From abda39a89ec739620a0357fcf68ee1d7f6edc4ea Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 10 Sep 2023 11:38:09 +0100 Subject: [PATCH] 6.5-stable patches added patches: cpufreq-brcmstb-avs-cpufreq-fix-warray-bounds-bug.patch crypto-stm32-fix-loop-iterating-through-scatterlist-for-dma.patch crypto-stm32-fix-mdmat-condition.patch hid-logitech-hidpp-rework-one-more-time-the-retries-attempts.patch iov_iter-fix-iov_iter_extract_pages-with-zero-sized-entries.patch of-property-fw_devlink-add-a-devlink-for-panel-followers.patch risc-v-add-ptrace-support-for-vectors.patch s390-dasd-fix-string-length-handling.patch s390-dcssblk-fix-kernel-crash-with-list_add-corruption.patch s390-ipl-add-missing-secure-has_secure-file-to-ipl-type-unknown.patch --- ...tb-avs-cpufreq-fix-warray-bounds-bug.patch | 64 +++++++ ...terating-through-scatterlist-for-dma.patch | 37 ++++ .../crypto-stm32-fix-mdmat-condition.patch | 32 ++++ ...k-one-more-time-the-retries-attempts.patch | 179 ++++++++++++++++++ ...xtract_pages-with-zero-sized-entries.patch | 120 ++++++++++++ ...nk-add-a-devlink-for-panel-followers.patch | 44 +++++ ...isc-v-add-ptrace-support-for-vectors.patch | 178 +++++++++++++++++ ...s390-dasd-fix-string-length-handling.patch | 122 ++++++++++++ ...ernel-crash-with-list_add-corruption.patch | 70 +++++++ ...-has_secure-file-to-ipl-type-unknown.patch | 37 ++++ queue-6.5/series | 10 + 11 files changed, 893 insertions(+) create mode 100644 queue-6.5/cpufreq-brcmstb-avs-cpufreq-fix-warray-bounds-bug.patch create mode 100644 queue-6.5/crypto-stm32-fix-loop-iterating-through-scatterlist-for-dma.patch create mode 100644 queue-6.5/crypto-stm32-fix-mdmat-condition.patch create mode 100644 queue-6.5/hid-logitech-hidpp-rework-one-more-time-the-retries-attempts.patch create mode 100644 queue-6.5/iov_iter-fix-iov_iter_extract_pages-with-zero-sized-entries.patch create mode 100644 queue-6.5/of-property-fw_devlink-add-a-devlink-for-panel-followers.patch create mode 100644 queue-6.5/risc-v-add-ptrace-support-for-vectors.patch create mode 100644 queue-6.5/s390-dasd-fix-string-length-handling.patch create mode 100644 queue-6.5/s390-dcssblk-fix-kernel-crash-with-list_add-corruption.patch create mode 100644 queue-6.5/s390-ipl-add-missing-secure-has_secure-file-to-ipl-type-unknown.patch diff --git a/queue-6.5/cpufreq-brcmstb-avs-cpufreq-fix-warray-bounds-bug.patch b/queue-6.5/cpufreq-brcmstb-avs-cpufreq-fix-warray-bounds-bug.patch new file mode 100644 index 00000000000..ee1c18782d7 --- /dev/null +++ b/queue-6.5/cpufreq-brcmstb-avs-cpufreq-fix-warray-bounds-bug.patch @@ -0,0 +1,64 @@ +From e520d0b6be950ce3738cf4b9bd3b392be818f1dc Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Mon, 31 Jul 2023 21:15:48 -0600 +Subject: cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug + +From: Gustavo A. R. Silva + +commit e520d0b6be950ce3738cf4b9bd3b392be818f1dc upstream. + +Allocate extra space for terminating element at: + +drivers/cpufreq/brcmstb-avs-cpufreq.c: +449 table[i].frequency = CPUFREQ_TABLE_END; + +and add code comment to make this clear. + +This fixes the following -Warray-bounds warning seen after building +ARM with multi_v7_defconfig (GCC 13): +In function 'brcm_avs_get_freq_table', + inlined from 'brcm_avs_cpufreq_init' at drivers/cpufreq/brcmstb-avs-cpufreq.c:623:15: +drivers/cpufreq/brcmstb-avs-cpufreq.c:449:28: warning: array subscript 5 is outside array bounds of 'void[60]' [-Warray-bounds=] + 449 | table[i].frequency = CPUFREQ_TABLE_END; +In file included from include/linux/node.h:18, + from include/linux/cpu.h:17, + from include/linux/cpufreq.h:12, + from drivers/cpufreq/brcmstb-avs-cpufreq.c:44: +In function 'devm_kmalloc_array', + inlined from 'devm_kcalloc' at include/linux/device.h:328:9, + inlined from 'brcm_avs_get_freq_table' at drivers/cpufreq/brcmstb-avs-cpufreq.c:437:10, + inlined from 'brcm_avs_cpufreq_init' at drivers/cpufreq/brcmstb-avs-cpufreq.c:623:15: +include/linux/device.h:323:16: note: at offset 60 into object of size 60 allocated by 'devm_kmalloc' + 323 | return devm_kmalloc(dev, bytes, flags); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +This helps with the ongoing efforts to tighten the FORTIFY_SOURCE +routines on memcpy() and help us make progress towards globally +enabling -Warray-bounds. + +Link: https://github.com/KSPP/linux/issues/324 +Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs") +Cc: stable@vger.kernel.org +Signed-off-by: Gustavo A. R. Silva +Reviewed-by: Florian Fainelli +Signed-off-by: Viresh Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/brcmstb-avs-cpufreq.