From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 15:11:04 +0000 (+0200) Subject: 6.1-stable patches X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=ddf668452bd76a408705af7f0b62dfd6dffd8b5c;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: alsa-seq-check-ump-support-for-midi_version-change.patch alsa-seq-fix-uninitialised-heap-leak-in-snd_seq_event_dup.patch alsa-seq-skip-event-type-filtering-for-ump-events.patch bluetooth-hci-disallow-setting-handle-bigger-than-hci_conn_handle_max.patch bluetooth-ignore-too-large-handle-values-in-big.patch cifs-fix-lock-ordering-while-disabling-multichannel.patch iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch iio-invensense-fix-odr-switching-to-same-value.patch tools-virtio-add-dma-sync-api-for-virtio-test.patch virtio_ring-fix-syncs-dma-memory-with-different-direction.patch --- diff --git a/queue-6.1/alsa-seq-check-ump-support-for-midi_version-change.patch b/queue-6.1/alsa-seq-check-ump-support-for-midi_version-change.patch new file mode 100644 index 0000000000..090b7ee687 --- /dev/null +++ b/queue-6.1/alsa-seq-check-ump-support-for-midi_version-change.patch @@ -0,0 +1,46 @@ +From 8765429279e7d3d68d39ace5f84af2815174bb1e Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 31 Dec 2024 15:53:58 +0100 +Subject: ALSA: seq: Check UMP support for midi_version change + +From: Takashi Iwai + +commit 8765429279e7d3d68d39ace5f84af2815174bb1e upstream. + +When the kernel is built without UMP support but a user-space app +requires the midi_version > 0, the kernel should return an error. +Otherwise user-space assumes as if it were possible to deal, +eventually hitting serious errors later. + +Fixes: 46397622a3fa ("ALSA: seq: Add UMP support") +Cc: +Link: https://patch.msgid.link/20241231145358.21946-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/seq/seq_clientmgr.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -1329,10 +1329,16 @@ static int snd_seq_ioctl_set_client_info + if (client->type != client_info->type) + return -EINVAL; + +- /* check validity of midi_version field */ +- if (client->user_pversion >= SNDRV_PROTOCOL_VERSION(1, 0, 3) && +- client_info->midi_version > SNDRV_SEQ_CLIENT_UMP_MIDI_2_0) +- return -EINVAL; ++ if (client->user_pversion >= SNDRV_PROTOCOL_VERSION(1, 0, 3)) { ++ /* check validity of midi_version field */ ++ if (client_info->midi_version > SNDRV_SEQ_CLIENT_UMP_MIDI_2_0) ++ return -EINVAL; ++ ++ /* check if UMP is supported in kernel */ ++ if (!IS_ENABLED(CONFIG_SND_SEQ_UMP) && ++ client_info->midi_version > 0) ++ return -EINVAL; ++ } + + /* fill the info fields */ + if (client_info->name[0]) diff --git a/queue-6.1/alsa-seq-fix-uninitialised-heap-leak-in-snd_seq_event_dup.patch b/queue-6.1/alsa-seq-fix-uninitialised-heap-leak-in-snd_seq_event_dup.patch new file mode 100644 index 0000000000..75cfbdd3b9 --- /dev/null +++ b/queue-6.1/alsa-seq-fix-uninitialised-heap-leak-in-snd_seq_event_dup.patch @@ -0,0 +1,55 @@ +From 435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 Mon Sep 17 00:00:00 2001 +From: HyeongJun An +Date: Wed, 24 Jun 2026 08:38:40 +0900 +Subject: ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() + +From: HyeongJun An + +commit 435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 upstream. + +snd_seq_event_dup() copies an incoming event into a pool cell and, in +the UMP-enabled build, clears the trailing cell->ump.raw.extra word that +the memcpy() did not cover. The guard deciding whether to clear it +compares the copied size against sizeof(cell->event): + + memcpy(&cell->ump, event, size); + if (size < sizeof(cell->event)) + cell->ump.raw.extra = 