From 0b2f52765025254362399b3143c8984702b50ace Mon Sep 17 00:00:00 2001 From: Frederic Weisbecker Date: Apr 29 2022 22:15:55 +0000 Subject: Merge branch 'SLE15-SP3' (58d5cf3d5c9) into 'SLE15-SP3-RT' - No -rt specific changes this merge. --- diff --git a/blacklist.conf b/blacklist.conf index 549ef14..0043a19 100644 --- a/blacklist.conf +++ b/blacklist.conf @@ -1491,3 +1491,9 @@ ec9d78070de986ecf581ea204fd322af4d2477ec # Fixes Clang build issue: https://revi 8240e87f16d17a9592c9d67857a3dcdbcb98f10d # Unsupported machine. No file to patch. 63c4c320ccf77074ffe9019ac596603133c1b517 # prerequisites break kABI 460a79e18842caca6fa0c415de4a3ac1e671ac50 # not a real bug, mostly refactoring +7f0f1f3ef62ed7a40e30aff28115bd94c4211d1d # we don't have ARCH_NOMADIK +9acc89d31f0c94c8e573ed61f3e4340bbd526d0c # breaks kABI +34b07d47dd003168556a1774558240fefbb9b461 # not applicable +b2423184ac3352a52fc7562fa0e7d23435fe67b9 # not applicable +11e3c676683c340966b9467da7d09080e522e181 # Changes kABI for no good reason +0abb33bfca0fb74df76aac03e90ce685016ef7be # not applicable diff --git a/patches.kabi/Revert-NFSv4-Handle-the-special-Linux-file-open-acce.kabi b/patches.kabi/Revert-NFSv4-Handle-the-special-Linux-file-open-acce.kabi new file mode 100644 index 0000000..a021e5c --- /dev/null +++ b/patches.kabi/Revert-NFSv4-Handle-the-special-Linux-file-open-acce.kabi @@ -0,0 +1,22 @@ +From: NeilBrown +Subject: Report kabi after Revert "NFSv4: Handle the special Linux file open access mode" +Patch-mainline: Never, kabi +References: git-fixes + +Restore the export + +Signed-off-by: NeilBrown +--- + fs/nfs/inode.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1110,6 +1110,7 @@ int nfs_open(struct inode *inode, struct + nfs_fscache_open_file(inode, filp); + return 0; + } ++EXPORT_SYMBOL_GPL(nfs_open); + + /* + * This function is called whenever some part of NFS notices that diff --git a/patches.suse/0003-amdgpu-fix-GEM-obj-leak-in-amdgpu_display_user_frame.patch b/patches.suse/0003-amdgpu-fix-GEM-obj-leak-in-amdgpu_display_user_frame.patch index 341e080..bfa034a 100644 --- a/patches.suse/0003-amdgpu-fix-GEM-obj-leak-in-amdgpu_display_user_frame.patch +++ b/patches.suse/0003-amdgpu-fix-GEM-obj-leak-in-amdgpu_display_user_frame.patch @@ -5,6 +5,7 @@ Subject: amdgpu: fix GEM obj leak in amdgpu_display_user_framebuffer_create MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit +Alt-commit: b44cdca7fd792c6b6203fd33a3030bdc43dfaee6 Git-commit: e0c16eb4b3610298a74ae5504c7f6939b12be991 Patch-mainline: v5.13-rc1 References: bsc#1152472 diff --git a/patches.suse/0004-drm-amdgpu-Don-t-query-CE-and-UE-errors.patch b/patches.suse/0004-drm-amdgpu-Don-t-query-CE-and-UE-errors.patch index cd057a4..b530089 100644 --- a/patches.suse/0004-drm-amdgpu-Don-t-query-CE-and-UE-errors.patch +++ b/patches.suse/0004-drm-amdgpu-Don-t-query-CE-and-UE-errors.patch @@ -8,6 +8,7 @@ Content-transfer-encoding: 8bit Git-commit: dce3d8e1d070900e0feeb06787a319ff9379212c Patch-mainline: v5.13-rc5 References: git-fixes +Alt-commit: 2871e10199430132c69d81c3c302db05d19db4e1 On QUERY2 IOCTL don't query counts of correctable and uncorrectable errors, since when RAS is diff --git a/patches.suse/0007-drm-vc4-hdmi-Make-sure-the-controller-is-powered-in-.patch b/patches.suse/0007-drm-vc4-hdmi-Make-sure-the-controller-is-powered-in-.patch index bb5986d..d86eee1 100644 --- a/patches.suse/0007-drm-vc4-hdmi-Make-sure-the-controller-is-powered-in-.patch +++ b/patches.suse/0007-drm-vc4-hdmi-Make-sure-the-controller-is-powered-in-.patch @@ -5,6 +5,7 @@ Subject: [PATCH] drm/vc4: hdmi: Make sure the controller is powered in detect Git-commit: 9984d6664ce9dcbbc713962539eaf7636ea246c2 Patch-mainline: v5.13 References: git-fixes +Alt-commit: 0f5251339eda7f7eb7bd4467607ae1d01b24e129 If the HPD GPIO is not available and drm_probe_ddc fails, we end up reading the HDMI_HOTPLUG register, but the controller might be powered diff --git a/patches.suse/ALSA-hda-hdmi-fix-warning-about-PCM-count-when-used-.patch b/patches.suse/ALSA-hda-hdmi-fix-warning-about-PCM-count-when-used-.patch new file mode 100644 index 0000000..7f53b97 --- /dev/null +++ b/patches.suse/ALSA-hda-hdmi-fix-warning-about-PCM-count-when-used-.patch @@ -0,0 +1,67 @@ +From c74193787b2f683751a67603fb5f15c7584f355f Mon Sep 17 00:00:00 2001 +From: Kai Vehmanen +Date: Thu, 14 Apr 2022 18:05:16 +0300 +Subject: [PATCH] ALSA: hda/hdmi: fix warning about PCM count when used with SOF +Git-commit: c74193787b2f683751a67603fb5f15c7584f355f +Patch-mainline: v5.18-rc4 +References: git-fixes + +With commit 13046370c4d1 ("ALSA: hda/hdmi: let new platforms assign the +pcm slot dynamically"), old behaviour to consider the HDA pin number, +when choosing PCM to assign, was dropped. + +Build on this change and limit the number of PCMs created to number of +converters (= maximum number of concurrent display/receivers) when +"mst_no_extra_pcms" and "dyn_pcm_no_legacy" quirks are both set. + +Fix the check in hdmi_find_pcm_slot() to ensure only spec->pcm_used +entries are considered in the search. Elsewhere in the driver +spec->pcm_used is already checked properly. + +Doing this avoids following warning at SOF driver probe for multiple +machine drivers: + +[ 112.425297] sof_sdw sof_sdw: hda_dsp_hdmi_build_controls: no +PCM in topology for HDMI converter 4 +[ 112.425298] sof_sdw sof_sdw: hda_dsp_hdmi_build_controls: no +PCM in topology for HDMI converter 5 +[ 112.425299] sof_sdw sof_sdw: hda_dsp_hdmi_build_controls: no +PCM in topology for HDMI converter 6 + +Fixes: 13046370c4d1 ("ALSA: hda/hdmi: let new platforms assign the pcm slot dynamically") +Buglink: https://github.com/thesofproject/linux/issues/2573 +Signed-off-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20220414150516.3638283-1-kai.vehmanen@linux.intel.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_hdmi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index 3e086eebf88d..f9d67058d69d 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -1395,7 +1395,7 @@ static int hdmi_find_pcm_slot(struct hdmi_spec *spec, + + last_try: + /* the last try; check the empty slots in pins */ +- for (i = 0; i < spec->num_nids; i++) { ++ for (i = 0; i < spec->pcm_used; i++) { + if (!test_bit(i, &spec->pcm_bitmap)) + return i; + } +@@ -2325,7 +2325,9 @@ static int generic_hdmi_build_pcms(struct hda_codec *codec) + * dev_num is the device entry number in a pin + */ + +- if (codec->mst_no_extra_pcms) ++ if (spec->dyn_pcm_no_legacy && codec->mst_no_extra_pcms) ++ pcm_num = spec->num_cvts; ++ else if (codec->mst_no_extra_pcms) + pcm_num = spec->num_nids; + else + pcm_num = spec->num_nids + spec->dev_num - 1; +-- +2.31.1 + diff --git a/patches.suse/ASoC-atmel-Remove-system-clock-tree-configuration-fo.patch b/patches.suse/ASoC-atmel-Remove-system-clock-tree-configuration-fo.patch new file mode 100644 index 0000000..da3c9f3 --- /dev/null +++ b/patches.suse/ASoC-atmel-Remove-system-clock-tree-configuration-fo.patch @@ -0,0 +1,142 @@ +From c775cbf62ed4911e4f0f23880f01815753123690 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Fri, 25 Mar 2022 15:42:39 +0000 +Subject: [PATCH] ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek +Git-commit: c775cbf62ed4911e4f0f23880f01815753123690 +Patch-mainline: v5.18-rc4 +References: git-fixes + +The MCLK of the WM8731 on the AT91SAM9G20-EK board is connected to the +PCK0 output of the SoC, intended in the reference software to be supplied +using PLLB and programmed to 12MHz. As originally written for use with a +board file the audio driver was responsible for configuring the entire tree +but in the conversion to the common clock framework the registration of +the named pck0 and pllb clocks was removed so the driver has failed to +instantiate ever since. + +Since the WM8731 driver has had support for managing a MCLK provided via +the common clock framework for some time we can simply drop all the clock +management code from the machine driver other than configuration of the +sysclk rate, the CODEC driver still respects that configuration from the +machine driver. + +Fixes: ff78a189b0ae55f ("ARM: at91: remove old at91-specific clock driver") +Signed-off-by: Mark Brown +Reviewed-by: Codrin Ciubotariu +Link: https://lore.kernel.org/r/20220325154241.1600757-2-broonie@kernel.org +Acked-by: Takashi Iwai + +--- + sound/soc/atmel/sam9g20_wm8731.c | 61 -------------------------------- + 1 file changed, 61 deletions(-) + +diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c +index 33e43013ff77..0d639a33ad96 100644 +--- a/sound/soc/atmel/sam9g20_wm8731.c ++++ b/sound/soc/atmel/sam9g20_wm8731.c +@@ -46,35 +46,6 @@ + */ + #undef ENABLE_MIC_INPUT + +-static struct clk *mclk; +- +-static int at91sam9g20ek_set_bias_level(struct snd_soc_card *card, +- struct snd_soc_dapm_context *dapm, +- enum snd_soc_bias_level level) +-{ +- static int mclk_on; +- int ret = 0; +- +- switch (level) { +- case SND_SOC_BIAS_ON: +- case SND_SOC_BIAS_PREPARE: +- if (!mclk_on) +- ret = clk_enable(mclk); +- if (ret == 0) +- mclk_on = 1; +- break; +- +- case SND_SOC_BIAS_OFF: +- case SND_SOC_BIAS_STANDBY: +- if (mclk_on) +- clk_disable(mclk); +- mclk_on = 0; +- break; +- } +- +- return ret; +-} +- + static const struct snd_soc_dapm_widget at91sam9g20ek_dapm_widgets[] = { + SND_SOC_DAPM_MIC("Int Mic", NULL), + SND_SOC_DAPM_SPK("Ext Spk", NULL), +@@ -135,7 +106,6 @@ static struct snd_soc_card snd_soc_at91sam9g20ek = { + .owner = THIS_MODULE, + .dai_link = &at91sam9g20ek_dai, + .num_links = 1, +- .set_bias_level = at91sam9g20ek_set_bias_level, + + .dapm_widgets = at91sam9g20ek_dapm_widgets, + .num_dapm_widgets = ARRAY_SIZE(at91sam9g20ek_dapm_widgets), +@@ -148,7 +118,6 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev) + { + struct device_node *np = pdev->dev.of_node; + struct device_node *codec_np, *cpu_np; +- struct clk *pllb; + struct snd_soc_card *card = &snd_soc_at91sam9g20ek; + int ret; + +@@ -162,31 +131,6 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev) + return -EINVAL; + } + +- /* +- * Codec MCLK is supplied by PCK0 - set it up. +- */ +- mclk = clk_get(NULL, "pck0"); +- if (IS_ERR(mclk)) { +- dev_err(&pdev->dev, "Failed to get MCLK\n"); +- ret = PTR_ERR(mclk); +- goto err; +- } +- +- pllb = clk_get(NULL, "pllb"); +- if (IS_ERR(pllb)) { +- dev_err(&pdev->dev, "Failed to get PLLB\n"); +- ret = PTR_ERR(pllb); +- goto err_mclk; +- } +- ret = clk_set_parent(mclk, pllb); +- clk_put(pllb); +- if (ret != 0) { +- dev_err(&pdev->dev, "Failed to set MCLK parent\n"); +- goto err_mclk; +- } +- +- clk_set_rate(mclk, MCLK_RATE); +- + card->dev = &pdev->dev; + + /* Parse device node info */ +@@ -230,9 +174,6 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev) + + return ret; + +-err_mclk: +- clk_put(mclk); +- mclk = NULL; + err: + atmel_ssc_put_audio(0); + return ret; +@@ -242,8 +183,6 @@ static int at91sam9g20ek_audio_remove(struct platform_device *pdev) + { + struct snd_soc_card *card = platform_get_drvdata(pdev); + +- clk_disable(mclk); +- mclk = NULL; + snd_soc_unregister_card(card); + atmel_ssc_put_audio(0); + +-- +2.31.1 + diff --git a/patches.suse/ASoC-codecs-wcd934x-do-not-switch-off-SIDO-Buck-when.patch b/patches.suse/ASoC-codecs-wcd934x-do-not-switch-off-SIDO-Buck-when.patch new file mode 100644 index 0000000..2d68ca5 --- /dev/null +++ b/patches.suse/ASoC-codecs-wcd934x-do-not-switch-off-SIDO-Buck-when.patch @@ -0,0 +1,85 @@ +From db6dd1bee63d1d88fbddfe07af800af5948ac28e Mon Sep 17 00:00:00 2001 +From: Srinivas Kandagatla +Date: Thu, 7 Apr 2022 10:43:13 +0100 +Subject: [PATCH] ASoC: codecs: wcd934x: do not switch off SIDO Buck when codec is in use +Git-commit: db6dd1bee63d1d88fbddfe07af800af5948ac28e +Patch-mainline: v5.18-rc4 +References: git-fixes + +SIDO(Single-Inductor Dual-Ouput) Buck powers up both analog and digital +circuits along with internal memory, powering off this is the last thing +that codec should do when going to very low power. + +Current code was powering off this Buck if there are no users of sysclk, +which is not correct. Powering off this buck will result in no register access. +This code path was never tested until recently after adding pm support +in SoundWire controller. Fix this by removing the buck poweroff when the +codec is active and also the code that is not used. + +Without this patch all the read/write transactions will never complete and +results in SLIMBus Errors like: + +qcom,slim-ngd qcom,slim-ngd.1: Tx:MT:0x0, MC:0x60, LA:0xcf failed:-110 +wcd934x-codec wcd934x-codec.1.auto: ASoC: error at soc_component_read_no_lock + on wcd934x-codec.1.auto for register: [0x00000d05] -110 +qcom,slim-ngd-ctrl 171c0000.slim: Error Interrupt received 0x82000000 + +Reported-by: Amit Pundir +Fixes: a61f3b4f476e ("ASoC: wcd934x: add support to wcd9340/wcd9341 codec") +Signed-off-by: Srinivas Kandagatla +Tested-by: Amit Pundir +Link: https://lore.kernel.org/r/20220407094313.2880-1-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/wcd934x.c | 26 +------------------------- + 1 file changed, 1 insertion(+), 25 deletions(-) + +diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c +index 1e75e93cf28f..6298ebe96e94 100644 +--- a/sound/soc/codecs/wcd934x.c ++++ b/sound/soc/codecs/wcd934x.c +@@ -1274,29 +1274,7 @@ static int wcd934x_set_sido_input_src(struct wcd934x_codec *wcd, int sido_src) + if (sido_src == wcd->sido_input_src) + return 0; + +- if (sido_src == SIDO_SOURCE_INTERNAL) { +- regmap_update_bits(wcd->regmap, WCD934X_ANA_BUCK_CTL, +- WCD934X_ANA_BUCK_HI_ACCU_EN_MASK, 0); +- usleep_range(100, 110); +- regmap_update_bits(wcd->regmap, WCD934X_ANA_BUCK_CTL, +- WCD934X_ANA_BUCK_HI_ACCU_PRE_ENX_MASK, 0x0); +- usleep_range(100, 110); +- regmap_update_bits(wcd->regmap, WCD934X_ANA_RCO, +- WCD934X_ANA_RCO_BG_EN_MASK, 0); +- usleep_range(100, 110); +- regmap_update_bits(wcd->regmap, WCD934X_ANA_BUCK_CTL, +- WCD934X_ANA_BUCK_PRE_EN1_MASK, +- WCD934X_ANA_BUCK_PRE_EN1_ENABLE); +- usleep_range(100, 110); +- regmap_update_bits(wcd->regmap, WCD934X_ANA_BUCK_CTL, +- WCD934X_ANA_BUCK_PRE_EN2_MASK, +- WCD934X_ANA_BUCK_PRE_EN2_ENABLE); +- usleep_range(100, 110); +- regmap_update_bits(wcd->regmap, WCD934X_ANA_BUCK_CTL, +- WCD934X_ANA_BUCK_HI_ACCU_EN_MASK, +- WCD934X_ANA_BUCK_HI_ACCU_ENABLE); +- usleep_range(100, 110); +- } else if (sido_src == SIDO_SOURCE_RCO_BG) { ++ if (sido_src == SIDO_SOURCE_RCO_BG) { + regmap_update_bits(wcd->regmap, WCD934X_ANA_RCO, + WCD934X_ANA_RCO_BG_EN_MASK, + WCD934X_ANA_RCO_BG_ENABLE); +@@ -1382,8 +1360,6 @@ static int wcd934x_disable_ana_bias_and_syclk(struct wcd934x_codec *wcd) + regmap_update_bits(wcd->regmap, WCD934X_CLK_SYS_MCLK_PRG, + WCD934X_EXT_CLK_BUF_EN_MASK | + WCD934X_MCLK_EN_MASK, 0x0); +- wcd934x_set_sido_input_src(wcd, SIDO_SOURCE_INTERNAL); +- + regmap_update_bits(wcd->regmap, WCD934X_ANA_BIAS, + WCD934X_ANA_BIAS_EN_MASK, 0); + regmap_update_bits(wcd->regmap, WCD934X_ANA_BIAS, +-- +2.31.1 + diff --git a/patches.suse/ASoC-msm8916-wcd-digital-Check-failure-for-devm_snd_.patch b/patches.suse/ASoC-msm8916-wcd-digital-Check-failure-for-devm_snd_.patch new file mode 100644 index 0000000..4fe12ee --- /dev/null +++ b/patches.suse/ASoC-msm8916-wcd-digital-Check-failure-for-devm_snd_.patch @@ -0,0 +1,46 @@ +From e927b05f3cc20de87f6b7d912a5bbe556931caca Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Sun, 3 Apr 2022 11:52:39 +0000 +Subject: [PATCH] ASoC: msm8916-wcd-digital: Check failure for devm_snd_soc_register_component +Git-commit: e927b05f3cc20de87f6b7d912a5bbe556931caca +Patch-mainline: v5.18-rc4 +References: git-fixes + +devm_snd_soc_register_component() may fails, we should check the error +and do the corresponding error handling. + +Fixes: 150db8c5afa1 ("ASoC: codecs: Add msm8916-wcd digital codec") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220403115239.30140-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/msm8916-wcd-digital.