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c ++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c +@@ -434,7 +434,11 @@ brcm_avs_get_freq_table(struct device *d + if (ret) + return ERR_PTR(ret); + +- table = devm_kcalloc(dev, AVS_PSTATE_MAX + 1, sizeof(*table), ++ /* ++ * We allocate space for the 5 different P-STATES AVS, ++ * plus extra space for a terminating element. ++ */ ++ table = devm_kcalloc(dev, AVS_PSTATE_MAX + 1 + 1, sizeof(*table), + GFP_KERNEL); + if (!table) + return ERR_PTR(-ENOMEM); diff --git a/queue-6.5/crypto-stm32-fix-loop-iterating-through-scatterlist-for-dma.patch b/queue-6.5/crypto-stm32-fix-loop-iterating-through-scatterlist-for-dma.patch new file mode 100644 index 00000000000..1c60a67c446 --- /dev/null +++ b/queue-6.5/crypto-stm32-fix-loop-iterating-through-scatterlist-for-dma.patch @@ -0,0 +1,37 @@ +From d9c83f71eeceed2cb54bb78be84f2d4055fd9a1f Mon Sep 17 00:00:00 2001 +From: Thomas Bourgoin +Date: Thu, 13 Jul 2023 17:15:15 +0200 +Subject: crypto: stm32 - fix loop iterating through scatterlist for DMA + +From: Thomas Bourgoin + +commit d9c83f71eeceed2cb54bb78be84f2d4055fd9a1f upstream. + +We were reading the length of the scatterlist sg after copying value of +tsg inside. +So we are using the size of the previous scatterlist and for the first +one we are using an unitialised value. +Fix this by copying tsg in sg[0] before reading the size. + +Fixes : 8a1012d3f2ab ("crypto: stm32 - Support for STM32 HASH module") +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Bourgoin +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/stm32/stm32-hash.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/stm32/stm32-hash.c ++++ b/drivers/crypto/stm32/stm32-hash.c +@@ -627,9 +627,9 @@ static int stm32_hash_dma_send(struct st + } + + for_each_sg(rctx->sg, tsg, rctx->nents, i) { ++ sg[0] = *tsg; + len = sg->length; + +- sg[0] = *tsg; + if (sg_is_last(sg)) { + if (hdev->dma_mode == 1) { + len = (ALIGN(sg->length, 16) - 16); diff --git a/queue-6.5/crypto-stm32-fix-mdmat-condition.patch b/queue-6.5/crypto-stm32-fix-mdmat-condition.patch new file mode 100644 index 00000000000..7449d08b50f --- /dev/null +++ b/queue-6.5/crypto-stm32-fix-mdmat-condition.patch @@ -0,0 +1,32 @@ +From a4adfbc2544933ac12e7fbd50708290265546dbc Mon Sep 17 00:00:00 2001 +From: Thomas Bourgoin +Date: Thu, 13 Jul 2023 17:15:17 +0200 +Subject: crypto: stm32 - fix MDMAT condition + +From: Thomas Bourgoin + +commit a4adfbc2544933ac12e7fbd50708290265546dbc upstream. + +If IP has MDMAT support, set or reset the bit MDMAT in Control Register. + +Fixes: b56403a25af7 ("crypto: stm32/hash - Support Ux500 hash") +Cc: stable@vger.kernel.org +Reviewed-by: Linus Walleij +Signed-off-by: Thomas Bourgoin +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/stm32/stm32-hash.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/stm32/stm32-hash.c ++++ b/drivers/crypto/stm32/stm32-hash.c +@@ -492,7 +492,7 @@ static int stm32_hash_xmit_dma(struct st + + reg = stm32_hash_read(hdev, HASH_CR); + +- if (!hdev->pdata->has_mdmat) { ++ if (hdev->pdata->has_mdmat) { + if (mdma) + reg |= HASH_CR_MDMAT; + else diff --git a/queue-6.5/hid-logitech-hidpp-rework-one-more-time-the-retries-attempts.patch b/queue-6.5/hid-logitech-hidpp-rework-one-more-time-the-retries-attempts.patch new file mode 100644 index 00000000000..dc39c473c3f --- /dev/null +++ b/queue-6.5/hid-logitech-hidpp-rework-one-more-time-the-retries-attempts.patch @@ -0,0 +1,179 @@ +From 60165ab774cb0c509680a73cf826d0e158454653 Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Wed, 12 Jul 2023 17:02:34 +0200 +Subject: HID: logitech-hidpp: rework one more time the retries attempts + +From: Benjamin Tissoires + +commit 60165ab774cb0c509680a73cf826d0e158454653 upstream. + +Extract the internal code inside a helper function, fix the +initialization of the parameters used in the helper function +(`hidpp->answer_available` was not reset and `*response` wasn't either), +and use a `do {...