0; + +For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) == +sizeof(cell->event), so the condition is false and the extra word keeps +stale data. The cell pool is allocated with kvmalloc() (not zeroed) and +cells are reused via a free list, so that word holds uninitialised heap +or leftover event data. + +When such a cell is delivered to a UMP client (client->midi_version > 0) +that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it +unconverted -- snd_seq_read() reads it out as the larger struct +snd_seq_ump_event and copies the stale word to user space, a 4-byte +kernel heap infoleak to an unprivileged /dev/snd/seq client. + +Compare against sizeof(cell->ump) instead, so the trailing word is zeroed +for every event shorter than the UMP cell. + +Fixes: 46397622a3fa ("ALSA: seq: Add UMP support") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: HyeongJun An +Link: https://patch.msgid.link/20260623233841.853326-1-sammiee5311@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/seq/seq_memory.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/core/seq/seq_memory.c ++++ b/sound/core/seq/seq_memory.c +@@ -309,7 +309,7 @@ int snd_seq_event_dup(struct snd_seq_poo + size = snd_seq_event_packet_size(event); + memcpy(&cell->ump, event, size); + #if IS_ENABLED(CONFIG_SND_SEQ_UMP) +- if (size < sizeof(cell->event)) ++ if (size < sizeof(cell->ump)) + cell->ump.raw.extra = 0; + #endif + diff --git a/queue-6.1/alsa-seq-skip-event-type-filtering-for-ump-events.patch b/queue-6.1/alsa-seq-skip-event-type-filtering-for-ump-events.patch new file mode 100644 index 0000000000..5796dc8d88 --- /dev/null +++ b/queue-6.1/alsa-seq-skip-event-type-filtering-for-ump-events.patch @@ -0,0 +1,34 @@ +From 32108c22ac619c32dd6db594319e259b63bfb387 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 19 Aug 2024 10:41:53 +0200 +Subject: ALSA: seq: Skip event type filtering for UMP events + +From: Takashi Iwai + +commit 32108c22ac619c32dd6db594319e259b63bfb387 upstream. + +UMP events don't use the event type field, hence it's invalid to apply +the filter, which may drop the events unexpectedly. +Skip the event filtering for UMP events, instead. + +Fixes: 46397622a3fa ("ALSA: seq: Add UMP support") +Cc: +Link: https://patch.msgid.link/20240819084156.10286-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/seq/seq_clientmgr.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -528,6 +528,9 @@ static struct snd_seq_client *get_event_ + return NULL; + if (! dest->accept_input) + goto __not_avail; ++ if (snd_seq_ev_is_ump(event)) ++ return dest; /* ok - no filter checks */ ++ + if ((dest->filter & SNDRV_SEQ_FILTER_USE_EVENT) && + ! test_bit(event->type, dest->event_filter)) + goto __not_avail; diff --git a/queue-6.1/bluetooth-hci-disallow-setting-handle-bigger-than-hci_conn_handle_max.patch b/queue-6.1/bluetooth-hci-disallow-setting-handle-bigger-than-hci_conn_handle_max.patch new file mode 100644 index 0000000000..0429158b66 --- /dev/null +++ b/queue-6.1/bluetooth-hci-disallow-setting-handle-bigger-than-hci_conn_handle_max.patch @@ -0,0 +1,60 @@ +From 1cc18c2ab2e8c54c355ea7c0423a636e415a0c23 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Thu, 20 Jun 2024 22:27:47 +0300 +Subject: bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX + +From: Pavel Skripkin + +commit 1cc18c2ab2e8c54c355ea7c0423a636e415a0c23 upstream. + +Syzbot hit warning in hci_conn_del() caused by freeing handle that was +not allocated using ida allocator. + +This is caused by handle bigger than HCI_CONN_HANDLE_MAX passed by +hci_le_big_sync_established_evt(), which makes code think it's unset +connection. + +Add same check for handle upper bound as in hci_conn_set_handle() to +prevent warning. + +Link: https://syzkaller.appspot.com/bug?extid=b2545b087a01a7319474 +Reported-by: syzbot+b2545b087a01a7319474@syzkaller.appspotmail.com +Fixes: 181a42edddf5 ("Bluetooth: Make handle of hci_conn be unique") +Signed-off-by: Pavel Skripkin +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hci_conn.