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c +index 9ad7fc0baf07..20a07c92b2fc 100644 +--- a/sound/soc/codecs/msm8916-wcd-digital.c ++++ b/sound/soc/codecs/msm8916-wcd-digital.c +@@ -1206,9 +1206,16 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev) + + dev_set_drvdata(dev, priv); + +- return devm_snd_soc_register_component(dev, &msm8916_wcd_digital, ++ ret = devm_snd_soc_register_component(dev, &msm8916_wcd_digital, + msm8916_wcd_digital_dai, + ARRAY_SIZE(msm8916_wcd_digital_dai)); ++ if (ret) ++ goto err_mclk; ++ ++ return 0; ++ ++err_mclk: ++ clk_disable_unprepare(priv->mclk); + err_clk: + clk_disable_unprepare(priv->ahbclk); + return ret; +-- +2.31.1 + diff --git a/patches.suse/ASoC-soc-dapm-fix-two-incorrect-uses-of-list-iterato.patch b/patches.suse/ASoC-soc-dapm-fix-two-incorrect-uses-of-list-iterato.patch new file mode 100644 index 0000000..6563e3d --- /dev/null +++ b/patches.suse/ASoC-soc-dapm-fix-two-incorrect-uses-of-list-iterato.patch @@ -0,0 +1,64 @@ +From f730a46b931d894816af34a0ff8e4ad51565b39f Mon Sep 17 00:00:00 2001 +From: Xiaomeng Tong +Date: Tue, 29 Mar 2022 09:21:34 +0800 +Subject: [PATCH] ASoC: soc-dapm: fix two incorrect uses of list iterator +Git-commit: f730a46b931d894816af34a0ff8e4ad51565b39f +Patch-mainline: v5.18-rc4 +References: git-fixes + +These two bug are here: + list_for_each_entry_safe_continue(w, n, list, + power_list); + list_for_each_entry_safe_continue(w, n, list, + power_list); + +After the list_for_each_entry_safe_continue() exits, the list iterator +will always be a bogus pointer which point to an invalid struct objdect +containing HEAD member. The funciton poniter 'w->event' will be a +invalid value which can lead to a control-flow hijack if the 'w' can be +controlled. + +The original intention was to continue the outer list_for_each_entry_safe() +loop with the same entry if w->event is NULL, but misunderstanding the +meaning of list_for_each_entry_safe_continue(). + +So just add a 'continue;' to fix the bug. + +Cc: stable@vger.kernel.org +Fixes: 163cac061c973 ("ASoC: Factor out DAPM sequence execution") +Signed-off-by: Xiaomeng Tong +Link: https://lore.kernel.org/r/20220329012134.9375-1-xiam0nd.tong@gmail.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/soc-dapm.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index b435b5c4cfb7..ca917a849c42 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -1687,8 +1687,7 @@ static void dapm_seq_run(struct snd_soc_card *card, + switch (w->id) { + case snd_soc_dapm_pre: + if (!w->event) +- list_for_each_entry_safe_continue(w, n, list, +- power_list); ++ continue; + + if (event == SND_SOC_DAPM_STREAM_START) + ret = w->event(w, +@@ -1700,8 +1699,7 @@ static void dapm_seq_run(struct snd_soc_card *card, + + case snd_soc_dapm_post: + if (!w->event) +- list_for_each_entry_safe_continue(w, n, list, +- power_list); ++ continue; + + if (event == SND_SOC_DAPM_STREAM_START) + ret = w->event(w, +-- +2.31.1 + diff --git a/patches.suse/IB-hfi1-Allow-larger-MTU-without-AIP.patch b/patches.suse/IB-hfi1-Allow-larger-MTU-without-AIP.patch new file mode 100644 index 0000000..322ddf4 --- /dev/null +++ b/patches.suse/IB-hfi1-Allow-larger-MTU-without-AIP.patch @@ -0,0 +1,39 @@ +From: Mike Marciniszyn +Date: Tue, 8 Feb 2022 14:25:09 -0500 +Subject: IB/hfi1: Allow larger MTU without AIP +Patch-mainline: v5.18-rc1 +Git-commit: b135e324d7a2e7fa0a7ef925076136e799b79f44 +References: jsc#SLE-13208 + +The AIP code signals the phys_mtu in the following query_port() +fragment: + + props->phys_mtu = HFI1_CAP_IS_KSET(AIP) ? hfi1_max_mtu : + ib_mtu_enum_to_int(props->max_mtu); + +Using the largest MTU possible should not depend on AIP. + +Fix by unconditionally using the hfi1_max_mtu value. + +Fixes: 6d72344cf6c4 ("IB/ipoib: Increase ipoib Datagram mode MTU's upper limit") +Link: https://lore.kernel.org/r/1644348309-174874-1-git-send-email-mike.marciniszyn@cornelisnetworks.com +Reviewed-by: Dennis Dalessandro +Signed-off-by: Mike Marciniszyn +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/hfi1/verbs.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/hfi1/verbs.c ++++ b/drivers/infiniband/hw/hfi1/verbs.c +@@ -1439,8 +1439,7 @@ static int query_port(struct rvt_dev_inf + 4096 : hfi1_max_mtu), IB_MTU_4096); + props->active_mtu = !valid_ib_mtu(ppd->ibmtu) ? props->max_mtu : + mtu_to_enum(ppd->ibmtu, IB_MTU_4096); +- props->phys_mtu = HFI1_CAP_IS_KSET(AIP) ? hfi1_max_mtu : +- ib_mtu_enum_to_int(props->max_mtu); ++ props->phys_mtu = hfi1_max_mtu; + + return 0; + } diff --git a/patches.suse/Input-omap4-keypad-fix-pm_runtime_get_sync-error-che.patch b/patches.suse/Input-omap4-keypad-fix-pm_runtime_get_sync-error-che.patch new file mode 100644 index 0000000..ee022a7 --- /dev/null +++ b/patches.suse/Input-omap4-keypad-fix-pm_runtime_get_sync-error-che.patch @@ -0,0 +1,33 @@ +From 81022a170462d38ea10612cb67e8e2c529d58abe Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Sun, 17 Apr 2022 13:03:31 -0700 +Subject: [PATCH] Input: omap4-keypad - fix pm_runtime_get_sync() error + checking +Git-commit: 81022a170462d38ea10612cb67e8e2c529d58abe +References: git-fixes +Patch-mainline: v5.18-rc4 + +If the device is already in a runtime PM enabled state +pm_runtime_get_sync() will return 1, so a test for negative +value should be used to check for errors. + +Fixes: f77621cc640a ("Input: omap-keypad - dynamically handle register offsets") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220412070131.19848-1-linmq006@gmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Oliver Neukum +--- + drivers/input/keyboard/omap4-keypad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/keyboard/omap4-keypad.c ++++ b/drivers/input/keyboard/omap4-keypad.c +@@ -304,7 +304,7 @@ static int omap4_keypad_probe(struct pla + * revision register. + */ + error = pm_runtime_get_sync(&pdev->dev); +- if (error) { ++ if (error < 0) { + dev_err(&pdev->dev, "pm_runtime_get_sync() failed\n"); + pm_runtime_put_noidle(&pdev->dev); + } else { diff --git a/patches.suse/NFSv4-fix-open-failure-with-O_ACCMODE-flag.patch b/patches.suse/NFSv4-fix-open-failure-with-O_ACCMODE-flag.patch new file mode 100644 index 0000000..d721be4 --- /dev/null +++ b/patches.suse/NFSv4-fix-open-failure-with-O_ACCMODE-flag.patch @@ -0,0 +1,99 @@ +From: ChenXiaoSong +Date: Tue, 29 Mar 2022 19:32:08 +0800 +Subject: [PATCH] NFSv4: fix open failure with O_ACCMODE flag +Git-commit: b243874f6f9568b2daf1a00e9222cacdc15e159c +Patch-mainline: v5.18 +References: git-fixes + +open() with O_ACCMODE|O_DIRECT flags secondly will fail. + +Reproducer: 1. mount -t nfs -o vers=4.2 $server_ip:/ /mnt/ + 2. fd = open("/mnt/file", O_ACCMODE|O_DIRECT|O_CREAT) + 3. close(fd) + 4. fd = open("/mnt/file", O_ACCMODE|O_DIRECT) + +Server nfsd4_decode_share_access() will fail with error nfserr_bad_xdr when +client use incorrect share access mode of 0. + +Fix this by using NFS4_SHARE_ACCESS_BOTH share access mode in client, +just like firstly opening. + +Fixes: ce4ef7c0a8a05 ("NFS: Split out NFS v4 file operations") +Signed-off-by: ChenXiaoSong +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + fs/nfs/dir.c | 10 ---------- + fs/nfs/internal.h | 10 ++++++++++ + fs/nfs/nfs4file.c | 6 ++++-- + 3 files changed, 14 insertions(+), 12 deletions(-) + +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -1519,16 +1519,6 @@ const struct dentry_operations nfs4_dent + }; + EXPORT_SYMBOL_GPL(nfs4_dentry_operations); + +-static fmode_t flags_to_mode(int flags) +-{ +- fmode_t res = (__force fmode_t)flags & FMODE_EXEC; +- if ((flags & O_ACCMODE) != O_WRONLY) +- res |= FMODE_READ; +- if ((flags & O_ACCMODE) != O_RDONLY) +- res |= FMODE_WRITE; +- return res; +-} +- + static struct nfs_open_context *create_nfs_open_context(struct dentry *dentry, int open_flags, struct file *filp) + { + return alloc_nfs_open_context(dentry, flags_to_mode(open_flags), filp); +--- a/fs/nfs/internal.h ++++ b/fs/nfs/internal.h +@@ -51,6 +51,16 @@ struct nfs_clone_mount { + rpc_authflavor_t authflavor; + }; + ++static inline fmode_t flags_to_mode(int flags) ++{ ++ fmode_t res = (__force fmode_t)flags & FMODE_EXEC; ++ if ((flags & O_ACCMODE) != O_WRONLY) ++ res |= FMODE_READ; ++ if ((flags & O_ACCMODE) != O_RDONLY) ++ res |= FMODE_WRITE; ++ return res; ++} ++ + /* + * Note: RFC 1813 doesn't limit the number of auth flavors that + * a server can return, so make something up. +--- a/fs/nfs/nfs4file.c ++++ b/fs/nfs/nfs4file.c +@@ -30,6 +30,7 @@ nfs4_file_open(struct inode *inode, stru + struct dentry *parent = NULL; + struct inode *dir; + unsigned openflags = filp->f_flags; ++ fmode_t f_mode; + struct iattr attr; + int err; + +@@ -48,8 +49,9 @@ nfs4_file_open(struct inode *inode, stru + if (err) + return err; + ++ f_mode = filp->f_mode; + if ((openflags & O_ACCMODE) == 3) +- openflags--; ++ f_mode |= flags_to_mode(openflags); + + /* We can't create new files here */ + openflags &= ~(O_CREAT|O_EXCL); +@@ -57,7 +59,7 @@ nfs4_file_open(struct inode *inode, stru + parent = dget_parent(dentry); + dir = d_inode(parent); + +- ctx = alloc_nfs_open_context(file_dentry(filp), filp->f_mode, filp); ++ ctx = alloc_nfs_open_context(file_dentry(filp), f_mode, filp); + err = PTR_ERR(ctx); + if (IS_ERR(ctx)) + goto out; diff --git a/patches.suse/RDMA-core-Set-MR-type-in-ib_reg_user_mr.patch b/patches.suse/RDMA-core-Set-MR-type-in-ib_reg_user_mr.patch new file mode 100644 index 0000000..f7b3a0d --- /dev/null +++ b/patches.suse/RDMA-core-Set-MR-type-in-ib_reg_user_mr.patch @@ -0,0 +1,29 @@ +From: Maor Gottlieb +Date: Tue, 18 Jan 2022 09:35:02 +0200 +Subject: RDMA/core: Set MR type in ib_reg_user_mr +Patch-mainline: v5.18-rc1 +Git-commit: 32a88d16615c2be295571c29273c4ac94cb75309 +References: jsc#SLE-8449 + +Add missing assignment of MR type to IB_MR_TYPE_USER. + +Fixes: 33006bd4f37f ("IB/core: Introduce ib_reg_user_mr") +Link: https://lore.kernel.org/r/be2e91bcd6e52dc36be289ae92f30d3a5cc6dcb1.1642491047.git.leonro@nvidia.com +Signed-off-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/core/verbs.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -2058,6 +2058,7 @@ struct ib_mr *ib_reg_user_mr(struct ib_p + return mr; + + mr->device = pd->device; ++ mr->type = IB_MR_TYPE_USER; + mr->pd = pd; + mr->dm = NULL; + atomic_inc(&pd->usecnt); diff --git a/patches.suse/RDMA-hfi1-Fix-use-after-free-bug-for-mm-struct.patch b/patches.suse/RDMA-hfi1-Fix-use-after-free-bug-for-mm-struct.patch new file mode 100644 index 0000000..222c76a --- /dev/null +++ b/patches.suse/RDMA-hfi1-Fix-use-after-free-bug-for-mm-struct.patch @@ -0,0 +1,49 @@ +From: Douglas Miller +Date: Fri, 8 Apr 2022 09:35:23 -0400 +Subject: RDMA/hfi1: Fix use-after-free bug for mm struct +Patch-mainline: v5.18-rc2 +Git-commit: 2bbac98d0930e8161b1957dc0ec99de39ade1b3c +References: bsc#1179878 CVE-2020-27835 + +Under certain conditions, such as MPI_Abort, the hfi1 cleanup code may +represent the last reference held on the task mm. +hfi1_mmu_rb_unregister() then drops the last reference and the mm is freed +before the final use in hfi1_release_user_pages(). A new task may +allocate the mm structure while it is still being used, resulting in +problems. One manifestation is corruption of the mmap_sem counter leading +to a hang in down_write(). Another is corruption of an mm struct that is +in use by another task. + +Fixes: 3d2a9d642512 ("IB/hfi1: Ensure correct mm is used at all times") +Link: https://lore.kernel.org/r/20220408133523.122165.72975.stgit@awfm-01.cornelisnetworks.com +Cc: +Signed-off-by: Douglas Miller +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/hfi1/mmu_rb.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/infiniband/hw/hfi1/mmu_rb.c ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c +@@ -121,6 +121,9 @@ void hfi1_mmu_rb_unregister(struct mmu_r + unsigned long flags; + struct list_head del_list; + ++ /* Prevent freeing of mm until we are completely finished. */ ++ mmgrab(handler->mn.mm); ++ + /* Unregister first so we don't get any more notifications. */ + mmu_notifier_unregister(&handler->mn, handler->mn.mm); + +@@ -143,6 +146,9 @@ void hfi1_mmu_rb_unregister(struct mmu_r + + do_remove(handler, &del_list); + ++ /* Now the mm may be freed. */ ++ mmdrop(handler->mn.mm); ++ + kfree(handler); + } + diff --git a/patches.suse/RDMA-mlx5-Add-a-missing-update-of-cache-last_add.patch b/patches.suse/RDMA-mlx5-Add-a-missing-update-of-cache-last_add.patch new file mode 100644 index 0000000..ef6bf57 --- /dev/null +++ b/patches.suse/RDMA-mlx5-Add-a-missing-update-of-cache-last_add.patch @@ -0,0 +1,31 @@ +From: Aharon Landau +Date: Mon, 4 Apr 2022 11:58:04 +0300 +Subject: RDMA/mlx5: Add a missing update of cache->last_add +Patch-mainline: v5.18-rc2 +Git-commit: 1d735eeee63a0beb65180ca0224f239cc0c9f804 +References: jsc#SLE-15175 + +Update cache->last_add when returning an MR to the cache so that the cache +work won't remove it. + +Fixes: b9358bdbc713 ("RDMA/mlx5: Fix locking in MR cache work queue") +Link: https://lore.kernel.org/r/c99f076fce4b44829d434936bbcd3b5fc4c95020.1649062436.git.leonro@nvidia.com +Signed-off-by: Aharon Landau +Reviewed-by: Shay Drory +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/mlx5/mr.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -621,6 +621,7 @@ void mlx5_mr_cache_free(struct mlx5_ib_d + return; + } + ++ WRITE_ONCE(dev->cache.last_add, jiffies); + spin_lock_irq(&ent->lock); + list_add_tail(&mr->list, &ent->head); + ent->available_mrs++; diff --git a/patches.suse/RDMA-mlx5-Don-t-remove-cache-MRs-when-a-delay-is-nee.patch b/patches.suse/RDMA-mlx5-Don-t-remove-cache-MRs-when-a-delay-is-nee.patch new file mode 100644 index 0000000..9fd8113 --- /dev/null +++ b/patches.suse/RDMA-mlx5-Don-t-remove-cache-MRs-when-a-delay-is-nee.patch @@ -0,0 +1,34 @@ +From: Aharon Landau +Date: Mon, 4 Apr 2022 11:58:03 +0300 +Subject: RDMA/mlx5: Don't remove cache MRs when a delay is needed +Patch-mainline: v5.18-rc2 +Git-commit: 84c2362fb65d69c721fec0974556378cbb36a62b +References: jsc#SLE-15175 + +Don't remove MRs from the cache if need to delay the removal. + +Fixes: b9358bdbc713 ("RDMA/mlx5: Fix locking in MR cache work queue") +Link: https://lore.kernel.org/r/c3087a90ff362c8796c7eaa2715128743ce36722.1649062436.git.leonro@nvidia.com +Signed-off-by: Aharon Landau +Reviewed-by: Shay Drory +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/mlx5/mr.