} while();` loop. + +Fixes: 586e8fede795 ("HID: logitech-hidpp: Retry commands when device is busy") +Cc: stable@vger.kernel.org +Reviewed-by: Bastien Nocera +Signed-off-by: Benjamin Tissoires +Link: https://lore.kernel.org/r/20230621-logitech-fixes-v2-1-3635f7f9c8af@kernel.org +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-logitech-hidpp.c | 115 +++++++++++++++++++++++++-------------- + 1 file changed, 75 insertions(+), 40 deletions(-) + +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -275,21 +275,22 @@ static int __hidpp_send_report(struct hi + } + + /* +- * hidpp_send_message_sync() returns 0 in case of success, and something else +- * in case of a failure. +- * - If ' something else' is positive, that means that an error has been raised +- * by the protocol itself. +- * - If ' something else' is negative, that means that we had a classic error +- * (-ENOMEM, -EPIPE, etc...) ++ * Effectively send the message to the device, waiting for its answer. ++ * ++ * Must be called with hidpp->send_mutex locked ++ * ++ * Same return protocol than hidpp_send_message_sync(): ++ * - success on 0 ++ * - negative error means transport error ++ * - positive value means protocol error + */ +-static int hidpp_send_message_sync(struct hidpp_device *hidpp, ++static int __do_hidpp_send_message_sync(struct hidpp_device *hidpp, + struct hidpp_report *message, + struct hidpp_report *response) + { +- int ret = -1; +- int max_retries = 3; ++ int ret; + +- mutex_lock(&hidpp->send_mutex); ++ __must_hold(&hidpp->send_mutex); + + hidpp->send_receive_buf = response; + hidpp->answer_available = false; +@@ -300,47 +301,74 @@ static int hidpp_send_message_sync(struc + */ + *response = *message; + +- for (; max_retries != 0 && ret; max_retries--) { +- ret = __hidpp_send_report(hidpp->hid_dev, message); ++ ret = __hidpp_send_report(hidpp->hid_dev, message); ++ if (ret) { ++ dbg_hid("__hidpp_send_report returned err: %d\n", ret); ++ memset(response, 0, sizeof(struct hidpp_report)); ++ return ret; ++ } + +- if (ret) { +- dbg_hid("__hidpp_send_report returned err: %d\n", ret); +- memset(response, 0, sizeof(struct hidpp_report)); +- break; +- } ++ if (!wait_event_timeout(hidpp->wait, hidpp->answer_available, ++ 5*HZ)) { ++ dbg_hid("%s:timeout waiting for response\n", __func__); ++ memset(response, 0, sizeof(struct hidpp_report)); ++ return -ETIMEDOUT; ++ } + +- if (!wait_event_timeout(hidpp->wait, hidpp->answer_available, +- 5*HZ)) { +- dbg_hid("%s:timeout waiting for response\n", __func__); +- memset(response, 0, sizeof(struct hidpp_report)); +- ret = -ETIMEDOUT; +- break; +- } ++ if (response->report_id == REPORT_ID_HIDPP_SHORT && ++ response->rap.sub_id == HIDPP_ERROR) { ++ ret = response->rap.params[1]; ++ dbg_hid("%s:got hidpp error %02X\n", __func__, ret); ++ return ret; ++ } + +- if (response->report_id == REPORT_ID_HIDPP_SHORT && +- response->rap.sub_id == HIDPP_ERROR) { +- ret = response->rap.params[1]; +- dbg_hid("%s:got hidpp error %02X\n", __func__, ret); ++ if ((response->report_id == REPORT_ID_HIDPP_LONG || ++ response->report_id == REPORT_ID_HIDPP_VERY_LONG) && ++ response->fap.feature_index == HIDPP20_ERROR) { ++ ret = response->fap.params[1]; ++ dbg_hid("%s:got hidpp 2.0 error %02X\n", __func__, ret); ++ return ret; ++ } ++ ++ return 0; ++} ++ ++/* ++ * hidpp_send_message_sync() returns 0 in case of success, and something else ++ * in case of a failure. ++ * ++ * See __do_hidpp_send_message_sync() for a detailed explanation of the returned ++ * value. ++ */ ++static int hidpp_send_message_sync(struct hidpp_device *hidpp, ++ struct hidpp_report *message, ++ struct hidpp_report *response) ++{ ++ int ret; ++ int max_retries = 3; ++ ++ mutex_lock(&hidpp->send_mutex); ++ ++ do { ++ ret = __do_hidpp_send_message_sync(hidpp, message, response); ++ if (ret != HIDPP20_ERROR_BUSY) + break; +- } + +- if ((response->report_id == REPORT_ID_HIDPP_LONG || +- response->report_id == REPORT_ID_HIDPP_VERY_LONG) && +- response->fap.feature_index == HIDPP20_ERROR) { +- ret = response->fap.params[1]; +- if (ret != HIDPP20_ERROR_BUSY) { +- dbg_hid("%s:got hidpp 2.0 error %02X\n", __func__, ret); +- break; +- } +- dbg_hid("%s:got busy hidpp 2.0 error %02X, retrying\n", __func__, ret); +- } +- } ++ dbg_hid("%s:got busy hidpp 2.0 error %02X, retrying\n", __func__, ret); ++ } while (--max_retries); + + mutex_unlock(&hidpp->send_mutex); + return ret; + + } + ++/* ++ * hidpp_send_fap_command_sync() returns 0 in case of success, and something else ++ * in case of a failure. ++ * ++ * See __do_hidpp_send_message_sync() for a detailed explanation of the returned ++ * value. ++ */ + static int hidpp_send_fap_command_sync(struct