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -988,8 +988,8 @@ static int hci_conn_hash_alloc_unset(str + U16_MAX, GFP_ATOMIC); + } + +-struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, +- u8 role, u16 handle) ++static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, ++ u8 role, u16 handle) + { + struct hci_conn *conn; + +@@ -1096,7 +1096,16 @@ struct hci_conn *hci_conn_add_unset(stru + if (unlikely(handle < 0)) + return NULL; + +- return hci_conn_add(hdev, type, dst, role, handle); ++ return __hci_conn_add(hdev, type, dst, role, handle); ++} ++ ++struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, ++ u8 role, u16 handle) ++{ ++ if (handle > HCI_CONN_HANDLE_MAX) ++ return ERR_PTR(-EINVAL); ++ ++ return __hci_conn_add(hdev, type, dst, role, handle); + } + + static bool hci_conn_unlink(struct hci_conn *conn) diff --git a/queue-6.1/bluetooth-ignore-too-large-handle-values-in-big.patch b/queue-6.1/bluetooth-ignore-too-large-handle-values-in-big.patch new file mode 100644 index 0000000000..7ba3a91750 --- /dev/null +++ b/queue-6.1/bluetooth-ignore-too-large-handle-values-in-big.patch @@ -0,0 +1,36 @@ +From 015d79c96d62cd8a4a359fcf5be40d58088c936b Mon Sep 17 00:00:00 2001 +From: Edward Adam Davis +Date: Mon, 17 Jun 2024 19:09:37 +0800 +Subject: Bluetooth: Ignore too large handle values in BIG + +From: Edward Adam Davis + +commit 015d79c96d62cd8a4a359fcf5be40d58088c936b upstream. + +hci_le_big_sync_established_evt is necessary to filter out cases where the +handle value is belonging to ida id range, otherwise ida will be erroneously +released in hci_conn_cleanup. + +Fixes: 181a42edddf5 ("Bluetooth: Make handle of hci_conn be unique") +Reported-by: syzbot+b2545b087a01a7319474@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=b2545b087a01a7319474 +Signed-off-by: Edward Adam Davis +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hci_event.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -6951,6 +6951,10 @@ static void hci_le_big_sync_established_ + + bis = hci_conn_hash_lookup_handle(hdev, handle); + if (!bis) { ++ if (handle > HCI_CONN_HANDLE_MAX) { ++ bt_dev_dbg(hdev, "ignore too large handle %u", handle); ++ continue; ++ } + bis = hci_conn_add(hdev, ISO_LINK, BDADDR_ANY, + HCI_ROLE_SLAVE, handle); + if (!bis) diff --git a/queue-6.1/cifs-fix-lock-ordering-while-disabling-multichannel.patch b/queue-6.1/cifs-fix-lock-ordering-while-disabling-multichannel.patch new file mode 100644 index 0000000000..695272fcbc --- /dev/null +++ b/queue-6.1/cifs-fix-lock-ordering-while-disabling-multichannel.patch @@ -0,0 +1,82 @@ +From 5eef12c4e3230f2025dc46ad8c4a3bc19978e5d7 Mon Sep 17 00:00:00 2001 +From: Shyam Prasad N +Date: Tue, 14 Nov 2023 04:58:23 +0000 +Subject: cifs: fix lock ordering while disabling multichannel + +From: Shyam Prasad N + +commit 5eef12c4e3230f2025dc46ad8c4a3bc19978e5d7 upstream. + +The code to handle the case of server disabling multichannel +was picking iface_lock with chan_lock held. This goes against +the lock ordering rules, as iface_lock is a higher order lock +(even if it isn't so obvious). + +This change fixes the lock ordering by doing the following in +that order for each secondary channel: +1. store iface and server pointers in local variable +2. remove references to iface and server in channels +3. unlock chan_lock +4. lock iface_lock +5. dec ref count for iface +6. unlock iface_lock +7. dec ref count for server +8. lock chan_lock again + +Since this function can only be called in smb2_reconnect, and +that cannot be called by two parallel processes, we should not +have races due to dropping chan_lock between steps 3 and 8. + +Fixes: ee1d21794e55 ("cifs: handle when server stops supporting multichannel") +Reported-by: Paulo Alcantara +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/sess.