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -507,8 +507,10 @@ static void __cache_work_func(struct mlx + spin_lock_irq(&ent->lock); + if (ent->disabled) + goto out; +- if (need_delay) ++ if (need_delay) { + queue_delayed_work(cache->wq, &ent->dwork, 300 * HZ); ++ goto out; ++ } + remove_cache_mr_locked(ent); + queue_adjust_cache_locked(ent); + } diff --git a/patches.suse/RDMA-mlx5-Fix-the-flow-of-a-miss-in-the-allocation-o.patch b/patches.suse/RDMA-mlx5-Fix-the-flow-of-a-miss-in-the-allocation-o.patch new file mode 100644 index 0000000..4b7f7d8 --- /dev/null +++ b/patches.suse/RDMA-mlx5-Fix-the-flow-of-a-miss-in-the-allocation-o.patch @@ -0,0 +1,32 @@ +From: Aharon Landau +Date: Tue, 15 Feb 2022 19:55:30 +0200 +Subject: RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR +Patch-mainline: v5.18-rc1 +Git-commit: 2f0e60d5e9f96341a0c8a01be8878cdb3b29ff20 +References: jsc#SLE-15175 + +When an ODP MR cache entry is empty and trying to allocate it, increment +the ent->miss counter and call to queue_adjust_cache_locked() to verify +the entry is balanced. + +Fixes: aad719dcf379 ("RDMA/mlx5: Allow MRs to be created in the cache synchronously") +Link: https://lore.kernel.org/r/09503e295276dcacc92cb1d8aef1ad0961c99dc1.1644947594.git.leonro@nvidia.com +Signed-off-by: Aharon Landau +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/mlx5/mr.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -547,6 +547,8 @@ struct mlx5_ib_mr *mlx5_mr_cache_alloc(s + ent = &cache->ent[entry]; + spin_lock_irq(&ent->lock); + if (list_empty(&ent->head)) { ++ queue_adjust_cache_locked(ent); ++ ent->miss++; + spin_unlock_irq(&ent->lock); + mr = create_cache_mr(ent); + if (IS_ERR(mr)) diff --git a/patches.suse/Revert-NFSv4-Handle-the-special-Linux-file-open-acce.patch b/patches.suse/Revert-NFSv4-Handle-the-special-Linux-file-open-acce.patch new file mode 100644 index 0000000..64f2fe5 --- /dev/null +++ b/patches.suse/Revert-NFSv4-Handle-the-special-Linux-file-open-acce.patch @@ -0,0 +1,50 @@ +From: ChenXiaoSong +Date: Tue, 29 Mar 2022 19:32:07 +0800 +Subject: [PATCH] Revert "NFSv4: Handle the special Linux file open access + mode" +Git-commit: ab0fc21bc7105b54bafd85bd8b82742f9e68898a +Patch-mainline: v5.18 +References: git-fixes + +This reverts commit 44942b4e457beda00981f616402a1a791e8c616e. + +After secondly opening a file with O_ACCMODE|O_DIRECT flags, +nfs4_valid_open_stateid() will dereference NULL nfs4_state when lseek(). + +Reproducer: 1. mount -t nfs -o vers=4.2 $server_ip:/ /mnt/ + 2. fd = open("/mnt/file", O_ACCMODE|O_DIRECT|O_CREAT) + 3. close(fd) + 4. fd = open("/mnt/file", O_ACCMODE|O_DIRECT) + 5. lseek(fd) + +Reported-by: Lyu Tao +Signed-off-by: ChenXiaoSong +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + fs/nfs/inode.c | 1 - + fs/nfs/nfs4file.c | 2 +- + 2 files changed, 1 insertion(+), 2 deletions(-) + +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1110,7 +1110,6 @@ int nfs_open(struct inode *inode, struct + nfs_fscache_open_file(inode, filp); + return 0; + } +-EXPORT_SYMBOL_GPL(nfs_open); + + /* + * This function is called whenever some part of NFS notices that +--- a/fs/nfs/nfs4file.c ++++ b/fs/nfs/nfs4file.c +@@ -49,7 +49,7 @@ nfs4_file_open(struct inode *inode, stru + return err; + + if ((openflags & O_ACCMODE) == 3) +- return nfs_open(inode, filp); ++ openflags--; + + /* We can't create new files here */ + openflags &= ~(O_CREAT|O_EXCL); diff --git a/patches.suse/SUNRPC-Ensure-we-flush-any-closed-sockets-before-xs_.patch b/patches.suse/SUNRPC-Ensure-we-flush-any-closed-sockets-before-xs_.patch new file mode 100644 index 0000000..fda19c0 --- /dev/null +++ b/patches.suse/SUNRPC-Ensure-we-flush-any-closed-sockets-before-xs_.patch @@ -0,0 +1,101 @@ +From: Trond Myklebust +Date: Sun, 3 Apr 2022 15:58:11 -0400 +Subject: [PATCH] SUNRPC: Ensure we flush any closed sockets before + xs_xprt_free() +Git-commit: f00432063db1a0db484e85193eccc6845435b80e +Patch-mainline: v5.18 +References: git-fixes + +We must ensure that all sockets are closed before we call xprt_free() +and release the reference to the net namespace. The problem is that +calling fput() will defer closing the socket until delayed_fput() gets +called. +Let's fix the situation by allowing rpciod and the transport teardown +code (which runs on the system wq) to call __fput_sync(), and directly +close the socket. + +Reported-by: Felix Fu +Acked-by: Al Viro +Fixes: a73881c96d73 ("SUNRPC: Fix an Oops in udp_poll()") +Cc: stable@vger.kernel.org # 5.1.x: 3be232f11a3c: SUNRPC: Prevent immediate close+reconnect +Cc: stable@vger.kernel.org # 5.1.x: 89f42494f92f: SUNRPC: Don't call connect() more than once on a TCP socket +Cc: stable@vger.kernel.org # 5.1.x +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + fs/file_table.c | 1 + + net/sunrpc/xprt.c | 5 +---- + net/sunrpc/xprtsock.c | 16 +++++++++++++--- + 3 files changed, 15 insertions(+), 7 deletions(-) + +--- a/fs/file_table.c ++++ b/fs/file_table.c +@@ -375,6 +375,7 @@ void __fput_sync(struct file *file) + } + + EXPORT_SYMBOL(fput); ++EXPORT_SYMBOL(__fput_sync); + + void __init files_init(void) + { +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -877,10 +877,7 @@ void xprt_connect(struct rpc_task *task) + if (!xprt_lock_write(xprt, task)) + return; + +- if (test_and_clear_bit(XPRT_CLOSE_WAIT, &xprt->state)) +- xprt->ops->close(xprt); +- +- if (!xprt_connected(xprt)) { ++ if (!xprt_connected(xprt) && !test_bit(XPRT_CLOSE_WAIT, &xprt->state)) { + task->tk_rqstp->rq_connect_cookie = xprt->connect_cookie; + rpc_sleep_on_timeout(&xprt->pending, task, NULL, + xprt_request_timeout(task->tk_rqstp)); +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -965,7 +965,7 @@ static int xs_local_send_request(struct + + /* Close the stream if the previous transmission was incomplete */ + if (xs_send_request_was_aborted(transport, req)) { +- xs_close(xprt); ++ xprt_force_disconnect(xprt); + return -ENOTCONN; + } + +@@ -1003,7 +1003,7 @@ static int xs_local_send_request(struct + -status); + /* fall through */ + case -EPIPE: +- xs_close(xprt); ++ xprt_force_disconnect(xprt); + status = -ENOTCONN; + } + +@@ -1279,6 +1279,16 @@ static void xs_reset_transport(struct so + + if (sk == NULL) + return; ++ /* ++ * Make sure we're calling this in a context from which it is safe ++ * to call __fput_sync(). In practice that means rpciod and the ++ * system workqueue. ++ */ ++ if (!(current->flags & PF_WQ_WORKER)) { ++ WARN_ON_ONCE(1); ++ set_bit(XPRT_CLOSE_WAIT, &xprt->state); ++ return; ++ } + + if (atomic_read(&transport->xprt.swapper)) + sk_clear_memalloc(sk); +@@ -1302,7 +1312,7 @@ static void xs_reset_transport(struct so + mutex_unlock(&transport->recv_mutex); + + trace_rpc_socket_close(xprt, sock); +- fput(filp); ++ __fput_sync(filp); + + xprt_disconnect_done(xprt); + } diff --git a/patches.suse/SUNRPC-Fix-the-svc_deferred_event-trace-class.patch b/patches.suse/SUNRPC-Fix-the-svc_deferred_event-trace-class.patch new file mode 100644 index 0000000..f317b57 --- /dev/null +++ b/patches.suse/SUNRPC-Fix-the-svc_deferred_event-trace-class.patch @@ -0,0 +1,63 @@ +From: Chuck Lever +Date: Wed, 6 Apr 2022 13:51:32 -0400 +Subject: SUNRPC: Fix the svc_deferred_event trace class +Git-commit: 4d5004451ab2218eab94a30e1841462c9316ba19 +Patch-mainline: v5.18-rc3 +References: git-fixes + +Fix a NULL deref crash that occurs when an svc_rqst is deferred +while the sunrpc tracing subsystem is enabled. svc_revisit() sets +dr->xprt to NULL, so it can't be relied upon in the tracepoint to +provide the remote's address. + +Unfortunately we can't revert the "svc_deferred_class" hunk in +commit ece200ddd54b ("sunrpc: Save remote presentation address in +svc_xprt for trace events") because there is now a specific check +of event format specifiers for unsafe dereferences. The warning +that check emits is: + + event svc_defer_recv has unsafe dereference of argument 1 + +A "%pISpc" format specifier with a "struct sockaddr *" is indeed +flagged by this check. + +Instead, take the brute-force approach used by the svcrdma_qp_error +tracepoint. Convert the dr::addr field into a presentation address +in the TP_fast_assign() arm of the trace event, and store that as +a string. This fix can be backported to -stable kernels. + +In the meantime, commit c6ced22997ad ("tracing: Update print fmt +check to handle new __get_sockaddr() macro") is now in v5.18, so +this wonky fix can be replaced with __sockaddr() and friends +properly during the v5.19 merge window. + +Fixes: ece200ddd54b ("sunrpc: Save remote presentation address in svc_xprt for trace events") +Signed-off-by: Chuck Lever +Acked-by: Miroslav Benes +--- + include/trace/events/sunrpc.h | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/include/trace/events/sunrpc.h ++++ b/include/trace/events/sunrpc.h +@@ -1270,16 +1270,17 @@ DECLARE_EVENT_CLASS(svc_deferred_event, + + TP_STRUCT__entry( + __field(u32, xid) +- __string(addr, dr->xprt->xpt_remotebuf) ++ __array(__u8, addr, INET6_ADDRSTRLEN + 10) + ), + + TP_fast_assign( + __entry->xid = be32_to_cpu(*(__be32 *)(dr->args + + (dr->xprt_hlen>>2))); +- __assign_str(addr, dr->xprt->xpt_remotebuf); ++ snprintf(__entry->addr, sizeof(__entry->addr) - 1, ++ "%pISpc", (struct sockaddr *)&dr->addr); + ), + +- TP_printk("addr=%s xid=0x%08x", __get_str(addr), __entry->xid) ++ TP_printk("addr=%s xid=0x%08x", __entry->addr, __entry->xid) + ); + #define DEFINE_SVC_DEFERRED_EVENT(name) \ + DEFINE_EVENT(svc_deferred_event, svc_##name##_deferred, \ diff --git a/patches.suse/SUNRPC-Handle-ENOMEM-in-call_transmit_status.patch b/patches.suse/SUNRPC-Handle-ENOMEM-in-call_transmit_status.patch new file mode 100644 index 0000000..c33f3d9 --- /dev/null +++ b/patches.suse/SUNRPC-Handle-ENOMEM-in-call_transmit_status.patch @@ -0,0 +1,36 @@ +From: Trond Myklebust +Date: Wed, 6 Apr 2022 23:18:57 -0400 +Subject: [PATCH] SUNRPC: Handle ENOMEM in call_transmit_status() +Git-commit: d3c15033b240767d0287f1c4a529cbbe2d5ded8a +Patch-mainline: v5.18 +References: git-fixes + +Both call_transmit() and call_bc_transmit() can now return ENOMEM, so +let's make sure that we handle the errors gracefully. + +Fixes: 0472e4766049 ("SUNRPC: Convert socket page send code to use iov_iter()") +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + net/sunrpc/clnt.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -2219,6 +2219,7 @@ call_transmit_status(struct rpc_task *ta + * socket just returned a connection error, + * then hold onto the transport lock. + */ ++ case -ENOMEM: + case -ENOBUFS: + rpc_delay(task, HZ>>2); + /* fall through */ +@@ -2304,6 +2305,7 @@ call_bc_transmit_status(struct rpc_task + case -ENOTCONN: + case -EPIPE: + break; ++ case -ENOMEM: + case -ENOBUFS: + rpc_delay(task, HZ>>2); + /* fall through */ diff --git a/patches.suse/SUNRPC-Handle-low-memory-situations-in-call_status.patch b/patches.suse/SUNRPC-Handle-low-memory-situations-in-call_status.patch new file mode 100644 index 0000000..8a737e0 --- /dev/null +++ b/patches.suse/SUNRPC-Handle-low-memory-situations-in-call_status.patch @@ -0,0 +1,36 @@ +From: Trond Myklebust +Date: Thu, 7 Apr 2022 09:50:19 -0400 +Subject: [PATCH] SUNRPC: Handle low memory situations in call_status() +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 9d82819d5b065348ce623f196bf601028e22ed00 +Patch-mainline: v5.18 +References: git-fixes + +We need to handle ENFILE, ENOBUFS, and ENOMEM, because +xprt_wake_pending_tasks() can be called with any one of these due to +socket creation failures. + +Fixes: b61d59fffd3e ("SUNRPC: xs_tcp_connect_worker{4,6}: merge common code") +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + net/sunrpc/clnt.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -2390,6 +2390,11 @@ call_status(struct rpc_task *task) + case -EPIPE: + case -EAGAIN: + break; ++ case -ENFILE: ++ case -ENOBUFS: ++ case -ENOMEM: ++ rpc_delay(task, HZ>>2); ++ break; + case -EIO: + /* shutdown or soft timeout */ + goto out_exit; diff --git a/patches.suse/SUNRPC-avoid-race-between-mod_timer-and-del_timer_sy.patch b/patches.suse/SUNRPC-avoid-race-between-mod_timer-and-del_timer_sy.patch index f50f943..725fad5 100644 --- a/patches.suse/SUNRPC-avoid-race-between-mod_timer-and-del_timer_sy.patch +++ b/patches.suse/SUNRPC-avoid-race-between-mod_timer-and-del_timer_sy.patch @@ -1,7 +1,8 @@ From: NeilBrown Date: Tue, 8 Mar 2022 13:20:57 +1100 Subject: [PATCH] SUNRPC: avoid race between mod_timer() and del_timer_sync() -Patch-mainline: Submitted, 08mar2022 - linux-nfs@vger.kernel.org +Patch-mainline: v5.18 +Git-commit: 3848e96edf4788f772d83990022fa7023a233d83 References: bnc#1195403 xprt_destory() claims XPRT_LOCKED and then calls del_timer_sync(). diff --git a/patches.suse/SUNRPC-change-locking-for-xs_swap_enable-disable.patch b/patches.suse/SUNRPC-change-locking-for-xs_swap_enable-disable.patch new file mode 100644 index 0000000..3f3be35 --- /dev/null +++ b/patches.suse/SUNRPC-change-locking-for-xs_swap_enable-disable.patch @@ -0,0 +1,82 @@ +From 693486d5f8951780a9bb31f7fe935171a80010e4 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Mon, 7 Mar 2022 10:41:45 +1100 +Subject: [PATCH] SUNRPC: change locking for xs_swap_enable/disable +Git-commit: 693486d5f8951780a9bb31f7fe935171a80010e4 +Patch-mainline: v5.18-rc1 +References: bsc#1196367 + +It is not in general safe to wait for XPRT_LOCKED to clear. +A wakeup is only sent when + - connection completes + - sock close completes +so during normal operations, this can wait indefinitely. + +The event we need to protect against is ->inet being set to NULL, and +that happens under the recv_mutex lock. + +So drop the handlign of XPRT_LOCKED and use recv_mutex instead. + +Signed-off-by: NeilBrown +Signed-off-by: Trond Myklebust +Acked-by: Yadan Fan +--- + net/sunrpc/xprtsock.c | 26 +++++++++++--------------- + 1 file changed, 11 insertions(+), 15 deletions(-) + +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 61d3293f1d68..7e39f87cde2d 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -1936,9 +1936,9 @@ static void xs_local_connect(struct rpc_xprt *xprt, struct rpc_task *task) + + #if IS_ENABLED(CONFIG_SUNRPC_SWAP) + /* +- * Note that this should be called with XPRT_LOCKED held (or when we otherwise +- * know that we have exclusive access to the socket), to guard against +- * races with xs_reset_transport. ++ * Note that this should be called with XPRT_LOCKED held, or recv_mutex ++ * held, or when we otherwise know that we have exclusive access to the ++ * socket, to guard against races with xs_reset_transport. + */ + static void xs_set_memalloc(struct rpc_xprt *xprt) + { +@@ -1967,13 +1967,11 @@ xs_enable_swap(struct rpc_xprt *xprt) + { + struct sock_xprt *xs = container_of(xprt, struct sock_xprt, xprt); + +- if (atomic_inc_return(&xprt->swapper) != 1) +- return 0; +- if (wait_on_bit_lock(&xprt->state, XPRT_LOCKED, TASK_KILLABLE)) +- return -ERESTARTSYS; +- if (xs->inet) ++ mutex_lock(&xs->recv_mutex); ++ if (atomic_inc_return(&xprt->swapper) == 1 && ++ xs->inet) + sk_set_memalloc(xs->inet); +- xprt_release_xprt(xprt, NULL); ++ mutex_unlock(&xs->recv_mutex); + return 0; + } + +@@ -1989,13 +1987,11 @@ xs_disable_swap(struct rpc_xprt *xprt) + { + struct sock_xprt *xs = container_of(xprt, struct sock_xprt, xprt); + +- if (!atomic_dec_and_test(&xprt->swapper)) +- return; +- if (wait_on_bit_lock(&xprt->state, XPRT_LOCKED, TASK_KILLABLE)) +- return; +- if (xs->inet) ++ mutex_lock(&xs->recv_mutex); ++ if (atomic_dec_and_test(&xprt->swapper) && ++ xs->inet) + sk_clear_memalloc(xs->inet); +- xprt_release_xprt(xprt, NULL); ++ mutex_unlock(&xs->recv_mutex); + } + #else + static void xs_set_memalloc(struct rpc_xprt *xprt) +-- +2.35.3 + diff --git a/patches.suse/ath5k-fix-building-with-LEDS-m.patch b/patches.suse/ath5k-fix-building-with-LEDS-m.patch new file mode 100644 index 0000000..f1e69f5 --- /dev/null +++ b/patches.suse/ath5k-fix-building-with-LEDS-m.patch @@ -0,0 +1,88 @@ +From: Arnd Bergmann +Date: Mon, 20 Sep 2021 14:23:44 +0200 +Subject: ath5k: fix building with LEDS=m +Git-commit: fb8c3a3c52400512fc8b3b61150057b888c30b0d +Patch-mainline: 5.15-rc5 +References: git-fixes + +Randconfig builds still show a failure for the ath5k driver, +similar to the one that was fixed for ath9k earlier: + +WARNING: unmet direct dependencies detected for MAC80211_LEDS + Depends on [n]: NET [=y] && WIRELESS [=y] && MAC80211 [=y] && (LEDS_CLASS [=m]=y || LEDS_CLASS [=m]=MAC80211 [=y]) + Selected by [m]: + - ATH5K [=m] && NETDEVICES [=y] && WLAN [=y] && WLAN_VENDOR_ATH [=y] && (PCI [=y] || ATH25) && MAC80211 [=y] +net/mac80211/led.c: In function 'ieee80211_alloc_led_names': +net/mac80211/led.c:34:22: error: 'struct led_trigger' has no member named 'name' + 34 | local->rx_led.name = kasprintf(GFP_KERNEL, "%srx", + | ^ + +Copying the same logic from my ath9k patch makes this one work +as well, stubbing out the calls to the LED subsystem. + +Fixes: b64acb28da83 ("ath9k: fix build error with LEDS_CLASS=m") +Fixes: 72cdab808714 ("ath9k: Do not select MAC80211_LEDS by default") +Fixes: 3a078876caee ("ath5k: convert LED code to use mac80211 triggers") +Link: https://lore.kernel.org/all/20210722105501.1000781-1-arnd@kernel.org/ +Signed-off-by: Arnd Bergmann +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210920122359.353810-1-arnd@kernel.org +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/ath/ath5k/Kconfig | 4 +--- + drivers/net/wireless/ath/ath5k/led.c | 10 ++++++---- + 2 files changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/net/wireless/ath/ath5k/Kconfig ++++ b/drivers/net/wireless/ath/ath5k/Kconfig +@@ -3,9 +3,7 @@ config ATH5K + tristate "Atheros 5xxx wireless cards support" + depends on (PCI || ATH25) && MAC80211 + select ATH_COMMON +- select MAC80211_LEDS +- select LEDS_CLASS +- select NEW_LEDS ++ select MAC80211_LEDS if LEDS_CLASS=y || LEDS_CLASS=MAC80211 + select ATH5K_AHB if ATH25 + select ATH5K_PCI if !ATH25 + ---help--- +--- a/drivers/net/wireless/ath/ath5k/led.c ++++ b/drivers/net/wireless/ath/ath5k/led.c +@@ -89,7 +89,8 @@ static const struct pci_device_id ath5k_ + + void ath5k_led_enable(struct ath5k_hw *ah) + { +- if (test_bit(ATH_STAT_LEDSOFT, ah->status)) { ++ if (IS_ENABLED(CONFIG_MAC80211_LEDS) && ++ test_bit(ATH_STAT_LEDSOFT, ah->status)) { + ath5k_hw_set_gpio_output(ah, ah->led_pin); + ath5k_led_off(ah); + } +@@ -104,7 +105,8 @@ static void ath5k_led_on(struct ath5k_hw + + void ath5k_led_off(struct ath5k_hw *ah) + { +- if (!test_bit(ATH_STAT_LEDSOFT, ah->status)) ++ if (!IS_ENABLED(CONFIG_MAC80211_LEDS) || ++ !test_bit(ATH_STAT_LEDSOFT, ah->status)) + return; + ath5k_hw_set_gpio(ah, ah->led_pin, !ah->led_on); + } +@@ -146,7 +148,7 @@ ath5k_register_led(struct ath5k_hw *ah, + static void + ath5k_unregister_led(struct ath5k_led *led) + { +- if (!led->ah) ++ if (!IS_ENABLED(CONFIG_MAC80211_LEDS) || !led->ah) + return; + led_classdev_unregister(&led->led_dev); + ath5k_led_off(led->ah); +@@ -169,7 +171,7 @@ int ath5k_init_leds(struct ath5k_hw *ah) + char name[ATH5K_LED_MAX_NAME_LEN + 1]; + const struct pci_device_id *match; + +- if (!ah->pdev) ++ if (!IS_ENABLED(CONFIG_MAC80211_LEDS) || !ah->pdev) + return 0; + + #ifdef CONFIG_ATH5K_AHB diff --git a/patches.suse/bareudp-use-ipv6_mod_enabled-to-check-if-IPv6-enable.patch b/patches.suse/bareudp-use-ipv6_mod_enabled-to-check-if-IPv6-enable.patch new file mode 100644 index 0000000..7f858d6 --- /dev/null +++ b/patches.suse/bareudp-use-ipv6_mod_enabled-to-check-if-IPv6-enable.patch @@ -0,0 +1,85 @@ +From: Hangbin Liu +Date: Tue, 15 Mar 2022 14:26:18 +0800 +Subject: bareudp: use ipv6_mod_enabled to check if IPv6 enabled +Patch-mainline: v5.18-rc1 +Git-commit: e077ed58c243afc197bc2a2ba0e1ff61135e4ec2 +References: jsc#SLE-15172 + +bareudp_create_sock() use AF_INET6 by default if IPv6 CONFIG enabled. +But if user start kernel with ipv6.disable=1, the bareudp sock will +created failed, which cause the interface open failed even with ethertype +ip. e.g. + + # ip link add bareudp1 type bareudp dstport 2 ethertype ip + # ip link set bareudp1 up + RTNETLINK answers: Address family not supported by protocol + +Fix it by using ipv6_mod_enabled() to check if IPv6 enabled. There is +no need to check IS_ENABLED(CONFIG_IPV6) as ipv6_mod_enabled() will +return false when CONFIG_IPV6 no enabled in include/linux/ipv6.h. + +Reported-by: Jianlin Shi +Fixes: 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.") +Signed-off-by: Hangbin Liu +Link: https://lore.kernel.org/r/20220315062618.156230-1-liuhangbin@gmail.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/bareudp.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +--- a/drivers/net/bareudp.c ++++ b/drivers/net/bareudp.c +@@ -141,14 +141,14 @@ static int bareudp_udp_encap_recv(struct + oiph = skb_network_header(skb); + skb_reset_network_header(skb); + +- if (!IS_ENABLED(CONFIG_IPV6) || family == AF_INET) ++ if (!ipv6_mod_enabled() || family == AF_INET) + err = IP_ECN_decapsulate(oiph, skb); + else + err = IP6_ECN_decapsulate(oiph, skb); + + if (unlikely(err)) { + if (log_ecn_error) { +- if (!IS_ENABLED(CONFIG_IPV6) || family == AF_INET) ++ if (!ipv6_mod_enabled() || family == AF_INET) + net_info_ratelimited("non-ECT from %pI4 " + "with TOS=%#x\n", + &((struct iphdr *)oiph)->saddr, +@@ -218,11 +218,12 @@ static struct socket *bareudp_create_soc + int err; + + memset(&udp_conf, 0, sizeof(udp_conf)); +-#if IS_ENABLED(CONFIG_IPV6) +- udp_conf.family = AF_INET6; +-#else +- udp_conf.family = AF_INET; +-#endif ++ ++ if (ipv6_mod_enabled()) ++ udp_conf.family = AF_INET6; ++ else ++ udp_conf.family = AF_INET; ++ + udp_conf.local_udp_port = port; + /* Open UDP socket */ + err = udp_sock_create(net, &udp_conf, &sock); +@@ -450,7 +451,7 @@ static netdev_tx_t bareudp_xmit(struct s + } + + rcu_read_lock(); +- if (IS_ENABLED(CONFIG_IPV6) && info->mode & IP_TUNNEL_INFO_IPV6) ++ if (ipv6_mod_enabled() && info->mode & IP_TUNNEL_INFO_IPV6) + err = bareudp6_xmit_skb(skb, dev, bareudp, info); + else + err = bareudp_xmit_skb(skb, dev, bareudp, info); +@@ -480,7 +481,7 @@ static int bareudp_fill_metadata_dst(str + + use_cache = ip_tunnel_dst_cache_usable(skb, info); + +- if (!IS_ENABLED(CONFIG_IPV6) || ip_tunnel_info_af(info) == AF_INET) { ++ if (!ipv6_mod_enabled() || ip_tunnel_info_af(info) == AF_INET) { + struct rtable *rt; + __be32 saddr; + diff --git a/patches.suse/block-drop-leftover-references-to-RQF_SORTED.patch b/patches.suse/block-drop-leftover-references-to-RQF_SORTED.patch new file mode 100644 index 0000000..7b2c03d --- /dev/null +++ b/patches.suse/block-drop-leftover-references-to-RQF_SORTED.patch @@ -0,0 +1,79 @@ +From: Jean Delvare +Date: Mon, 1 Mar 2021 17:23:25 +0100 +Subject: block: Drop leftover references to RQF_SORTED +Git-commit: 5218e12e9f3a324f41c05da4874d76d7ea3677cb +Patch-mainline: v5.12 +References: bsc#1182073 + +Commit a1ce35fa49852db60fc6e268038530be533c5b15 ("block: remove dead +elevator code") removed all users of RQF_SORTED. However it is still +defined, and there is one reference left to it (which in effect is +dead code). Clear it all up. + +Backporting notes: +The definition of RQF_SORTED is preserved so as to not break the API. +Instead of removing it, we change the comment, to make it clear that +this flag no longer has any effect. + +Signed-off-by: Jean Delvare +Cc: Jens Axboe +Cc: Ming Lei +Cc: Omar Sandoval +Cc: Hannes Reinecke +Signed-off-by: Jens Axboe +--- + block/blk-mq-debugfs.c | 1 - + block/blk-mq-sched.c | 6 +----- + include/linux/blkdev.h | 2 +- + 3 files changed, 2 insertions(+), 7 deletions(-) + +--- a/block/blk-mq-debugfs.c ++++ b/block/blk-mq-debugfs.c +@@ -290,7 +290,6 @@ static const char *const cmd_flag_name[] + + #define RQF_NAME(name) [ilog2((__force u32)RQF_##name)] = #name + static const char *const rqf_name[] = { +- RQF_NAME(SORTED), + RQF_NAME(STARTED), + RQF_NAME(SOFTBARRIER), + RQF_NAME(FLUSH_SEQ), +--- a/block/blk-mq-sched.c ++++ b/block/blk-mq-sched.c +@@ -494,7 +494,6 @@ void blk_mq_sched_request_inserted(struc + EXPORT_SYMBOL_GPL(blk_mq_sched_request_inserted); + + static bool blk_mq_sched_bypass_insert(struct blk_mq_hw_ctx *hctx, +- bool has_sched, + struct request *rq) + { + /* +@@ -511,9 +510,6 @@ static bool blk_mq_sched_bypass_insert(s + if ((rq->rq_flags & RQF_FLUSH_SEQ) || blk_rq_is_passthrough(rq)) + return true; + +- if (has_sched) +- rq->rq_flags |= RQF_SORTED; +- + return false; + } + +@@ -533,7 +529,7 @@ void blk_mq_sched_insert_request(struct + + WARN_ON(e && (rq->tag != -1)); + +- if (blk_mq_sched_bypass_insert(hctx, !!e, rq)) { ++ if (blk_mq_sched_bypass_insert(hctx, rq)) { + /* + * Firstly normal IO request is inserted to scheduler queue or + * sw queue, meantime we add flush request to dispatch queue( +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -64,7 +64,7 @@ typedef void (rq_end_io_fn)(struct reque + * request flags */ + typedef __u32 __bitwise req_flags_t; + +-/* elevator knows about this request */ ++/* this flag has no effect, will be removed in the future */ + #define RQF_SORTED ((__force req_flags_t)(1 << 0)) + /* drive already may have started this one */ + #define RQF_STARTED ((__force req_flags_t)(1 << 1)) diff --git a/patches.suse/dma-at_xdmac-fix-a-missing-check-on-list-iterator.patch b/patches.suse/dma-at_xdmac-fix-a-missing-check-on-list-iterator.patch new file mode 100644 index 0000000..eed1bb3 --- /dev/null +++ b/patches.suse/dma-at_xdmac-fix-a-missing-check-on-list-iterator.patch @@ -0,0 +1,62 @@ +From 206680c4e46b62fd8909385e0874a36952595b85 Mon Sep 17 00:00:00 2001 +From: Xiaomeng Tong +Date: Sun, 27 Mar 2022 14:11:54 +0800 +Subject: [PATCH] dma: at_xdmac: fix a missing check on list iterator +Git-commit: 206680c4e46b62fd8909385e0874a36952595b85 +Patch-mainline: v5.18-rc4 +References: git-fixes + +The bug is here: + __func__, desc, &desc->tx_dma_desc.phys, ret, cookie, residue); + +The list iterator 'desc' will point to a bogus position containing +HEAD if the list is empty or no element is found. To avoid dev_dbg() +prints a invalid address, use a new variable 'iter' as the list +iterator, while use the origin variable 'desc' as a dedicated +pointer to point to the found element. + +Cc: stable@vger.kernel.org +Fixes: 82e2424635f4c ("dmaengine: xdmac: fix print warning on dma_addr_t variable") +Signed-off-by: Xiaomeng Tong +Link: https://lore.kernel.org/r/20220327061154.4867-1-xiam0nd.tong@gmail.com +Signed-off-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/dma/at_xdmac.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c +index 1476156af74b..def564d1e8fa 100644 +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -1453,7 +1453,7 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, + { + struct at_xdmac_chan *atchan = to_at_xdmac_chan(chan); + struct at_xdmac *atxdmac = to_at_xdmac(atchan->chan.device); +- struct at_xdmac_desc *desc, *_desc; ++ struct at_xdmac_desc *desc, *_desc, *iter; + struct list_head *descs_list; + enum dma_status ret; + int residue, retry; +@@ -1568,11 +1568,13 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, + * microblock. + */ + descs_list = &desc->descs_list; +- list_for_each_entry_safe(desc, _desc, descs_list, desc_node) { +- dwidth = at_xdmac_get_dwidth(desc->lld.mbr_cfg); +- residue -= (desc->lld.mbr_ubc & 0xffffff) << dwidth; +- if ((desc->lld.mbr_nda & 0xfffffffc) == cur_nda) ++ list_for_each_entry_safe(iter, _desc, descs_list, desc_node) { ++ dwidth = at_xdmac_get_dwidth(iter->lld.mbr_cfg); ++ residue -= (iter->lld.mbr_ubc & 0xffffff) << dwidth; ++ if ((iter->lld.mbr_nda & 0xfffffffc) == cur_nda) { ++ desc = iter; + break; ++ } + } + residue += cur_ubc << dwidth; + +-- +2.31.1 + diff --git a/patches.suse/dmaengine-idxd-add-RO-check-for-wq-max_batch_size-wr.patch b/patches.suse/dmaengine-idxd-add-RO-check-for-wq-max_batch_size-wr.patch new file mode 100644 index 0000000..5c7371c --- /dev/null +++ b/patches.suse/dmaengine-idxd-add-RO-check-for-wq-max_batch_size-wr.patch @@ -0,0 +1,40 @@ +From 66903461ffed0b66fc3e0200082d4e09365aacdc Mon Sep 17 00:00:00 2001 +From: Dave Jiang +Date: Mon, 11 Apr 2022 15:08:55 -0700 +Subject: [PATCH] dmaengine: idxd: add RO check for wq max_batch_size write +Git-commit: 66903461ffed0b66fc3e0200082d4e09365aacdc +Patch-mainline: v5.18-rc4 +References: git-fixes + +Block wq_max_batch_size_store() when the device is configured as read-only +and not configurable. + +Fixes: e7184b159dd3 ("dmaengine: idxd: add support for configurable max wq batch size") +Reported-by: Bernice Zhang +Tested-by: Bernice Zhang +Signed-off-by: Dave Jiang +Link: https://lore.kernel.org/r/164971493551.2201159.1942042593642155209.stgit@djiang5-desk3.ch.intel.com +Signed-off-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/dma/idxd/sysfs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c +index 7e19ab92b61a..6c41d429bd89 100644 +--- a/drivers/dma/idxd/sysfs.c ++++ b/drivers/dma/idxd/sysfs.c +@@ -939,6 +939,9 @@ static ssize_t wq_max_batch_size_store(struct device *dev, struct device_attribu + u64 batch_size; + int rc; + ++ if (!test_bit(IDXD_FLAG_CONFIGURABLE, &idxd->flags)) ++ return -EPERM; ++ + if (wq->state != IDXD_WQ_DISABLED) + return -EPERM; + +-- +2.31.1 + diff --git a/patches.suse/dmaengine-idxd-add-RO-check-for-wq-max_transfer_size.patch b/patches.suse/dmaengine-idxd-add-RO-check-for-wq-max_transfer_size.patch new file mode 100644 index 0000000..b58e1d7 --- /dev/null +++ b/patches.suse/dmaengine-idxd-add-RO-check-for-wq-max_transfer_size.patch @@ -0,0 +1,40 @@ +From 505a2d1032ae656b0a8c736be110255503941cde Mon Sep 17 00:00:00 2001 +From: Dave Jiang +Date: Mon, 11 Apr 2022 15:08:01 -0700 +Subject: [PATCH] dmaengine: idxd: add RO check for wq max_transfer_size write +Git-commit: 505a2d1032ae656b0a8c736be110255503941cde +Patch-mainline: v5.18-rc4 +References: git-fixes + +Block wq_max_transfer_size_store() when the device is configured as +read-only and not configurable. + +Fixes: d7aad5550eca ("dmaengine: idxd: add support for configurable max wq xfer size") +Reported-by: Bernice Zhang +Tested-by: Bernice Zhang +Signed-off-by: Dave Jiang +Link: https://lore.kernel.org/r/164971488154.2200913.10706665404118545941.stgit@djiang5-desk3.ch.intel.com +Signed-off-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/dma/idxd/sysfs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c +index 6c41d429bd89..dfd549685c46 100644 +--- a/drivers/dma/idxd/sysfs.c ++++ b/drivers/dma/idxd/sysfs.c +@@ -905,6 +905,9 @@ static ssize_t wq_max_transfer_size_store(struct device *dev, struct device_attr + u64 xfer_size; + int rc; + ++ if (!test_bit(IDXD_FLAG_CONFIGURABLE, &idxd->flags)) ++ return -EPERM; ++ + if (wq->state != IDXD_WQ_DISABLED) + return -EPERM; + +-- +2.31.1 + diff --git a/patches.suse/dmaengine-imx-sdma-Fix-error-checking-in-sdma_event_.patch b/patches.suse/dmaengine-imx-sdma-Fix-error-checking-in-sdma_event_.patch new file mode 100644 index 0000000..a7fa99b --- /dev/null +++ b/patches.suse/dmaengine-imx-sdma-Fix-error-checking-in-sdma_event_.patch @@ -0,0 +1,46 @@ +From 7104b9cb35a33ad803a1adbbfa50569b008faf15 Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Tue, 8 Mar 2022 06:49:51 +0000 +Subject: [PATCH] dmaengine: imx-sdma: Fix error checking in sdma_event_remap +Git-commit: 7104b9cb35a33ad803a1adbbfa50569b008faf15 +Patch-mainline: v5.18-rc4 +References: git-fixes + +of_parse_phandle() returns NULL on errors, rather than error +pointers. Using NULL check on grp_np to fix this. + +Fixes: d078cd1b4185 ("dmaengine: imx-sdma: Add imx6sx platform support") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220308064952.15743-1-linmq006@gmail.com +Signed-off-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/dma/imx-sdma.