..5ca4ab5770542 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +@@ -111,7 +111,7 @@ static void rvu_map_cgx_nix_block(struct rvu *rvu, int pf, + p2x = cgx_lmac_get_p2x(cgx_id, lmac_id); + /* Firmware sets P2X_SELECT as either NIX0 or NIX1 */ + pfvf->nix_blkaddr = BLKADDR_NIX0; +- if (p2x == CMR_P2X_SEL_NIX1) ++ if (is_rvu_supports_nix1(rvu) && p2x == CMR_P2X_SEL_NIX1) + pfvf->nix_blkaddr = BLKADDR_NIX1; + } + +-- +2.39.2 + diff --git a/queue-5.15/phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch b/queue-5.15/phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch new file mode 100644 index 00000000000..2703bbcbdea --- /dev/null +++ b/queue-5.15/phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch @@ -0,0 +1,40 @@ +From 77aba32917e2fe9473b713a8902f15084035a898 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 10:39:50 +0300 +Subject: phy: tegra: xusb: check return value of devm_kzalloc() + +From: Claudiu Beznea + +[ Upstream commit 44faada0f38fc333d392af04c343b0e23f8f5d81 ] + +devm_kzalloc() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: f67213cee2b3 ("phy: tegra: xusb: Add usb-role-switch support") +Signed-off-by: Claudiu Beznea +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20230531073950.145339-1-claudiu.beznea@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/tegra/xusb.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c +index bdcf217bf3f88..119e2c039225f 100644 +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -669,6 +669,9 @@ static int tegra_xusb_setup_usb_role_switch(struct tegra_xusb_port *port) + port->dev.driver = devm_kzalloc(&port->dev, + sizeof(struct device_driver), + GFP_KERNEL); ++ if (!port->dev.driver) ++ return -ENOMEM; ++ + port->dev.driver->owner = THIS_MODULE; + + port->usb_role_sw = usb_role_switch_register(&port->dev, +-- +2.39.2 + diff --git a/queue-5.15/powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch b/queue-5.15/powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch new file mode 100644 index 00000000000..cae561a037c --- /dev/null +++ b/queue-5.15/powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch @@ -0,0 +1,46 @@ +From 7f7f01ec0d038639b39ac28b8e1e310264ce21b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 22:47:12 -0700 +Subject: powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randy Dunlap + +[ Upstream commit 39f49684036d24af800ff194c33c7b2653c591d7 ] + +In a randconfig with CONFIG_SERIAL_CPM=m and +CONFIG_PPC_EARLY_DEBUG_CPM=y, there is a build error: +ERROR: modpost: "udbg_putc" [drivers/tty/serial/cpm_uart/cpm_uart.ko] undefined! + +Prevent the build error by allowing PPC_EARLY_DEBUG_CPM only when +SERIAL_CPM=y. + +Fixes: c374e00e17f1 ("[POWERPC] Add early debug console for CPM serial ports.") +Signed-off-by: Randy Dunlap +Reviewed-by: Pali Rohár +Reviewed-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230701054714.30512-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/Kconfig.debug | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug +index 192f0ed0097ff..80ce54f59fae8 100644 +--- a/arch/powerpc/Kconfig.debug ++++ b/arch/powerpc/Kconfig.debug +@@ -240,7 +240,7 @@ config PPC_EARLY_DEBUG_40x + + config PPC_EARLY_DEBUG_CPM + bool "Early serial debugging for Freescale CPM-based serial ports" +- depends on SERIAL_CPM ++ depends on SERIAL_CPM=y + help + Select this to enable early debugging for Freescale chips + using a CPM-based serial port. This assumes that the bootwrapper +-- +2.39.2 + diff --git a/queue-5.15/pptp-fix-fib-lookup-calls.patch b/queue-5.15/pptp-fix-fib-lookup-calls.patch new file mode 100644 index 00000000000..31b0adccdee --- /dev/null +++ b/queue-5.15/pptp-fix-fib-lookup-calls.patch @@ -0,0 +1,116 @@ +From ddc1ded69f7b489bb1ed6f1bee4cc613fb455013 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 19:14:46 +0200 +Subject: pptp: Fix fib lookup calls. + +From: Guillaume Nault + +[ Upstream commit 84bef5b6037c15180ef88ac4216dc621d16df1a6 ] + +PPTP uses pppox sockets (struct pppox_sock). These sockets don't embed +an inet_sock structure, so it's invalid to call inet_sk() on them. + +Therefore, the ip_route_output_ports() call in pptp_connect() has two +problems: + + * The tos variable is set with RT_CONN_FLAGS(sk), which calls + inet_sk() on the pppox socket. + + * ip_route_output_ports() tries to retrieve routing flags using + inet_sk_flowi_flags(), which is also going to call inet_sk() on the + pppox socket. + +While PPTP doesn't use inet sockets, it's actually really layered on +top of IP and therefore needs a proper way to do fib lookups. So let's +define pptp_route_output() to get a struct rtable from a pptp socket. +Let's also replace the ip_route_output_ports() call of pptp_xmit() for +consistency. + +In practice, this means that: + + * pptp_connect() sets ->flowi4_tos and ->flowi4_flags to zero instead + of using bits of unrelated struct pppox_sock fields. + + * pptp_xmit() now respects ->sk_mark and ->sk_uid. + + * pptp_xmit() now calls the security_sk_classify_flow() security + hook, thus allowing to set ->flowic_secid. + + * pptp_xmit() now passes the pppox socket to xfrm_lookup_route(). + +Found by code inspection. + +Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)") +Signed-off-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ppp/pptp.c | 31 ++++++++++++++++++++----------- + 1 file changed, 20 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c +index 0fe78826c8fa4..32183f24e63ff 100644 +--- a/drivers/net/ppp/pptp.c ++++ b/drivers/net/ppp/pptp.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -128,6 +129,23 @@ static void del_chan(struct pppox_sock *sock) + spin_unlock(&chan_lock); + } + ++static struct rtable *pptp_route_output(struct pppox_sock *po, ++ struct flowi4 *fl4) ++{ ++ struct sock *sk = &po->sk; ++ struct net *net; ++ ++ net = sock_net(sk); ++ flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark, 0, ++ RT_SCOPE_UNIVERSE, IPPROTO_GRE, 0, ++ po->proto.pptp.dst_addr.sin_addr.s_addr, ++ po->proto.pptp.src_addr.sin_addr.s_addr, ++ 0, 0, sock_net_uid(net, sk)); ++ security_sk_classify_flow(sk, flowi4_to_flowi_common(fl4)); ++ ++ return ip_route_output_flow(net, fl4, sk); ++} ++ + static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb) + { + struct sock *sk = (struct sock *) chan->private; +@@ -151,11 +169,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb) + if (sk_pppox(po)->sk_state & PPPOX_DEAD) + goto tx_error; + +- rt = ip_route_output_ports(net, &fl4, NULL, +- opt->dst_addr.sin_addr.s_addr, +- opt->src_addr.sin_addr.s_addr, +- 0, 0, IPPROTO_GRE, +- RT_TOS(0), sk->sk_bound_dev_if); ++ rt = pptp_route_output(po, &fl4); + if (IS_ERR(rt)) + goto tx_error; + +@@ -438,12 +452,7 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr, + po->chan.private = sk; + po->chan.ops = &pptp_chan_ops; + +- rt = ip_route_output_ports(sock_net(sk), &fl4, sk, +- opt->dst_addr.sin_addr.s_addr, +- opt->src_addr.sin_addr.s_addr, +- 0, 0, +- IPPROTO_GRE, RT_CONN_FLAGS(sk), +- sk->sk_bound_dev_if); ++ rt = pptp_route_output(po, &fl4); + if (IS_ERR(rt)) { + error = -EHOSTUNREACH; + goto end; +-- +2.39.2 + diff --git a/queue-5.15/pwm-ab8500-fix-error-code-in-probe.patch b/queue-5.15/pwm-ab8500-fix-error-code-in-probe.patch new file mode 100644 index 00000000000..22b67a9e603 --- /dev/null +++ b/queue-5.15/pwm-ab8500-fix-error-code-in-probe.patch @@ -0,0 +1,41 @@ +From 0a7e2bcc5dcc34b8d638c9781cbd8098442cb4a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 May 2023 14:07:42 +0300 +Subject: pwm: ab8500: Fix error code in probe() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +[ Upstream commit cdcffafc4d845cc0c6392cba168c7a942734cce7 ] + +This code accidentally return positive EINVAL instead of negative +-EINVAL. + +Fixes: eb41f334589d ("pwm: ab8500: Fix register offset calculation to not depend on probe order") +Signed-off-by: Dan Carpenter +Reviewed-by: Uwe Kleine-König +Reviewed-by: Linus Walleij +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-ab8500.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pwm/pwm-ab8500.c b/drivers/pwm/pwm-ab8500.c +index ad37bc46f2721..5fa91f4cda7ac 100644 +--- a/drivers/pwm/pwm-ab8500.c ++++ b/drivers/pwm/pwm-ab8500.c +@@ -96,7 +96,7 @@ static int ab8500_pwm_probe(struct platform_device *pdev) + int err; + + if (pdev->id < 1 || pdev->id > 31) +- return dev_err_probe(&pdev->dev, EINVAL, "Invalid device id %d\n", pdev->id); ++ return dev_err_probe(&pdev->dev, -EINVAL, "Invalid device id %d\n", pdev->id); + + /* + * Nothing to be done in probe, this is required to get the +-- +2.39.2 + diff --git a/queue-5.15/pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch b/queue-5.15/pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch new file mode 100644 index 00000000000..3838664505a --- /dev/null +++ b/queue-5.15/pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch @@ -0,0 +1,48 @@ +From b658c5d88e1cfcb9fa639138c80e22a77a1fe6f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 14:58:39 +0800 +Subject: pwm: imx-tpm: force 'real_period' to be zero in suspend +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fancy Fang + +[ Upstream commit 661dfb7f46298e53f6c3deaa772fa527aae86193 ] + +During suspend, all the tpm registers will lose values. +So the 'real_period' value of struct 'imx_tpm_pwm_chip' +should be forced to be zero to force the period update +code can be executed after system resume back. + +Signed-off-by: Fancy Fang +Signed-off-by: Clark Wang +Acked-by: Uwe Kleine-König +Fixes: 738a1cfec2ed ("pwm: Add i.MX TPM PWM driver support") +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-imx-tpm.