From 2cc2aded63425a2a8d38169436a2b04ef5b71c90 Mon Sep 17 00:00:00 2001 From: Oscar Salvador Date: Jun 16 2022 04:23:47 +0000 Subject: Merge remote-tracking branch 'origin/users/tiwai/SLE15-SP3/for-next' into SLE15-SP3 Conflicts: series.conf --- diff --git a/patches.suse/0003-MODSIGN-load-blacklist-from-MOKx.patch b/patches.suse/0003-MODSIGN-load-blacklist-from-MOKx.patch index ac817dc..1a56f75 100644 --- a/patches.suse/0003-MODSIGN-load-blacklist-from-MOKx.patch +++ b/patches.suse/0003-MODSIGN-load-blacklist-from-MOKx.patch @@ -15,7 +15,7 @@ Signed-off-by: Lee, Chun-Yi --- a/security/integrity/platform_certs/load_uefi.c +++ b/security/integrity/platform_certs/load_uefi.c -@@ -150,8 +150,8 @@ static int __init load_uefi_certs(void) +@@ -106,8 +106,8 @@ static int __init load_uefi_certs(void) { efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID; efi_guid_t mok_var = EFI_SHIM_LOCK_GUID; @@ -24,9 +24,9 @@ Signed-off-by: Lee, Chun-Yi + void *db = NULL, *dbx = NULL, *mok = NULL, *mokx = NULL; + unsigned long dbsize = 0, dbxsize = 0, moksize = 0, mokxsize = 0; int rc = 0; + const struct dmi_system_id *dmi_id; - if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) -@@ -182,7 +182,7 @@ static int __init load_uefi_certs(void) +@@ -145,7 +145,7 @@ static int __init load_uefi_certs(void) kfree(dbx); } @@ -35,7 +35,7 @@ Signed-off-by: Lee, Chun-Yi if (!efi_enabled(EFI_SECURE_BOOT)) return 0; -@@ -195,6 +195,16 @@ static int __init load_uefi_certs(void) +@@ -158,6 +158,16 @@ static int __init load_uefi_certs(void) kfree(mok); } diff --git a/patches.suse/ACPI-PM-Block-ASUS-B1400CEAE-from-suspend-to-idle-by.patch b/patches.suse/ACPI-PM-Block-ASUS-B1400CEAE-from-suspend-to-idle-by.patch new file mode 100644 index 0000000..b9fa4a2 --- /dev/null +++ b/patches.suse/ACPI-PM-Block-ASUS-B1400CEAE-from-suspend-to-idle-by.patch @@ -0,0 +1,57 @@ +From d52848620de00cde4a3a5df908e231b8c8868250 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Tue, 10 May 2022 08:11:36 -0500 +Subject: [PATCH] ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default +Git-commit: d52848620de00cde4a3a5df908e231b8c8868250 +Patch-mainline: v5.19-rc1 +References: git-fixes + +ASUS B1400CEAE fails to resume from suspend to idle by default. This was +bisected back to commit df4f9bc4fb9c ("nvme-pci: add support for ACPI +StorageD3Enable property") but this is a red herring to the problem. + +Before this commit the system wasn't getting into deepest sleep state. +Presumably this commit is allowing entry into deepest sleep state as +advertised by firmware, but there are some other problems related to +the wakeup. + +As it is confirmed the system works properly with S3, set the default for +this system to S3. + +Reported-by: Jian-Hong Pan +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215742 +Signed-off-by: Mario Limonciello +Tested-by: Jian-Hong Pan +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/sleep.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index c992e57b2c79..3147702710af 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -373,6 +373,18 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "20GGA00L00"), + }, + }, ++ /* ++ * ASUS B1400CEAE hangs on resume from suspend (see ++ * https://bugzilla.kernel.org/show_bug.cgi?id=215742). ++ */ ++ { ++ .callback = init_default_s3, ++ .ident = "ASUS B1400CEAE", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK B1400CEAE"), ++ }, ++ }, + {}, + }; + +-- +2.35.3 + diff --git a/patches.suse/ACPI-sysfs-Fix-BERT-error-region-memory-mapping.patch b/patches.suse/ACPI-sysfs-Fix-BERT-error-region-memory-mapping.patch new file mode 100644 index 0000000..d09392b --- /dev/null +++ b/patches.suse/ACPI-sysfs-Fix-BERT-error-region-memory-mapping.patch @@ -0,0 +1,89 @@ +From 1bbc21785b7336619fb6a67f1fff5afdaf229acc Mon Sep 17 