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c +index b708d029b6e9..6196a7b3956b 100644 +--- a/drivers/dma/imx-sdma.c ++++ b/drivers/dma/imx-sdma.c +@@ -1885,7 +1885,7 @@ static int sdma_event_remap(struct sdma_engine *sdma) + u32 reg, val, shift, num_map, i; + int ret = 0; + +- if (IS_ERR(np) || IS_ERR(gpr_np)) ++ if (IS_ERR(np) || !gpr_np) + goto out; + + event_remap = of_find_property(np, propname, NULL); +@@ -1933,7 +1933,7 @@ static int sdma_event_remap(struct sdma_engine *sdma) + } + + out: +- if (!IS_ERR(gpr_np)) ++ if (gpr_np) + of_node_put(gpr_np); + + return ret; +-- +2.31.1 + diff --git a/patches.suse/dmaengine-mediatek-Fix-PM-usage-reference-leak-of-mt.patch b/patches.suse/dmaengine-mediatek-Fix-PM-usage-reference-leak-of-mt.patch new file mode 100644 index 0000000..76571c0 --- /dev/null +++ b/patches.suse/dmaengine-mediatek-Fix-PM-usage-reference-leak-of-mt.patch @@ -0,0 +1,66 @@ +From 545b2baac89b859180e51215468c05d85ea8465a Mon Sep 17 00:00:00 2001 +From: zhangqilong +Date: Sat, 19 Mar 2022 10:21:42 +0800 +Subject: [PATCH] dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan_resources +Git-commit: 545b2baac89b859180e51215468c05d85ea8465a +Patch-mainline: v5.18-rc4 +References: git-fixes + +pm_runtime_get_sync will increment pm usage counter even it failed. +Forgetting to putting operation will result in reference leak here. +We fix it: +1) Replacing it with pm_runtime_resume_and_get to keep usage counter + balanced. +2) Add putting operation before returning error. + +Fixes:9135408c3ace4 ("dmaengine: mediatek: Add MediaTek UART APDMA support") + +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20220319022142.142709-1-zhangqilong3@huawei.com +Signed-off-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/dma/mediatek/mtk-uart-apdma.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/dma/mediatek/mtk-uart-apdma.c b/drivers/dma/mediatek/mtk-uart-apdma.c +index 375e7e647df6..a1517ef1f4a0 100644 +--- a/drivers/dma/mediatek/mtk-uart-apdma.c ++++ b/drivers/dma/mediatek/mtk-uart-apdma.c +@@ -274,7 +274,7 @@ static int mtk_uart_apdma_alloc_chan_resources(struct dma_chan *chan) + unsigned int status; + int ret; + +- ret = pm_runtime_get_sync(mtkd->ddev.dev); ++ ret = pm_runtime_resume_and_get(mtkd->ddev.dev); + if (ret < 0) { + pm_runtime_put_noidle(chan->device->dev); + return ret; +@@ -288,18 +288,21 @@ static int mtk_uart_apdma_alloc_chan_resources(struct dma_chan *chan) + ret = readx_poll_timeout(readl, c->base + VFF_EN, + status, !status, 10, 100); + if (ret) +- return ret; ++ goto err_pm; + + ret = request_irq(c->irq, mtk_uart_apdma_irq_handler, + IRQF_TRIGGER_NONE, KBUILD_MODNAME, chan); + if (ret < 0) { + dev_err(chan->device->dev, "Can't request dma IRQ\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto err_pm; + } + + if (mtkd->support_33bits) + mtk_uart_apdma_write(c, VFF_4G_SUPPORT, VFF_4G_SUPPORT_CLR_B); + ++err_pm: ++ pm_runtime_put_noidle(mtkd->ddev.dev); + return ret; + } + +-- +2.31.1 + diff --git a/patches.suse/drm-i915-Call-i915_globals_exit-if-pci_register_devi.patch b/patches.suse/drm-i915-Call-i915_globals_exit-if-pci_register_devi.patch new file mode 100644 index 0000000..ef5b395 --- /dev/null +++ b/patches.suse/drm-i915-Call-i915_globals_exit-if-pci_register_devi.patch @@ -0,0 +1,53 @@ +From 1354d830cb8f9be966cc07fc61368af27ffb7c4a Mon Sep 17 00:00:00 2001 +From: Jason Ekstrand +Date: Wed, 21 Jul 2021 10:23:54 -0500 +Subject: drm/i915: Call i915_globals_exit() if pci_register_device() fails +Git-commit: 1354d830cb8f9be966cc07fc61368af27ffb7c4a +Patch-mainline: v5.14-rc5 +References: git-fixes + +In the unlikely event that pci_register_device() fails, we were tearing +down our PMU setup but not globals. This leaves a bunch of memory slabs +lying around. + +Signed-off-by: Jason Ekstrand +Fixes: 32eb6bcfdda9 ("drm/i915: Make request allocation caches global") +[danvet: Fix conflicts against removal of the globals_flush +infrastructure.] +Reviewed-by: Daniel Vetter +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20210721152358.2893314-3-jason@jlekstrand.net +(cherry picked from commit db484889d1ff0645e07e360d3e3ad306c0515821) +Signed-off-by: Rodrigo Vivi +[Fixed small conflict while cherry picking] +Signed-off-by: Patrik Jakobsson +--- + drivers/gpu/drm/i915/i915_globals.c | 2 +- + drivers/gpu/drm/i915/i915_pci.c | 4 +++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_globals.c ++++ b/drivers/gpu/drm/i915/i915_globals.c +@@ -149,7 +149,7 @@ + atomic_dec(&active); + } + +-void __exit i915_globals_exit(void) ++void i915_globals_exit(void) + { + GEM_BUG_ON(atomic_read(&active)); + +--- a/drivers/gpu/drm/i915/i915_pci.c ++++ b/drivers/gpu/drm/i915/i915_pci.c +@@ -1129,8 +1129,10 @@ + } + + err = pci_register_driver(&i915_pci_driver); +- if (err) ++ if (err) { ++ i915_globals_exit(); + return err; ++ } + + i915_perf_sysctl_register(); + return 0; diff --git a/patches.suse/drm-i915-gem-Flush-coherency-domains-on-first-set-do.patch b/patches.suse/drm-i915-gem-Flush-coherency-domains-on-first-set-do.patch new file mode 100644 index 0000000..2ccf6ad --- /dev/null +++ b/patches.suse/drm-i915-gem-Flush-coherency-domains-on-first-set-do.patch @@ -0,0 +1,84 @@ +From 59dd13ad310793757e34afa489dd6fc8544fc3da Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Mon, 19 Oct 2020 21:38:25 +0100 +Subject: drm/i915/gem: Flush coherency domains on first set-domain-ioctl +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Alt-commit: 44c2200afcd59f441b43f27829b4003397cc495d +Git-commit: 59dd13ad310793757e34afa489dd6fc8544fc3da +Patch-mainline: v5.10-rc3 +References: git-fixes + +Avoid skipping what appears to be a no-op set-domain-ioctl if the cache +coherency state is inconsistent with our target domain. This also has +the utility of using the population of the pages to validate the backing +store. + +The danger in skipping the first set-domain is leaving the cache +inconsistent and submitting stale data, or worse leaving the clean data +in the cache and not flushing it to the GPU. The impact should be small +as it requires a no-op set-domain as the very first ioctl in a +particular sequence not found in typical userspace. + +Reported-by: Zbigniew Kempczyński +Fixes: 754a25442705 ("drm/i915: Skip object locking around a no-op set-domain ioctl") +Testcase: igt/gem_mmap_offset/blt-coherency +Signed-off-by: Chris Wilson +Cc: Joonas Lahtinen +Cc: Matthew Auld +Cc: Zbigniew Kempczyński +Cc: # v5.2+ +Reviewed-by: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20201019203825.10966-1-chris@chris-wilson.co.uk +(cherry picked from commit 44c2200afcd59f441b43f27829b4003397cc495d) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Patrik Jakobsson +--- + drivers/gpu/drm/i915/gem/i915_gem_domain.c | 28 +++++++++++++--------------- + 1 file changed, 13 insertions(+), 15 deletions(-) + +--- a/drivers/gpu/drm/i915/gem/i915_gem_domain.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_domain.c +@@ -485,21 +485,6 @@ + return -ENOENT; + + /* +- * Already in the desired write domain? Nothing for us to do! +- * +- * We apply a little bit of cunning here to catch a broader set of +- * no-ops. If obj->write_domain is set, we must be in the same +- * obj->read_domains, and only that domain. Therefore, if that +- * obj->write_domain matches the request read_domains, we are +- * already in the same read/write domain and can skip the operation, +- * without having to further check the requested write_domain. +- */ +- if (READ_ONCE(obj->write_domain) == read_domains) { +- err = 0; +- goto out; +- } +- +- /* + * Try to flush the object off the GPU without holding the lock. + * We will repeat the flush holding the lock in the normal manner + * to catch cases where we are gazumped. +@@ -536,6 +521,19 @@ + if (err) + goto out; + ++ /* ++ * Already in the desired write domain? Nothing for us to do! ++ * ++ * We apply a little bit of cunning here to catch a broader set of ++ * no-ops. If obj->write_domain is set, we must be in the same ++ * obj->read_domains, and only that domain. Therefore, if that ++ * obj->write_domain matches the request read_domains, we are ++ * already in the same read/write domain and can skip the operation, ++ * without having to further check the requested write_domain. ++ */ ++ if (READ_ONCE(obj->write_domain) == read_domains) ++ goto out_unpin; ++ + err = i915_gem_object_lock_interruptible(obj); + if (err) + goto out_unpin; diff --git a/patches.suse/drm-i915-gt-Prevent-use-of-engine-wa_ctx-after-error.patch b/patches.suse/drm-i915-gt-Prevent-use-of-engine-wa_ctx-after-error.patch index 8d69640..5821ddc 100644 --- a/patches.suse/drm-i915-gt-Prevent-use-of-engine-wa_ctx-after-error.patch +++ b/patches.suse/drm-i915-gt-Prevent-use-of-engine-wa_ctx-after-error.patch @@ -5,6 +5,7 @@ Subject: [PATCH] drm/i915/gt: Prevent use of engine->wa_ctx after error Git-commit: 488751a0ef9b5ce572c47301ce62d54fc6b5a74d Patch-mainline: v5.11-rc5 References: git-fixes +Alt-commit: 5b4dc95cf7f573e927fbbd406ebe54225d41b9b2 On error we unpin and free the wa_ctx.vma, but do not clear any of the derived flags. During lrc_init, we look at the flags and attempt to diff --git a/patches.suse/drm-mediatek-Add-AAL-output-size-configuration.patch b/patches.suse/drm-mediatek-Add-AAL-output-size-configuration.patch new file mode 100644 index 0000000..89bf449 --- /dev/null +++ b/patches.suse/drm-mediatek-Add-AAL-output-size-configuration.patch @@ -0,0 +1,38 @@ +From 71ac6f390f6a3017f58d05d677b961bb1f851338 Mon Sep 17 00:00:00 2001 +From: "jason-jh.lin" +Date: Tue, 10 Aug 2021 10:55:03 +0800 +Subject: drm/mediatek: Add AAL output size configuration +Git-commit: 71ac6f390f6a3017f58d05d677b961bb1f851338 +Patch-mainline: v5.14-rc7 +References: git-fixes + +To avoid the output width and height is incorrect, +AAL_OUTPUT_SIZE configuration should be set. + +Fixes: 0664d1392c26 ("drm/mediatek: Add AAL engine basic function") +Signed-off-by: jason-jh.lin +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Patrik Jakobsson +--- + drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c +@@ -32,6 +32,7 @@ + + #define DISP_AAL_EN 0x0000 + #define DISP_AAL_SIZE 0x0030 ++#define DISP_AAL_OUTPUT_SIZE 0x04d8 + + #define DISP_CCORR_EN 0x0000 + #define CCORR_EN BIT(0) +@@ -178,7 +179,7 @@ + unsigned int h, unsigned int vrefresh, + unsigned int bpc, struct cmdq_pkt *cmdq_pkt) + { +- mtk_ddp_write(cmdq_pkt, w << 16 | h, comp, DISP_AAL_SIZE); ++ mtk_ddp_write(cmdq_pkt, w << 16 | h, comp, DISP_AAL_OUTPUT_SIZE); + } + + static void mtk_aal_start(struct mtk_ddp_comp *comp) diff --git a/patches.suse/drm-mediatek-Fix-aal-size-config.patch b/patches.suse/drm-mediatek-Fix-aal-size-config.patch new file mode 100644 index 0000000..c7efa72 --- /dev/null +++ b/patches.suse/drm-mediatek-Fix-aal-size-config.patch @@ -0,0 +1,32 @@ +From 71dcadba34203d8dd35152e368720f977e9cdb81 Mon Sep 17 00:00:00 2001 +From: Yongqiang Niu +Date: Mon, 11 Jan 2021 15:43:47 +0800 +Subject: drm/mediatek: Fix aal size config +Git-commit: 71dcadba34203d8dd35152e368720f977e9cdb81 +Patch-mainline: v5.12-rc1 +References: git-fixes + +The orginal setting is not correct, fix it to follow hardware data sheet. +If keep this error setting, mt8173/mt8183 display ok +but mt8192 display abnormal. + +Fixes: 0664d1392c26 ("drm/mediatek: Add AAL engine basic function") + +Signed-off-by: Yongqiang Niu +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Patrik Jakobsson +--- + drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c +@@ -178,7 +178,7 @@ + unsigned int h, unsigned int vrefresh, + unsigned int bpc, struct cmdq_pkt *cmdq_pkt) + { +- mtk_ddp_write(cmdq_pkt, h << 16 | w, comp, DISP_AAL_SIZE); ++ mtk_ddp_write(cmdq_pkt, w << 16 | h, comp, DISP_AAL_SIZE); + } + + static void mtk_aal_start(struct mtk_ddp_comp *comp) diff --git a/patches.suse/drm-panel-raspberrypi-touchscreen-Avoid-NULL-deref-i.patch b/patches.suse/drm-panel-raspberrypi-touchscreen-Avoid-NULL-deref-i.patch new file mode 100644 index 0000000..b89e716 --- /dev/null +++ b/patches.suse/drm-panel-raspberrypi-touchscreen-Avoid-NULL-deref-i.patch @@ -0,0 +1,42 @@ +From f92055ae0acb035891e988ce345d6b81a0316423 Mon Sep 17 00:00:00 2001 +From: Dave Stevenson +Date: Fri, 15 Apr 2022 18:25:12 +0200 +Subject: [PATCH] drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised +Git-commit: f92055ae0acb035891e988ce345d6b81a0316423 +Patch-mainline: v5.18-rc4 +References: git-fixes + +If a call to rpi_touchscreen_i2c_write from rpi_touchscreen_probe +fails before mipi_dsi_device_register_full is called, then +in trying to log the error message if uses ts->dsi->dev when +it is still NULL. + +Use ts->i2c->dev instead, which is initialised earlier in probe. + +Fixes: 2f733d6194bd ("drm/panel: Add support for the Raspberry Pi 7" Touchscreen.") +Signed-off-by: Dave Stevenson +Signed-off-by: Stefan Wahren +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20220415162513.42190-2-stefan.wahren@i2se.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c +index 46029c5610c8..1f805eb8fdb5 100644 +--- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c ++++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c +@@ -229,7 +229,7 @@ static void rpi_touchscreen_i2c_write(struct rpi_touchscreen *ts, + + ret = i2c_smbus_write_byte_data(ts->i2c, reg, val); + if (ret) +- dev_err(&ts->dsi->dev, "I2C write failed: %d\n", ret); ++ dev_err(&ts->i2c->dev, "I2C write failed: %d\n", ret); + } + + static int rpi_touchscreen_write(struct rpi_touchscreen *ts, u16 reg, u32 val) +-- +2.31.1 + diff --git a/patches.suse/drm-panel-raspberrypi-touchscreen-Initialise-the-bri.patch b/patches.suse/drm-panel-raspberrypi-touchscreen-Initialise-the-bri.patch new file mode 100644 index 0000000..b646d0b --- /dev/null +++ b/patches.suse/drm-panel-raspberrypi-touchscreen-Initialise-the-bri.patch @@ -0,0 +1,63 @@ +From 5f18c0782b99e26121efa93d20b76c19e17aa1dd Mon Sep 17 00:00:00 2001 +From: Dave Stevenson +Date: Fri, 15 Apr 2022 18:25:13 +0200 +Subject: [PATCH] drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare +Git-commit: 5f18c0782b99e26121efa93d20b76c19e17aa1dd +Patch-mainline: v5.18-rc4 +References: git-fixes + +The panel has a prepare call which is before video starts, and an +enable call which is after. +The Toshiba bridge should be configured before video, so move +the relevant power and initialisation calls to prepare. + +Fixes: 2f733d6194bd ("drm/panel: Add support for the Raspberry Pi 7" Touchscreen.") +Signed-off-by: Dave Stevenson +Signed-off-by: Stefan Wahren +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20220415162513.42190-3-stefan.wahren@i2se.