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/pwm/pwm-imx-tpm.c b/drivers/pwm/pwm-imx-tpm.c +index e5e7b7c339a8f..7a53bf51964f2 100644 +--- a/drivers/pwm/pwm-imx-tpm.c ++++ b/drivers/pwm/pwm-imx-tpm.c +@@ -397,6 +397,13 @@ static int __maybe_unused pwm_imx_tpm_suspend(struct device *dev) + if (tpm->enable_count > 0) + return -EBUSY; + ++ /* ++ * Force 'real_period' to be zero to force period update code ++ * can be executed after system resume back, since suspend causes ++ * the period related registers to become their reset values. ++ */ ++ tpm->real_period = 0; ++ + clk_disable_unprepare(tpm->clk); + + return 0; +-- +2.39.2 + diff --git a/queue-5.15/pwm-mtk_disp-fix-the-disable-flow-of-disp_pwm.patch b/queue-5.15/pwm-mtk_disp-fix-the-disable-flow-of-disp_pwm.patch new file mode 100644 index 00000000000..fbd88e61c7c --- /dev/null +++ b/queue-5.15/pwm-mtk_disp-fix-the-disable-flow-of-disp_pwm.patch @@ -0,0 +1,57 @@ +From e5de0dc6dffae3433ccc4b1351c9bc84f8092fe7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 11:10:01 +0800 +Subject: pwm: mtk_disp: Fix the disable flow of disp_pwm +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shuijing Li + +[ Upstream commit bc13d60e4e1e945b34769a4a4c2b172e8552abe5 ] + +There is a flow error in the original mtk_disp_pwm_apply() function. +If this function is called when the clock is disabled, there will be a +chance to operate the disp_pwm register, resulting in disp_pwm exception. +Fix this accordingly. + +Fixes: 888a623db5d0 ("pwm: mtk-disp: Implement atomic API .apply()") +Signed-off-by: Shuijing Li +Reviewed-by: Matthias Brugger +Tested-by: Fei Shao +Acked-by: Uwe Kleine-König +Reviewed-by: Alexandre Mergnat +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-mtk-disp.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c +index 92ba02cfec92f..a581d8adab59c 100644 +--- a/drivers/pwm/pwm-mtk-disp.c ++++ b/drivers/pwm/pwm-mtk-disp.c +@@ -79,14 +79,11 @@ static int mtk_disp_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + if (state->polarity != PWM_POLARITY_NORMAL) + return -EINVAL; + +- if (!state->enabled) { +- mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, mdp->data->enable_mask, +- 0x0); +- +- if (mdp->enabled) { +- clk_disable_unprepare(mdp->clk_mm); +- clk_disable_unprepare(mdp->clk_main); +- } ++ if (!state->enabled && mdp->enabled) { ++ mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, ++ mdp->data->enable_mask, 0x0); ++ clk_disable_unprepare(mdp->clk_mm); ++ clk_disable_unprepare(mdp->clk_main); + + mdp->enabled = false; + return 0; +-- +2.39.2 + diff --git a/queue-5.15/pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch b/queue-5.15/pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch new file mode 100644 index 00000000000..3adf772803d --- /dev/null +++ b/queue-5.15/pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch @@ -0,0 +1,90 @@ +From ad5d8acb6627e9b118783f9dd64c41d3af9da609 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 18:47:36 +0200 +Subject: pwm: sysfs: Do not apply state to already disabled PWMs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Vasut + +[ Upstream commit 38ba83598633373f47951384cfc389181c8d1bed ] + +If the PWM is exported but not enabled, do not call pwm_class_apply_state(). +First of all, in this case, period may still be unconfigured and this would +make pwm_class_apply_state() return -EINVAL, and then suspend would fail. +Second, it makes little sense to apply state onto PWM that is not enabled +before suspend. + +Failing case: +" +$ echo 1 > /sys/class/pwm/pwmchip4/export +$ echo mem > /sys/power/state +... +pwm pwmchip4: PM: dpm_run_callback(): pwm_class_suspend+0x1/0xa8 returns -22 +pwm pwmchip4: PM: failed to suspend: error -22 +PM: Some devices failed to suspend, or early wake event detected +" + +Working case: +" +$ echo 1 > /sys/class/pwm/pwmchip4/export +$ echo 100 > /sys/class/pwm/pwmchip4/pwm1/period +$ echo 10 > /sys/class/pwm/pwmchip4/pwm1/duty_cycle +$ echo mem > /sys/power/state +... +" + +Do not call pwm_class_apply_state() in case the PWM is disabled +to fix this issue. + +Fixes: 7fd4edc57bbae ("pwm: sysfs: Add suspend/resume support") +Signed-off-by: Marek Vasut +Fixes: ef2bf4997f7d ("pwm: Improve args checking in pwm_apply_state()") +Reviewed-by: Brian Norris +Reviewed-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/sysfs.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c +index 9903c3a7ecedc..b8417a8d2ef97 100644 +--- a/drivers/pwm/sysfs.c ++++ b/drivers/pwm/sysfs.c +@@ -424,6 +424,13 @@ static int pwm_class_resume_npwm(struct device *parent, unsigned int npwm) + if (!export) + continue; + ++ /* If pwmchip was not enabled before suspend, do nothing. */ ++ if (!export->suspend.enabled) { ++ /* release lock taken in pwm_class_get_state */ ++ mutex_unlock(&export->lock); ++ continue; ++ } ++ + state.enabled = export->suspend.enabled; + ret = pwm_class_apply_state(export, pwm, &state); + if (ret < 0) +@@ -448,7 +455,17 @@ static int __maybe_unused pwm_class_suspend(struct device *parent) + if (!export) + continue; + ++ /* ++ * If pwmchip was not enabled before suspend, save ++ * state for resume time and do nothing else. ++ */ + export->suspend = state; ++ if (!state.enabled) { ++ /* release lock taken in pwm_class_get_state */ ++ mutex_unlock(&export->lock); ++ continue; ++ } ++ + state.enabled = false; + ret = pwm_class_apply_state(export, pwm, &state); + if (ret < 0) { +-- +2.39.2 + diff --git a/queue-5.15/revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch b/queue-5.15/revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch new file mode 100644 index 00000000000..42fde7919c8 --- /dev/null +++ b/queue-5.15/revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch @@ -0,0 +1,98 @@ +From 94a17b334aaed6c8050e605573dc2487b803855f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 11:30:35 +0200 +Subject: Revert "usb: common: usb-conn-gpio: Set last role to unknown before + initial detection" + +From: Greg Kroah-Hartman + +[ Upstream commit df49f2a0ac4a34c0cb4b5c233fcfa0add644c43c ] + +This reverts commit edd60d24bd858cef165274e4cd6cab43bdc58d15. + +Heikki reports that this should not be a global flag just to work around +one broken driver and should be fixed differently, so revert it. + +Reported-by: Heikki Krogerus +Fixes: edd60d24bd85 ("usb: common: usb-conn-gpio: Set last role to unknown before initial detection") +Link: https://lore.kernel.org/r/ZImE4L3YgABnCIsP@kuha.fi.intel.com +Cc: Prashanth K +Cc: AngeloGioacchino Del Regno +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/cdns3/core.c | 2 -- + drivers/usb/common/usb-conn-gpio.c | 3 --- + drivers/usb/musb/jz4740.c | 2 -- + drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 -- + include/linux/usb/role.h | 1 - + 5 files changed, 10 deletions(-) + +diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c +index 69d2921f2d3b5..dbcdf3b24b477 100644 +--- a/drivers/usb/cdns3/core.c ++++ b/drivers/usb/cdns3/core.c +@@ -252,8 +252,6 @@ static enum usb_role cdns_hw_role_state_machine(struct cdns *cdns) + if (!vbus) + role = USB_ROLE_NONE; + break; +- default: +- break; + } + + dev_dbg(cdns->dev, "role %d -> %d\n", cdns->role, role); +diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c +index 25e2910fdb008..0158148cb0546 100644 +--- a/drivers/usb/common/usb-conn-gpio.c ++++ b/drivers/usb/common/usb-conn-gpio.c +@@ -272,9 +272,6 @@ static int usb_conn_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, info); + +- /* Set last role to unknown before performing the initial detection */ +- info->last_role = USB_ROLE_UNKNOWN; +- + /* Perform initial detection */ + usb_conn_queue_dwork(info, 0); + +diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c +index e3a53b57d3245..5b7d576bf6ee8 100644 +--- a/drivers/usb/musb/jz4740.c ++++ b/drivers/usb/musb/jz4740.c +@@ -91,8 +91,6 @@ static int jz4740_musb_role_switch_set(struct usb_role_switch *sw, + case USB_ROLE_HOST: + atomic_notifier_call_chain(&phy->notifier, USB_EVENT_ID, phy); + break; +- default: +- break; + } + + return 0; +diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c +index 4d6a3dd06e011..5c96e929acea0 100644 +--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c ++++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c +@@ -97,8 +97,6 @@ static int intel_xhci_usb_set_role(struct usb_role_switch *sw, + val |= SW_VBUS_VALID; + drd_config = DRD_CONFIG_STATIC_DEVICE; + break; +- default: +- break; + } + val |= SW_IDPIN_EN; + if (data->enable_sw_switch) { +diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h +index 65e790a28913e..b5deafd91f67b 100644 +--- a/include/linux/usb/role.h ++++ b/include/linux/usb/role.h +@@ -11,7 +11,6 @@ enum usb_role { + USB_ROLE_NONE, + USB_ROLE_HOST, + USB_ROLE_DEVICE, +- USB_ROLE_UNKNOWN, + }; + + typedef int (*usb_role_switch_set_t)(struct usb_role_switch *sw, +-- +2.39.2 + diff --git a/queue-5.15/riscv-move-memblock_allow_resize-after-linear-mappin.patch b/queue-5.15/riscv-move-memblock_allow_resize-after-linear-mappin.patch new file mode 100644 index 00000000000..8edce37783b --- /dev/null +++ b/queue-5.15/riscv-move-memblock_allow_resize-after-linear-mappin.patch @@ -0,0 +1,109 @@ +From fbb371f8437452d23efca60e6b30f35cd8b41d30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 21:19:07 +0800 +Subject: riscv: move memblock_allow_resize() after linear mapping is ready + +From: Woody Zhang + +[ Upstream commit 85fadc0d04119c2fe4a20287767ab904c6d21ba1 ] + +The initial memblock metadata is accessed from kernel image mapping. The +regions arrays need to "reallocated" from memblock and accessed through +linear mapping to cover more memblock regions. So the resizing should +not be allowed until linear mapping is ready. Note that there are +memblock allocations when building linear mapping. + +This patch is similar to 24cc61d8cb5a ("arm64: memblock: don't permit +memblock resizing until linear mapping is up"). + +In following log, many memblock regions are reserved before +create_linear_mapping_page_table(). And then it triggered reallocation +of memblock.reserved.regions and memcpy the old array in kernel image +mapping to the new array in linear mapping which caused a page fault. + +[ 0.000000] memblock_reserve: [0x00000000bf01f000-0x00000000bf01ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf021000-0x00000000bf021fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf023000-0x00000000bf023fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf025000-0x00000000bf025fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf027000-0x00000000bf027fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf029000-0x00000000bf029fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf02b000-0x00000000bf02bfff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf02d000-0x00000000bf02dfff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf02f000-0x00000000bf02ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf030000-0x00000000bf030fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] OF: reserved mem: 0x0000000080000000..0x000000008007ffff (512 KiB) map non-reusable mmode_resv0@80000000 +[ 0.000000] memblock_reserve: [0x00000000bf000000-0x00000000bf001fed] paging_init+0x19a/0x5ae +[ 0.000000] memblock_phys_alloc_range: 4096 bytes align=0x1000 from=0x0000000000000000 max_addr=0x0000000000000000 alloc_pmd_fixmap+0x14/0x1c +[ 0.000000] memblock_reserve: [0x000000017ffff000-0x000000017fffffff] memblock_alloc_range_nid+0xb8/0x128 +[ 0.000000] memblock: reserved is doubled to 256 at [0x000000017fffd000-0x000000017fffe7ff] +[ 0.000000] Unable to handle kernel paging request at virtual address ff600000ffffd000 +[ 0.000000] Oops [#1] +[ 0.000000] Modules linked in: +[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.4.0-rc1-00011-g99a670b2069c #66 +[ 0.000000] Hardware name: riscv-virtio,qemu (DT) +[ 0.000000] epc : __memcpy+0x60/0xf8 +[ 0.000000] ra : memblock_double_array+0x192/0x248 +[ 0.000000] epc : ffffffff8081d214 ra : ffffffff80a3dfc0 sp : ffffffff81403bd0 +[ 0.000000] gp : ffffffff814fbb38 tp : ffffffff8140dac0 t0 : 0000000001600000 +[ 0.000000] t1 : 0000000000000000 t2 : 000000008f001000 s0 : ffffffff81403c60 +[ 0.000000] s1 : ffffffff80c0bc98 a0 : ff600000ffffd000 a1 : ffffffff80c0bcd8 +[ 0.000000] a2 : 0000000000000c00 a3 : ffffffff80c0c8d8 a4 : 0000000080000000 +[ 0.000000] a5 : 0000000000080000 a6 : 0000000000000000 a7 : 0000000080200000 +[ 0.000000] s2 : ff600000ffffd000 s3 : 0000000000002000 s4 : 0000000000000c00 +[ 0.000000] s5 : ffffffff80c0bc60 s6 : ffffffff80c0bcc8 s7 : 0000000000000000 +[ 0.000000] s8 : ffffffff814fd0a8 s9 : 000000017fffe7ff s10: 0000000000000000 +[ 0.000000] s11: 0000000000001000 t3 : 0000000000001000 t4 : 0000000000000000 +[ 0.000000] t5 : 000000008f003000 t6 : ff600000ffffd000 +[ 0.000000] status: 0000000200000100 badaddr: ff600000ffffd000 cause: 000000000000000f +[ 0.000000] [] __memcpy+0x60/0xf8 +[ 0.000000] [] memblock_add_range.isra.14+0x12c/0x162 +[ 0.000000] [] memblock_reserve+0x6e/0x8c +[ 0.000000] [] memblock_alloc_range_nid+0xb8/0x128 +[ 0.000000] [] memblock_phys_alloc_range+0x5e/0x6a +[ 0.000000] [] alloc_pmd_fixmap+0x14/0x1c +[ 0.000000] [] alloc_p4d_fixmap+0xc/0x14 +[ 0.000000] [] create_pgd_mapping+0x98/0x17c +[ 0.000000] [] create_linear_mapping_range.constprop.10+0xe4/0x112 +[ 0.000000] [] paging_init+0x3ec/0x5ae +[ 0.000000] [] setup_arch+0xb2/0x576 +[ 0.000000] [] start_kernel+0x72/0x57e +[ 0.000000] Code: b303 0285 b383 0305 be03 0385 be83 0405 bf03 0485 (b023) 00ef +[ 0.000000] ---[ end trace 0000000000000000 ]--- +[ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task! +[ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]--- + +Fixes: 671f9a3e2e24 ("RISC-V: Setup initial page tables in two stages") +Signed-off-by: Woody Zhang +Tested-by: Song Shuai +Link: https://lore.kernel.org/r/tencent_FBB94CE615C5CCE7701CD39C15CCE0EE9706@qq.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/mm/init.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c +index 0afcd4ae7eed1..f8bfbe983517c 100644 +--- a/arch/riscv/mm/init.c ++++ b/arch/riscv/mm/init.c +@@ -235,7 +235,6 @@ static void __init setup_bootmem(void) + dma_contiguous_reserve(dma32_phys_limit); + if (IS_ENABLED(CONFIG_64BIT)) + hugetlb_cma_reserve(PUD_SHIFT - PAGE_SHIFT); +- memblock_allow_resize(); + } + + #ifdef CONFIG_MMU +@@ -868,6 +867,9 @@ void __init paging_init(void) + { + setup_bootmem(); + setup_vm_final(); ++ ++ /* Depend on that Linear Mapping is ready */ ++ memblock_allow_resize(); + } + + void __init misc_mem_init(void) +-- +2.39.2 + diff --git a/queue-5.15/rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch b/queue-5.15/rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch new file mode 100644 index 00000000000..f307c27800e --- /dev/null +++ b/queue-5.15/rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch @@ -0,0 +1,40 @@ +From 7f15efba9d69f236ea95d1849337c85bdf26c4ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 21:11:42 +0200 +Subject: rtc: st-lpc: Release some resources in st_rtc_probe() in case of + error + +From: Christophe JAILLET + +[ Upstream commit 06c6e1b01d9261f03629cefd1f3553503291e6cf ] + +If an error occurs after clk_get(), the corresponding resources should be +released. + +Use devm_clk_get() to fix it. + +Fixes: b5b2bdfc2893 ("rtc: st: Add new driver for ST's LPC RTC") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/866af6adbc7454a7b4505eb6c28fbdc86ccff39e.1686251455.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-st-lpc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-st-lpc.c b/drivers/rtc/rtc-st-lpc.c +index 0f8e4231098ef..d04d46f9cc65a 100644 +--- a/drivers/rtc/rtc-st-lpc.c ++++ b/drivers/rtc/rtc-st-lpc.c +@@ -228,7 +228,7 @@ static int st_rtc_probe(struct platform_device *pdev) + enable_irq_wake(rtc->irq); + disable_irq(rtc->irq); + +- rtc->clk = clk_get(&pdev->dev, NULL); ++ rtc->clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(rtc->clk)) { + dev_err(&pdev->dev, "Unable to request clock\n"); + return PTR_ERR(rtc->clk); +-- +2.39.2 + diff --git a/queue-5.15/s390-qeth-fix-vipa-deletion.patch b/queue-5.15/s390-qeth-fix-vipa-deletion.patch new file mode 100644 index 00000000000..cb51070c346 --- /dev/null +++ b/queue-5.15/s390-qeth-fix-vipa-deletion.patch @@ -0,0 +1,42 @@ +From 7a6ed78641a330b222f6eb624c7e202bded54c42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 16:41:21 +0200 +Subject: s390/qeth: Fix vipa deletion + +From: Thorsten Winkler + +[ Upstream commit 80de809bd35e2a8999edf9f5aaa2d8de18921f11 ] + +Change boolean parameter of function "qeth_l3_vipa_store" inside the +"qeth_l3_dev_vipa_del4_store" function from "true" to "false" because +"true" is used for adding a virtual ip address and "false" for deleting. + +Fixes: 2390166a6b45 ("s390/qeth: clean up L3 sysfs code") + +Reviewed-by: Alexandra Winter +Reviewed-by: Wenjia Zhang +Signed-off-by: Thorsten Winkler +Signed-off-by: Alexandra Winter +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/s390/net/qeth_l3_sys.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c +index 1082380b21f85..dba9b307020cb 100644 +--- a/drivers/s390/net/qeth_l3_sys.c ++++ b/drivers/s390/net/qeth_l3_sys.c +@@ -652,7 +652,7 @@ static QETH_DEVICE_ATTR(vipa_add4, add4, 0644, + static ssize_t qeth_l3_dev_vipa_del4_store(struct device *dev, + struct device_attribute *attr, const char *buf, size_t count) + { +- return qeth_l3_vipa_store(dev, buf, true, count, QETH_PROT_IPV4); ++ return qeth_l3_vipa_store(dev, buf, false, count, QETH_PROT_IPV4); + } + + static QETH_DEVICE_ATTR(vipa_del4, del4, 0200, NULL, +-- +2.39.2 + diff --git a/queue-5.15/sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch b/queue-5.15/sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch new file mode 100644 index 00000000000..f143e274d28 --- /dev/null +++ b/queue-5.15/sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch @@ -0,0 +1,57 @@ +From 2391683d324abe4c4f2f37976f6a350f668e3d27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 12:03:40 +0000 +Subject: sctp: fix potential deadlock on &net->sctp.addr_wq_lock + +From: Chengfeng Ye + +[ Upstream commit 6feb37b3b06e9049e20dcf7e23998f92c9c5be9a ] + +As &net->sctp.addr_wq_lock is also acquired by the timer +sctp_addr_wq_timeout_handler() in protocal.c, the same lock acquisition +at sctp_auto_asconf_init() seems should disable irq since it is called +from sctp_accept() under process context. + +Possible deadlock scenario: +sctp_accept() + -> sctp_sock_migrate() + -> sctp_auto_asconf_init() + -> spin_lock(&net->sctp.addr_wq_lock) + + -> sctp_addr_wq_timeout_handler() + -> spin_lock_bh(&net->sctp.addr_wq_lock); (deadlock here) + +This flaw was found using an experimental static analysis tool we are +developing for irq-related deadlock. + +The tentative patch fix the potential deadlock by spin_lock_bh(). + +Signed-off-by: Chengfeng Ye +Fixes: 34e5b0118685 ("sctp: delay auto_asconf init until binding the first addr") +Acked-by: Xin Long +Link: https://lore.kernel.org/r/20230627120340.19432-1-dg573847474@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sctp/socket.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index ed35d4a4c5253..f10ad80fd6948 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -362,9 +362,9 @@ static void sctp_auto_asconf_init(struct sctp_sock *sp) + struct net *net = sock_net(&sp->inet.sk); + + if (net->sctp.default_auto_asconf) { +- spin_lock(&net->sctp.addr_wq_lock); ++ spin_lock_bh(&net->sctp.addr_wq_lock); + list_add_tail(&sp->auto_asconf_list, &net->sctp.auto_asconf_splist); +- spin_unlock(&net->sctp.addr_wq_lock); ++ spin_unlock_bh(&net->sctp.addr_wq_lock); + sp->do_auto_asconf = 1; + } + } +-- +2.39.2 + diff --git a/queue-5.15/serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch b/queue-5.15/serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch new file mode 100644 index 00000000000..f91a6bc8840 --- /dev/null +++ b/queue-5.15/serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch @@ -0,0 +1,39 @@ +From e8b83f095191897c4a4d71ae79b38bf70ff869fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 11:37:54 +0206 +Subject: serial: 8250: lock port for stop_rx() in omap8250_irq() + +From: John Ogness + +[ Upstream commit ca73a892c5bec4b08a2fa22b3015e98ed905abb7 ] + +The uarts_ops stop_rx() callback expects that the port->lock is +taken and interrupts are disabled. + +Fixes: 1fe0e1fa3209 ("serial: 8250_omap: Handle optional overrun-throttle-ms property") +Signed-off-by: John Ogness +Reviewed-by: Tony Lindgren +Link: https://lore.kernel.org/r/20230525093159.223817-4-john.ogness@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 6fa0e3ca469a0..28e243312286f 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -655,7 +655,9 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id) + + up->ier = port->serial_in(port, UART_IER); + if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) { ++ spin_lock(&port->lock); + port->ops->stop_rx(port); ++ spin_unlock(&port->lock); + } else { + /* Keep restarting the timer until + * the input overrun subsides. +-- +2.39.2 + diff --git a/queue-5.15/serial-8250-lock-port-for-uart_ier-access-in-omap825.patch b/queue-5.15/serial-8250-lock-port-for-uart_ier-access-in-omap825.patch new file mode 100644 index 00000000000..d6ab41045f2 --- /dev/null +++ b/queue-5.15/serial-8250-lock-port-for-uart_ier-access-in-omap825.patch @@ -0,0 +1,57 @@ +From a299b95389eec3c6825b6c80819f8f529cbe28a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 11:37:58 +0206 +Subject: serial: 8250: lock port for UART_IER access in omap8250_irq() + +From: John Ogness + +[ Upstream commit 25614735a647693c1260f253dc3ab32127697806 ] + +omap8250_irq() accesses UART_IER. This register is modified twice +by each console write (serial8250_console_write()) under the port +lock. omap8250_irq() must also take the port lock to guanentee +synchronized access to UART_IER. + +Since the port lock is already being taken for the stop_rx() callback +and since it is safe to call cancel_delayed_work() while holding the +port lock, simply extend the port lock region to include UART_IER +access. + +Fixes: 1fe0e1fa3209 ("serial: 8250_omap: Handle optional overrun-throttle-ms property") +Signed-off-by: John Ogness +Reviewed-by: Tony Lindgren +Link: https://lore.kernel.org/r/20230525093159.223817-8-john.ogness@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 28e243312286f..de0447c87846b 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -653,17 +653,18 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id) + if ((lsr & UART_LSR_OE) && up->overrun_backoff_time_ms > 0) { + unsigned long delay; + ++ /* Synchronize UART_IER access against the console. */ ++ spin_lock(&port->lock); + up->ier = port->serial_in(port, UART_IER); + if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) { +- spin_lock(&port->lock); + port->ops->stop_rx(port); +- spin_unlock(&port->lock); + } else { + /* Keep restarting the timer until + * the input overrun subsides. + */ + cancel_delayed_work(&up->overrun_backoff); + } ++ spin_unlock(&port->lock); + + delay = msecs_to_jiffies(up->overrun_backoff_time_ms); + schedule_delayed_work(&up->overrun_backoff, delay); +-- +2.39.2 + diff --git a/queue-5.15/serial-8250-omap-fix-freeing-of-resources-on-failed-.patch b/queue-5.15/serial-8250-omap-fix-freeing-of-resources-on-failed-.patch new file mode 100644 index 00000000000..ee263f0e345 --- /dev/null +++ b/queue-5.15/serial-8250-omap-fix-freeing-of-resources-on-failed-.patch @@ -0,0 +1,42 @@ +From 2eecc15fa19943700773d7e563964a80eb9c5489 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 11:20:11 +0300 +Subject: serial: 8250: omap: Fix freeing of resources on failed register +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tony Lindgren + +[ Upstream commit b9ab22c2bc8652324a803b3e2be69838920b4025 ] + +If serial8250_register_8250_port() fails, the SoC can hang as the +deferred PMQoS work will still run as is not flushed and removed. + +Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver") +Signed-off-by: Tony Lindgren +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20230508082014.23083-2-tony@atomide.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 078a7028ee5a2..6fa0e3ca469a0 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -1469,7 +1469,9 @@ static int omap8250_probe(struct platform_device *pdev) + err: + pm_runtime_dont_use_autosuspend(&pdev->dev); + pm_runtime_put_sync(&pdev->dev); ++ flush_work(&priv->qos_work); + pm_runtime_disable(&pdev->dev); ++ cpu_latency_qos_remove_request(&priv->pm_qos_request); + return ret; + } + +-- +2.39.2 + diff --git a/queue-5.15/serial-8250_omap-use-force_suspend-and-resume-for-sy.patch b/queue-5.15/serial-8250_omap-use-force_suspend-and-resume-for-sy.patch new file mode 100644 index 00000000000..71d82fc81ad --- /dev/null +++ b/queue-5.15/serial-8250_omap-use-force_suspend-and-resume-for-sy.patch @@ -0,0 +1,78 @@ +From f5bd394c4b70f5c915d01a8ab74c27e934303ecb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 07:59:19 +0300 +Subject: serial: 8250_omap: Use force_suspend and resume for system suspend + +From: Tony Lindgren + +[ Upstream commit 20a41a62618df85f3a2981008edec5cadd785e0a ] + +We should not rely on autosuspend timeout for system suspend. Instead, +let's use force_suspend and force_resume functions. Otherwise the serial +port controller device may not be idled on suspend. + +As we are doing a register write on suspend to configure the serial port, +we still need to runtime PM resume the port on suspend. + +While at it, let's switch to pm_runtime_resume_and_get() and check for +errors returned. And let's add the missing line break before return to the +suspend function while at it. + +Fixes: 09d8b2bdbc5c ("serial: 8250: omap: Provide ability to enable/disable UART as wakeup source") +Signed-off-by: Tony Lindgren +Tested-by: Dhruva Gole +Message-ID: <20230614045922.4798-1-tony@atomide.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index de0447c87846b..a6b374c026a87 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -1521,25 +1521,35 @@ static int omap8250_suspend(struct device *dev) + { + struct omap8250_priv *priv = dev_get_drvdata(dev); + struct uart_8250_port *up = serial8250_get_port(priv->line); ++ int err; + + serial8250_suspend_port(priv->line); + +- pm_runtime_get_sync(dev); ++ err = pm_runtime_resume_and_get(dev); ++ if (err) ++ return err; + if (!device_may_wakeup(dev)) + priv->wer = 0; + serial_out(up, UART_OMAP_WER, priv->wer); +- pm_runtime_mark_last_busy(dev); +- pm_runtime_put_autosuspend(dev); +- ++ err = pm_runtime_force_suspend(dev); + flush_work(&priv->qos_work); +- return 0; ++ ++ return err; + } + + static int omap8250_resume(struct device *dev) + { + struct omap8250_priv *priv = dev_get_drvdata(dev); ++ int err; + ++ err = pm_runtime_force_resume(dev); ++ if (err) ++ return err; + serial8250_resume_port(priv->line); ++ /* Paired with pm_runtime_resume_and_get() in omap8250_suspend() */ ++ pm_runtime_mark_last_busy(dev); ++ pm_runtime_put_autosuspend(dev); ++ + return 0; + } + #else +-- +2.39.2 + diff --git a/queue-5.15/series b/queue-5.15/series index a24d92f9af3..b208184f0c5 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -267,3 +267,82 @@ block-add-overflow-checks-for-amiga-partition-support.patch block-change-all-__u32-annotations-to-__be32-in-affs_hardblocks.h.patch block-increment-diskseq-on-all-media-change-events.patch sunrpc-fix-uaf-in-svc_tcp_listen_data_ready.patch +w1-w1_therm-fix-locking-behavior-in-convert_t.patch +w1-fix-loop-in-w1_fini.patch +f2fs-introduce-f2fs_ipu_honor_opu_write-ipu-policy.patch +f2fs-do-not-allow-to-defragment-files-have-fi_compre.patch +sh-j2-use-ioremap-to-translate-device-tree-address-i.patch +usb-dwc2-platform-improve-error-reporting-for-proble.patch +usb-dwc2-fix-some-error-handling-paths.patch +serial-8250-omap-fix-freeing-of-resources-on-failed-.patch +clk-qcom-camcc-sc7180-add-parent-dependency-to-all-c.patch +clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch +media-usb-check-az6007_read-return-value.patch +media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch +media-usb-siano-fix-warning-due-to-null-work_func_t-.patch +media-i2c-correct-format-propagation-for-st-mipid02.patch +clk-qcom-reset-allow-specifying-custom-reset-delay.patch +clk-qcom-reset-support-resetting-multiple-bits.patch +clk-qcom-ipq6018-fix-networking-resets.patch +usb-dwc3-qcom-fix-potential-memory-leak.patch +usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch +extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch +extcon-fix-kernel-doc-of-property-capability-fields-.patch +usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch +usb-hide-unused-usbfs_notify_suspend-resume-function.patch +serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch +serial-8250-lock-port-for-uart_ier-access-in-omap825.patch +kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch +coresight-fix-loss-of-connection-info-when-a-module-.patch +mfd-rt5033-drop-rt5033-battery-sub-device.patch +media-venus-helpers-fix-align-of-non-power-of-two.patch +media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch +kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch +usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch +usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch +usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch +usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch +mfd-intel-lpss-add-missing-check-for-platform_get_re.patch +revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch +serial-8250_omap-use-force_suspend-and-resume-for-sy.patch +test_firmware-return-enomem-instead-of-enospc-on-fai.patch +nvmem-rmem-use-nvmem_devid_auto.patch +mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch +mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch +kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch +kvm-s390-diag-fix-racy-access-of-physical-cpu-number.patch +mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch +phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch +pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch +pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch +pwm-ab8500-fix-error-code-in-probe.patch +pwm-mtk_disp-fix-the-disable-flow-of-disp_pwm.patch +md-raid10-fix-the-condition-to-call-bio_end_io_acct.patch +rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch +drm-i915-psr-use-hw.adjusted-mode-when-calculating-i.patch +media-cec-i2c-ch7322-also-select-regmap.patch +sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch +net-sched-act_ipt-add-sanity-checks-on-table-name-an.patch +add-module_firmware-for-firmware_tg357766.patch +ibmvnic-do-not-reset-dql-stats-on-non_fatal-err.patch +net-dsa-vsc73xx-fix-mtu-configuration.patch +spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch +mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch +f2fs-fix-error-path-handling-in-truncate_dnode.patch +octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch +octeontx2-af-add-validation-before-accessing-cgx-and.patch +ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch +powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch +net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch +tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch +xsk-honor-so_bindtodevice-on-bind.patch +net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch +riscv-move-memblock_allow_resize-after-linear-mappin.patch +pptp-fix-fib-lookup-calls.patch +net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch +octeontx-af-fix-hardware-timestamp-configuration.patch +s390-qeth-fix-vipa-deletion.patch +sh-dma-fix-dma-channel-offset-calculation.patch +apparmor-fix-missing-error-check-for-rhashtable_inse.patch +i2c-xiic-defer-xiic_wakeup-and-__xiic_start_xfer-in-.patch +i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch diff --git a/queue-5.15/sh-dma-fix-dma-channel-offset-calculation.patch