hidpp_device *hidpp, + u8 feat_index, u8 funcindex_clientid, u8 *params, int param_count, + struct hidpp_report *response) +@@ -373,6 +401,13 @@ static int hidpp_send_fap_command_sync(s + return ret; + } + ++/* ++ * hidpp_send_rap_command_sync() returns 0 in case of success, and something else ++ * in case of a failure. ++ * ++ * See __do_hidpp_send_message_sync() for a detailed explanation of the returned ++ * value. ++ */ + static int hidpp_send_rap_command_sync(struct hidpp_device *hidpp_dev, + u8 report_id, u8 sub_id, u8 reg_address, u8 *params, int param_count, + struct hidpp_report *response) diff --git a/queue-6.5/iov_iter-fix-iov_iter_extract_pages-with-zero-sized-entries.patch b/queue-6.5/iov_iter-fix-iov_iter_extract_pages-with-zero-sized-entries.patch new file mode 100644 index 00000000000..c39c7e39e85 --- /dev/null +++ b/queue-6.5/iov_iter-fix-iov_iter_extract_pages-with-zero-sized-entries.patch @@ -0,0 +1,120 @@ +From f741bd7178c95abd7aeac5a9d933ee542f9a5509 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Fri, 8 Sep 2023 17:03:20 +0100 +Subject: iov_iter: Fix iov_iter_extract_pages() with zero-sized entries + +From: David Howells + +commit f741bd7178c95abd7aeac5a9d933ee542f9a5509 upstream. + +iov_iter_extract_pages() doesn't correctly handle skipping over initial +zero-length entries in ITER_KVEC and ITER_BVEC-type iterators. + +The problem is that it accidentally reduces maxsize to 0 when it +skipping and thus runs to the end of the array and returns 0. + +Fix this by sticking the calculated size-to-copy in a new variable +rather than back in maxsize. + +Fixes: 7d58fe731028 ("iov_iter: Add a function to extract a page list from an iterator") +Signed-off-by: David Howells +Reviewed-by: Christoph Hellwig +Cc: Christian Brauner +Cc: Jens Axboe +Cc: Al Viro +Cc: David Hildenbrand +Cc: John Hubbard +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + lib/iov_iter.c | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +--- a/lib/iov_iter.c ++++ b/lib/iov_iter.c +@@ -1640,14 +1640,14 @@ static ssize_t iov_iter_extract_bvec_pag + size_t *offset0) + { + struct page **p, *page; +- size_t skip = i->iov_offset, offset; ++ size_t skip = i->iov_offset, offset, size; + int k; + + for (;;) { + if (i->nr_segs == 0) + return 0; +- maxsize = min(maxsize, i->bvec->bv_len - skip); +- if (maxsize) ++ size = min(maxsize, i->bvec->bv_len - skip); ++ if (size) + break; + i->iov_offset = 0; + i->nr_segs--; +@@ -1660,16 +1660,16 @@ static ssize_t iov_iter_extract_bvec_pag + offset = skip % PAGE_SIZE; + *offset0 = offset; + +- maxpages = want_pages_array(pages, maxsize, offset, maxpages); ++ maxpages = want_pages_array(pages, size, offset, maxpages); + if (!maxpages) + return -ENOMEM; + p = *pages; + for (k = 0; k < maxpages; k++) + p[k] = page + k; + +- maxsize = min_t(size_t, maxsize, maxpages * PAGE_SIZE - offset); +- iov_iter_advance(i, maxsize); +- return maxsize; ++ size = min_t(size_t, size, maxpages * PAGE_SIZE - offset); ++ iov_iter_advance(i, size); ++ return size; + } + + /* +@@ -1684,14 +1684,14 @@ static ssize_t iov_iter_extract_kvec_pag + { + struct page **p, *page; + const void *kaddr; +- size_t skip = i->iov_offset, offset, len; ++ size_t skip = i->iov_offset, offset, len, size; + int k; + + for (;;) { + if (i->nr_segs == 0) + return 0; +- maxsize = min(maxsize, i->kvec->iov_len - skip); +- if (maxsize) ++ size = min(maxsize, i->kvec->iov_len - skip); ++ if (size) + break; + i->iov_offset = 0; + i->nr_segs--; +@@ -1703,13 +1703,13 @@ static ssize_t iov_iter_extract_kvec_pag + offset = (unsigned long)kaddr & ~PAGE_MASK; + *offset0 = offset; + +- maxpages = want_pages_array(pages, maxsize, offset, maxpages); ++ maxpages = want_pages_array(pages, size, offset, maxpages); + if (!maxpages) + return -ENOMEM; + p = *pages; + + kaddr -= offset; +- len = offset + maxsize; ++ len = offset + size; + for (k = 0; k < maxpages; k++) { + size_t seg = min_t(size_t, len, PAGE_SIZE); + +@@ -1723,9 +1723,9 @@ static ssize_t iov_iter_extract_kvec_pag + kaddr += PAGE_SIZE; + } + +- maxsize = min_t(size_t, maxsize, maxpages * PAGE_SIZE - offset); +- iov_iter_advance(i, maxsize); +- return maxsize; ++ size = min_t(size_t, size, maxpages * PAGE_SIZE - offset); ++ iov_iter_advance(i, size); ++ return size; + } + + /* diff --git a/queue-6.5/of-property-fw_devlink-add-a-devlink-for-panel-followers.patch b/queue-6.5/of-property-fw_devlink-add-a-devlink-for-panel-followers.patch