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c +index 1f805eb8fdb5..145047e19394 100644 +--- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c ++++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c +@@ -265,7 +265,7 @@ static int rpi_touchscreen_noop(struct drm_panel *panel) + return 0; + } + +-static int rpi_touchscreen_enable(struct drm_panel *panel) ++static int rpi_touchscreen_prepare(struct drm_panel *panel) + { + struct rpi_touchscreen *ts = panel_to_ts(panel); + int i; +@@ -295,6 +295,13 @@ static int rpi_touchscreen_enable(struct drm_panel *panel) + rpi_touchscreen_write(ts, DSI_STARTDSI, 0x01); + msleep(100); + ++ return 0; ++} ++ ++static int rpi_touchscreen_enable(struct drm_panel *panel) ++{ ++ struct rpi_touchscreen *ts = panel_to_ts(panel); ++ + /* Turn on the backlight. */ + rpi_touchscreen_i2c_write(ts, REG_PWM, 255); + +@@ -349,7 +356,7 @@ static int rpi_touchscreen_get_modes(struct drm_panel *panel, + static const struct drm_panel_funcs rpi_touchscreen_funcs = { + .disable = rpi_touchscreen_disable, + .unprepare = rpi_touchscreen_noop, +- .prepare = rpi_touchscreen_noop, ++ .prepare = rpi_touchscreen_prepare, + .enable = rpi_touchscreen_enable, + .get_modes = rpi_touchscreen_get_modes, + }; +-- +2.31.1 + diff --git a/patches.suse/drm-radeon-Avoid-power-table-parsing-memory-leaks.patch b/patches.suse/drm-radeon-Avoid-power-table-parsing-memory-leaks.patch index 6bd0e4d..4feaf17 100644 --- a/patches.suse/drm-radeon-Avoid-power-table-parsing-memory-leaks.patch +++ b/patches.suse/drm-radeon-Avoid-power-table-parsing-memory-leaks.patch @@ -5,6 +5,7 @@ Subject: [PATCH] drm/radeon: Avoid power table parsing memory leaks Git-commit: c69f27137a38d24301a6b659454a91ad85dff4aa Patch-mainline: v5.13-rc1 References: git-fixes +Alt-commit: 642f3ad00f9640a1a74c6e0da538c5f88d2d0117 Avoid leaving a hanging pre-allocated clock_info if last mode is invalid, and avoid heap corruption if no valid modes are found. diff --git a/patches.suse/drm-radeon-Fix-off-by-one-power_state-index-heap-ove.patch b/patches.suse/drm-radeon-Fix-off-by-one-power_state-index-heap-ove.patch index 5a0d7ad..87dc772 100644 --- a/patches.suse/drm-radeon-Fix-off-by-one-power_state-index-heap-ove.patch +++ b/patches.suse/drm-radeon-Fix-off-by-one-power_state-index-heap-ove.patch @@ -5,6 +5,7 @@ Subject: [PATCH] drm/radeon: Fix off-by-one power_state index heap overwrite Git-commit: 5bbf219328849e83878bddb7c226d8d42e84affc Patch-mainline: v5.13-rc1 References: git-fixes +Alt-commit: 359615251034790abaa06b7b0e5635543e01d473 An out of bounds write happens when setting the default power state. KASAN sees this as: diff --git a/patches.suse/drm-vc4-Use-pm_runtime_resume_and_get-to-fix-pm_runt.patch b/patches.suse/drm-vc4-Use-pm_runtime_resume_and_get-to-fix-pm_runt.patch new file mode 100644 index 0000000..54e23bf --- /dev/null +++ b/patches.suse/drm-vc4-Use-pm_runtime_resume_and_get-to-fix-pm_runt.patch @@ -0,0 +1,36 @@ +From 3d0b93d92a2790337aa9d18cb332d02356a24126 Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Wed, 20 Apr 2022 21:50:07 +0800 +Subject: [PATCH] drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage +Git-commit: 3d0b93d92a2790337aa9d18cb332d02356a24126 +Patch-mainline: v5.18-rc4 +References: git-fixes + +If the device is already in a runtime PM enabled state +pm_runtime_get_sync() will return 1. + +Also, we need to call pm_runtime_put_noidle() when pm_runtime_get_sync() +fails, so use pm_runtime_resume_and_get() instead. this function +will handle this. + +Fixes: 4078f5757144 ("drm/vc4: Add DSI driver") +Signed-off-by: Miaoqian Lin +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20220420135008.2757-1-linmq006@gmail.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/vc4/vc4_dsi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vc4/vc4_dsi.c ++++ b/drivers/gpu/drm/vc4/vc4_dsi.c +@@ -835,7 +835,7 @@ static void vc4_dsi_encoder_enable(struc + unsigned long phy_clock; + int ret; + +- ret = pm_runtime_get_sync(dev); ++ ret = pm_runtime_resume_and_get(dev); + if (ret) { + DRM_ERROR("Failed to runtime PM enable on DSI%d\n", dsi->port); + return; diff --git a/patches.suse/e1000e-Fix-possible-overflow-in-LTR-decoding.patch b/patches.suse/e1000e-Fix-possible-overflow-in-LTR-decoding.patch new file mode 100644 index 0000000..8b5162e --- /dev/null +++ b/patches.suse/e1000e-Fix-possible-overflow-in-LTR-decoding.patch @@ -0,0 +1,57 @@ +From 04ebaa1cfddae5f240cc7404f009133bb0389a47 Mon Sep 17 00:00:00 2001 +From: Sasha Neftin +Date: Tue, 5 Apr 2022 18:56:01 +0300 +Subject: [PATCH] e1000e: Fix possible overflow in LTR decoding +Git-commit: 04ebaa1cfddae5f240cc7404f009133bb0389a47 +Patch-mainline: v5.18-rc4 +References: git-fixes + +When we decode the latency and the max_latency, u16 value may not fit +the required size and could lead to the wrong LTR representation. + +Scaling is represented as: +scale 0 - 1 (2^(5*0)) = 2^0 +scale 1 - 32 (2^(5 *1))= 2^5 +scale 2 - 1024 (2^(5 *2)) =2^10 +scale 3 - 32768 (2^(5 *3)) =2^15 +scale 4 - 1048576 (2^(5 *4)) = 2^20 +scale 5 - 33554432 (2^(5 *4)) = 2^25 +scale 4 and scale 5 required 20 and 25 bits respectively. +scale 6 reserved. + +Replace the u16 type with the u32 type and allow corrected LTR +representation. + +Cc: stable@vger.kernel.org +Fixes: 44a13a5d99c7 ("e1000e: Fix the max snoop/no-snoop latency for 10M") +Reported-by: James Hutchinson +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215689 +Suggested-by: Dima Ruinskiy +Signed-off-by: Sasha Neftin +Tested-by: Naama Meir +Tested-by: James Hutchinson +Signed-off-by: Tony Nguyen +Acked-by: Takashi Iwai + +--- + drivers/net/ethernet/intel/e1000e/ich8lan.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c +index d60e2016d03c..e6c8e6d5234f 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c +@@ -1009,8 +1009,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) + { + u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) | + link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND; +- u16 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */ +- u16 lat_enc_d = 0; /* latency decoded */ ++ u32 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */ ++ u32 lat_enc_d = 0; /* latency decoded */ + u16 lat_enc = 0; /* latency encoded */ + + if (link) { +-- +2.31.1 + diff --git a/patches.suse/hwrng-cavium-HW_RANDOM_CAVIUM-should-depend-on-ARCH_.patch b/patches.suse/hwrng-cavium-HW_RANDOM_CAVIUM-should-depend-on-ARCH_.patch new file mode 100644 index 0000000..6d83047 --- /dev/null +++ b/patches.suse/hwrng-cavium-HW_RANDOM_CAVIUM-should-depend-on-ARCH_.patch @@ -0,0 +1,31 @@ +From: Geert Uytterhoeven +Date: Wed, 12 Jan 2022 15:05:03 +0100 +Subject: hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER +Git-commit: ab7d88549e2f7ae116afd303f32e1950cb790a1d +Patch-mainline: 5.18-rc1 +References: git-fixes + +The Cavium ThunderX Random Number Generator is only present on Cavium +ThunderX SoCs, and not available as an independent PCIe endpoint. Hence +add a dependency on ARCH_THUNDER, to prevent asking the user about this +driver when configuring a kernel without Cavium Thunder SoC support. + +Fixes: cc2f1908c6b8f625 ("hwrng: cavium - Add Cavium HWRNG driver for ThunderX SoC.") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Herbert Xu +Signed-off-by: Jiri Slaby +--- + drivers/char/hw_random/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/char/hw_random/Kconfig ++++ b/drivers/char/hw_random/Kconfig +@@ -387,7 +387,7 @@ config HW_RANDOM_MESON + + config HW_RANDOM_CAVIUM + tristate "Cavium ThunderX Random Number Generator support" +- depends on HW_RANDOM && PCI && (ARM64 || (COMPILE_TEST && 64BIT)) ++ depends on HW_RANDOM && PCI && (ARCH_THUNDER || (COMPILE_TEST && 64BIT)) + default HW_RANDOM + ---help--- + This driver provides kernel-side support for the Random Number diff --git a/patches.suse/ipmi-Fix-UAF-when-uninstall-ipmi_si-and-ipmi_msghand.patch b/patches.suse/ipmi-Fix-UAF-when-uninstall-ipmi_si-and-ipmi_msghand.patch new file mode 100644 index 0000000..437f92c --- /dev/null +++ b/patches.suse/ipmi-Fix-UAF-when-uninstall-ipmi_si-and-ipmi_msghand.patch @@ -0,0 +1,136 @@ +From: Wu Bo +Date: Tue, 21 Dec 2021 15:00:34 +0800 +Subject: ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module +Git-commit: ffb76a86f8096a8206be03b14adda6092e18e275 +Patch-mainline: 5.16-rc7 +References: git-fixes + +Hi, + +When testing install and uninstall of ipmi_si.ko and ipmi_msghandler.ko, +the system crashed. + +The log as follows: +[ 141.087026] BUG: unable to handle kernel paging request at ffffffffc09b3a5a +[ 141.087241] PGD 8fe4c0d067 P4D 8fe4c0d067 PUD 8fe4c0f067 PMD 103ad89067 PTE 0 +[ 141.087464] Oops: 0010 [#1] SMP NOPTI +[ 141.087580] CPU: 67 PID: 668 Comm: kworker/67:1 Kdump: loaded Not tainted 4.18.0.x86_64 #47 +[ 141.088009] Workqueue: events 0xffffffffc09b3a40 +[ 141.088009] RIP: 0010:0xffffffffc09b3a5a +[ 141.088009] Code: Bad RIP value. +[ 141.088009] RSP: 0018:ffffb9094e2c3e88 EFLAGS: 00010246 +[ 141.088009] RAX: 0000000000000000 RBX: ffff9abfdb1f04a0 RCX: 0000000000000000 +[ 141.088009] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 +[ 141.088009] RBP: 0000000000000000 R08: ffff9abfffee3cb8 R09: 00000000000002e1 +[ 141.088009] R10: ffffb9094cb73d90 R11: 00000000000f4240 R12: ffff9abfffee8700 +[ 141.088009] R13: 0000000000000000 R14: ffff9abfdb1f04a0 R15: ffff9abfdb1f04a8 +[ 141.088009] FS: 0000000000000000(0000) GS:ffff9abfffec0000(0000) knlGS:0000000000000000 +[ 141.088009] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 141.088009] CR2: ffffffffc09b3a30 CR3: 0000008fe4c0a001 CR4: 00000000007606e0 +[ 141.088009] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 141.088009] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 141.088009] PKRU: 55555554 +[ 141.088009] Call Trace: +[ 141.088009] ? process_one_work+0x195/0x390 +[ 141.088009] ? worker_thread+0x30/0x390 +[ 141.088009] ? process_one_work+0x390/0x390 +[ 141.088009] ? kthread+0x10d/0x130 +[ 141.088009] ? kthread_flush_work_fn+0x10/0x10 +[ 141.088009] ? ret_from_fork+0x35/0x40] BUG: unable to handle kernel paging request at ffffffffc0b28a5a +[ 200.223240] PGD 97fe00d067 P4D 97fe00d067 PUD 97fe00f067 PMD a580cbf067 PTE 0 +[ 200.223464] Oops: 0010 [#1] SMP NOPTI +[ 200.223579] CPU: 63 PID: 664 Comm: kworker/63:1 Kdump: loaded Not tainted 4.18.0.x86_64 #46 +[ 200.224008] Workqueue: events 0xffffffffc0b28a40 +[ 200.224008] RIP: 0010:0xffffffffc0b28a5a +[ 200.224008] Code: Bad RIP value. +[ 200.224008] RSP: 0018:ffffbf3c8e2a3e88 EFLAGS: 00010246 +[ 200.224008] RAX: 0000000000000000 RBX: ffffa0799ad6bca0 RCX: 0000000000000000 +[ 200.224008] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 +[ 200.224008] RBP: 0000000000000000 R08: ffff9fe43fde3cb8 R09: 00000000000000d5 +[ 200.224008] R10: ffffbf3c8cb53d90 R11: 00000000000f4240 R12: ffff9fe43fde8700 +[ 200.224008] R13: 0000000000000000 R14: ffffa0799ad6bca0 R15: ffffa0799ad6bca8 +[ 200.224008] FS: 0000000000000000(0000) GS:ffff9fe43fdc0000(0000) knlGS:0000000000000000 +[ 200.224008] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 200.224008] CR2: ffffffffc0b28a30 CR3: 00000097fe00a002 CR4: 00000000007606e0 +[ 200.224008] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 200.224008] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 200.224008] PKRU: 55555554 +[ 200.224008] Call Trace: +[ 200.224008] ? process_one_work+0x195/0x390 +[ 200.224008] ? worker_thread+0x30/0x390 +[ 200.224008] ? process_one_work+0x390/0x390 +[ 200.224008] ? kthread+0x10d/0x130 +[ 200.224008] ? kthread_flush_work_fn+0x10/0x10 +[ 200.224008] ? ret_from_fork+0x35/0x40 +[ 200.224008] kernel fault(0x1) notification starting on CPU 63 +[ 200.224008] kernel fault(0x1) notification finished on CPU 63 +[ 200.224008] CR2: ffffffffc0b28a5a +[ 200.224008] ---[ end trace c82a412d93f57412 ]--- + +The reason is as follows: +T1: rmmod ipmi_si. + ->ipmi_unregister_smi() + -> ipmi_bmc_unregister() + -> __ipmi_bmc_unregister() + -> kref_put(&bmc->usecount, cleanup_bmc_device); + -> schedule_work(&bmc->remove_work); + +T2: rmmod ipmi_msghandler. + ipmi_msghander module uninstalled, and the module space + will be freed. + +T3: bmc->remove_work doing cleanup the bmc resource. + -> cleanup_bmc_work() + -> platform_device_unregister(&bmc->pdev); + -> platform_device_del(pdev); + -> device_del(&pdev->dev); + -> kobject_uevent(&dev->kobj, KOBJ_REMOVE); + -> kobject_uevent_env() + -> dev_uevent() + -> if (dev->type && dev->type->name) + + 'dev->type'(bmc_device_type) pointer space has freed when uninstall + ipmi_msghander module, 'dev->type->name' cause the system crash. + +drivers/char/ipmi/ipmi_msghandler.c: +2820 static const struct device_type bmc_device_type = { +2821 .groups = bmc_dev_attr_groups, +2822 }; + +Steps to reproduce: +Add a time delay in cleanup_bmc_work() function, +and uninstall ipmi_si and ipmi_msghandler module. + +2910 static void cleanup_bmc_work(struct work_struct *work) +2911 { +2912 struct bmc_device *bmc = container_of(work, struct bmc_device, +2913 remove_work); +2914 int id = bmc->pdev.id; /* Unregister overwrites id */ +2915 +2916 msleep(3000); <--- +2917 platform_device_unregister(&bmc->pdev); +2918 ida_simple_remove(&ipmi_bmc_ida, id); +2919 } + +Use 'remove_work_wq' instead of 'system_wq' to solve this issues. + +Fixes: b2cfd8ab4add ("ipmi: Rework device id and guid handling to catch changing BMCs") +Signed-off-by: Wu Bo +Message-Id: <1640070034-56671-1-git-send-email-wubo40@huawei.com> +Signed-off-by: Corey Minyard +Signed-off-by: Jiri Slaby +--- + drivers/char/ipmi/ipmi_msghandler.