b/queue-5.15/sh-dma-fix-dma-channel-offset-calculation.patch new file mode 100644 index 00000000000..48c05319de8 --- /dev/null +++ b/queue-5.15/sh-dma-fix-dma-channel-offset-calculation.patch @@ -0,0 +1,103 @@ +From 8fbb8ebdc75d8b75fddff72e688ef26b94a22a2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 May 2023 18:44:50 +0200 +Subject: sh: dma: Fix DMA channel offset calculation + +From: Artur Rojek + +[ Upstream commit e82e47584847129a20b8c9f4a1dcde09374fb0e0 ] + +Various SoCs of the SH3, SH4 and SH4A family, which use this driver, +feature a differing number of DMA channels, which can be distributed +between up to two DMAC modules. The existing implementation fails to +correctly accommodate for all those variations, resulting in wrong +channel offset calculations and leading to kernel panics. + +Rewrite dma_base_addr() in order to properly calculate channel offsets +in a DMAC module. Fix dmaor_read_reg() and dmaor_write_reg(), so that +the correct DMAC module base is selected for the DMAOR register. + +Fixes: 7f47c7189b3e8f19 ("sh: dma: More legacy cpu dma chainsawing.") +Signed-off-by: Artur Rojek +Reviewed-by: Geert Uytterhoeven +Reviewed-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20230527164452.64797-2-contact@artur-rojek.eu +Signed-off-by: John Paul Adrian Glaubitz +Signed-off-by: Sasha Levin +--- + arch/sh/drivers/dma/dma-sh.c | 37 +++++++++++++++++++++++------------- + 1 file changed, 24 insertions(+), 13 deletions(-) + +diff --git a/arch/sh/drivers/dma/dma-sh.c b/arch/sh/drivers/dma/dma-sh.c +index 96c626c2cd0a4..306fba1564e5e 100644 +--- a/arch/sh/drivers/dma/dma-sh.c ++++ b/arch/sh/drivers/dma/dma-sh.c +@@ -18,6 +18,18 @@ + #include + #include + ++/* ++ * Some of the SoCs feature two DMAC modules. In such a case, the channels are ++ * distributed equally among them. ++ */ ++#ifdef SH_DMAC_BASE1 ++#define SH_DMAC_NR_MD_CH (CONFIG_NR_ONCHIP_DMA_CHANNELS / 2) ++#else ++#define SH_DMAC_NR_MD_CH CONFIG_NR_ONCHIP_DMA_CHANNELS ++#endif ++ ++#define SH_DMAC_CH_SZ 0x10 ++ + /* + * Define the default configuration for dual address memory-memory transfer. + * The 0x400 value represents auto-request, external->external. +@@ -29,7 +41,7 @@ static unsigned long dma_find_base(unsigned int chan) + unsigned long base = SH_DMAC_BASE0; + + #ifdef SH_DMAC_BASE1 +- if (chan >= 6) ++ if (chan >= SH_DMAC_NR_MD_CH) + base = SH_DMAC_BASE1; + #endif + +@@ -40,13 +52,13 @@ static unsigned long dma_base_addr(unsigned int chan) + { + unsigned long base = dma_find_base(chan); + +- /* Normalize offset calculation */ +- if (chan >= 9) +- chan -= 6; +- if (chan >= 4) +- base += 0x10; ++ chan = (chan % SH_DMAC_NR_MD_CH) * SH_DMAC_CH_SZ; ++ ++ /* DMAOR is placed inside the channel register space. Step over it. */ ++ if (chan >= DMAOR) ++ base += SH_DMAC_CH_SZ; + +- return base + (chan * 0x10); ++ return base + chan; + } + + #ifdef CONFIG_SH_DMA_IRQ_MULTI +@@ -250,12 +262,11 @@ static int sh_dmac_get_dma_residue(struct dma_channel *chan) + #define NR_DMAOR 1 + #endif + +-/* +- * DMAOR bases are broken out amongst channel groups. DMAOR0 manages +- * channels 0 - 5, DMAOR1 6 - 11 (optional). +- */ +-#define dmaor_read_reg(n) __raw_readw(dma_find_base((n)*6)) +-#define dmaor_write_reg(n, data) __raw_writew(data, dma_find_base(n)*6) ++#define dmaor_read_reg(n) __raw_readw(dma_find_base((n) * \ ++ SH_DMAC_NR_MD_CH) + DMAOR) ++#define dmaor_write_reg(n, data) __raw_writew(data, \ ++ dma_find_base((n) * \ ++ SH_DMAC_NR_MD_CH) + DMAOR) + + static inline int dmaor_reset(int no) + { +-- +2.39.2 + diff --git a/queue-5.15/sh-j2-use-ioremap-to-translate-device-tree-address-i.patch b/queue-5.15/sh-j2-use-ioremap-to-translate-device-tree-address-i.patch new file mode 100644 index 00000000000..19bf5334558 --- /dev/null +++ b/queue-5.15/sh-j2-use-ioremap-to-translate-device-tree-address-i.patch @@ -0,0 +1,44 @@ +From a829c38166e48a97787561fb35a5f18959cebe18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 14:57:41 +0200 +Subject: sh: j2: Use ioremap() to translate device tree address into kernel + memory + +From: John Paul Adrian Glaubitz + +[ Upstream commit bc9d1f0cecd2407cfb2364a7d4be2f52d1d46a9d ] + +Addresses the following warning when building j2_defconfig: + +arch/sh/kernel/cpu/sh2/probe.c: In function 'scan_cache': +arch/sh/kernel/cpu/sh2/probe.c:24:16: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] + 24 | j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node); + | + +Fixes: 5a846abad07f ("sh: add support for J-Core J2 processor") +Reviewed-by: Geert Uytterhoeven +Tested-by: Rob Landley +Signed-off-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20230503125746.331835-1-glaubitz@physik.fu-berlin.de +Signed-off-by: John Paul Adrian Glaubitz +Signed-off-by: Sasha Levin +--- + arch/sh/kernel/cpu/sh2/probe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sh/kernel/cpu/sh2/probe.c b/arch/sh/kernel/cpu/sh2/probe.c +index d342ea08843f6..70a07f4f2142f 100644 +--- a/arch/sh/kernel/cpu/sh2/probe.c ++++ b/arch/sh/kernel/cpu/sh2/probe.c +@@ -21,7 +21,7 @@ static int __init scan_cache(unsigned long node, const char *uname, + if (!of_flat_dt_is_compatible(node, "jcore,cache")) + return 0; + +- j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node); ++ j2_ccr_base = ioremap(of_flat_dt_translate_address(node), 4); + + return 1; + } +-- +2.39.2 + diff --git a/queue-5.15/spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch b/queue-5.15/spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch new file mode 100644 index 00000000000..ad1bc186062 --- /dev/null +++ b/queue-5.15/spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch @@ -0,0 +1,58 @@ +From 57740d044d63883256449407d08aa13a9c8c4ac8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 15:43:05 +0200 +Subject: spi: bcm-qspi: return error if neither hif_mspi nor mspi is available + +From: Jonas Gorski + +[ Upstream commit 7c1f23ad34fcdace50275a6aa1e1969b41c6233f ] + +If neither a "hif_mspi" nor "mspi" resource is present, the driver will +just early exit in probe but still return success. Apart from not doing +anything meaningful, this would then also lead to a null pointer access +on removal, as platform_get_drvdata() would return NULL, which it would +then try to dereference when trying to unregister the spi master. + +Fix this by unconditionally calling devm_ioremap_resource(), as it can +handle a NULL res and will then return a viable ERR_PTR() if we get one. + +The "return 0;" was previously a "goto qspi_resource_err;" where then +ret was returned, but since ret was still initialized to 0 at this place +this was a valid conversion in 63c5395bb7a9 ("spi: bcm-qspi: Fix +use-after-free on unbind"). The issue was not introduced by this commit, +only made more obvious. + +Fixes: fa236a7ef240 ("spi: bcm-qspi: Add Broadcom MSPI driver") +Signed-off-by: Jonas Gorski +Reviewed-by: Kamal Dasu +Link: https://lore.kernel.org/r/20230629134306.95823-1-jonas.gorski@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm-qspi.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c +index bd7c7fc739610..c79797c06cda1 100644 +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -1370,13 +1370,9 @@ int bcm_qspi_probe(struct platform_device *pdev, + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, + "mspi"); + +- if (res) { +- qspi->base[MSPI] = devm_ioremap_resource(dev, res); +- if (IS_ERR(qspi->base[MSPI])) +- return PTR_ERR(qspi->base[MSPI]); +- } else { +- return 0; +- } ++ qspi->base[MSPI] = devm_ioremap_resource(dev, res); ++ if (IS_ERR(qspi->base[MSPI])) ++ return PTR_ERR(qspi->base[MSPI]); + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi"); + if (res) { +-- +2.39.2 + diff --git a/queue-5.15/tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch b/queue-5.15/tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch new file mode 100644 index 00000000000..613e8b4d382 --- /dev/null +++ b/queue-5.15/tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch @@ -0,0 +1,55 @@ +From 4243949f88e3cc302df61162680d52afc74d781c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 16:41:50 +0000 +Subject: tcp: annotate data races in __tcp_oow_rate_limited() + +From: Eric Dumazet + +[ Upstream commit 998127cdb4699b9d470a9348ffe9f1154346be5f ] + +request sockets are lockless, __tcp_oow_rate_limited() could be called +on the same object from different cpus. This is harmless. + +Add READ_ONCE()/WRITE_ONCE() annotations to avoid a KCSAN report. + +Fixes: 4ce7e93cb3fe ("tcp: rate limit ACK sent by SYN_RECV request sockets") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 65f5d07cd83d9..6849094e5e5e8 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -3584,8 +3584,11 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32 + static bool __tcp_oow_rate_limited(struct net *net, int mib_idx, + u32 *last_oow_ack_time) + { +- if (*last_oow_ack_time) { +- s32 elapsed = (s32)(tcp_jiffies32 - *last_oow_ack_time); ++ /* Paired with the WRITE_ONCE() in this function. */ ++ u32 val = READ_ONCE(*last_oow_ack_time); ++ ++ if (val) { ++ s32 elapsed = (s32)(tcp_jiffies32 - val); + + if (0 <= elapsed && + elapsed < READ_ONCE(net->ipv4.sysctl_tcp_invalid_ratelimit)) { +@@ -3594,7 +3597,10 @@ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx, + } + } + +- *last_oow_ack_time = tcp_jiffies32; ++ /* Paired with the prior READ_ONCE() and with itself, ++ * as we might be lockless. ++ */ ++ WRITE_ONCE(*last_oow_ack_time, tcp_jiffies32); + + return false; /* not rate-limited: go ahead, send dupack now! */ + } +-- +2.39.2 + diff --git a/queue-5.15/test_firmware-return-enomem-instead-of-enospc-on-fai.patch b/queue-5.15/test_firmware-return-enomem-instead-of-enospc-on-fai.patch new file mode 100644 index 00000000000..49702f76118 --- /dev/null +++ b/queue-5.15/test_firmware-return-enomem-instead-of-enospc-on-fai.patch @@ -0,0 +1,111 @@ +From 565c4a55b1a3509ff8c50768bb6e97e84e17bd4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 09:08:10 +0200 +Subject: test_firmware: return ENOMEM instead of ENOSPC on failed memory + allocation + +From: Mirsad Goran Todorovac + +[ Upstream commit 7dae593cd226a0bca61201cf85ceb9335cf63682 ] + +In a couple of situations like + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) + return -ENOSPC; + +the error is not actually "No space left on device", but "Out of memory". + +It is semantically correct to return -ENOMEM in all failed kstrndup() +and kzalloc() cases in this driver, as it is not a problem with disk +space, but with kernel memory allocator failing allocation. + +The semantically correct should be: + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) + return -ENOMEM; + +Cc: Dan Carpenter +Cc: Takashi Iwai +Cc: Kees Cook +Cc: "Luis R. Rodriguez" +Cc: Scott Branden +Cc: Hans de Goede +Cc: Brian Norris +Fixes: c92316bf8e948 ("test_firmware: add batched firmware tests") +Fixes: 0a8adf584759c ("test: add firmware_class loader test") +Fixes: 548193cba2a7d ("test_firmware: add support for firmware_request_platform") +Fixes: eb910947c82f9 ("test: firmware_class: add asynchronous request trigger") +Fixes: 061132d2b9c95 ("test_firmware: add test custom fallback trigger") +Fixes: 7feebfa487b92 ("test_firmware: add support for request_firmware_into_buf") +Signed-off-by: Mirsad Goran Todorovac +Reviewed-by: Dan Carpenter +Message-ID: <20230606070808.9300-1-mirsad.todorovac@alu.unizg.hr> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + lib/test_firmware.