new file mode 100644 index 00000000000..5fd45a8b66a --- /dev/null +++ b/queue-6.5/of-property-fw_devlink-add-a-devlink-for-panel-followers.patch @@ -0,0 +1,44 @@ +From fbf0ea2da3c7cd0b33ed7ae53a67ab1c24838cba Mon Sep 17 00:00:00 2001 +From: Douglas Anderson +Date: Thu, 27 Jul 2023 10:16:31 -0700 +Subject: of: property: fw_devlink: Add a devlink for panel followers + +From: Douglas Anderson + +commit fbf0ea2da3c7cd0b33ed7ae53a67ab1c24838cba upstream. + +Inform fw_devlink of the fact that a panel follower (like a +touchscreen) is effectively a consumer of the panel from the purposes +of fw_devlink. + +NOTE: this patch isn't required for correctness but instead optimizes +probe order / helps avoid deferrals. + +Acked-by: Rob Herring +Reviewed-by: Maxime Ripard +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20230727101636.v4.4.Ibf8e1342b5b7906279db2365aca45e6253857bb3@changeid +Cc: Adam Ford +Signed-off-by: Greg Kroah-Hartman +--- + drivers/of/property.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/of/property.c ++++ b/drivers/of/property.c +@@ -1266,6 +1266,7 @@ DEFINE_SIMPLE_PROP(pwms, "pwms", "#pwm-c + DEFINE_SIMPLE_PROP(resets, "resets", "#reset-cells") + DEFINE_SIMPLE_PROP(leds, "leds", NULL) + DEFINE_SIMPLE_PROP(backlight, "backlight", NULL) ++DEFINE_SIMPLE_PROP(panel, "panel", NULL) + DEFINE_SUFFIX_PROP(regulators, "-supply", NULL) + DEFINE_SUFFIX_PROP(gpio, "-gpio", "#gpio-cells") + +@@ -1354,6 +1355,7 @@ static const struct supplier_bindings of + { .parse_prop = parse_resets, }, + { .parse_prop = parse_leds, }, + { .parse_prop = parse_backlight, }, ++ { .parse_prop = parse_panel, }, + { .parse_prop = parse_gpio_compat, }, + { .parse_prop = parse_interrupts, }, + { .parse_prop = parse_regulators, }, diff --git a/queue-6.5/risc-v-add-ptrace-support-for-vectors.patch b/queue-6.5/risc-v-add-ptrace-support-for-vectors.patch new file mode 100644 index 00000000000..0042332e7f9 --- /dev/null +++ b/queue-6.5/risc-v-add-ptrace-support-for-vectors.patch @@ -0,0 +1,178 @@ +From 9300f00439743c4a34d735e1a27118eb68a1504e Mon Sep 17 00:00:00 2001 +From: Andy Chiu +Date: Fri, 25 Aug 2023 05:02:46 +0000 +Subject: RISC-V: Add ptrace support for vectors + +From: Andy Chiu + +commit 9300f00439743c4a34d735e1a27118eb68a1504e upstream. + +This patch add back the ptrace support with the following fix: + - Define NT_RISCV_CSR and re-number NT_RISCV_VECTOR to prevent + conflicting with gdb's NT_RISCV_CSR. + - Use struct __riscv_v_regset_state to handle ptrace requests + +Since gdb does not directly include the note description header in +Linux and has already defined NT_RISCV_CSR as 0x900, we decide to +sync with gdb and renumber NT_RISCV_VECTOR to solve and prevent future +conflicts. + +Fixes: 0c59922c769a ("riscv: Add ptrace vector support") +Signed-off-by: Andy Chiu +Link: https://lore.kernel.org/r/20230825050248.32681-1-andy.chiu@sifive.com +[Palmer: Drop the unused "size" variable in riscv_vr_set().] +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/include/uapi/asm/ptrace.h | 13 +++-- + arch/riscv/kernel/ptrace.c | 79 ++++++++++++++++++++++++++++ + include/uapi/linux/elf.h | 2 + + 3 files changed, 90 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/include/uapi/asm/ptrace.h b/arch/riscv/include/uapi/asm/ptrace.h +index 283800130614..575e95bb1bc3 100644 +--- a/arch/riscv/include/uapi/asm/ptrace.h ++++ b/arch/riscv/include/uapi/asm/ptrace.h +@@ -103,13 +103,18 @@ struct __riscv_v_ext_state { + * In signal handler, datap will be set a correct user stack offset + * and vector registers will be copied to the address of datap + * pointer. +- * +- * In ptrace syscall, datap will be set to zero and the vector +- * registers will be copied to the address right after this +- * structure. + */ + }; + ++struct __riscv_v_regset_state { ++ unsigned long vstart; ++ unsigned long vl; ++ unsigned long vtype; ++ unsigned long vcsr; ++ unsigned long vlenb; ++ char vreg[]; ++}; ++ + /* + * According to spec: The number of bits in a single vector register, + * VLEN >= ELEN, which must be a power of 2, and must be no greater than +diff --git a/arch/riscv/kernel/ptrace.c b/arch/riscv/kernel/ptrace.c +index 487303e3ef22..2afe460de16a 100644 +--- a/arch/riscv/kernel/ptrace.c ++++ b/arch/riscv/kernel/ptrace.c +@@ -25,6 +25,9 @@ enum riscv_regset { + #ifdef CONFIG_FPU + REGSET_F, + #endif ++#ifdef CONFIG_RISCV_ISA_V ++ REGSET_V, ++#endif + }; + + static int riscv_gpr_get(struct task_struct *target, +@@ -81,6 +84,71 @@ static int riscv_fpr_set(struct task_struct *target, + } + #endif + ++#ifdef CONFIG_RISCV_ISA_V ++static int riscv_vr_get(struct task_struct *target, ++ const struct user_regset *regset, ++ struct membuf to) ++{ ++ struct __riscv_v_ext_state *vstate = &target->thread.vstate; ++ struct __riscv_v_regset_state ptrace_vstate; ++ ++ if (!riscv_v_vstate_query(task_pt_regs(target))) ++ return -EINVAL; ++ ++ /* ++ * Ensure the vector registers have been saved to the memory before ++ * copying them to membuf. ++ */ ++ if (target == current) ++ riscv_v_vstate_save(current, task_pt_regs(current)); ++ ++ ptrace_vstate.vstart = vstate->vstart; ++ ptrace_vstate.vl = vstate->vl; ++ ptrace_vstate.vtype = vstate->vtype; ++ ptrace_vstate.vcsr = vstate->vcsr; ++ ptrace_vstate.vlenb = vstate->vlenb; ++ ++ /* Copy vector header from vstate. */ ++ membuf_write(&to, &ptrace_vstate, sizeof(struct __riscv_v_regset_state)); ++ ++ /* Copy all the vector registers from vstate. */ ++ return membuf_write(&to, vstate->datap, riscv_v_vsize); ++} ++ ++static int riscv_vr_set(struct task_struct *target, ++ const struct user_regset *regset, ++ unsigned int pos, unsigned int count, ++ const void *kbuf, const void __user *ubuf) ++{ ++ int ret; ++ struct __riscv_v_ext_state *vstate = &target->thread.vstate; ++ struct __riscv_v_regset_state ptrace_vstate; ++ ++ if (!riscv_v_vstate_query(task_pt_regs(target))) ++ return -EINVAL; ++ ++ /* Copy rest of the vstate except datap */ ++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ptrace_vstate, 0, ++ sizeof(struct __riscv_v_regset_state)); ++ if (unlikely(ret)) ++ return ret; ++ ++ if (vstate->vlenb != ptrace_vstate.vlenb) ++ return -EINVAL; ++ ++ vstate->vstart = ptrace_vstate.vstart; ++ vstate->vl = ptrace_vstate.vl; ++ vstate->vtype = ptrace_vstate.vtype; ++ vstate->vcsr = ptrace_vstate.vcsr; ++ ++ /* Copy all the vector registers. */ ++ pos = 0; ++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, vstate->datap, ++ 0, riscv_v_vsize); ++ return ret; ++} ++#endif ++ + static const struct user_regset riscv_user_regset[] = { + [REGSET_X] = { + .core_note_type = NT_PRSTATUS, +@@ -100,6 +168,17 @@ static const struct user_regset riscv_user_regset[] = { + .set = riscv_fpr_set, + }, + #endif ++#ifdef CONFIG_RISCV_ISA_V ++ [REGSET_V] = { ++ .core_note_type = NT_RISCV_VECTOR, ++ .align = 16, ++ .n = ((32 * RISCV_MAX_VLENB) + ++ sizeof(struct __riscv_v_regset_state)) / sizeof(__u32), ++ .size = sizeof(__u32), ++ .regset_get = riscv_vr_get, ++ .set = riscv_vr_set, ++ }, ++#endif + }; + + static const struct user_regset_view riscv_user_native_view = { +diff --git a/include/uapi/linux/elf.h b/include/uapi/linux/elf.h +index e0e159138331..20e285fdbc46 100644 +--- a/include/uapi/linux/elf.h ++++ b/include/uapi/linux/elf.h +@@ -443,6 +443,8 @@ typedef struct elf64_shdr { + #define NT_MIPS_DSP 0x800 /* MIPS DSP ASE registers */ + #define NT_MIPS_FP_MODE 0x801 /* MIPS floating-point mode */ + #define NT_MIPS_MSA 0x802 /* MIPS SIMD registers */ ++#define NT_RISCV_CSR 0x900 /* RISC-V Control and Status Registers */ ++#define NT_RISCV_VECTOR 0x901 /* RISC-V vector registers */ + #define NT_LOONGARCH_CPUCFG 0xa00 /* LoongArch CPU config registers */ + #define NT_LOONGARCH_CSR 0xa01 /* LoongArch control and status registers */ + #define NT_LOONGARCH_LSX 0xa02 /* LoongArch Loongson SIMD Extension registers */ +-- +2.42.0 + diff --git a/queue-6.5/s390-dasd-fix-string-length-handling.patch b/queue-6.5/s390-dasd-fix-string-length-handling.patch new file mode 100644 index 00000000000..0efaa7ccd40 --- /dev/null +++ b/queue-6.5/s390-dasd-fix-string-length-handling.patch @@ -0,0 +1,122 @@ +From f7cf22424665043787a96a66a048ff6b2cfd473c Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Mon, 28 Aug 2023 17:31:42 +0200 +Subject: s390/dasd: fix string length handling + +From: Heiko Carstens + +commit f7cf22424665043787a96a66a048ff6b2cfd473c upstream. + +Building dasd_eckd.o with latest clang reveals this bug: + + CC drivers/s390/block/dasd_eckd.o + drivers/s390/block/dasd_eckd.c:1082:3: warning: 'snprintf' will always be truncated; + specified size is 1, but format string expands to at least 11 [-Wfortify-source] + 1082 | snprintf(print_uid, sizeof(*print_uid), + | ^ + drivers/s390/block/dasd_eckd.c:1087:3: warning: 'snprintf' will always be