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +--- a/fs/smb/client/sess.c ++++ b/fs/smb/client/sess.c +@@ -303,28 +303,32 @@ cifs_disable_secondary_channels(struct c + iface = ses->chans[i].iface; + server = ses->chans[i].server; + ++ /* ++ * remove these references first, since we need to unlock ++ * the chan_lock here, since iface_lock is a higher lock ++ */ ++ ses->chans[i].iface = NULL; ++ ses->chans[i].server = NULL; ++ spin_unlock(&ses->chan_lock); ++ + if (iface) { + spin_lock(&ses->iface_lock); + kref_put(&iface->refcount, release_iface); +- ses->chans[i].iface = NULL; + iface->num_channels--; + if (iface->weight_fulfilled) + iface->weight_fulfilled--; + spin_unlock(&ses->iface_lock); + } + +- spin_unlock(&ses->chan_lock); +- if (server && !server->terminate) { +- server->terminate = true; +- cifs_signal_cifsd_for_reconnect(server, false); +- } +- spin_lock(&ses->chan_lock); +- + if (server) { +- ses->chans[i].server = NULL; ++ if (!server->terminate) { ++ server->terminate = true; ++ cifs_signal_cifsd_for_reconnect(server, false); ++ } + cifs_put_tcp_session(server, false); + } + ++ spin_lock(&ses->chan_lock); + } + + done: diff --git a/queue-6.1/iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch b/queue-6.1/iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch new file mode 100644 index 0000000000..9d96e8ba1c --- /dev/null +++ b/queue-6.1/iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch @@ -0,0 +1,55 @@ +From 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol +Date: Tue, 23 Jun 2026 16:22:15 +0200 +Subject: iio: imu: inv_icm42600: fix timestamp clock period by using lower value + +From: Jean-Baptiste Maneyrol + +commit 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 upstream. + +Clock period value is used for computing periods of sampling. There is +no need for it to be higher than the maximum odr, otherwise we are +losing precision in the computation for nothing. + +Switch clock period value to maximum odr period (8kHz). + +Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 ++-- + drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c +@@ -720,10 +720,10 @@ struct iio_dev *inv_icm42600_accel_init( + return ERR_PTR(-ENOMEM); + + /* +- * clock period is 32kHz (31250ns) ++ * clock period is 8kHz (125000ns) + * jitter is +/- 2% (20 per mille) + */ +- ts_chip.clock_period = 31250; ++ ts_chip.clock_period = 125000; + ts_chip.jitter = 20; + ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr); + ts = iio_priv(indio_dev); +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c +@@ -731,10 +731,10 @@ struct iio_dev *inv_icm42600_gyro_init(s + return ERR_PTR(-ENOMEM); + + /* +- * clock period is 32kHz (31250ns) ++ * clock period is 8kHz (125000ns) + * jitter is +/- 2% (20 per mille) + */ +- ts_chip.clock_period = 31250; ++ ts_chip.clock_period = 125000; + ts_chip.jitter = 20; + ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr); + ts = iio_priv(indio_dev); diff --git a/queue-6.1/iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch b/queue-6.1/iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch new file mode 100644 index 0000000000..12c2a18b6c --- /dev/null +++ b/queue-6.1/iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch @@ -0,0 +1,45 @@ +From daec424cc57b33a28f8621eb7ac85f8bd327bd6b Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol +Date: Mon, 19 Feb 2024 15:47:41 +0000 +Subject: iio: imu: inv_mpu6050: fix frequency setting when chip is off + +From: Jean-Baptiste Maneyrol + +commit daec424cc57b33a28f8621eb7ac85f8bd327bd6b upstream. + +Track correctly FIFO state and apply ODR change before starting +the chip. Without the fix, you cannot change ODR more than 1 time +when data buffering is off. This restriction on a single pending ODR +change should only apply when the FIFO is on. + +Fixes: 111e1abd0045 ("iio: imu: inv_mpu6050: use the common inv_sensors timestamp module") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol +Link: https://lore.kernel.org/r/20240219154741.90601-1-inv.git-commit@tdk.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c ++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c +@@ -111,6 +111,7 @@ int inv_mpu6050_prepare_fifo(struct inv_ + if (enable) { + /* reset timestamping */ + inv_sensors_timestamp_reset(&st->timestamp); ++ inv_sensors_timestamp_apply_odr(&st->timestamp, 0, 0, 0); + /* reset FIFO */ + d = st->chip_config.user_ctrl | INV_MPU6050_BIT_FIFO_RST; + ret = regmap_write(st->map, st->reg->user_ctrl, d); +@@ -184,6 +185,10 @@ static int inv_mpu6050_set_enable(struct + if (result) + goto error_power_off; + } else { ++ st->chip_config.gyro_fifo_enable = 0; ++ st->chip_config.accl_fifo_enable = 0; ++ st->chip_config.temp_fifo_enable = 0; ++ st->chip_config.magn_fifo_enable = 0; + result = inv_mpu6050_prepare_fifo(st, false); + if (result) + goto error_power_off; diff --git a/queue-6.1/iio-invensense-fix-odr-switching-to-same-value.patch b/queue-6.1/iio-invensense-fix-odr-switching-to-same-value.patch new file mode 100644 index 0000000000..cf49075df1 --- /dev/null +++ b/queue-6.1/iio-invensense-fix-odr-switching-to-same-value.patch @@ -0,0 +1,46 @@ +From 95444b9eeb8c5c0330563931d70c61ca3b101548 Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol +Date: Fri, 24 May 2024 12:48:51 +0000 +Subject: iio: invensense: fix odr switching to same value + +From: Jean-Baptiste Maneyrol + +commit 95444b9eeb8c5c0330563931d70c61ca3b101548 upstream. + +ODR switching happens in 2 steps, update to store the new value and then +apply when the ODR change flag is received in the data. When switching to +the same ODR value, the ODR change flag is never happening, and frequency +switching is blocked waiting for the never coming apply. + +Fix the issue by preventing update to happen when switching to same ODR +value. + +Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol +Link: https://lore.kernel.org/r/20240524124851.567485-1-inv.git-commit@tdk.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/common/inv_sensors/inv_sensors_timestamp.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c ++++ b/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c +@@ -60,11 +60,15 @@ EXPORT_SYMBOL_NS_GPL(inv_sensors_timesta + int inv_sensors_timestamp_update_odr(struct inv_sensors_timestamp *ts, + uint32_t period, bool fifo) + { ++ uint32_t mult; ++ + /* when FIFO is on, prevent odr change if one is already pending */ + if (fifo && ts->new_mult != 0) + return -EAGAIN; + +- ts->new_mult = period / ts->chip.clock_period; ++ mult = period / ts->chip.clock_period; ++ if (mult != ts->mult) ++ ts->new_mult = mult; + + return 0; + } diff --git a/queue-6.1/series b/queue-6.1/series index 9e339bb064..67063f2697 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -1054,3 +1054,14 @@ jiffies-cast-to-unsigned-long-in-secs_to_jiffies-conversion.patch