From e4fd2ae9cc3a2f53963b7399704fdf842f58826d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 2 Dec 2024 14:00:40 +0100 Subject: [PATCH] 6.6-stable patches added patches: alsa-usb-audio-fix-potential-out-of-bound-accesses-for-extigy-and-mbox-devices.patch arm64-dts-mediatek-mt8195-cherry-mark-usb-3.0-on-xhci1-as-disabled.patch btrfs-do-not-bug_on-when-freeing-tree-block-after-error.patch f2fs-fix-null-reference-error-when-checking-end-of-zone.patch revert-arm64-dts-mediatek-mt8195-cherry-mark-usb-3.0-on-xhci1-as-disabled.patch --- ...accesses-for-extigy-and-mbox-devices.patch | 105 +++++++ ...ry-mark-usb-3.0-on-xhci1-as-disabled.patch | 41 +++ ...-when-freeing-tree-block-after-error.patch | 289 ++++++++++++++++++ ...ence-error-when-checking-end-of-zone.patch | 46 +++ ...ry-mark-usb-3.0-on-xhci1-as-disabled.patch | 36 +++ queue-6.6/series | 5 + 6 files changed, 522 insertions(+) create mode 100644 queue-6.6/alsa-usb-audio-fix-potential-out-of-bound-accesses-for-extigy-and-mbox-devices.patch create mode 100644 queue-6.6/arm64-dts-mediatek-mt8195-cherry-mark-usb-3.0-on-xhci1-as-disabled.patch create mode 100644 queue-6.6/btrfs-do-not-bug_on-when-freeing-tree-block-after-error.patch create mode 100644 queue-6.6/f2fs-fix-null-reference-error-when-checking-end-of-zone.patch create mode 100644 queue-6.6/revert-arm64-dts-mediatek-mt8195-cherry-mark-usb-3.0-on-xhci1-as-disabled.patch diff --git a/queue-6.6/alsa-usb-audio-fix-potential-out-of-bound-accesses-for-extigy-and-mbox-devices.patch b/queue-6.6/alsa-usb-audio-fix-potential-out-of-bound-accesses-for-extigy-and-mbox-devices.patch new file mode 100644 index 00000000000..c518d1cbc88 --- /dev/null +++ b/queue-6.6/alsa-usb-audio-fix-potential-out-of-bound-accesses-for-extigy-and-mbox-devices.patch @@ -0,0 +1,105 @@ +From b909df18ce2a998afef81d58bbd1a05dc0788c40 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Beno=C3=AEt=20Sevens?= +Date: Wed, 20 Nov 2024 12:41:44 +0000 +Subject: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Benoît Sevens + +commit b909df18ce2a998afef81d58bbd1a05dc0788c40 upstream. + +A bogus device can provide a bNumConfigurations value that exceeds the +initial value used in usb_get_configuration for allocating dev->config. + +This can lead to out-of-bounds accesses later, e.g. in +usb_destroy_configuration. + +Signed-off-by: Benoît Sevens +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@kernel.org +Link: https://patch.msgid.link/20241120124144.3814457-1-bsevens@google.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/quirks.c | 27 +++++++++++++++++++++------ + 1 file changed, 21 insertions(+), 6 deletions(-) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -555,6 +555,7 @@ int snd_usb_create_quirk(struct snd_usb_ + static int snd_usb_extigy_boot_quirk(struct usb_device *dev, struct usb_interface *intf) + { + struct usb_host_config *config = dev->actconfig; ++ struct usb_device_descriptor new_device_descriptor; + int err; + + if (le16_to_cpu(get_cfg_desc(config)->wTotalLength) == EXTIGY_FIRMWARE_SIZE_OLD || +@@ -566,10 +567,14 @@ static int snd_usb_extigy_boot_quirk(str + if (err < 0) + dev_dbg(&dev->dev, "error sending boot message: %d\n", err); + err = usb_get_descriptor(dev, USB_DT_DEVICE, 0, +- &dev->descriptor, sizeof(dev->descriptor)); +- config = dev->actconfig; ++ &new_device_descriptor, sizeof(new_device_descriptor)); + if (err < 0) + dev_dbg(&dev->dev, "error usb_get_descriptor: %d\n", err); ++ if (new_device_descriptor.bNumConfigurations > dev->descriptor.bNumConfigurations) ++ dev_dbg(&dev->dev, "error too large bNumConfigurations: %d\n", ++ new_device_descriptor.bNumConfigurations); ++ else ++ memcpy(&dev->descriptor, &new_device_descriptor, sizeof(dev->descriptor)); + err = usb_reset_configuration(dev); + if (err < 0) + dev_dbg(&dev->dev, "error usb_reset_configuration: %d\n", err); +@@ -901,6 +906,7 @@ static void mbox2_setup_48_24_magic(stru + static int snd_usb_mbox2_boot_quirk(struct usb_device *dev) + { + struct usb_host_config *config = dev->actconfig; ++ struct usb_device_descriptor new_device_descriptor; + int err; + u8 bootresponse[0x12]; + int fwsize; +@@ -936,10 +942,14 @@ static int snd_usb_mbox2_boot_quirk(stru + dev_dbg(&dev->dev, "device initialised!\n"); + + err = usb_get_descriptor(dev, USB_DT_DEVICE, 0, +- &dev->descriptor, sizeof(dev->descriptor)); +- config = dev->actconfig; ++ &new_device_descriptor, sizeof(new_device_descriptor)); + if (err < 0) + dev_dbg(&dev->dev, "error usb_get_descriptor: %d\n", err); ++ if (new_device_descriptor.bNumConfigurations > dev->descriptor.bNumConfigurations) ++ dev_dbg(&dev->dev, "error too large bNumConfigurations: %d\n", ++ new_device_descriptor.bNumConfigurations); ++ else ++ memcpy(&dev->descriptor, &new_device_descriptor, sizeof(dev->descriptor)); + + err = usb_reset_configuration(dev); + if (err < 0) +@@ -1253,6 +1263,7 @@ static void mbox3_setup_48_24_magic(stru + static int snd_usb_mbox3_boot_quirk(struct usb_device *dev) + { + struct usb_host_config *config = dev->actconfig; ++ struct usb_device_descriptor new_device_descriptor; + int err; + int descriptor_size; + +@@ -1266,10 +1277,14 @@ static int snd_usb_mbox3_boot_quirk(stru + dev_dbg(&dev->dev, "device initialised!\n"); + + err = usb_get_descriptor(dev, USB_DT_DEVICE, 0, +- &dev->descriptor, sizeof(dev->descriptor)); +- config = dev->actconfig; ++ &new_device_descriptor, sizeof(new_device_descriptor)); + if (err < 0) + dev_dbg(&dev->dev, "error usb_get_descriptor: %d\n", err); ++ if (new_device_descriptor.bNumConfigurations > dev->descriptor.bNumConfigurations) ++ dev_dbg(&dev->dev, "error too large bNumConfigurations: %d\n", ++ new_device_descriptor.bNumConfigurations); ++ else ++ memcpy(&dev->descriptor, &new_device_descriptor, sizeof(dev->descriptor)); + + err = usb_reset_configuration(dev); + if (err < 0) diff --git a/queue-6.6/arm64-dts-mediatek-mt8195-cherry-mark-usb-3.0-on-xhci1-as-disabled.patch b/queue-6.6/arm64-dts-mediatek-mt8195-cherry-mark-usb-3.0-on-xhci1-as-disabled.patch new file mode 100644 index 00000000000..fb3681155b9 --- /dev/null +++ b/queue-6.6/arm64-dts-mediatek-mt8195-cherry-mark-usb-3.0-on-xhci1-as-disabled.patch @@ -0,0 +1,41 @@ +From stable+bounces-95935-greg=kroah.com@vger.kernel.org Mon Dec 2 09:16:34 2024 +From: Chen-Yu Tsai +Date: Mon, 2 Dec 2024 16:15:50 +0800 +Subject: arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled +To: Greg Kroah-Hartman , Sasha Levin +Cc: "Chen-Yu Tsai" , stable@vger.kernel.org, linux-kernel@vger.kernel.org, "Matthias Brugger" , "AngeloGioacchino Del Regno" , devicetree@vger.kernel.org, linux-mediatek@lists.infradead.org, "Koichiro Den" , "Nícolas F. R. A. Prado" +Message-ID: <20241202081552.156183-2-wenst@chromium.org> + +From: Chen-Yu Tsai + +[ Upstream commit 09d385679487c58f0859c1ad4f404ba3df2f8830 ] + +USB 3.0 on xhci1 is not used, as the controller shares the same PHY as +pcie1. The latter is enabled to support the M.2 PCIe WLAN card on this +design. + +Mark USB 3.0 as disabled on this controller using the +"mediatek,u3p-dis-msk" property. + +Reported-by: Nícolas F. R. A. Prado #KernelCI +Closes: https://lore.kernel.org/all/9fce9838-ef87-4d1b-b3df-63e1ddb0ec51@notapiano/ +Fixes: b6267a396e1c ("arm64: dts: mediatek: cherry: Enable T-PHYs and USB XHCI controllers") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240731034411.371178-2-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi +@@ -1296,6 +1296,7 @@ + + vusb33-supply = <&mt6359_vusb_ldo_reg>; + vbus-supply = <&usb_vbus>; ++ mediatek,u3p-dis-msk = <1>; + }; + + &xhci2 { diff --git a/queue-6.6/btrfs-do-not-bug_on-when-freeing-tree-block-after-error.patch b/queue-6.6/btrfs-do-not-bug_on-when-freeing-tree-block-after-error.patch new file mode 100644 index 00000000000..ce341961e08 --- /dev/null +++ b/queue-6.6/btrfs-do-not-bug_on-when-freeing-tree-block-after-error.patch @@ -0,0 +1,289 @@ +From bb3868033a4cccff7be57e9145f2117cbdc91c11 Mon Sep 17 00:00:00 2001 +From: Filipe Manana +Date: Fri, 14 Jun 2024 14:50:47 +0100 +Subject: btrfs: do not BUG_ON() when freeing tree block after error + +From: Filipe Manana + +commit bb3868033a4cccff7be57e9145f2117cbdc91c11 upstream. + +When freeing a tree block, at btrfs_free_tree_block(), if we fail to +create a delayed reference we don't deal with the error and just do a +BUG_ON(). The error most likely to happen is -ENOMEM, and we have a +comment mentioning that only -ENOMEM can happen, but that is not true, +because in case qgroups are enabled any error returned from +btrfs_qgroup_trace_extent_post() (can be -EUCLEAN or anything returned +from btrfs_search_slot() for example) can be propagated back to +btrfs_free_tree_block(). + +So stop doing a BUG_ON() and return the error to the callers and make +them abort the transaction to prevent leaking space. Syzbot was +triggering this, likely due to memory allocation failure injection. + +Reported-by: syzbot+a306f914b4d01b3958fe@syzkaller.appspotmail.com +Link: https://lore.kernel.org/linux-btrfs/000000000000fcba1e05e998263c@google.com/ +Reviewed-by: Qu Wenruo +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +[ Resolve minor conflicts ] +Signed-off-by: Bin Lan +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/ctree.c | 51 ++++++++++++++++++++++++++++++++++++--------- + fs/btrfs/extent-tree.c | 22 +++++++++++-------- + fs/btrfs/extent-tree.h | 8 +++---- + fs/btrfs/free-space-tree.c | 10 ++++++-- + fs/btrfs/ioctl.c | 6 ++++- + fs/btrfs/qgroup.c | 6 +++-- + 6 files changed, 74 insertions(+), 29 deletions(-) + +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -617,10 +617,16 @@ static noinline int __btrfs_cow_block(st + atomic_inc(&cow->refs); + rcu_assign_pointer(root->node, cow); + +- btrfs_free_tree_block(trans, btrfs_root_id(root), buf, +- parent_start, last_ref); ++ ret = btrfs_free_tree_block(trans, btrfs_root_id(root), buf, ++ parent_start, last_ref); + free_extent_buffer(buf); + add_root_to_dirty_list(root); ++ if (ret < 0) { ++ btrfs_tree_unlock(cow); ++ free_extent_buffer(cow); ++ btrfs_abort_transaction(trans, ret); ++ return ret; ++ } + } else { + WARN_ON(trans->transid != btrfs_header_generation(parent)); + ret = btrfs_tree_mod_log_insert_key(parent, parent_slot, +@@ -645,8 +651,14 @@ static noinline int __btrfs_cow_block(st + return ret; + } + } +- btrfs_free_tree_block(trans, btrfs_root_id(root), buf, +- parent_start, last_ref); ++ ret = btrfs_free_tree_block(trans, btrfs_root_id(root), buf, ++ parent_start, last_ref); ++ if (ret < 0) { ++ btrfs_tree_unlock(cow); ++ free_extent_buffer(cow); ++ btrfs_abort_transaction(trans, ret); ++ return