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/lib/test_firmware.c b/lib/test_firmware.c +index 2a4078946a3fd..b64f87f4f2284 100644 +--- a/lib/test_firmware.c ++++ b/lib/test_firmware.c +@@ -183,7 +183,7 @@ static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp) + { + *dst = kstrndup(name, count, gfp); + if (!*dst) +- return -ENOSPC; ++ return -ENOMEM; + return count; + } + +@@ -606,7 +606,7 @@ static ssize_t trigger_request_store(struct device *dev, + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) +- return -ENOSPC; ++ return -ENOMEM; + + pr_info("loading '%s'\n", name); + +@@ -654,7 +654,7 @@ static ssize_t trigger_request_platform_store(struct device *dev, + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) +- return -ENOSPC; ++ return -ENOMEM; + + pr_info("inserting test platform fw '%s'\n", name); + efi_embedded_fw.name = name; +@@ -707,7 +707,7 @@ static ssize_t trigger_async_request_store(struct device *dev, + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) +- return -ENOSPC; ++ return -ENOMEM; + + pr_info("loading '%s'\n", name); + +@@ -752,7 +752,7 @@ static ssize_t trigger_custom_fallback_store(struct device *dev, + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) +- return -ENOSPC; ++ return -ENOMEM; + + pr_info("loading '%s' using custom fallback mechanism\n", name); + +@@ -803,7 +803,7 @@ static int test_fw_run_batch_request(void *data) + + test_buf = kzalloc(TEST_FIRMWARE_BUF_SIZE, GFP_KERNEL); + if (!test_buf) +- return -ENOSPC; ++ return -ENOMEM; + + if (test_fw_config->partial) + req->rc = request_partial_firmware_into_buf +-- +2.39.2 + diff --git a/queue-5.15/usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch b/queue-5.15/usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch new file mode 100644 index 00000000000..3d6fda7bca2 --- /dev/null +++ b/queue-5.15/usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch @@ -0,0 +1,104 @@ +From 18b0cf4d847cfc56ecde6fbb64b5e2c114fa1253 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 20:11:14 +0530 +Subject: usb: common: usb-conn-gpio: Set last role to unknown before initial + detection + +From: Prashanth K + +[ Upstream commit edd60d24bd858cef165274e4cd6cab43bdc58d15 ] + +Currently if we bootup a device without cable connected, then +usb-conn-gpio won't call set_role() since last_role is same as +current role. This happens because during probe last_role gets +initialised to zero. + +To avoid this, added a new constant in enum usb_role, last_role +is set to USB_ROLE_UNKNOWN before performing initial detection. + +While at it, also handle default case for the usb_role switch +in cdns3, intel-xhci-usb-role-switch & musb/jz4740 to avoid +build warnings. + +Fixes: 4602f3bff266 ("usb: common: add USB GPIO based connection detection driver") +Signed-off-by: Prashanth K +Reviewed-by: AngeloGioacchino Del Regno +Message-ID: <1685544074-17337-1-git-send-email-quic_prashk@quicinc.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/cdns3/core.c | 2 ++ + drivers/usb/common/usb-conn-gpio.c | 3 +++ + drivers/usb/musb/jz4740.c | 2 ++ + drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 ++ + include/linux/usb/role.h | 1 + + 5 files changed, 10 insertions(+) + +diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c +index dbcdf3b24b477..69d2921f2d3b5 100644 +--- a/drivers/usb/cdns3/core.c ++++ b/drivers/usb/cdns3/core.c +@@ -252,6 +252,8 @@ static enum usb_role cdns_hw_role_state_machine(struct cdns *cdns) + if (!vbus) + role = USB_ROLE_NONE; + break; ++ default: ++ break; + } + + dev_dbg(cdns->dev, "role %d -> %d\n", cdns->role, role); +diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c +index 0158148cb0546..25e2910fdb008 100644 +--- a/drivers/usb/common/usb-conn-gpio.c ++++ b/drivers/usb/common/usb-conn-gpio.c +@@ -272,6 +272,9 @@ static int usb_conn_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, info); + ++ /* Set last role to unknown before performing the initial detection */ ++ info->last_role = USB_ROLE_UNKNOWN; ++ + /* Perform initial detection */ + usb_conn_queue_dwork(info, 0); + +diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c +index 5b7d576bf6ee8..e3a53b57d3245 100644 +--- a/drivers/usb/musb/jz4740.c ++++ b/drivers/usb/musb/jz4740.c +@@ -91,6 +91,8 @@ static int jz4740_musb_role_switch_set(struct usb_role_switch *sw, + case USB_ROLE_HOST: + atomic_notifier_call_chain(&phy->notifier, USB_EVENT_ID, phy); + break; ++ default: ++ break; + } + + return 0; +diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c +index 5c96e929acea0..4d6a3dd06e011 100644 +--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c ++++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c +@@ -97,6 +97,8 @@ static int intel_xhci_usb_set_role(struct usb_role_switch *sw, + val |= SW_VBUS_VALID; + drd_config = DRD_CONFIG_STATIC_DEVICE; + break; ++ default: ++ break; + } + val |= SW_IDPIN_EN; + if (data->enable_sw_switch) { +diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h +index b5deafd91f67b..65e790a28913e 100644 +--- a/include/linux/usb/role.h ++++ b/include/linux/usb/role.h +@@ -11,6 +11,7 @@ enum usb_role { + USB_ROLE_NONE, + USB_ROLE_HOST, + USB_ROLE_DEVICE, ++ USB_ROLE_UNKNOWN, + }; + + typedef int (*usb_role_switch_set_t)(struct usb_role_switch *sw, +-- +2.39.2 + diff --git a/queue-5.15/usb-dwc2-fix-some-error-handling-paths.patch b/queue-5.15/usb-dwc2-fix-some-error-handling-paths.patch new file mode 100644 index 00000000000..6c2d82c3f2e --- /dev/null +++ b/queue-5.15/usb-dwc2-fix-some-error-handling-paths.patch @@ -0,0 +1,81 @@ +From 0d342324626a067e042bbdb0294568706ad2b4f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 19:15:08 +0200 +Subject: usb: dwc2: Fix some error handling paths + +From: Christophe JAILLET + +[ Upstream commit ada050c69108bc34be13ecc11f7fad0f20ebadc4 ] + +dwc2_driver_probe() calls dwc2_lowlevel_hw_init() which deassert some reset +lines. +Should an error happen in dwc2_lowlevel_hw_init() after calling +reset_control_deassert() or in the probe after calling +dwc2_lowlevel_hw_init(), the reset lines remain deasserted. + +Add some devm_add_action_or_reset() calls to re-assert the lines if needed. + +Update the remove function accordingly. + +This change is compile-tested only. + +Fixes: 83f8da562f8b ("usb: dwc2: Add reset control to dwc2") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/c64537b5339342bd00f7c2152b8fc23792b9f95a.1683306479.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/platform.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c +index ad8c7de4bfb19..6496bfbd34ed9 100644 +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -205,6 +205,11 @@ int dwc2_lowlevel_hw_disable(struct dwc2_hsotg *hsotg) + return ret; + } + ++static void dwc2_reset_control_assert(void *data) ++{ ++ reset_control_assert(data); ++} ++ + static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg) + { + int i, ret; +@@ -217,6 +222,10 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg) + } + + reset_control_deassert(hsotg->reset); ++ ret = devm_add_action_or_reset(hsotg->dev, dwc2_reset_control_assert, ++ hsotg->reset); ++ if (ret) ++ return ret; + + hsotg->reset_ecc = devm_reset_control_get_optional(hsotg->dev, "dwc2-ecc"); + if (IS_ERR(hsotg->reset_ecc)) { +@@ -226,6 +235,10 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg) + } + + reset_control_deassert(hsotg->reset_ecc); ++ ret = devm_add_action_or_reset(hsotg->dev, dwc2_reset_control_assert, ++ hsotg->reset_ecc); ++ if (ret) ++ return ret; + + /* + * Attempt to find a generic PHY, then look for an old style +@@ -352,9 +365,6 @@ static int dwc2_driver_remove(struct platform_device *dev) + if (hsotg->ll_hw_enabled) + dwc2_lowlevel_hw_disable(hsotg); + +- reset_control_assert(hsotg->reset); +- reset_control_assert(hsotg->reset_ecc); +- + return 0; + } + +-- +2.39.2 + diff --git a/queue-5.15/usb-dwc2-platform-improve-error-reporting-for-proble.patch b/queue-5.15/usb-dwc2-platform-improve-error-reporting-for-proble.patch new file mode 100644 index 00000000000..8cebbe29f2c --- /dev/null +++ b/queue-5.15/usb-dwc2-platform-improve-error-reporting-for-proble.patch @@ -0,0 +1,49 @@ +From 6eb0ab8d0944f0f2d0894da4ff1370facafb2f24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 21:59:14 +0200 +Subject: usb: dwc2: platform: Improve error reporting for problems during + .remove() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 55f223b8b408cbfd85fb1c5b74ab85ccab319a69 ] + +Returning an error value in a platform driver's remove callback results in +a generic error message being emitted by the driver core, but otherwise it +doesn't make a difference. The device goes away anyhow. + +For each case where ret is non-zero the driver already emits an error +message, so suppress the generic error message by returning zero +unconditionally. (Side note: The return value handling was unreliable +anyhow as the value returned by dwc2_exit_hibernation() was overwritten +anyhow if hsotg->in_ppd was non-zero.) + +Signed-off-by: Uwe Kleine-König +Acked-by: Minas Harutyunyan +Link: https://lore.kernel.org/r/20221017195914.1426297-1-u.kleine-koenig@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: ada050c69108 ("usb: dwc2: Fix some error handling paths") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c +index 7a09476e9f193..ad8c7de4bfb19 100644 +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -355,7 +355,7 @@ static int dwc2_driver_remove(struct platform_device *dev) + reset_control_assert(hsotg->reset); + reset_control_assert(hsotg->reset_ecc); + +- return ret; ++ return 0; + } + + /** +-- +2.39.2 + diff --git a/queue-5.15/usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch b/queue-5.15/usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch new file mode 100644 index 00000000000..61824558fe2 --- /dev/null +++ b/queue-5.15/usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch @@ -0,0 +1,51 @@ +From a8f83f5882b903acb10e6a7e2f755febfe7f1508 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jun 2023 15:32:52 +0200 +Subject: usb: dwc3-meson-g12a: Fix an error handling path in + dwc3_meson_g12a_probe() + +From: Christophe JAILLET + +[ Upstream commit 01052b91c9808e3c3b068ae2721cb728ec9aa4c0 ] + +If dwc3_meson_g12a_otg_init() fails, resources allocated by the previous +of_platform_populate() call should be released, as already done in the +error handling path. + +Fixes: 1e355f21d3fb ("usb: dwc3: Add Amlogic A1 DWC3 glue") +Signed-off-by: Christophe JAILLET +Reviewed-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Message-ID: <9d28466de1808ccc756b4cc25fc72c482d133d13.1686403934.git.christophe.jaillet@wanadoo.fr> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-meson-g12a.