driver-core-fix-missing-jiffies-conversion-in-deferred_probe_extend_timeout.patch driver-core-guard-deferred-probe-timeout-extension-with-delayed_work_pending.patch alsa-seq-avoid-confusion-of-aligned-read-size.patch +tools-virtio-add-dma-sync-api-for-virtio-test.patch +cifs-fix-lock-ordering-while-disabling-multichannel.patch +virtio_ring-fix-syncs-dma-memory-with-different-direction.patch +iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch +iio-invensense-fix-odr-switching-to-same-value.patch +bluetooth-ignore-too-large-handle-values-in-big.patch +bluetooth-hci-disallow-setting-handle-bigger-than-hci_conn_handle_max.patch +alsa-seq-skip-event-type-filtering-for-ump-events.patch +alsa-seq-check-ump-support-for-midi_version-change.patch +iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch +alsa-seq-fix-uninitialised-heap-leak-in-snd_seq_event_dup.patch diff --git a/queue-6.1/tools-virtio-add-dma-sync-api-for-virtio-test.patch b/queue-6.1/tools-virtio-add-dma-sync-api-for-virtio-test.patch new file mode 100644 index 0000000000..696760c3df --- /dev/null +++ b/queue-6.1/tools-virtio-add-dma-sync-api-for-virtio-test.patch @@ -0,0 +1,46 @@ +From e07744b43d3ad10b040f0ec464b6323ca96903d6 Mon Sep 17 00:00:00 2001 +From: Liming Wu +Date: Sun, 8 Oct 2023 11:17:33 +0800 +Subject: tools/virtio: Add dma sync api for virtio test + +From: Liming Wu + +commit e07744b43d3ad10b040f0ec464b6323ca96903d6 upstream. + +Fixes: 8bd2f71054bd ("virtio_ring: introduce dma sync api for virtqueue") +also add dma sync api for virtio test. + +Signed-off-by: Liming Wu +Message-Id: <20231008031734.1095-1-liming.wu@jaguarmicro.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Greg Kroah-Hartman +--- + tools/virtio/linux/dma-mapping.h | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/tools/virtio/linux/dma-mapping.h ++++ b/tools/virtio/linux/dma-mapping.h +@@ -24,11 +24,23 @@ enum dma_data_direction { + #define dma_map_page(d, p, o, s, dir) (page_to_phys(p) + (o)) + + #define dma_map_single(d, p, s, dir) (virt_to_phys(p)) ++#define dma_map_single_attrs(d, p, s, dir, a) (virt_to_phys(p)) + #define dma_mapping_error(...) (0) + + #define dma_unmap_single(d, a, s, r) do { (void)(d); (void)(a); (void)(s); (void)(r); } while (0) + #define dma_unmap_page(d, a, s, r) do { (void)(d); (void)(a); (void)(s); (void)(r); } while (0) + ++#define sg_dma_address(sg) (0) ++#define dma_need_sync(v, a) (0) ++#define dma_unmap_single_attrs(d, a, s, r, t) do { \ ++ (void)(d); (void)(a); (void)(s); (void)(r); (void)(t); \ ++} while (0) ++#define dma_sync_single_range_for_cpu(d, a, o, s, r) do { \ ++ (void)(d); (void)(a); (void)(o); (void)(s); (void)(r); \ ++} while (0) ++#define dma_sync_single_range_for_device(d, a, o, s, r) do { \ ++ (void)(d); (void)(a); (void)(o); (void)(s); (void)(r); \ ++} while (0) + #define dma_max_mapping_size(...) SIZE_MAX + + #endif diff --git a/queue-6.1/virtio_ring-fix-syncs-dma-memory-with-different-direction.patch b/queue-6.1/virtio_ring-fix-syncs-dma-memory-with-different-direction.patch new file mode 100644 index 0000000000..16d33c34fe --- /dev/null +++ b/queue-6.1/virtio_ring-fix-syncs-dma-memory-with-different-direction.patch @@ -0,0 +1,95 @@ +From 1f475cd572ea77ae6474a17e693a96bca927efe9 Mon Sep 17 00:00:00 2001 +From: Xuan Zhuo +Date: Fri, 1 Dec 2023 11:33:03 +0800 +Subject: virtio_ring: fix syncs DMA memory with different direction + +From: Xuan Zhuo + +commit 1f475cd572ea77ae6474a17e693a96bca927efe9 upstream. + +Now the APIs virtqueue_dma_sync_single_range_for_{cpu,device} ignore +the parameter 'dir', that is a mistake. + +[ 6.101666] ------------[ cut here ]------------ +[ 6.102079] DMA-API: virtio-pci 0000:00:04.0: device driver syncs DMA memory with different direction [device address=0x00000000ae010000] [size=32752 bytes] [mapped with DMA_FROM_DEVICE] [synced with DMA_BIDIRECTIONAL] +[ 6.103630] WARNING: CPU: 6 PID: 0 at kernel/dma/debug.c:1125 check_sync+0x53e/0x6c0 +[ 6.107420] CPU: 6 PID: 0 Comm: swapper/6 Tainted: G E 6.6.0+ #290 +[ 6.108030] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +[ 6.108936] RIP: 0010:check_sync+0x53e/0x6c0 +[ 6.109289] Code: 24 10 e8 f5 d9 74 00 4c 8b 4c 24 10 4c 8b 44 24 18 48 8b 4c 24 20 48 89 c6 41 56 4c 89 ea 48 c7 c7 b0 f1 50 82 e8 32 fc f3 ff <0f> 0b 48 c7 c7 48 4b 4a 82 e8 74 d9 fc ff 8b 73 4c 48 8d 7b 50 31 +[ 6.110750] RSP: 0018:ffffc90000180cd8 EFLAGS: 00010092 +[ 6.111178] RAX: 00000000000000ce RBX: ffff888100aa5900 RCX: 0000000000000000 +[ 6.111744] RDX: 0000000000000104 RSI: ffffffff824c3208 RDI: 00000000ffffffff +[ 6.112316] RBP: ffffc90000180d40 R08: 0000000000000000 R09: 00000000fffeffff +[ 6.112893] R10: ffffc90000180b98 R11: ffffffff82f63308 R12: ffffffff83d5af00 +[ 6.113460] R13: ffff888100998200 R14: ffffffff824a4b5f R15: 0000000000000286 +[ 6.114027] FS: 0000000000000000(0000) GS:ffff88842fd80000(0000) knlGS:0000000000000000 +[ 6.114665] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 6.115128] CR2: 00007f10f1e03030 CR3: 0000000108272004 CR4: 0000000000770ee0 +[ 6.115701] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 6.116272] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 6.116842] PKRU: 55555554 +[ 6.117069] Call Trace: +[ 6.117275] +[ 6.117452] ? __warn+0x84/0x140 +[ 6.117727] ? check_sync+0x53e/0x6c0 +[ 6.118034] ? __report_bug+0xea/0x100 +[ 6.118353] ? check_sync+0x53e/0x6c0 +[ 6.118653] ? report_bug+0x41/0xc0 +[ 6.118944] ? handle_bug+0x3c/0x70 +[ 6.119237] ? exc_invalid_op+0x18/0x70 +[ 6.119551] ? asm_exc_invalid_op+0x1a/0x20 +[ 6.119900] ? check_sync+0x53e/0x6c0 +[ 6.120199] ? check_sync+0x53e/0x6c0 +[ 6.120499] debug_dma_sync_single_for_cpu+0x5c/0x70 +[ 6.120906] ? dma_sync_single_for_cpu+0xb7/0x100 +[ 6.121291] virtnet_rq_unmap+0x158/0x170 [virtio_net] +[ 6.121716] virtnet_receive+0x196/0x220 [virtio_net] +[ 6.122135] virtnet_poll+0x48/0x1b0 [virtio_net] +[ 6.122524] __napi_poll+0x29/0x1b0 +[ 6.123083] net_rx_action+0x282/0x360 +[ 6.123612] __do_softirq+0xf3/0x2fb +[ 6.124138] __irq_exit_rcu+0x8e/0xf0 +[ 6.124663] common_interrupt+0xbc/0xe0 +[ 6.125202] + +We need to enable CONFIG_DMA_API_DEBUG and work with need sync mode(such +as swiotlb) to reproduce this warn. + +Fixes: 8bd2f71054bd ("virtio_ring: introduce dma sync api for virtqueue") +Reported-by: "Ning, Hongyu" +Closes: https://lore.kernel.org/all/f37cb55a-6fc8-4e21-8789-46d468325eea@linux.intel.com/ +Suggested-by: Jason Wang +Signed-off-by: Xuan Zhuo +Message-Id: <20231201033303.25141-1-xuanzhuo@linux.alibaba.com> +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Parav Pandit +Acked-by: Jason Wang +Tested-by: Hongyu Ning +Signed-off-by: Greg Kroah-Hartman +--- + drivers/virtio/virtio_ring.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -3039,8 +3039,7 @@ void virtqueue_dma_sync_single_range_for + if (!vq->use_dma_api) + return; + +- dma_sync_single_range_for_cpu(dev, addr, offset, size, +- DMA_BIDIRECTIONAL); ++ dma_sync_single_range_for_cpu(dev, addr, offset, size, dir); + } + EXPORT_SYMBOL_GPL(virtqueue_dma_sync_single_range_for_cpu); + +@@ -3066,8 +3065,7 @@ void virtqueue_dma_sync_single_range_for + if (!vq->use_dma_api) + return; + +- dma_sync_single_range_for_device(dev, addr, offset, size, +- DMA_BIDIRECTIONAL); ++ dma_sync_single_range_for_device(dev, addr, offset, size, dir); + } + EXPORT_SYMBOL_GPL(virtqueue_dma_sync_single_range_for_device); +