ret; ++ } + } + if (unlock_orig) + btrfs_tree_unlock(buf); +@@ -1121,9 +1133,13 @@ static noinline int balance_level(struct + free_extent_buffer(mid); + + root_sub_used(root, mid->len); +- btrfs_free_tree_block(trans, btrfs_root_id(root), mid, 0, 1); ++ ret = btrfs_free_tree_block(trans, btrfs_root_id(root), mid, 0, 1); + /* once for the root ptr */ + free_extent_buffer_stale(mid); ++ if (ret < 0) { ++ btrfs_abort_transaction(trans, ret); ++ goto out; ++ } + return 0; + } + if (btrfs_header_nritems(mid) > +@@ -1191,10 +1207,14 @@ static noinline int balance_level(struct + goto out; + } + root_sub_used(root, right->len); +- btrfs_free_tree_block(trans, btrfs_root_id(root), right, ++ ret = btrfs_free_tree_block(trans, btrfs_root_id(root), right, + 0, 1); + free_extent_buffer_stale(right); + right = NULL; ++ if (ret < 0) { ++ btrfs_abort_transaction(trans, ret); ++ goto out; ++ } + } else { + struct btrfs_disk_key right_key; + btrfs_node_key(right, &right_key, 0); +@@ -1249,9 +1269,13 @@ static noinline int balance_level(struct + goto out; + } + root_sub_used(root, mid->len); +- btrfs_free_tree_block(trans, btrfs_root_id(root), mid, 0, 1); ++ ret = btrfs_free_tree_block(trans, btrfs_root_id(root), mid, 0, 1); + free_extent_buffer_stale(mid); + mid = NULL; ++ if (ret < 0) { ++ btrfs_abort_transaction(trans, ret); ++ goto out; ++ } + } else { + /* update the parent key to reflect our changes */ + struct btrfs_disk_key mid_key; +@@ -3022,7 +3046,11 @@ static noinline int insert_new_root(stru + old = root->node; + ret = btrfs_tree_mod_log_insert_root(root->node, c, false); + if (ret < 0) { +- btrfs_free_tree_block(trans, btrfs_root_id(root), c, 0, 1); ++ int ret2; ++ ++ ret2 = btrfs_free_tree_block(trans, btrfs_root_id(root), c, 0, 1); ++ if (ret2 < 0) ++ btrfs_abort_transaction(trans, ret2); + btrfs_tree_unlock(c); + free_extent_buffer(c); + return ret; +@@ -4587,9 +4615,12 @@ static noinline int btrfs_del_leaf(struc + root_sub_used(root, leaf->len); + + atomic_inc(&leaf->refs); +- btrfs_free_tree_block(trans, btrfs_root_id(root), leaf, 0, 1); ++ ret = btrfs_free_tree_block(trans, btrfs_root_id(root), leaf, 0, 1); + free_extent_buffer_stale(leaf); +- return 0; ++ if (ret < 0) ++ btrfs_abort_transaction(trans, ret); ++ ++ return ret; + } + /* + * delete the item at the leaf level in path. If that empties +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -3290,10 +3290,10 @@ out_delayed_unlock: + return 0; + } + +-void btrfs_free_tree_block(struct btrfs_trans_handle *trans, +- u64 root_id, +- struct extent_buffer *buf, +- u64 parent, int last_ref) ++int btrfs_free_tree_block(struct btrfs_trans_handle *trans, ++ u64 root_id, ++ struct extent_buffer *buf, ++ u64 parent, int last_ref) + { + struct btrfs_fs_info *fs_info = trans->fs_info; + struct btrfs_ref generic_ref = { 0 }; +@@ -3307,7 +3307,8 @@ void btrfs_free_tree_block(struct btrfs_ + if (root_id != BTRFS_TREE_LOG_OBJECTID) { + btrfs_ref_tree_mod(fs_info, &generic_ref); + ret = btrfs_add_delayed_tree_ref(trans, &generic_ref, NULL); +- BUG_ON(ret); /* -ENOMEM */ ++ if (ret < 0) ++ return ret; + } + + if (last_ref && btrfs_header_generation(buf) == trans->transid) { +@@ -3371,6 +3372,7 @@ out: + */ + clear_bit(EXTENT_BUFFER_CORRUPT, &buf->bflags); + } ++ return 0; + } + + /* Can return -ENOMEM */ +@@ -5474,7 +5476,7 @@ static noinline int walk_up_proc(struct + struct walk_control *wc) + { + struct btrfs_fs_info *fs_info = root->fs_info; +- int ret; ++ int ret = 0; + int level = wc->level; + struct extent_buffer *eb = path->nodes[level]; + u64 parent = 0; +@@ -5565,12 +5567,14 @@ static noinline int walk_up_proc(struct + goto owner_mismatch; + } + +- btrfs_free_tree_block(trans, btrfs_root_id(root), eb, parent, +- wc->refs[level] == 1); ++ ret = btrfs_free_tree_block(trans, btrfs_root_id(root), eb, parent, ++ wc->refs[level] == 1); ++ if (ret < 0) ++ btrfs_abort_transaction(trans, ret); + out: + wc->refs[level] = 0; + wc->flags[level] = 0; +- return 0; ++ return ret; + + owner_mismatch: + btrfs_err_rl(fs_info, "unexpected tree owner, have %llu expect %llu", +--- a/fs/btrfs/extent-tree.h ++++ b/fs/btrfs/extent-tree.h +@@ -114,10 +114,10 @@ struct extent_buffer *btrfs_alloc_tree_b + int level, u64 hint, + u64 empty_size, + enum btrfs_lock_nesting nest); +-void btrfs_free_tree_block(struct btrfs_trans_handle *trans, +- u64 root_id, +- struct extent_buffer *buf, +- u64 parent, int last_ref); ++int btrfs_free_tree_block(struct btrfs_trans_handle *trans, ++ u64 root_id, ++ struct extent_buffer *buf, ++ u64 parent, int last_ref); + int btrfs_alloc_reserved_file_extent(struct btrfs_trans_handle *trans, + struct btrfs_root *root, u64 owner, + u64 offset, u64 ram_bytes, +--- a/fs/btrfs/free-space-tree.c ++++ b/fs/btrfs/free-space-tree.c +@@ -1289,10 +1289,14 @@ int btrfs_delete_free_space_tree(struct + btrfs_tree_lock(free_space_root->node); + btrfs_clear_buffer_dirty(trans, free_space_root->node); + btrfs_tree_unlock(free_space_root->node); +- btrfs_free_tree_block(trans, btrfs_root_id(free_space_root), +- free_space_root->node, 0, 1); +- ++ ret = btrfs_free_tree_block(trans, btrfs_root_id(free_space_root), ++ free_space_root->node, 0, 1); + btrfs_put_root(free_space_root); ++ if (ret < 0) { ++ btrfs_abort_transaction(trans, ret); ++ btrfs_end_transaction(trans); ++ return ret; ++ } + + return btrfs_commit_transaction(trans); + +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -707,6 +707,8 @@ static noinline int create_subvol(struct + ret = btrfs_insert_root(trans, fs_info->tree_root, &key, + root_item); + if (ret) { ++ int ret2; ++ + /* + * Since we don't abort the transaction in this case, free the + * tree block so that we don't leak space and leave the +@@ -717,7 +719,9 @@ static noinline int create_subvol(struct + btrfs_tree_lock(leaf); + btrfs_clear_buffer_dirty(trans, leaf); + btrfs_tree_unlock(leaf); +- btrfs_free_tree_block(trans, objectid, leaf, 0, 1); ++ ret2 = btrfs_free_tree_block(trans, objectid, leaf, 0, 1); ++ if (ret2 < 0) ++ btrfs_abort_transaction(trans, ret2); + free_extent_buffer(leaf); + goto out; + } +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -1320,9 +1320,11 @@ int btrfs_quota_disable(struct btrfs_fs_ + btrfs_tree_lock(quota_root->node); + btrfs_clear_buffer_dirty(trans, quota_root->node); + btrfs_tree_unlock(quota_root->node); +- btrfs_free_tree_block(trans, btrfs_root_id(quota_root), +- quota_root->node, 0, 1); ++ ret = btrfs_free_tree_block(trans, btrfs_root_id(quota_root), ++ quota_root->node, 0, 1); + ++ if (ret < 0) ++ btrfs_abort_transaction(trans, ret); + + out: + btrfs_put_root(quota_root); diff --git a/queue-6.6/f2fs-fix-null-reference-error-when-checking-end-of-zone.patch b/queue-6.6/f2fs-fix-null-reference-error-when-checking-end-of-zone.patch new file mode 100644 index 00000000000..88f1f68f282 --- /dev/null +++ b/queue-6.6/f2fs-fix-null-reference-error-when-checking-end-of-zone.patch @@ -0,0 +1,46 @@ +From c82bc1ab2a8a5e73d9728e80c4c2ed87e8921a38 Mon Sep 17 00:00:00 2001 +From: Daejun Park +Date: Thu, 4 Jul 2024 10:01:21 +0900 +Subject: f2fs: fix null reference error when checking end of zone + +From: Daejun Park + +commit c82bc1ab2a8a5e73d9728e80c4c2ed87e8921a38 upstream. + +This patch fixes a potentially null pointer being accessed by +is_end_zone_blkaddr() that checks the last block of a zone +when f2fs is mounted as a single device. + +Fixes: e067dc3c6b9c ("f2fs: maintain six open zones for zoned devices") +Signed-off-by: Daejun Park +Reviewed-by: Chao Yu +Reviewed-by: Daeho Jeong +Signed-off-by: Jaegeuk Kim +[ Resolve minor conflicts ] +Signed-off-by: Bin Lan +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/data.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -924,6 +924,7 @@ alloc_new: + #ifdef CONFIG_BLK_DEV_ZONED + static bool is_end_zone_blkaddr(struct f2fs_sb_info *sbi, block_t blkaddr) + { ++ struct block_device *bdev = sbi->sb->s_bdev; + int devi = 0; + + if (f2fs_is_multi_device(sbi)) { +@@ -934,8 +935,9 @@ static bool is_end_zone_blkaddr(struct f + return false; + } + blkaddr -= FDEV(devi).start_blk; ++ bdev = FDEV(devi).bdev; + } +- return bdev_zoned_model(FDEV(devi).bdev) == BLK_ZONED_HM && ++ return bdev_is_zoned(bdev) && + f2fs_blkz_is_seq(sbi, devi, blkaddr) && + (blkaddr % sbi->blocks_per_blkz == sbi->blocks_per_blkz - 1); + } diff --git a/queue-6.6/revert-arm64-dts-mediatek-mt8195-cherry-mark-usb-3.0-on-xhci1-as-disabled.patch b/queue-6.6/revert-arm64-dts-mediatek-mt8195-cherry-mark-usb-3.0-on-xhci1-as-disabled.patch new file mode 100644 index 00000000000..508f8e06a74 --- /dev/null +++ b/queue-6.6/revert-arm64-dts-mediatek-mt8195-cherry-mark-usb-3.0-on-xhci1-as-disabled.patch @@ -0,0 +1,36 @@ +From stable+bounces-95934-greg=kroah.com@vger.kernel.org Mon Dec 2 09:16:23 2024 +From: Chen-Yu Tsai +Date: Mon, 2 Dec 2024 16:15:49 +0800 +Subject: Revert "arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled" +To: Greg Kroah-Hartman , Sasha Levin +Cc: Chen-Yu Tsai , stable@vger.kernel.org, linux-kernel@vger.kernel.org, Matthias Brugger , AngeloGioacchino Del Regno , devicetree@vger.kernel.org, linux-mediatek@lists.infradead.org, Koichiro Den +Message-ID: <20241202081552.156183-1-wenst@chromium.org> + +From: Chen-Yu Tsai + +This reverts commit 090386dbedbc2f099c44a0136eb8eb8713930072. + +The hunk was applied to the wrong device node when the commit was +backported to the 6.6 stable branch. + +Revert it to re-do the backport correctly. + +Reported-by: Koichiro Den +Closes: https://lore.kernel.org/stable/6itvivhxbjlpky5hn6x2hmc3kzz4regcvmsk226t6ippjad7yk@26xug5lrdqdw/ +Fixes: 090386dbedbc ("arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi +@@ -1312,7 +1312,6 @@ + usb2-lpm-disable; + vusb33-supply = <&mt6359_vusb_ldo_reg>; + vbus-supply = <&usb_vbus>; +- mediatek,u3p-dis-msk = <1>; + }; + + #include diff --git a/queue-6.6/series b/queue-6.6/series index ee82b17d511..dbf04351bc7 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -468,3 +468,8 @@ drm-amd-display-check-phantom_stream-before-it-is-used.patch drm-amd-display-add-null-pointer-check-for-kzalloc.patch dm-bufio-fix-warnings-about-duplicate-slab-caches.patch perf-x86-intel-hide-topdown-metrics-events-if-the-feature-is-not-enumerated.patch +f2fs-fix-null-reference-error-when-checking-end-of-zone.patch +btrfs-do-not-bug_on-when-freeing-tree-block-after-error.patch +alsa-usb-audio-fix-potential-out-of-bound-accesses-for-extigy-and-mbox-devices.patch +revert-arm64-dts-mediatek-mt8195-cherry-mark-usb-3.0-on-xhci1-as-disabled.patch +arm64-dts-mediatek-mt8195-cherry-mark-usb-3.0-on-xhci1-as-disabled.patch -- 2.47.3