truncated; + specified size is 1, but format string expands to at least 10 [-Wfortify-source] + 1087 | snprintf(print_uid, sizeof(*print_uid), + | ^ + +Fix this by moving and using the existing UID_STRLEN for the arrays +that are being written to. Also rename UID_STRLEN to DASD_UID_STRLEN +to clarify its scope. + +Fixes: 23596961b437 ("s390/dasd: split up dasd_eckd_read_conf") +Reviewed-by: Peter Oberparleiter +Signed-off-by: Heiko Carstens +Tested-by: Nick Desaulniers # build +Reported-by: Nathan Chancellor +Closes: https://github.com/ClangBuiltLinux/linux/issues/1923 +Reviewed-by: Nick Desaulniers +Link: https://lore.kernel.org/r/20230828153142.2843753-2-hca@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/block/dasd_devmap.c | 6 +----- + drivers/s390/block/dasd_eckd.c | 10 +++++----- + drivers/s390/block/dasd_int.h | 4 ++++ + 3 files changed, 10 insertions(+), 10 deletions(-) + +--- a/drivers/s390/block/dasd_devmap.c ++++ b/drivers/s390/block/dasd_devmap.c +@@ -1378,16 +1378,12 @@ static ssize_t dasd_vendor_show(struct d + + static DEVICE_ATTR(vendor, 0444, dasd_vendor_show, NULL); + +-#define UID_STRLEN ( /* vendor */ 3 + 1 + /* serial */ 14 + 1 +\ +- /* SSID */ 4 + 1 + /* unit addr */ 2 + 1 +\ +- /* vduit */ 32 + 1) +- + static ssize_t + dasd_uid_show(struct device *dev, struct device_attribute *attr, char *buf) + { ++ char uid_string[DASD_UID_STRLEN]; + struct dasd_device *device; + struct dasd_uid uid; +- char uid_string[UID_STRLEN]; + char ua_string[3]; + + device = dasd_device_from_cdev(to_ccwdev(dev)); +--- a/drivers/s390/block/dasd_eckd.c ++++ b/drivers/s390/block/dasd_eckd.c +@@ -1079,12 +1079,12 @@ static void dasd_eckd_get_uid_string(str + + create_uid(conf, &uid); + if (strlen(uid.vduit) > 0) +- snprintf(print_uid, sizeof(*print_uid), ++ snprintf(print_uid, DASD_UID_STRLEN, + "%s.%s.%04x.%02x.%s", + uid.vendor, uid.serial, uid.ssid, + uid.real_unit_addr, uid.vduit); + else +- snprintf(print_uid, sizeof(*print_uid), ++ snprintf(print_uid, DASD_UID_STRLEN, + "%s.%s.%04x.%02x", + uid.vendor, uid.serial, uid.ssid, + uid.real_unit_addr); +@@ -1093,8 +1093,8 @@ static void dasd_eckd_get_uid_string(str + static int dasd_eckd_check_cabling(struct dasd_device *device, + void *conf_data, __u8 lpm) + { ++ char print_path_uid[DASD_UID_STRLEN], print_device_uid[DASD_UID_STRLEN]; + struct dasd_eckd_private *private = device->private; +- char print_path_uid[60], print_device_uid[60]; + struct dasd_conf path_conf; + + path_conf.data = conf_data; +@@ -1293,9 +1293,9 @@ static void dasd_eckd_path_available_act + __u8 path_rcd_buf[DASD_ECKD_RCD_DATA_SIZE]; + __u8 lpm, opm, npm, ppm, epm, hpfpm, cablepm; + struct dasd_conf_data *conf_data; ++ char print_uid[DASD_UID_STRLEN]; + struct dasd_conf path_conf; + unsigned long flags; +- char print_uid[60]; + int rc, pos; + + opm = 0; +@@ -5855,8 +5855,8 @@ static void dasd_eckd_dump_sense(struct + static int dasd_eckd_reload_device(struct dasd_device *device) + { + struct dasd_eckd_private *private = device->private; ++ char print_uid[DASD_UID_STRLEN]; + int rc, old_base; +- char print_uid[60]; + struct dasd_uid uid; + unsigned long flags; + +--- a/drivers/s390/block/dasd_int.h ++++ b/drivers/s390/block/dasd_int.h +@@ -259,6 +259,10 @@ struct dasd_uid { + char vduit[33]; + }; + ++#define DASD_UID_STRLEN ( /* vendor */ 3 + 1 + /* serial */ 14 + 1 + \ ++ /* SSID */ 4 + 1 + /* unit addr */ 2 + 1 + \ ++ /* vduit */ 32 + 1) ++ + /* + * PPRC Status data + */ diff --git a/queue-6.5/s390-dcssblk-fix-kernel-crash-with-list_add-corruption.patch b/queue-6.5/s390-dcssblk-fix-kernel-crash-with-list_add-corruption.patch new file mode 100644 index 00000000000..d519fe43b96 --- /dev/null +++ b/queue-6.5/s390-dcssblk-fix-kernel-crash-with-list_add-corruption.patch @@ -0,0 +1,70 @@ +From c8f40a0bccefd613748d080147469a4652d6e74c Mon Sep 17 00:00:00 2001 +From: Gerald Schaefer +Date: Thu, 10 Aug 2023 10:22:36 +0200 +Subject: s390/dcssblk: fix kernel crash with list_add corruption + +From: Gerald Schaefer + +commit c8f40a0bccefd613748d080147469a4652d6e74c upstream. + +Commit fb08a1908cb1 ("dax: simplify the dax_device <-> gendisk +association") introduced new logic for gendisk association, requiring +drivers to explicitly call dax_add_host() and dax_remove_host(). + +For dcssblk driver, some dax_remove_host() calls were missing, e.g. in +device remove path. The commit also broke error handling for out_dax case +in