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/dwc3-meson-g12a.c b/drivers/usb/dwc3/dwc3-meson-g12a.c +index bd814df3bf8b8..8f94bc4a82cf2 100644 +--- a/drivers/usb/dwc3/dwc3-meson-g12a.c ++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c +@@ -805,7 +805,7 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev) + + ret = dwc3_meson_g12a_otg_init(pdev, priv); + if (ret) +- goto err_phys_power; ++ goto err_plat_depopulate; + + pm_runtime_set_active(dev); + pm_runtime_enable(dev); +@@ -813,6 +813,9 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev) + + return 0; + ++err_plat_depopulate: ++ of_platform_depopulate(dev); ++ + err_phys_power: + for (i = 0 ; i < PHY_COUNT ; ++i) + phy_power_off(priv->phys[i]); +-- +2.39.2 + diff --git a/queue-5.15/usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch b/queue-5.15/usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch new file mode 100644 index 00000000000..46c0bbbf8a1 --- /dev/null +++ b/queue-5.15/usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch @@ -0,0 +1,43 @@ +From 37e813ebbeb0c28520dac006b1f1cfc7c40a5a90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 16:56:34 +0200 +Subject: usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe() + +From: Christophe JAILLET + +[ Upstream commit 4a944da707123686d372ec01ea60056902fadf35 ] + +If dwc3_qcom_create_urs_usb_platdev() fails, some resources still need to +be released, as already done in the other error handling path of the +probe. + +Fixes: c25c210f590e ("usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot") +Signed-off-by: Christophe JAILLET +Reviewed-by: Andrew Halaney +Message-ID: +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index 3a81b95accdf4..73c0c381e5d05 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -791,9 +791,10 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + if (IS_ERR_OR_NULL(qcom->urs_usb)) { + dev_err(dev, "failed to create URS USB platdev\n"); + if (!qcom->urs_usb) +- return -ENODEV; ++ ret = -ENODEV; + else +- return PTR_ERR(qcom->urs_usb); ++ ret = PTR_ERR(qcom->urs_usb); ++ goto clk_disable; + } + } + } +-- +2.39.2 + diff --git a/queue-5.15/usb-dwc3-qcom-fix-potential-memory-leak.patch b/queue-5.15/usb-dwc3-qcom-fix-potential-memory-leak.patch new file mode 100644 index 00000000000..66107a1fd1f --- /dev/null +++ b/queue-5.15/usb-dwc3-qcom-fix-potential-memory-leak.patch @@ -0,0 +1,53 @@ +From dd009933245a995ce8e67df4f56ddf43ffd3ad7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 20:25:18 +0300 +Subject: usb: dwc3: qcom: Fix potential memory leak + +From: Vladislav Efanov + +[ Upstream commit 097fb3ee710d4de83b8d4f5589e8ee13e0f0541e ] + +Function dwc3_qcom_probe() allocates memory for resource structure +which is pointed by parent_res pointer. This memory is not +freed. This leads to memory leak. Use stack memory to prevent +memory leak. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI") +Signed-off-by: Vladislav Efanov +Acked-by: Shawn Guo +Link: https://lore.kernel.org/r/20230517172518.442591-1-VEfanov@ispras.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index 28bc7480acf3c..c55f939168fce 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -727,6 +727,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + struct device *dev = &pdev->dev; + struct dwc3_qcom *qcom; + struct resource *res, *parent_res = NULL; ++ struct resource local_res; + int ret, i; + bool ignore_pipe_clk; + +@@ -777,9 +778,8 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + if (np) { + parent_res = res; + } else { +- parent_res = kmemdup(res, sizeof(struct resource), GFP_KERNEL); +- if (!parent_res) +- return -ENOMEM; ++ memcpy(&local_res, res, sizeof(struct resource)); ++ parent_res = &local_res; + + parent_res->start = res->start + + qcom->acpi_pdata->qscratch_base_offset; +-- +2.39.2 + diff --git a/queue-5.15/usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch b/queue-5.15/usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch new file mode 100644 index 00000000000..30b88de39fe --- /dev/null +++ b/queue-5.15/usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch @@ -0,0 +1,50 @@ +From a5ccec709ba7b11a723214fe7a9cf48633ab88cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 17:04:37 +0200 +Subject: usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove() + +From: Christophe JAILLET + +[ Upstream commit 8fd95da2cfb5046c4bb5a3cdc9eb7963ba8b10dd ] + +In the probe, some resources are allocated with +dwc3_qcom_of_register_core() or dwc3_qcom_acpi_register_core(). The +corresponding resources are already coorectly freed in the error handling +path of the probe, but not in the remove function. + +Fix it. + +Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI") +Signed-off-by: Christophe JAILLET +Reviewed-by: Andrew Halaney +Message-ID: +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index c55f939168fce..3a81b95accdf4 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -873,11 +873,15 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + static int dwc3_qcom_remove(struct platform_device *pdev) + { + struct dwc3_qcom *qcom = platform_get_drvdata(pdev); ++ struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + int i; + + device_remove_software_node(&qcom->dwc3->dev); +- of_platform_depopulate(dev); ++ if (np) ++ of_platform_depopulate(&pdev->dev); ++ else ++ platform_device_put(pdev); + + for (i = qcom->num_clocks - 1; i >= 0; i--) { + clk_disable_unprepare(qcom->clks[i]); +-- +2.39.2 + diff --git a/queue-5.15/usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch b/queue-5.15/usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch new file mode 100644 index 00000000000..0d5243a384b --- /dev/null +++ b/queue-5.15/usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch @@ -0,0 +1,56 @@ +From f4ee10efa42ca0eec08e637e5f4b4673ef81d2b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 14:48:37 +0530 +Subject: usb: gadget: u_serial: Add null pointer check in gserial_suspend + +From: Prashanth K + +[ Upstream commit 2f6ecb89fe8feb2b60a53325b0eeb9866d88909a ] + +Consider a case where gserial_disconnect has already cleared +gser->ioport. And if gserial_suspend gets called afterwards, +it will lead to accessing of gser->ioport and thus causing +null pointer dereference. + +Avoid this by adding a null pointer check. Added a static +spinlock to prevent gser->ioport from becoming null after +the newly added null pointer check. + +Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks") +Signed-off-by: Prashanth K +Link: https://lore.kernel.org/r/1683278317-11774-1-git-send-email-quic_prashk@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/u_serial.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c +index 116d2e15e9b22..a8d1e8b192c55 100644 +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -1419,10 +1419,19 @@ EXPORT_SYMBOL_GPL(gserial_disconnect); + + void gserial_suspend(struct gserial *gser) + { +- struct gs_port *port = gser->ioport; ++ struct gs_port *port; + unsigned long flags; + +- spin_lock_irqsave(&port->port_lock, flags); ++ spin_lock_irqsave(&serial_port_lock, flags); ++ port = gser->ioport; ++ ++ if (!port) { ++ spin_unlock_irqrestore(&serial_port_lock, flags); ++ return; ++ } ++ ++ spin_lock(&port->port_lock); ++ spin_unlock(&serial_port_lock); + port->suspended = true; + spin_unlock_irqrestore(&port->port_lock, flags); + } +-- +2.39.2 + diff --git a/queue-5.15/usb-hide-unused-usbfs_notify_suspend-resume-function.patch b/queue-5.15/usb-hide-unused-usbfs_notify_suspend-resume-function.patch new file mode 100644 index 00000000000..db1f23eacc5 --- /dev/null +++ b/queue-5.15/usb-hide-unused-usbfs_notify_suspend-resume-function.patch @@ -0,0 +1,52 @@ +From 3538eba04851d665b849cd6be337b88258ab1681 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 22:17:42 +0200 +Subject: usb: hide unused usbfs_notify_suspend/resume functions + +From: Arnd Bergmann + +[ Upstream commit 8e6bd945e6dde64fbc60ec3fe252164493a8d3a2 ] + +The declaration is in an #ifdef, which causes warnings when building +with 'make W=1' and without CONFIG_PM: + +drivers/usb/core/devio.c:742:6: error: no previous prototype for 'usbfs_notify_suspend' +drivers/usb/core/devio.c:747:6: error: no previous prototype for 'usbfs_notify_resume' + +Use the same #ifdef check around the function definitions to avoid +the warnings and slightly shrink the USB core. + +Fixes: 7794f486ed0b ("usbfs: Add ioctls for runtime power management") +Signed-off-by: Arnd Bergmann +Reviewed-by: Sebastian Reichel +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20230516202103.558301-1-arnd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/core/devio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 5e34986fac96f..5cd0a724b425e 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -735,6 +735,7 @@ static int driver_resume(struct usb_interface *intf) + return 0; + } + ++#ifdef CONFIG_PM + /* The following routines apply to the entire device, not interfaces */ + void usbfs_notify_suspend(struct usb_device *udev) + { +@@ -753,6 +754,7 @@ void usbfs_notify_resume(struct usb_device *udev) + } + mutex_unlock(&usbfs_mutex); + } ++#endif + + struct usb_driver usbfs_driver = { + .name = "usbfs", +-- +2.39.2 + diff --git a/queue-5.15/usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch b/queue-5.15/usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch new file mode 100644 index 00000000000..62ead80d130 --- /dev/null +++ b/queue-5.15/usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch @@ -0,0 +1,43 @@ +From 9eb79adacb6373a150cab31148f3dc1c561c9e57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 22:08:31 +0800 +Subject: usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() + +From: Li Yang + +[ Upstream commit 342161c11403ea00e9febc16baab1d883d589d04 ] + +Smatch reports: +drivers/usb/phy/phy-tahvo.c: tahvo_usb_probe() +warn: missing unwind goto? + +After geting irq, if ret < 0, it will return without error handling to +free memory. +Just add error handling to fix this problem. + +Fixes: 0d45a1373e66 ("usb: phy: tahvo: add IRQ check") +Signed-off-by: Li Yang +Reviewed-by: Dongliang Mu +Link: https://lore.kernel.org/r/20230420140832.9110-1-lidaxian@hust.