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -2935,7 +2935,7 @@ cleanup_bmc_device(struct kref *ref) + * with removing the device attributes while reading a device + * attribute. + */ +- schedule_work(&bmc->remove_work); ++ queue_work(remove_work_wq, &bmc->remove_work); + } + + /* diff --git a/patches.suse/ipmi-Move-remove_work-to-dedicated-workqueue.patch b/patches.suse/ipmi-Move-remove_work-to-dedicated-workqueue.patch new file mode 100644 index 0000000..d7456c3 --- /dev/null +++ b/patches.suse/ipmi-Move-remove_work-to-dedicated-workqueue.patch @@ -0,0 +1,78 @@ +From: Ioanna Alifieraki +Date: Mon, 15 Nov 2021 15:16:45 +0200 +Subject: ipmi: Move remove_work to dedicated workqueue +Git-commit: 1d49eb91e86e8c1c1614c72e3e958b6b7e2472a9 +Patch-mainline: 5.16-rc4 +References: git-fixes + +Currently when removing an ipmi_user the removal is deferred as a work on +the system's workqueue. Although this guarantees the free operation will +occur in non atomic context, it can race with the ipmi_msghandler module +removal (see [1]) . In case a remove_user work is scheduled for removal +and shortly after ipmi_msghandler module is removed we can end up in a +situation where the module is removed fist and when the work is executed +the system crashes with : +BUG: unable to handle page fault for address: ffffffffc05c3450 +PF: supervisor instruction fetch in kernel mode +PF: error_code(0x0010) - not-present page +because the pages of the module are gone. In cleanup_ipmi() there is no +easy way to detect if there are any pending works to flush them before +removing the module. This patch creates a separate workqueue and schedules +the remove_work works on it. When removing the module the workqueue is +drained when destroyed to avoid the race. + +[1] https://bugs.launchpad.net/bugs/1950666 + +Cc: stable@vger.kernel.org # 5.1 +Fixes: 3b9a907223d7 (ipmi: fix sleep-in-atomic in free_user at cleanup SRCU user->release_barrier) +Signed-off-by: Ioanna Alifieraki +Message-Id: <20211115131645.25116-1-ioanna-maria.alifieraki@canonical.com> +Signed-off-by: Corey Minyard +Signed-off-by: Jiri Slaby +--- + drivers/char/ipmi/ipmi_msghandler.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -220,6 +220,8 @@ struct ipmi_user { + struct work_struct remove_work; + }; + ++struct workqueue_struct *remove_work_wq; ++ + static struct ipmi_user *acquire_ipmi_user(struct ipmi_user *user, int *index) + __acquires(user->release_barrier) + { +@@ -1284,7 +1286,7 @@ static void free_user(struct kref *ref) + struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount); + + /* SRCU cleanup must happen in task context. */ +- schedule_work(&user->remove_work); ++ queue_work(remove_work_wq, &user->remove_work); + } + + static void _ipmi_destroy_user(struct ipmi_user *user) +@@ -5158,6 +5160,13 @@ static int ipmi_init_msghandler(void) + + atomic_notifier_chain_register(&panic_notifier_list, &panic_block); + ++ remove_work_wq = create_singlethread_workqueue("ipmi-msghandler-remove-wq"); ++ if (!remove_work_wq) { ++ pr_err("unable to create ipmi-msghandler-remove-wq workqueue"); ++ rv = -ENOMEM; ++ goto out; ++ } ++ + initialized = true; + + out: +@@ -5183,6 +5192,8 @@ static void __exit cleanup_ipmi(void) + int count; + + if (initialized) { ++ destroy_workqueue(remove_work_wq); ++ + atomic_notifier_chain_unregister(&panic_notifier_list, + &panic_block); + diff --git a/patches.suse/ipmi-bail-out-if-init_srcu_struct-fails.patch b/patches.suse/ipmi-bail-out-if-init_srcu_struct-fails.patch new file mode 100644 index 0000000..7b787d7 --- /dev/null +++ b/patches.suse/ipmi-bail-out-if-init_srcu_struct-fails.patch @@ -0,0 +1,35 @@ +From: Thadeu Lima de Souza Cascardo +Date: Fri, 17 Dec 2021 12:44:09 -0300 +Subject: ipmi: bail out if init_srcu_struct fails +Git-commit: 2b5160b12091285c5aca45980f100a9294af7b04 +Patch-mainline: 5.16-rc7 +References: git-fixes + +In case, init_srcu_struct fails (because of memory allocation failure), we +might proceed with the driver initialization despite srcu_struct not being +entirely initialized. + +Fixes: 913a89f009d9 ("ipmi: Don't initialize anything in the core until something uses it") +Signed-off-by: Thadeu Lima de Souza Cascardo +Cc: Corey Minyard +Cc: stable@vger.kernel.org +Message-Id: <20211217154410.1228673-1-cascardo@canonical.com> +Signed-off-by: Corey Minyard +Signed-off-by: Jiri Slaby +--- + drivers/char/ipmi/ipmi_msghandler.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -5153,7 +5153,9 @@ static int ipmi_init_msghandler(void) + if (initialized) + goto out; + +- init_srcu_struct(&ipmi_interfaces_srcu); ++ rv = init_srcu_struct(&ipmi_interfaces_srcu); ++ if (rv) ++ goto out; + + timer_setup(&ipmi_timer, ipmi_timeout, 0); + mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); diff --git a/patches.suse/net-asix-add-proper-error-handling-of-usb-read-error.patch b/patches.suse/net-asix-add-proper-error-handling-of-usb-read-error.patch new file mode 100644 index 0000000..22c1842 --- /dev/null +++ b/patches.suse/net-asix-add-proper-error-handling-of-usb-read-error.patch @@ -0,0 +1,136 @@ +From 920a9fa27e7805499cfe78491b36fed2322c02ec Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Sun, 6 Feb 2022 21:05:16 +0300 +Subject: [PATCH] net: asix: add proper error handling of usb read errors +Git-commit: 920a9fa27e7805499cfe78491b36fed2322c02ec +References: git-fixes +Patch-mainline: v5.18-rc1 + +Syzbot once again hit uninit value in asix driver. The problem still the +same -- asix_read_cmd() reads less bytes, than was requested by caller. + +Since all read requests are performed via asix_read_cmd() let's catch +usb related error there and add __must_check notation to be sure all +callers actually check return value. + +So, this patch adds sanity check inside asix_read_cmd(), that simply +checks if bytes read are not less, than was requested and adds missing +error handling of asix_read_cmd() all across the driver code. + +Fixes: d9fe64e51114 ("net: asix: Add in_pm parameter") +Reported-and-tested-by: syzbot+6ca9f7867b77c2d316ac@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Tested-by: Oleksij Rempel +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: David S. Miller +Signed-off-by: Oliver Neukum +--- + drivers/net/usb/asix.h | 4 ++-- + drivers/net/usb/asix_common.c | 19 +++++++++++++------ + drivers/net/usb/asix_devices.c | 21 ++++++++++++++++++--- + 3 files changed, 33 insertions(+), 11 deletions(-) + +--- a/drivers/net/usb/asix.h ++++ b/drivers/net/usb/asix.h +@@ -185,8 +185,8 @@ extern const struct driver_info ax88172a + /* ASIX specific flags */ + #define FLAG_EEPROM_MAC (1UL << 0) /* init device MAC from eeprom */ + +-int asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, +- u16 size, void *data, int in_pm); ++int __must_check asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, ++ u16 size, void *data, int in_pm); + + int asix_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, + u16 size, void *data, int in_pm); +--- a/drivers/net/usb/asix_common.c ++++ b/drivers/net/usb/asix_common.c +@@ -11,8 +11,8 @@ + + #define AX_HOST_EN_RETRIES 30 + +-int asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, +- u16 size, void *data, int in_pm) ++int __must_check asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, ++ u16 size, void *data, int in_pm) + { + int ret; + int (*fn)(struct usbnet *, u8, u8, u16, u16, void *, u16); +@@ -27,9 +27,12 @@ int asix_read_cmd(struct usbnet *dev, u8 + ret = fn(dev, cmd, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + value, index, data, size); + +- if (unlikely(ret < 0)) ++ if (unlikely(ret < size)) { ++ ret = ret < 0 ? ret : -ENODATA; ++ + netdev_warn(dev->net, "Failed to read reg index 0x%04x: %d\n", + index, ret); ++ } + + return ret; + } +@@ -79,7 +82,7 @@ static int asix_check_host_enable(struct + 0, 0, 1, &smsr, in_pm); + if (ret == -ENODEV) + break; +- else if (ret < sizeof(smsr)) ++ else if (ret < 0) + continue; + else if (smsr & AX_HOST_EN) + break; +@@ -528,8 +531,12 @@ int asix_mdio_read_nopm(struct net_devic + return ret; + } + +- asix_read_cmd(dev, AX_CMD_READ_MII_REG, phy_id, +- (__u16)loc, 2, &res, 1); ++ ret = asix_read_cmd(dev, AX_CMD_READ_MII_REG, phy_id, ++ (__u16)loc, 2, &res, 1); ++ if (ret < 0) { ++ mutex_unlock(&dev->phy_mutex); ++ return ret; ++ } + asix_set_hw_mii(dev, 1); + mutex_unlock(&dev->phy_mutex); + +--- a/drivers/net/usb/asix_devices.c ++++ b/drivers/net/usb/asix_devices.c +@@ -724,7 +724,12 @@ static int ax88772_bind(struct usbnet *d + dev->net->needed_headroom = 4; /* cf asix_tx_fixup() */ + dev->net->needed_tailroom = 4; /* cf asix_tx_fixup() */ + +- asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG, 0, 0, 1, &chipcode, 0); ++ ret = asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG, 0, 0, 1, &chipcode, 0); ++ if (ret < 0) { ++ netdev_dbg(dev->net, "Failed to read STATMNGSTS_REG: %d\n", ret); ++ return ret; ++ } ++ + chipcode &= AX_CHIPCODE_MASK; + + ret = (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) : +@@ -874,11 +879,21 @@ static int ax88178_reset(struct usbnet * + int gpio0 = 0; + u32 phyid; + +- asix_read_cmd(dev, AX_CMD_READ_GPIOS, 0, 0, 1, &status, 0); ++ ret = asix_read_cmd(dev, AX_CMD_READ_GPIOS, 0, 0, 1, &status, 0); ++ if (ret < 0) { ++ netdev_dbg(dev->net, "Failed to read GPIOS: %d\n", ret); ++ return ret; ++ } ++ + netdev_dbg(dev->net, "GPIO Status: 0x%04x\n", status); + + asix_write_cmd(dev, AX_CMD_WRITE_ENABLE, 0, 0, 0, NULL, 0); +- asix_read_cmd(dev, AX_CMD_READ_EEPROM, 0x0017, 0, 2, &eeprom, 0); ++ ret = asix_read_cmd(dev, AX_CMD_READ_EEPROM, 0x0017, 0, 2, &eeprom, 0); ++ if (ret < 0) { ++ netdev_dbg(dev->net, "Failed to read EEPROM: %d\n", ret); ++ return ret; ++ } ++ + asix_write_cmd(dev, AX_CMD_WRITE_DISABLE, 0, 0, 0, NULL, 0); + + netdev_dbg(dev->net, "EEPROM index 0x17 is 0x%04x\n", eeprom); diff --git a/patches.suse/random-check-for-signal_pending-outside-of-need_resc.patch b/patches.suse/random-check-for-signal_pending-outside-of-need_resc.patch new file mode 100644 index 0000000..3b43a00 --- /dev/null +++ b/patches.suse/random-check-for-signal_pending-outside-of-need_resc.patch @@ -0,0 +1,44 @@ +From: Jann Horn +Date: Tue, 5 Apr 2022 18:39:31 +0200 +Subject: random: check for signal_pending() outside of need_resched() check +Git-commit: 1448769c9cdb69ad65287f4f7ab58bc5f2f5d7ba +Patch-mainline: 5.18-rc2 +References: git-fixes + +signal_pending() checks TIF_NOTIFY_SIGNAL and TIF_SIGPENDING, which +signal that the task should bail out of the syscall when possible. This +is a separate concept from need_resched(), which checks +TIF_NEED_RESCHED, signaling that the task should preempt. + +In particular, with the current code, the signal_pending() bailout +probably won't work reliably. + +Change this to look like other functions that read lots of data, such as +read_zero(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jann Horn +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Jiri Slaby +--- + drivers/char/random.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1157,13 +1157,13 @@ static ssize_t extract_crng_user(void __ + int large_request = (nbytes > 256); + + while (nbytes) { +- if (large_request && need_resched()) { ++ if (large_request) { + if (signal_pending(current)) { + if (ret == 0) + ret = -ERESTARTSYS; + break; + } +- schedule(); ++ cond_resched(); + } + + extract_crng(tmp); diff --git a/patches.suse/scsi-scsi_dh_alua-Avoid-crash-during-alua_bus_detach.patch b/patches.suse/scsi-scsi_dh_alua-Avoid-crash-during-alua_bus_detach.patch new file mode 100644 index 0000000..b5db661 --- /dev/null +++ b/patches.suse/scsi-scsi_dh_alua-Avoid-crash-during-alua_bus_detach.patch @@ -0,0 +1,72 @@ +From 5faf50e9e9fdc2117c61ff7e20da49cd6a29e0ca Mon Sep 17 00:00:00 2001 +From: Hannes Reinecke +Date: Thu, 24 Sep 2020 12:45:59 +0200 +Subject: [PATCH] scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() +References: bsc#1028340 bsc#1198825 +Git-commit: 5faf50e9e9fdc2117c61ff7e20da49cd6a29e0ca +Patch-mainline: v5.10-rc3 + +alua_bus_detach() might be running concurrently with alua_rtpg_work(), so +we might trip over h->sdev == NULL and call BUG_ON(). The correct way of +handling it is to not set h->sdev to NULL in alua_bus_detach(), and call +rcu_synchronize() before the final delete to ensure that all concurrent +threads have left the critical section. Then we can get rid of the +BUG_ON() and replace it with a simple if condition. + +Link: https://lore.kernel.org/r/1600167537-12509-1-git-send-email-jitendra.khasdev@oracle.com +Link: https://lore.kernel.org/r/20200924104559.26753-1-hare@suse.de +Cc: Brian Bunker +Acked-by: Brian Bunker +Tested-by: Jitendra Khasdev +Reviewed-by: Jitendra Khasdev +Signed-off-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Thomas Abraham +--- + drivers/scsi/device_handler/scsi_dh_alua.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c +index f32da0ca529e..308bda2e9c00 100644 +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -658,8 +658,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + rcu_read_lock(); + list_for_each_entry_rcu(h, + &tmp_pg->dh_list, node) { +- /* h->sdev should always be valid */ +- BUG_ON(!h->sdev); ++ if (!h->sdev) ++ continue; + h->sdev->access_state = desc[0]; + } + rcu_read_unlock(); +@@ -705,7 +705,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + pg->expiry = 0; + rcu_read_lock(); + list_for_each_entry_rcu(h, &pg->dh_list, node) { +- BUG_ON(!h->sdev); ++ if (!h->sdev) ++ continue; + h->sdev->access_state = + (pg->state & SCSI_ACCESS_STATE_MASK); + if (pg->pref) +@@ -1147,7 +1148,6 @@ static void alua_bus_detach(struct scsi_device *sdev) + spin_lock(&h->pg_lock); + pg = rcu_dereference_protected(h->pg, lockdep_is_held(&h->pg_lock)); + rcu_assign_pointer(h->pg, NULL); +- h->sdev = NULL; + spin_unlock(&h->pg_lock); + if (pg) { + spin_lock_irq(&pg->lock); +@@ -1156,6 +1156,7 @@ static void alua_bus_detach(struct scsi_device *sdev) + kref_put(&pg->kref, release_port_group); + } + sdev->handler_data = NULL; ++ synchronize_rcu(); + kfree(h); + } + +-- +2.34.1 + diff --git a/patches.suse/xen-x86-obtain-full-video-frame-buffer-address-for-D.patch b/patches.suse/xen-x86-obtain-full-video-frame-buffer-address-for-D.patch new file mode 100644 index 0000000..98190a6 --- /dev/null +++ b/patches.suse/xen-x86-obtain-full-video-frame-buffer-address-for-D.patch @@ -0,0 +1,59 @@ +Patch-mainline: v5.17-rc4 +Git-commit: f34c4f2dd2445ab89e5373fff2990fab36578bd3 +References: bsc#1193556 +From: Jan Beulich +Date: Mon, 7 Feb 2022 08:41:03 +0100 +Subject: [PATCH] xen/x86: obtain full video frame buffer address for Dom0 also + under EFI + +The initial change would not work when Xen was booted from EFI: There is +an early exit from the case block in that case. Move the necessary code +ahead of that. + +Fixes: 335e4dd67b48 ("xen/x86: obtain upper 32 bits of video frame buffer address for Dom0") +Signed-off-by: Jan Beulich +Reviewed-by: Juergen Gross + +Link: https://lore.kernel.org/r/2501ce9d-40e5-b49d-b0e5-435544d17d4a@suse.com +Signed-off-by: Juergen Gross +--- + arch/x86/xen/vga.