00:00:00 2001 +From: Lorenzo Pieralisi +Date: Thu, 7 Apr 2022 11:51:20 +0100 +Subject: [PATCH] ACPI: sysfs: Fix BERT error region memory mapping +Git-commit: 1bbc21785b7336619fb6a67f1fff5afdaf229acc +Patch-mainline: v5.19-rc1 +References: git-fixes + +Currently the sysfs interface maps the BERT error region as "memory" +(through acpi_os_map_memory()) in order to copy the error records into +memory buffers through memory operations (eg memory_read_from_buffer()). + +The OS system cannot detect whether the BERT error region is part of +system RAM or it is "device memory" (eg BMC memory) and therefore it +cannot detect which memory attributes the bus to memory support (and +corresponding kernel mapping, unless firmware provides the required +information). + +The acpi_os_map_memory() arch backend implementation determines the +mapping attributes. On arm64, if the BERT error region is not present in +the EFI memory map, the error region is mapped as device-nGnRnE; this +triggers alignment faults since memcpy unaligned accesses are not +allowed in device-nGnRnE regions. + +The ACPI sysfs code cannot therefore map by default the BERT error +region with memory semantics but should use a safer default. + +Change the sysfs code to map the BERT error region as MMIO (through +acpi_os_map_iomem()) and use the memcpy_fromio() interface to read the +error region into the kernel buffer. + +Link: https://lore.kernel.org/linux-arm-kernel/31ffe8fc-f5ee-2858-26c5-0fd8bdd68702@arm.com +Link: https://lore.kernel.org/linux-acpi/CAJZ5v0g+OVbhuUUDrLUCfX_mVqY_e8ubgLTU98=jfjTeb4t+Pw@mail.gmail.com +Signed-off-by: Lorenzo Pieralisi +Tested-by: Veronika Kabatova +Tested-by: Aristeu Rozanski +Acked-by: Ard Biesheuvel +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/sysfs.c | 25 ++++++++++++++++++------- + 1 file changed, 18 insertions(+), 7 deletions(-) + +diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c +index a4b638bea6f1..cc2fe0618178 100644 +--- a/drivers/acpi/sysfs.c ++++ b/drivers/acpi/sysfs.c +@@ -415,19 +415,30 @@ static ssize_t acpi_data_show(struct file *filp, struct kobject *kobj, + loff_t offset, size_t count) + { + struct acpi_data_attr *data_attr; +- void *base; +- ssize_t rc; ++ void __iomem *base; ++ ssize_t size; + + data_attr = container_of(bin_attr, struct acpi_data_attr, attr); ++ size = data_attr->attr.size; ++ ++ if (offset < 0) ++ return -EINVAL; ++ ++ if (offset >= size) ++ return 0; + +- base = acpi_os_map_memory(data_attr->addr, data_attr->attr.size); ++ if (count > size - offset) ++ count = size - offset; ++ ++ base = acpi_os_map_iomem(data_attr->addr, size); + if (!base) + return -ENOMEM; +- rc = memory_read_from_buffer(buf, count, &offset, base, +- data_attr->attr.size); +- acpi_os_unmap_memory(base, data_attr->attr.size); + +- return rc; ++ memcpy_fromio(buf, base + offset, count); ++ ++ acpi_os_unmap_iomem(base, size); ++ ++ return count; + } + + static int acpi_bert_data_init(void *th, struct acpi_data_attr *data_attr) +-- +2.35.3 + diff --git a/patches.suse/ACPI-sysfs-Make-sparse-happy-about-address-space-in-.patch b/patches.suse/ACPI-sysfs-Make-sparse-happy-about-address-space-in-.patch new file mode 100644 index 0000000..c26287b --- /dev/null +++ b/patches.suse/ACPI-sysfs-Make-sparse-happy-about-address-space-in-.patch @@ -0,0 +1,47 @@ +From bdd56d7d8931e842775d2e5b93d426a8d1940e33 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Wed, 16 Jun 2021 20:03:32 +0300 +Subject: [PATCH] ACPI: sysfs: Make sparse happy about address space in use +Git-commit: bdd56d7d8931e842775d2e5b93d426a8d1940e33 +Patch-mainline: v5.14-rc1 +References: git-fixes + +Sparse is not happy about address space in use in acpi_data_show(): + +drivers/acpi/sysfs.c:428:14: warning: incorrect type in assignment (different address spaces) +drivers/acpi/sysfs.c:428:14: expected void [noderef] __iomem *base +drivers/acpi/sysfs.c:428:14: got void * +drivers/acpi/sysfs.c:431:59: warning: incorrect type in argument 4 (different address spaces) +drivers/acpi/sysfs.c:431:59: expected void const *from +drivers/acpi/sysfs.c:431:59: got void [noderef] __iomem *base +drivers/acpi/sysfs.c:433:30: warning: incorrect type in argument 1 (different address spaces) +drivers/acpi/sysfs.c:433:30: expected void *logical_address +drivers/acpi/sysfs.c:433:30: got void [noderef] __iomem *base + +Indeed, acpi_os_map_memory() returns a void pointer with dropped specific +address space. Hence, we don't need to carry out __iomem in acpi_data_show(). + +Signed-off-by: Andy Shevchenko +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c +index d6626aba4a6a..faab6f1c6165 100644 +--- a/drivers/acpi/sysfs.c ++++ b/drivers/acpi/sysfs.c +@@ -420,7 +420,7 @@ static ssize_t acpi_data_show(struct file *filp, struct kobject *kobj, + loff_t offset, size_t count) + { + struct acpi_data_attr *data_attr; +- void __iomem *base; ++ void *base; + ssize_t rc; + + data_attr = container_of(bin_attr, struct acpi_data_attr, attr); +-- +2.35.3 + diff --git a/patches.suse/ALSA-hda-conexant-Fix-loopback-issue-with-CX20632.patch b/patches.suse/ALSA-hda-conexant-Fix-loopback-issue-with-CX20632.patch new file mode 100644 index 0000000..c84ca9b --- /dev/null +++ b/patches.suse/ALSA-hda-conexant-Fix-loopback-issue-with-CX20632.patch @@ -0,0 +1,41 @@ +From d5ea7544c32ba27c2c5826248e4ff58bd50a2518 Mon Sep 17 00:00:00 2001 +From: huangwenhui +Date: Tue, 7 Jun 2022 14:56:31 +0800 +Subject: [PATCH] ALSA: hda/conexant - Fix loopback issue with CX20632 +Git-commit: d5ea7544c32ba27c2c5826248e4ff58bd50a2518 +Patch-mainline: v5.19-rc2 +References: git-fixes + +On a machine with CX20632, Alsamixer doesn't have 'Loopback +Mixing' and 'Line'. + +Signed-off-by: huangwenhui +Cc: +Link: https://lore.kernel.org/r/20220607065631.10708-1-huangwenhuia@uniontech.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_conexant.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index aa360a0af284..1248d1a51cf0 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -1052,6 +1052,13 @@ static int patch_conexant_auto(struct hda_codec *codec) + snd_hda_pick_fixup(codec, cxt5051_fixup_models, + cxt5051_fixups, cxt_fixups); + break; ++ case 0x14f15098: ++ codec->pin_amp_workaround = 1; ++ spec->gen.mixer_nid = 0x22; ++ spec->gen.add_stereo_mix_input = HDA_HINT_STEREO_MIX_AUTO; ++ snd_hda_pick_fixup(codec, cxt5066_fixup_models, ++ cxt5066_fixups, cxt_fixups); ++ break; + case 0x14f150f2: + codec->power_save_node = 1; + fallthrough; +-- +2.35.3 + diff --git a/patches.suse/ALSA-usb-audio-Optimize-TEAC-clock-quirk.patch b/patches.suse/ALSA-usb-audio-Optimize-TEAC-clock-quirk.patch new file mode 100644 index 0000000..f4a02e8 --- /dev/null +++ b/patches.suse/ALSA-usb-audio-Optimize-TEAC-clock-quirk.patch @@ -0,0 +1,47 @@ +From 3753fcc22974affa26160ce1c46a6ebaaaa86758 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 31 May 2022 15:07:49 +0200 +Subject: [PATCH] ALSA: usb-audio: Optimize TEAC clock quirk +Git-commit: 3753fcc22974affa26160ce1c46a6ebaaaa86758 +Patch-mainline: v5.19-rc1 +References: git-fixes + +Maris found out that the quirk for TEAC devices to work around the +clock setup is needed to apply only when the base clock is changed, +e.g. from 48000-based clocks (48000, 96000, 192000, 384000) to +44100-based clocks (44100, 88200, 176400, 352800), or vice versa, +while switching to another clock with the same base clock doesn't need +the (forcible) interface setup. + +This patch implements the optimization for the TEAC clock quirk to +avoid the unnecessary interface re-setup. + +Fixes: 5ce0b06ae5e6 ("ALSA: usb-audio: Workaround for clock setup on TEAC devices") +Reported-by: Maris Abele +Cc: +Link: https://lore.kernel.org/r/20220531130749.30357-1-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/usb/clock.