device add path, resulting in an extra put_device() w/o the previous +get_device() in that case. + +This lead to stale xarray entries after device add / remove cycles. In the +case when a previously used struct gendisk pointer (xarray index) would be +used again, because blk_alloc_disk() happened to return such a pointer, the +xa_insert() in dax_add_host() would fail and go to out_dax, doing the extra +put_device() in the error path. In combination with an already flawed error +handling in dcssblk (device_register() cleanup), which needs to be +addressed in a separate patch, this resulted in a missing device_del() / +klist_del(), and eventually in the kernel crash with list_add corruption on +a subsequent device_add() / klist_add(). + +Fix this by adding the missing dax_remove_host() calls, and also move the +put_device() in the error path to restore the previous logic. + +Fixes: fb08a1908cb1 ("dax: simplify the dax_device <-> gendisk association") +Cc: # 5.17+ +Acked-by: Heiko Carstens +Signed-off-by: Gerald Schaefer +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/block/dcssblk.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/s390/block/dcssblk.c ++++ b/drivers/s390/block/dcssblk.c +@@ -412,6 +412,7 @@ removeseg: + } + list_del(&dev_info->lh); + ++ dax_remove_host(dev_info->gd); + kill_dax(dev_info->dax_dev); + put_dax(dev_info->dax_dev); + del_gendisk(dev_info->gd); +@@ -707,9 +708,9 @@ dcssblk_add_store(struct device *dev, st + goto out; + + out_dax_host: ++ put_device(&dev_info->dev); + dax_remove_host(dev_info->gd); + out_dax: +- put_device(&dev_info->dev); + kill_dax(dev_info->dax_dev); + put_dax(dev_info->dax_dev); + put_dev: +@@ -789,6 +790,7 @@ dcssblk_remove_store(struct device *dev, + } + + list_del(&dev_info->lh); ++ dax_remove_host(dev_info->gd); + kill_dax(dev_info->dax_dev); + put_dax(dev_info->dax_dev); + del_gendisk(dev_info->gd); diff --git a/queue-6.5/s390-ipl-add-missing-secure-has_secure-file-to-ipl-type-unknown.patch b/queue-6.5/s390-ipl-add-missing-secure-has_secure-file-to-ipl-type-unknown.patch new file mode 100644 index 00000000000..cd0b9338c4b --- /dev/null +++ b/queue-6.5/s390-ipl-add-missing-secure-has_secure-file-to-ipl-type-unknown.patch @@ -0,0 +1,37 @@ +From ea5717cb13468323a7c3dd394748301802991f39 Mon Sep 17 00:00:00 2001 +From: Sven Schnelle +Date: Tue, 15 Aug 2023 09:26:06 +0200 +Subject: s390/ipl: add missing secure/has_secure file to ipl type 'unknown' + +From: Sven Schnelle + +commit ea5717cb13468323a7c3dd394748301802991f39 upstream. + +OS installers are relying on /sys/firmware/ipl/has_secure to be +present on machines supporting secure boot. This file is present +for all IPL types, but not the unknown type, which prevents a secure +installation when an LPAR is booted in HMC via FTP(s), because +this is an unknown IPL type in linux. While at it, also add the secure +file. + +Fixes: c9896acc7851 ("s390/ipl: Provide has_secure sysfs attribute") +Cc: stable@vger.kernel.org +Signed-off-by: Sven Schnelle +Reviewed-by: Heiko Carstens +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/kernel/ipl.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/s390/kernel/ipl.c ++++ b/arch/s390/kernel/ipl.c +@@ -640,6 +640,8 @@ static struct attribute_group ipl_ccw_at + + static struct attribute *ipl_unknown_attrs[] = { + &sys_ipl_type_attr.attr, ++ &sys_ipl_secure_attr.attr, ++ &sys_ipl_has_secure_attr.attr, + NULL, + }; + diff --git a/queue-6.5/series b/queue-6.5/series index f8c8da09b0c..7206ffb37f3 100644 --- a/queue-6.5/series +++ b/queue-6.5/series @@ -705,3 +705,13 @@ mmc-renesas_sdhi-register-irqs-before-registering-controller.patch pstore-ram-check-start-of-empty-przs-during-init.patch arm64-sdei-abort-running-sdei-handlers-during-crash.patch regulator-dt-bindings-qcom-rpm-fix-pattern-for-children.patch +iov_iter-fix-iov_iter_extract_pages-with-zero-sized-entries.patch +risc-v-add-ptrace-support-for-vectors.patch +s390-dcssblk-fix-kernel-crash-with-list_add-corruption.patch +s390-ipl-add-missing-secure-has_secure-file-to-ipl-type-unknown.patch +s390-dasd-fix-string-length-handling.patch +hid-logitech-hidpp-rework-one-more-time-the-retries-attempts.patch +crypto-stm32-fix-loop-iterating-through-scatterlist-for-dma.patch +crypto-stm32-fix-mdmat-condition.patch +cpufreq-brcmstb-avs-cpufreq-fix-warray-bounds-bug.patch +of-property-fw_devlink-add-a-devlink-for-panel-followers.patch -- 2.47.3