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/xen/vga.c b/arch/x86/xen/vga.c +index 31b1e3477cb6..14ea32e734d5 100644 +--- a/arch/x86/xen/vga.c ++++ b/arch/x86/xen/vga.c +@@ -57,6 +57,14 @@ void __init xen_init_vga(const struct dom0_vga_console_info *info, size_t size) + screen_info->rsvd_size = info->u.vesa_lfb.rsvd_size; + screen_info->rsvd_pos = info->u.vesa_lfb.rsvd_pos; + ++ if (size >= offsetof(struct dom0_vga_console_info, ++ u.vesa_lfb.ext_lfb_base) ++ + sizeof(info->u.vesa_lfb.ext_lfb_base) ++ && info->u.vesa_lfb.ext_lfb_base) { ++ screen_info->ext_lfb_base = info->u.vesa_lfb.ext_lfb_base; ++ screen_info->capabilities |= VIDEO_CAPABILITY_64BIT_BASE; ++ } ++ + if (info->video_type == XEN_VGATYPE_EFI_LFB) { + screen_info->orig_video_isVGA = VIDEO_TYPE_EFI; + break; +@@ -66,14 +74,6 @@ void __init xen_init_vga(const struct dom0_vga_console_info *info, size_t size) + u.vesa_lfb.mode_attrs) + + sizeof(info->u.vesa_lfb.mode_attrs)) + screen_info->vesa_attributes = info->u.vesa_lfb.mode_attrs; +- +- if (size >= offsetof(struct dom0_vga_console_info, +- u.vesa_lfb.ext_lfb_base) +- + sizeof(info->u.vesa_lfb.ext_lfb_base) +- && info->u.vesa_lfb.ext_lfb_base) { +- screen_info->ext_lfb_base = info->u.vesa_lfb.ext_lfb_base; +- screen_info->capabilities |= VIDEO_CAPABILITY_64BIT_BASE; +- } + break; + } + } +-- +2.34.1 + diff --git a/patches.suse/xen-x86-obtain-upper-32-bits-of-video-frame-buffer-a.patch b/patches.suse/xen-x86-obtain-upper-32-bits-of-video-frame-buffer-a.patch new file mode 100644 index 0000000..1acfb57 --- /dev/null +++ b/patches.suse/xen-x86-obtain-upper-32-bits-of-video-frame-buffer-a.patch @@ -0,0 +1,68 @@ +Patch-mainline: v5.17-rc1 +Git-commit: 335e4dd67b480c8fa571ea7e71af0d22047fcfb7 +References: bsc#1193556 +From: Jan Beulich +Date: Tue, 4 Jan 2022 09:46:06 +0100 +Subject: [PATCH] xen/x86: obtain upper 32 bits of video frame buffer address + for Dom0 + +The hypervisor has been supplying this information for a couple of major +releases. Make use of it. The need to set a flag in the capabilities +field also points out that the prior setting of that field from the +hypervisor interface's gbl_caps one was wrong, so that code gets deleted +(there's also no equivalent of this in native boot code). + +Signed-off-by: Jan Beulich +Reviewed-by: Boris Ostrovsky + +Link: https://lore.kernel.org/r/a3df8bf3-d044-b7bb-3383-cd5239d6d4af@suse.com +Signed-off-by: Juergen Gross +--- + arch/x86/xen/vga.c | 12 ++++++++---- + include/xen/interface/xen.h | 3 +++ + 2 files changed, 11 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/xen/vga.c b/arch/x86/xen/vga.c +index e336f223f7f4..31b1e3477cb6 100644 +--- a/arch/x86/xen/vga.c ++++ b/arch/x86/xen/vga.c +@@ -62,14 +62,18 @@ void __init xen_init_vga(const struct dom0_vga_console_info *info, size_t size) + break; + } + +- if (size >= offsetof(struct dom0_vga_console_info, +- u.vesa_lfb.gbl_caps) +- + sizeof(info->u.vesa_lfb.gbl_caps)) +- screen_info->capabilities = info->u.vesa_lfb.gbl_caps; + if (size >= offsetof(struct dom0_vga_console_info, + u.vesa_lfb.mode_attrs) + + sizeof(info->u.vesa_lfb.mode_attrs)) + screen_info->vesa_attributes = info->u.vesa_lfb.mode_attrs; ++ ++ if (size >= offsetof(struct dom0_vga_console_info, ++ u.vesa_lfb.ext_lfb_base) ++ + sizeof(info->u.vesa_lfb.ext_lfb_base) ++ && info->u.vesa_lfb.ext_lfb_base) { ++ screen_info->ext_lfb_base = info->u.vesa_lfb.ext_lfb_base; ++ screen_info->capabilities |= VIDEO_CAPABILITY_64BIT_BASE; ++ } + break; + } + } +diff --git a/include/xen/interface/xen.h b/include/xen/interface/xen.h +index 5e9916939268..0ca23eca2a9c 100644 +--- a/include/xen/interface/xen.h ++++ b/include/xen/interface/xen.h +@@ -722,6 +722,9 @@ struct dom0_vga_console_info { + uint32_t gbl_caps; + /* Mode attributes (offset 0x0, VESA command 0x4f01). */ + uint16_t mode_attrs; ++ uint16_t pad; ++ /* high 32 bits of lfb_base */ ++ uint32_t ext_lfb_base; + } vesa_lfb; + } u; + }; +-- +2.34.1 + diff --git a/series.conf b/series.conf index e2c4ee3..3929921 100644 --- a/series.conf +++ b/series.conf @@ -45918,6 +45918,7 @@ patches.suse/0033-drm-imx-tve-remove-extraneous-type-qualifier.patch patches.suse/drm-i915-gvt-Set-SNOOP-for-PAT3-on-BXT-APL-to-workar.patch patches.suse/drm-i915-gvt-Only-pin-unpin-intel_context-along-with.patch + patches.suse/drm-i915-gem-Flush-coherency-domains-on-first-set-do.patch patches.suse/drm-i915-gt-Use-the-local-HWSP-offset-during-submiss.patch patches.suse/drm-i915-Fix-encoder-lookup-during-PSR-atomic-check.patch patches.suse/drm-amdgpu-perform-srbm-soft-reset-always-on-SDMA-re.patch @@ -45956,6 +45957,7 @@ patches.suse/ASoC-codecs-wcd9335-Set-digital-gain-range-correctly.patch patches.suse/mtd-spi-nor-Don-t-copy-self-pointing-struct-around.patch patches.suse/mtd-spi-nor-Fix-address-width-on-flash-chips-16MB.patch + patches.suse/scsi-scsi_dh_alua-Avoid-crash-during-alua_bus_detach.patch patches.suse/ceph-check-session-state-after-bumping-session-s_seq.patch patches.suse/i2c-mediatek-move-dma-reset-before-i2c-reset.patch patches.suse/i2c-sh_mobile-implement-atomic-transfers.patch @@ -48767,6 +48769,7 @@ patches.suse/drm-i915-gen11-Only-load-DRAM-information-from-pcode.patch patches.suse/drm-i915-Rename-is_16gb_dimm-to-wm_lv_0_adjust_neede.patch patches.suse/drm-mediatek-Check-if-fb-is-null.patch + patches.suse/drm-mediatek-Fix-aal-size-config.patch patches.suse/drm-amd-display-Guard-against-NULL-pointer-deref-whe.patch patches.suse/drm-amd-display-Fix-10-12-bpc-setup-in-DCE-output-bi.patch patches.suse/drm-amd-display-Fix-HDMI-deep-color-output-for-DCE-6.patch @@ -49186,6 +49189,7 @@ patches.suse/iommu-vt-d-fix-status-code-for-allocate-free-pasid-command patches.suse/ACPI-bus-Constify-is_acpi_node-and-friends-part-2.patch patches.suse/PM-runtime-Update-device-status-before-letting-suppl.patch + patches.suse/block-drop-leftover-references-to-RQF_SORTED.patch patches.suse/rsxx-Return-EFAULT-if-copy_to_user-fails.patch patches.suse/nvme-hwmon-Return-error-code-when-registration-fails.patch patches.suse/nvme-fabrics-fix-kato-initialization.patch @@ -52205,6 +52209,7 @@ patches.suse/bnx2x-fix-an-error-code-in-bnx2x_nic_load.patch patches.suse/net-pegasus-fix-uninit-value-in-get_interrupt_interv.patch patches.suse/drm-i915-Correct-SFC_DONE-register-offset.patch + patches.suse/drm-i915-Call-i915_globals_exit-if-pci_register_devi.patch patches.suse/drm-amdgpu-fix-the-doorbell-missing-when-in-CGPG-iss.patch patches.suse/drm-amd-display-Fix-Dynamic-bpp-issue-with-8K30-with.patch patches.suse/drm-amd-display-workaround-for-hard-hang-on-HPD-on-n.patch @@ -52359,6 +52364,7 @@ patches.suse/drm-Copy-drm_wait_vblank-to-user-before-returning.patch patches.suse/drm-nouveau-disp-power-down-unused-DP-links-during-i.patch patches.suse/drm-nouveau-kms-nv50-workaround-EFI-GOP-window-chann.patch + patches.suse/drm-mediatek-Add-AAL-output-size-configuration.patch patches.suse/blk-mq-don-t-grab-rq-s-refcount-in-blk_mq_check_expi.patch patches.suse/blk-mq-fix-kernel-panic-during-iterating-over-flush-.patch patches.suse/blk-mq-fix-is_flush_rq.patch @@ -53051,6 +53057,7 @@ patches.suse/hwmon-tmp421-fix-rounding-for-negative-values.patch patches.suse/ext4-fix-reserved-space-counter-leakage.patch patches.suse/phy-mdio-fix-memory-leak.patch + patches.suse/ath5k-fix-building-with-LEDS-m.patch patches.suse/iwlwifi-pcie-add-configuration-of-a-Wi-Fi-adapter-on.patch patches.suse/net-mlx5e-IPSEC-RX-enable-checksum-complete.patch patches.suse/net-mlx5-E-Switch-Fix-double-allocation-of-acl-flow-.patch @@ -53798,6 +53805,7 @@ patches.suse/ASoC-tegra-Fix-kcontrol-put-callback-in-DMIC.patch patches.suse/ASoC-tegra-Fix-kcontrol-put-callback-in-DSPK.patch patches.suse/ASoC-tegra-Fix-kcontrol-put-callback-in-AHUB.patch + patches.suse/ipmi-Move-remove_work-to-dedicated-workqueue.patch patches.suse/kprobes-limit-max-data_size-of-the-kretprobe-instances.patch patches.suse/net-usb-lan78xx-lan78xx_phy_init-use-PHY_POLL-instea.patch patches.suse/wireguard-allowedips-add-missing-__rcu-annotation-to.patch @@ -53961,6 +53969,8 @@ patches.suse/xen-netback-don-t-queue-unlimited-number-of-packages.patch patches.suse/spi-change-clk_disable_unprepare-to-clk_unprepare.patch patches.suse/RDMA-hns-Replace-kfree-with-kvfree.patch + patches.suse/ipmi-bail-out-if-init_srcu_struct-fails.patch + patches.suse/ipmi-Fix-UAF-when-uninstall-ipmi_si-and-ipmi_msghand.patch patches.suse/tee-handle-lookup-of-shm-with-reference-count-0.patch patches.suse/arm64-dts-allwinner-orangepi-zero-plus-fix-PHY-mode.patch patches.suse/arm64-dts-lx2160a-fix-scl-gpios-property-name.patch @@ -54251,6 +54261,7 @@ patches.suse/iommu-amd-remove-useless-irq-affinity-notifier patches.suse/iommu-io-pgtable-arm-fix-table-descriptor-paddr-formatting patches.suse/iommu-iova-fix-race-between-fq-timeout-and-teardown + patches.suse/xen-x86-obtain-upper-32-bits-of-video-frame-buffer-a.patch patches.suse/clk-imx-pllv1-fix-kernel-doc-notation-for-struct-clk.patch patches.suse/clk-Gemini-fix-struct-name-in-kernel-doc.patch patches.suse/clk-stm32-Fix-ltdc-s-clock-turn-off-by-clk_disable_u.patch @@ -54515,6 +54526,7 @@ patches.suse/ata-libata-core-Disable-TRIM-on-M88V29.patch patches.suse/PM-s2idle-ACPI-Fix-wakeup-interrupts-handling.patch patches.suse/ACPI-IORT-Check-node-revision-for-PMCG-resources.patch + patches.suse/xen-x86-obtain-full-video-frame-buffer-address-for-D.patch patches.suse/s390-cio-verify-the-driver-availability-for-path_event-call patches.suse/usb-f_fs-Fix-use-after-free-for-epfile.patch patches.suse/usb-ulpi-Move-of_node_put-to-ulpi_dev_release.patch @@ -54725,6 +54737,7 @@ patches.suse/PM-suspend-fix-return-value-of-__setup-handler.patch patches.suse/thermal-int340x-Check-for-NULL-after-calling-kmemdup.patch patches.suse/thermal-int340x-Increase-bitmap-size.patch + patches.suse/hwrng-cavium-HW_RANDOM_CAVIUM-should-depend-on-ARCH_.patch patches.suse/crypto-rsa-pkcs1pad-correctly-get-hash-from-source-s.patch patches.suse/crypto-rsa-pkcs1pad-restore-signature-length-check.patch patches.suse/crypto-rsa-pkcs1pad-fix-buffer-overread-in-pkcs1pad_.patch @@ -54821,6 +54834,7 @@ patches.suse/memory-emif-check-the-pointer-temp-in-get_device_det.patch patches.suse/pinctrl-samsung-drop-pin-banks-references-on-error-p.patch patches.suse/Bluetooth-hci_serdev-call-init_rwsem-before-p-open.patch + patches.suse/net-asix-add-proper-error-handling-of-usb-read-error.patch patches.suse/ath10k-fix-memory-overwrite-of-the-WoWLAN-wakeup-pac.patch patches.suse/ath5k-fix-OOB-in-ath5k_eeprom_read_pcal_info_5111.patch patches.suse/ath9k_htc-fix-uninit-value-bugs.patch @@ -54836,6 +54850,7 @@ patches.suse/iwlwifi-mvm-Fix-an-error-code-in-iwl_mvm_up.patch patches.suse/carl9170-fix-missing-bit-wise-or-operator-for-tx_par.patch patches.suse/mac80211-fix-potential-double-free-on-mesh-join.patch + patches.suse/bareudp-use-ipv6_mod_enabled-to-check-if-IPv6-enable.patch patches.suse/Bluetooth-btusb-Add-missing-Chicony-device-for-Realt.patch patches.suse/Bluetooth-Fix-use-after-free-in-hci_send_acl.patch patches.suse/Bluetooth-btmtksdio-Fix-kernel-oops-in-btmtksdio_int.patch @@ -54867,6 +54882,9 @@ patches.suse/drm-bridge-cdns-dsi-Make-sure-to-to-create-proper-al.patch patches.suse/drm-msm-dpu-add-DSPP-blocks-teardown.patch patches.suse/drm-i915-gem-add-missing-boundary-check-in-vm_access.patch + patches.suse/RDMA-core-Set-MR-type-in-ib_reg_user_mr.patch + patches.suse/RDMA-mlx5-Fix-the-flow-of-a-miss-in-the-allocation-o.patch + patches.suse/IB-hfi1-Allow-larger-MTU-without-AIP.patch patches.suse/scsi-qla2xxx-Refactor-asynchronous-command-initializ.patch patches.suse/scsi-qla2xxx-Implement-ref-count-for-SRB.patch patches.suse/scsi-qla2xxx-Fix-stuck-session-in-gpdb.patch @@ -55011,6 +55029,7 @@ patches.suse/dma-debug-fix-return-value-of-__setup-handlers.patch patches.suse/NFS-Use-of-mapping_set_error-results-in-spurious-err.patch patches.suse/NFS-Return-valid-errors-from-nfs2-3_decode_dirent.patch + patches.suse/SUNRPC-avoid-race-between-mod_timer-and-del_timer_sy.patch patches.suse/NFSv4.1-don-t-retry-BIND_CONN_TO_SESSION-on-session-.patch patches.suse/NFSv4-pNFS-Fix-another-issue-with-a-list-iterator-po.patch patches.suse/clk-si5341-fix-reported-clk_rate-when-output-divider.patch @@ -55055,6 +55074,7 @@ patches.suse/x86-sev-unroll-string-mmio-with-cc_attr_guest_unroll_string_io patches.suse/ata-sata_dwc_460ex-Fix-crash-due-to-OOB-write.patch patches.suse/ata-libata-core-Disable-READ-LOG-DMA-EXT-for-Samsung.patch + patches.suse/random-check-for-signal_pending-outside-of-need_resc.patch patches.suse/net-usb-aqc111-Fix-out-of-bounds-accesses-in-RX-fixu.patch patches.suse/bpf-Resolve-to-prog-aux-dst_prog-type-only-for-BPF_P.patch patches.suse/drm-amd-Add-USBC-connector-ID.patch @@ -55071,8 +55091,17 @@ patches.suse/mmc-renesas_sdhi-don-t-overwrite-TAP-settings-when-H.patch patches.suse/regulator-wm8994-Add-an-off-on-delay-for-WM8994-vari.patch patches.suse/spi-bcm-qspi-fix-MSPI-only-access-with-bcm_qspi_exec.patch + patches.suse/Revert-NFSv4-Handle-the-special-Linux-file-open-acce.patch + patches.suse/NFSv4-fix-open-failure-with-O_ACCMODE-flag.patch + patches.suse/SUNRPC-Ensure-we-flush-any-closed-sockets-before-xs_.patch + patches.suse/SUNRPC-Handle-ENOMEM-in-call_transmit_status.patch + patches.suse/SUNRPC-Handle-low-memory-situations-in-call_status.patch patches.suse/lz4-fix-LZ4_decompress_safe_partial-read-out-of-boun.patch + patches.suse/RDMA-mlx5-Don-t-remove-cache-MRs-when-a-delay-is-nee.patch + patches.suse/RDMA-mlx5-Add-a-missing-update-of-cache-last_add.patch + patches.suse/RDMA-hfi1-Fix-use-after-free-bug-for-mm-struct.patch patches.suse/scsi-mpt3sas-Fix-use-after-free-in-_scsih_expander_node_remove + patches.suse/SUNRPC-Fix-the-svc_deferred_event-trace-class.patch patches.suse/ALSA-hda-realtek-Add-quirk-for-Clevo-PD50PNT.patch patches.suse/ALSA-usb-audio-Cap-upper-limits-of-buffer-period-byt.patch patches.suse/ALSA-usb-audio-Increase-max-buffer-size.patch @@ -55089,6 +55118,21 @@ patches.suse/gpiolib-acpi-use-correct-format-characters.patch patches.suse/i2c-dev-Force-case-user-pointers-in-compat_i2cdev_io.patch patches.suse/spi-atmel-quadspi-Fix-the-buswidth-adjustment-betwee.patch + patches.suse/e1000e-Fix-possible-overflow-in-LTR-decoding.patch + patches.suse/dma-at_xdmac-fix-a-missing-check-on-list-iterator.patch + patches.suse/dmaengine-imx-sdma-Fix-error-checking-in-sdma_event_.patch + patches.suse/dmaengine-mediatek-Fix-PM-usage-reference-leak-of-mt.patch + patches.suse/dmaengine-idxd-add-RO-check-for-wq-max_batch_size-wr.patch + patches.suse/dmaengine-idxd-add-RO-check-for-wq-max_transfer_size.patch + patches.suse/ALSA-hda-hdmi-fix-warning-about-PCM-count-when-used-.patch + patches.suse/ASoC-atmel-Remove-system-clock-tree-configuration-fo.patch + patches.suse/ASoC-soc-dapm-fix-two-incorrect-uses-of-list-iterato.patch + patches.suse/ASoC-msm8916-wcd-digital-Check-failure-for-devm_snd_.patch + patches.suse/ASoC-codecs-wcd934x-do-not-switch-off-SIDO-Buck-when.patch + patches.suse/Input-omap4-keypad-fix-pm_runtime_get_sync-error-che.patch + patches.suse/drm-panel-raspberrypi-touchscreen-Avoid-NULL-deref-i.patch + patches.suse/drm-panel-raspberrypi-touchscreen-Initialise-the-bri.patch + patches.suse/drm-vc4-Use-pm_runtime_resume_and_get-to-fix-pm_runt.patch # out-of-tree patches patches.suse/random-fix-crash-on-multiple-early-calls-to-add_bootloader_randomness.patch @@ -55288,7 +55332,6 @@ patches.suse/nfsd-allow-lock-state-ids-to-be-revoked-and-then-fre.patch patches.suse/nfsd-allow-delegation-state-ids-to-be-revoked-and-th.patch patches.suse/nfsd-dont-revoke-v4-0-states.patch - patches.suse/SUNRPC-avoid-race-between-mod_timer-and-del_timer_sy.patch # other patches.suse/pstore_disable_efi_backend_by_default.patch @@ -55655,6 +55698,10 @@ patches.kabi/ALSA-kABI-workaround-for-snd_pcm_runtime-changes.patch patches.kabi/net-ax25_dev-kabi-workaround.patch patches.kabi/drm-drm_file-kabi-workaround.patch + patches.kabi/Revert-NFSv4-Handle-the-special-Linux-file-open-acce.kabi + + # bsc#1196367 + patches.suse/SUNRPC-change-locking-for-xs_swap_enable-disable.patch ######################################################## # You'd better have a good reason for adding a patch