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-tahvo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c +index a3e043e3e4aae..d0672b6712985 100644 +--- a/drivers/usb/phy/phy-tahvo.c ++++ b/drivers/usb/phy/phy-tahvo.c +@@ -395,7 +395,7 @@ static int tahvo_usb_probe(struct platform_device *pdev) + + tu->irq = ret = platform_get_irq(pdev, 0); + if (ret < 0) +- return ret; ++ goto err_remove_phy; + ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt, + IRQF_ONESHOT, + "tahvo-vbus", tu); +-- +2.39.2 + diff --git a/queue-5.15/w1-fix-loop-in-w1_fini.patch b/queue-5.15/w1-fix-loop-in-w1_fini.patch new file mode 100644 index 00000000000..aae3ceec147 --- /dev/null +++ b/queue-5.15/w1-fix-loop-in-w1_fini.patch @@ -0,0 +1,43 @@ +From 7467b3c8ff8b8bee6f3d70289ae59ba027eff344 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 17:17:45 +0300 +Subject: w1: fix loop in w1_fini() + +From: Dan Carpenter + +[ Upstream commit 83f3fcf96fcc7e5405b37d9424c7ef26bfa203f8 ] + +The __w1_remove_master_device() function calls: + + list_del(&dev->w1_master_entry); + +So presumably this can cause an endless loop. + +Fixes: 7785925dd8e0 ("[PATCH] w1: cleanups.") +Signed-off-by: Dan Carpenter +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/w1/w1.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c +index 4a2ddf730a3ac..2eee26b7fc4a3 100644 +--- a/drivers/w1/w1.c ++++ b/drivers/w1/w1.c +@@ -1263,10 +1263,10 @@ static int __init w1_init(void) + + static void __exit w1_fini(void) + { +- struct w1_master *dev; ++ struct w1_master *dev, *n; + + /* Set netlink removal messages and some cleanup */ +- list_for_each_entry(dev, &w1_masters, w1_master_entry) ++ list_for_each_entry_safe(dev, n, &w1_masters, w1_master_entry) + __w1_remove_master_device(dev); + + w1_fini_netlink(); +-- +2.39.2 + diff --git a/queue-5.15/w1-w1_therm-fix-locking-behavior-in-convert_t.patch b/queue-5.15/w1-w1_therm-fix-locking-behavior-in-convert_t.patch new file mode 100644 index 00000000000..a106588b7de --- /dev/null +++ b/queue-5.15/w1-w1_therm-fix-locking-behavior-in-convert_t.patch @@ -0,0 +1,91 @@ +From e152cd39a4a6eacf412fba60af99e3eebcd5e9c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 13:21:52 +0200 +Subject: w1: w1_therm: fix locking behavior in convert_t + +From: Stefan Wahren + +[ Upstream commit dca5480ab7b77a889088ab7cac81934604510ac7 ] + +The commit 67b392f7b8ed ("w1_therm: optimizing temperature read timings") +accidentially inverted the logic for lock handling of the bus mutex. + +Before: + pullup -> release lock before sleep + no pullup -> release lock after sleep + +After: + pullup -> release lock after sleep + no pullup -> release lock before sleep + +This cause spurious measurements of 85 degree (powerup value) on the +Tarragon board with connected 1-w temperature sensor +(w1_therm.w1_strong_pull=0). + +In the meantime a new feature for polling the conversion +completion has been integrated in these branches with +commit 021da53e65fd ("w1: w1_therm: Add sysfs entries to control +conversion time and driver features"). But this feature isn't +available for parasite power mode, so handle this separately. + +Link: https://lore.kernel.org/regressions/2023042645-attentive-amends-7b0b@gregkh/T/ +Fixes: 67b392f7b8ed ("w1_therm: optimizing temperature read timings") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20230427112152.12313-1-stefan.wahren@i2se.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/w1/slaves/w1_therm.c | 31 ++++++++++++++----------------- + 1 file changed, 14 insertions(+), 17 deletions(-) + +diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c +index 9cbeeb4923ecf..67d1cfbbb5f7f 100644 +--- a/drivers/w1/slaves/w1_therm.c ++++ b/drivers/w1/slaves/w1_therm.c +@@ -1093,29 +1093,26 @@ static int convert_t(struct w1_slave *sl, struct therm_info *info) + + w1_write_8(dev_master, W1_CONVERT_TEMP); + +- if (strong_pullup) { /*some device need pullup */ ++ if (SLAVE_FEATURES(sl) & W1_THERM_POLL_COMPLETION) { ++ ret = w1_poll_completion(dev_master, W1_POLL_CONVERT_TEMP); ++ if (ret) { ++ dev_dbg(&sl->dev, "%s: Timeout\n", __func__); ++ goto mt_unlock; ++ } ++ mutex_unlock(&dev_master->bus_mutex); ++ } else if (!strong_pullup) { /*no device need pullup */ + sleep_rem = msleep_interruptible(t_conv); + if (sleep_rem != 0) { + ret = -EINTR; + goto mt_unlock; + } + mutex_unlock(&dev_master->bus_mutex); +- } else { /*no device need pullup */ +- if (SLAVE_FEATURES(sl) & W1_THERM_POLL_COMPLETION) { +- ret = w1_poll_completion(dev_master, W1_POLL_CONVERT_TEMP); +- if (ret) { +- dev_dbg(&sl->dev, "%s: Timeout\n", __func__); +- goto mt_unlock; +- } +- mutex_unlock(&dev_master->bus_mutex); +- } else { +- /* Fixed delay */ +- mutex_unlock(&dev_master->bus_mutex); +- sleep_rem = msleep_interruptible(t_conv); +- if (sleep_rem != 0) { +- ret = -EINTR; +- goto dec_refcnt; +- } ++ } else { /*some device need pullup */ ++ mutex_unlock(&dev_master->bus_mutex); ++ sleep_rem = msleep_interruptible(t_conv); ++ if (sleep_rem != 0) { ++ ret = -EINTR; ++ goto dec_refcnt; + } + } + ret = read_scratchpad(sl, info); +-- +2.39.2 + diff --git a/queue-5.15/xsk-honor-so_bindtodevice-on-bind.patch b/queue-5.15/xsk-honor-so_bindtodevice-on-bind.patch new file mode 100644 index 00000000000..bf11cdce44d --- /dev/null +++ b/queue-5.15/xsk-honor-so_bindtodevice-on-bind.patch @@ -0,0 +1,101 @@ +From e894c08567940a0ddfa5c321e5b3abe06cbc6c6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 19:53:29 +0200 +Subject: xsk: Honor SO_BINDTODEVICE on bind + +From: Ilya Maximets + +[ Upstream commit f7306acec9aae9893d15e745c8791124d42ab10a ] + +Initial creation of an AF_XDP socket requires CAP_NET_RAW capability. A +privileged process might create the socket and pass it to a non-privileged +process for later use. However, that process will be able to bind the socket +to any network interface. Even though it will not be able to receive any +traffic without modification of the BPF map, the situation is not ideal. + +Sockets already have a mechanism that can be used to restrict what interface +they can be attached to. That is SO_BINDTODEVICE. + +To change the SO_BINDTODEVICE binding the process will need CAP_NET_RAW. + +Make xsk_bind() honor the SO_BINDTODEVICE in order to allow safer workflow +when non-privileged process is using AF_XDP. + +The intended workflow is following: + + 1. First process creates a bare socket with socket(AF_XDP, ...). + 2. First process loads the XSK program to the interface. + 3. First process adds the socket fd to a BPF map. + 4. First process ties socket fd to a particular interface using + SO_BINDTODEVICE. + 5. First process sends socket fd to a second process. + 6. Second process allocates UMEM. + 7. Second process binds socket to the interface with bind(...). + 8. Second process sends/receives the traffic. + +All the steps above are possible today if the first process is privileged +and the second one has sufficient RLIMIT_MEMLOCK and no capabilities. +However, the second process will be able to bind the socket to any interface +it wants on step 7 and send traffic from it. With the proposed change, the +second process will be able to bind the socket only to a specific interface +chosen by the first process at step 4. + +Fixes: 965a99098443 ("xsk: add support for bind for Rx") +Signed-off-by: Ilya Maximets +Signed-off-by: Daniel Borkmann +Acked-by: Magnus Karlsson +Acked-by: John Fastabend +Acked-by: Jason Wang +Link: https://lore.kernel.org/bpf/20230703175329.3259672-1-i.maximets@ovn.org +Signed-off-by: Sasha Levin +--- + Documentation/networking/af_xdp.rst | 9 +++++++++ + net/xdp/xsk.c | 5 +++++ + 2 files changed, 14 insertions(+) + +diff --git a/Documentation/networking/af_xdp.rst b/Documentation/networking/af_xdp.rst +index 60b217b436be6..5b77b9e5ac7e6 100644 +--- a/Documentation/networking/af_xdp.rst ++++ b/Documentation/networking/af_xdp.rst +@@ -433,6 +433,15 @@ start N bytes into the buffer leaving the first N bytes for the + application to use. The final option is the flags field, but it will + be dealt with in separate sections for each UMEM flag. + ++SO_BINDTODEVICE setsockopt ++-------------------------- ++ ++This is a generic SOL_SOCKET option that can be used to tie AF_XDP ++socket to a particular network interface. It is useful when a socket ++is created by a privileged process and passed to a non-privileged one. ++Once the option is set, kernel will refuse attempts to bind that socket ++to a different interface. Updating the value requires CAP_NET_RAW. ++ + XDP_STATISTICS getsockopt + ------------------------- + +diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c +index 330dd498fc61d..e80e3fcbb8e8f 100644 +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -893,6 +893,7 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len) + struct sock *sk = sock->sk; + struct xdp_sock *xs = xdp_sk(sk); + struct net_device *dev; ++ int bound_dev_if; + u32 flags, qid; + int err = 0; + +@@ -906,6 +907,10 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len) + XDP_USE_NEED_WAKEUP)) + return -EINVAL; + ++ bound_dev_if = READ_ONCE(sk->sk_bound_dev_if); ++ if (bound_dev_if && bound_dev_if != sxdp->sxdp_ifindex) ++ return -EINVAL; ++ + rtnl_lock(); + mutex_lock(&xs->mutex); + if (xs->state != XSK_READY) { +-- +2.39.2 + -- 2.47.3