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/sound/usb/clock.c ++++ b/sound/usb/clock.c +@@ -675,9 +675,13 @@ static int set_sample_rate_v2v3(struct s + } + + /* FIXME - TEAC devices require the immediate interface setup */ +- if (rate != prev_rate && USB_ID_VENDOR(chip->usb_id) == 0x0644) { +- usb_set_interface(chip->dev, fmt->iface, fmt->altsetting); +- msleep(50); ++ if (USB_ID_VENDOR(chip->usb_id) == 0x0644) { ++ bool cur_base_48k = (rate % 48000 == 0); ++ bool prev_base_48k = (prev_rate % 48000 == 0); ++ if (cur_base_48k != prev_base_48k) { ++ usb_set_interface(chip->dev, fmt->iface, fmt->altsetting); ++ msleep(50); ++ } + } + + validation: diff --git a/patches.suse/ALSA-usb-audio-Set-up-implicit-sync-for-Saffire-6.patch b/patches.suse/ALSA-usb-audio-Set-up-implicit-sync-for-Saffire-6.patch new file mode 100644 index 0000000..33d6fd5 --- /dev/null +++ b/patches.suse/ALSA-usb-audio-Set-up-implicit-sync-for-Saffire-6.patch @@ -0,0 +1,70 @@ +From e0469d6581aecb0e34e2ec64f39f88e6985cc52f Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 6 Jun 2022 18:09:10 +0200 +Subject: [PATCH] ALSA: usb-audio: Set up (implicit) sync for Saffire 6 +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: e0469d6581aecb0e34e2ec64f39f88e6985cc52f +Patch-mainline: v5.19-rc2 +References: git-fixes + +Focusrite Saffire 6 has fixed audioformat quirks with multiple +endpoints assigned to a single altsetting. Unfortunately the generic +parser couldn't detect the sync endpoint correctly as the implicit +sync due to the missing EP attribute bits. In the former kernels, it +used to work somehow casually, but it's been broken for a while after +the large code change in 5.11. + +This patch cures the regression by the following: +- Allow the static quirk table to provide the sync EP information; + we just need to fill the fields and let the generic parser skipping + parsing if sync_ep is already set. +- Add the sync endpoint information to the entry for Saffire 6. + +Fixes: 7b0efea4baf0 ("ALSA: usb-audio: Add missing ep_idx in fixed EP quirks") +Reported-and-tested-by: André Kapelrud +Cc: +Link: https://lore.kernel.org/r/20220606160910.6926-3-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/usb/pcm.c | 3 +++ + sound/usb/quirks-table.h | 7 ++++++- + 2 files changed, 9 insertions(+), 1 deletion(-) + +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index b0369df53910..e692ae04436a 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -291,6 +291,9 @@ int snd_usb_audioformat_set_sync_ep(struct snd_usb_audio *chip, + bool is_playback; + int err; + ++ if (fmt->sync_ep) ++ return 0; /* already set up */ ++ + alts = snd_usb_get_host_interface(chip, fmt->iface, fmt->altsetting); + if (!alts) + return 0; +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 78eb41b621d6..4f56e1784932 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -2658,7 +2658,12 @@ YAMAHA_DEVICE(0x7010, "UB99"), + .nr_rates = 2, + .rate_table = (unsigned int[]) { + 44100, 48000 +- } ++ }, ++ .sync_ep = 0x82, ++ .sync_iface = 0, ++ .sync_altsetting = 1, ++ .sync_ep_idx = 1, ++ .implicit_fb = 1, + } + }, + { +-- +2.35.3 + diff --git a/patches.suse/ALSA-usb-audio-Skip-generic-sync-EP-parse-for-second.patch b/patches.suse/ALSA-usb-audio-Skip-generic-sync-EP-parse-for-second.patch new file mode 100644 index 0000000..18d98ca --- /dev/null +++ b/patches.suse/ALSA-usb-audio-Skip-generic-sync-EP-parse-for-second.patch @@ -0,0 +1,45 @@ +From efb75df105e82f076a85b9f2d81410428bcb55fc Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 6 Jun 2022 18:09:09 +0200 +Subject: [PATCH] ALSA: usb-audio: Skip generic sync EP parse for secondary EP +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: efb75df105e82f076a85b9f2d81410428bcb55fc +Patch-mainline: v5.19-rc2 +References: git-fixes + +When ep_idx is already non-zero, it means usually a capture stream +that is set up explicity by a fixed-format quirk, and applying the +check for generic (non-implicit-fb) sync EPs might hit incorrectly, +resulting in a bogus sync endpoint for the capture stream. + +This patch adds a check for the ep_idx and skip if it's a secondary +endpoint. It's a part of the fixes for regressions on Saffire 6. + +Fixes: 7b0efea4baf0 ("ALSA: usb-audio: Add missing ep_idx in fixed EP quirks") +Reported-and-tested-by: André Kapelrud +Cc: +Link: https://lore.kernel.org/r/20220606160910.6926-2-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/usb/pcm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index b470404a5376..b0369df53910 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -304,7 +304,7 @@ int snd_usb_audioformat_set_sync_ep(struct snd_usb_audio *chip, + * Generic sync EP handling + */ + +- if (altsd->bNumEndpoints < 2) ++ if (fmt->ep_idx > 0 || altsd->bNumEndpoints < 2) + return 0; + + is_playback = !(get_endpoint(alts, 0)->bEndpointAddress & USB_DIR_IN); +-- +2.35.3 + diff --git a/patches.suse/ALSA-usb-audio-Workaround-for-clock-setup-on-TEAC-de.patch b/patches.suse/ALSA-usb-audio-Workaround-for-clock-setup-on-TEAC-de.patch new file mode 100644 index 0000000..ba81701 --- /dev/null +++ b/patches.suse/ALSA-usb-audio-Workaround-for-clock-setup-on-TEAC-de.patch @@ -0,0 +1,53 @@ +From 5ce0b06ae5e69e23142e73c5c3c0260e9f2ccb4b Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sat, 21 May 2022 08:46:27 +0200 +Subject: [PATCH] ALSA: usb-audio: Workaround for clock setup on TEAC devices +Git-commit: 5ce0b06ae5e69e23142e73c5c3c0260e9f2ccb4b +Patch-mainline: v5.19-rc1 +References: git-fixes + +Maris reported that TEAC UD-501 (0644:8043) doesn't work with the +typical "clock source 41 is not valid, cannot use" errors on the +recent kernels. The currently known workaround so far is to restore +(partially) what we've done unconditionally at the clock setup; +namely, re-setup the USB interface immediately after the clock is +changed. This patch re-introduces the behavior conditionally for TEAC +devices. + +Further notes: +- The USB interface shall be set later in + snd_usb_endpoint_configure(), but this seems to be too late. +- Even calling usb_set_interface() right after + sne_usb_init_sample_rate() doesn't help; so this must be related + with the clock validation, too. +- The device may still spew the "clock source 41 is not valid" error + at the first clock setup. This seems happening at the very first + try of clock setup, but it disappears at later attempts. + The error is likely harmless because the driver retries the clock + setup (such an error is more or less expected on some devices). + +Fixes: bf6313a0ff76 ("ALSA: usb-audio: Refactor endpoint management") +Reported-and-tested-by: Maris Abele +Cc: +Link: https://lore.kernel.org/r/20220521064627.29292-1-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/usb/clock.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/sound/usb/clock.c ++++ b/sound/usb/clock.c +@@ -674,6 +674,12 @@ static int set_sample_rate_v2v3(struct s + /* continue processing */ + } + ++ /* FIXME - TEAC devices require the immediate interface setup */ ++ if (rate != prev_rate && USB_ID_VENDOR(chip->usb_id) == 0x0644) { ++ usb_set_interface(chip->dev, fmt->iface, fmt->altsetting); ++ msleep(50); ++ } ++ + validation: + /* validate clock after rate change */ + if (!uac_clock_source_is_valid(chip, fmt, clock)) diff --git a/patches.suse/ASoC-dapm-Don-t-fold-register-value-changes-into-not.patch b/patches.suse/ASoC-dapm-Don-t-fold-register-value-changes-into-not.patch new file mode 100644 index 0000000..78dab4c --- /dev/null +++ b/patches.suse/ASoC-dapm-Don-t-fold-register-value-changes-into-not.patch @@ -0,0 +1,50 @@ +From ad685980469b9f9b99d4d6ea05f4cb8f57cb2234 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Thu, 28 Apr 2022 17:18:32 +0100 +Subject: [PATCH] ASoC: dapm: Don't fold register value changes into notifications +Git-commit: ad685980469b9f9b99d4d6ea05f4cb8f57cb2234 +Patch-mainline: v5.19-rc1 +References: git-fixes + +DAPM tracks and reports the value presented to the user from DAPM controls +separately to the register value, these may diverge during initialisation +or when an autodisable control is in use. + +When writing DAPM controls we currently report that a change has occurred +if either the DAPM value or the value stored in the register has changed, +meaning that if the two are out of sync we may appear to report a spurious +event to userspace. Since we use this folded in value for nothing other +than the value reported to userspace simply drop the folding in of the +register change. + +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20220428161833.3690050-1-broonie@kernel.org +Acked-by: Takashi Iwai + +--- + sound/soc/soc-dapm.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index ca917a849c42..869c76506b66 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -3437,7 +3437,6 @@ int snd_soc_dapm_put_volsw(struct snd_kcontrol *kcontrol, + update.val = val; + card->update = &update; + } +- change |= reg_change; + + ret = soc_dapm_mixer_update_power(card, kcontrol, connect, + rconnect); +@@ -3539,7 +3538,6 @@ int snd_soc_dapm_put_enum_double(struct snd_kcontrol *kcontrol, + update.val = val; + card->update = &update; + } +- change |= reg_change; + + ret = soc_dapm_mux_update_power(card, kcontrol, item[0], e); + +-- +2.35.3 + diff --git a/patches.suse/ASoC-max98357a-remove-dependency-on-GPIOLIB.patch b/patches.suse/ASoC-max98357a-remove-dependency-on-GPIOLIB.patch new file mode 100644 index 0000000..1cf5124 --- /dev/null +++ b/patches.suse/ASoC-max98357a-remove-dependency-on-GPIOLIB.patch @@ -0,0 +1,54 @@ +From 21ca3274333f5c1cbbf9d91e5b33f4f2463859b2 Mon Sep 17 00:00:00 2001 +From: Pierre-Louis Bossart +Date: Tue, 17 May 2022 12:26:46 -0500 +Subject: [PATCH] ASoC: max98357a: remove dependency on GPIOLIB +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 21ca3274333f5c1cbbf9d91e5b33f4f2463859b2 +Patch-mainline: v5.19-rc1 +References: git-fixes + +commit dcc2c012c7691 ("ASoC: Fix gpiolib dependencies") removed a +series of unnecessary dependencies on GPIOLIB when the gpio was +optional. + +A similar simplification seems valid for max98357a, so remove the +dependency as well. This will avoid the following warning + + WARNING: unmet direct dependencies detected for SND_SOC_MAX98357A + Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && GPIOLIB [=n] + Selected by [y]: + - SND_SOC_INTEL_SOF_CS42L42_MACH [=y] && SOUND [=y] && !UML && + SND [=y] && SND_SOC [=y] && SND_SOC_INTEL_MACH [=y] && + (SND_SOC_SOF_HDA_LINK [=y] || SND_SOC_SOF_BAYTRAIL [=n]) && I2C + [=y] && ACPI [=y] && SND_HDA_CODEC_HDMI [=y] && + SND_SOC_SOF_HDA_AUDIO_CODEC [=y] && (MFD_INTEL_LPSS [=y] || + COMPILE_TEST [=n]) + +Reported-by: kernel test robot +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Péter Ujfalusi +Link: https://lore.kernel.org/r/20220517172647.468244-2-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig +index 095712316baf..735dece6a53a 100644 +--- a/sound/soc/codecs/Kconfig ++++ b/sound/soc/codecs/Kconfig +@@ -986,7 +986,6 @@ config SND_SOC_MAX98095 + + config SND_SOC_MAX98357A + tristate "Maxim MAX98357A CODEC" +- depends on GPIOLIB + + config SND_SOC_MAX98371 + tristate +-- +2.35.3 + diff --git a/patches.suse/ASoC-rt5645-Fix-errorenous-cleanup-order.patch b/patches.suse/ASoC-rt5645-Fix-errorenous-cleanup-order.patch new file mode 100644 index 0000000..6c6dbb1 --- /dev/null +++ b/patches.suse/ASoC-rt5645-Fix-errorenous-cleanup-order.patch @@ -0,0 +1,53 @@ +From 2def44d3aec59e38d2701c568d65540783f90f2f Mon Sep 17 00:00:00 2001 +From: Lin Ma +Date: Mon, 16 May 2022 17:20:35 +0800 +Subject: [PATCH] ASoC: rt5645: Fix errorenous cleanup order +Git-commit: 2def44d3aec59e38d2701c568d65540783f90f2f +Patch-mainline: v5.19-rc1 +References: git-fixes + +There is a logic error when removing rt5645 device as the function +rt5645_i2c_remove() first cancel the &rt5645->jack_detect_work and +delete the &rt5645->btn_check_timer latter. However, since the timer +handler rt5645_btn_check_callback() will re-queue the jack_detect_work, +this cleanup order is buggy. + +That is, once the del_timer_sync in rt5645_i2c_remove is concurrently +run with the rt5645_btn_check_callback, the canceled jack_detect_work +will be rescheduled again, leading to possible use-after-free. + +This patch fix the issue by placing the del_timer_sync function before +the cancel_delayed_work_sync. + +Signed-off-by: Lin Ma +Link: https://lore.kernel.org/r/20220516092035.28283-1-linma@zju.edu.cn +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/rt5645.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index ccdea234a3ba..507aba8de3cc 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -4153,9 +4153,14 @@ static int rt5645_i2c_remove(struct i2c_client *i2c) + if (i2c->irq) + free_irq(i2c->irq, rt5645); + ++ /* ++ * Since the rt5645_btn_check_callback() can queue jack_detect_work, ++ * the timer need to be delted first ++ */ ++ del_timer_sync(&rt5645->btn_check_timer); ++ + cancel_delayed_work_sync(&rt5645->jack_detect_work); + cancel_delayed_work_sync(&rt5645->rcclock_work); +- del_timer_sync(&rt5645->btn_check_timer); + + regulator_bulk_disable(ARRAY_SIZE(rt5645->supplies), rt5645->supplies); + +-- +2.35.3 + diff --git a/patches.suse/ASoC-tscs454-Add-endianness-flag-in-snd_soc_componen.patch b/patches.suse/ASoC-tscs454-Add-endianness-flag-in-snd_soc_componen.patch new file mode 100644 index 0000000..28896a1 --- /dev/null +++ b/patches.suse/ASoC-tscs454-Add-endianness-flag-in-snd_soc_componen.patch @@ -0,0 +1,68 @@ +From ff69ec96b87dccb3a29edef8cec5d4fefbbc2055 Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Wed, 4 May 2022 18:08:52 +0100 +Subject: [PATCH] ASoC: tscs454: Add endianness flag in snd_soc_component_driver +Git-commit: ff69ec96b87dccb3a29edef8cec5d4fefbbc2055 +Patch-mainline: v5.19-rc1 +References: git-fixes + +The endianness flag is used on the CODEC side to specify an +ambivalence to endian, typically because it is lost over the hardware +link. This device receives audio over an I2S DAI and as such should +have endianness applied. + +A fixup is also required to use the width directly rather than relying +on the format in hw_params, now both little and big endian would be +supported. It is worth noting this changes the behaviour of S24_LE to +use a word length of 24 rather than 32. This would appear to be a +correction since the fact S24_LE is stored as 32 bits should not be +presented over the bus. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220504170905.332415-26-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/tscs454.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/tscs454.c b/sound/soc/codecs/tscs454.c +index b34a8b516484..38622bc247fc 100644 +--- a/sound/soc/codecs/tscs454.c ++++ b/sound/soc/codecs/tscs454.c +@@ -3120,18 +3120,17 @@ static int set_aif_sample_format(struct snd_soc_component *component, + unsigned int width; + int ret; + +- switch (format) { +- case SNDRV_PCM_FORMAT_S16_LE: ++ switch (snd_pcm_format_width(format)) { ++ case 16: + width = FV_WL_16; + break; +- case SNDRV_PCM_FORMAT_S20_3LE: ++ case 20: + width = FV_WL_20; + break; +- case SNDRV_PCM_FORMAT_S24_3LE: ++ case 24: + width = FV_WL_24; + break; +- case SNDRV_PCM_FORMAT_S24_LE: +- case SNDRV_PCM_FORMAT_S32_LE: ++ case 32: + width = FV_WL_32; + break; + default: +@@ -3326,6 +3325,7 @@ static const struct snd_soc_component_driver soc_component_dev_tscs454 = { + .num_dapm_routes = ARRAY_SIZE(tscs454_intercon), + .controls = tscs454_snd_controls, + .num_controls = ARRAY_SIZE(tscs454_snd_controls), ++ .endianness = 1, + }; + + #define TSCS454_RATES SNDRV_PCM_RATE_8000_96000 +-- +2.35.3 + diff --git a/patches.suse/HID-bigben-fix-slab-out-of-bounds-Write-in-bigben_pr.patch b/patches.suse/HID-bigben-fix-slab-out-of-bounds-Write-in-bigben_pr.patch new file mode 100644 index 0000000..73b1b26 --- /dev/null +++ b/patches.suse/HID-bigben-fix-slab-out-of-bounds-Write-in-bigben_pr.patch @@ -0,0 +1,43 @@ +From fc4ef9d5724973193bfa5ebed181dba6de3a56db Mon Sep 17 00:00:00 2001 +From: Dongliang Mu +Date: Fri, 6 May 2022 15:24:25 +0800 +Subject: [PATCH] HID: bigben: fix slab-out-of-bounds Write in bigben_probe +Git-commit: fc4ef9d5724973193bfa5ebed181dba6de3a56db +Patch-mainline: v5.19-rc1 +References: git-fixes + +There is a slab-out-of-bounds Write bug in hid-bigbenff driver. +The problem is the driver assumes the device must have an input but +some malicious devices violate this assumption. + +Fix this by checking hid_device's input is non-empty before its usage. + +Reported-by: syzkaller +Signed-off-by: Dongliang Mu +Signed-off-by: Jiri Kosina +Acked-by: Takashi Iwai + +--- + drivers/hid/hid-bigbenff.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c +index 74ad8bf98bfd..e8c5e3ac9fff 100644 +--- a/drivers/hid/hid-bigbenff.c ++++ b/drivers/hid/hid-bigbenff.c +@@ -347,6 +347,12 @@ static int bigben_probe(struct hid_device *hid, + bigben->report = list_entry(report_list->next, + struct hid_report, list); + ++ if (list_empty(&hid->inputs)) { ++ hid_err(hid, "no inputs found\n"); ++ error = -ENODEV; ++ goto error_hw_stop; ++ } ++ + hidinput = list_first_entry(&hid->inputs, struct hid_input, list); + set_bit(FF_RUMBLE, hidinput->input->ffbit); + +-- +2.35.3 + diff --git a/patches.suse/HID-multitouch-Add-support-for-Google-Whiskers-Touch.patch b/patches.suse/HID-multitouch-Add-support-for-Google-Whiskers-Touch.patch new file mode 100644 index 0000000..04a8e48 --- /dev/null +++ b/patches.suse/HID-multitouch-Add-support-for-Google-Whiskers-Touch.patch @@ -0,0 +1,38 @@ +From 1d07cef7fd7599450b3d03e1915efc2a96e1f03f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Marek=20Ma=C5=9Blanka?= +Date: Tue, 5 Apr 2022 17:04:07 +0200 +Subject: [PATCH] HID: multitouch: Add support for Google Whiskers Touchpad +Git-commit: 1d07cef7fd7599450b3d03e1915efc2a96e1f03f +Patch-mainline: v5.19-rc1 +References: git-fixes + +The Google Whiskers touchpad does not work properly with the default +multitouch configuration. Instead, use the same configuration as Google +Rose. + +Signed-off-by: Marek Maslanka +Acked-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Acked-by: Takashi Iwai + +--- + drivers/hid/hid-multitouch.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 0dece608c023..6bb3890b0f2c 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2184,6 +2184,9 @@ static const struct hid_device_id mt_devices[] = { + { .driver_data = MT_CLS_GOOGLE, + HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, USB_VENDOR_ID_GOOGLE, + USB_DEVICE_ID_GOOGLE_TOUCH_ROSE) }, ++ { .driver_data = MT_CLS_GOOGLE, ++ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8, USB_VENDOR_ID_GOOGLE, ++ USB_DEVICE_ID_GOOGLE_WHISKERS) }, + + /* Generic MT device */ + { HID_DEVICE(HID_BUS_ANY, HID_GROUP_MULTITOUCH, HID_ANY_ID, HID_ANY_ID) }, +-- +2.35.3 + diff --git a/patches.suse/Input-bcm5974-set-missing-URB_NO_TRANSFER_DMA_MAP-ur.patch b/patches.suse/Input-bcm5974-set-missing-URB_NO_TRANSFER_DMA_MAP-ur.patch new file mode 100644 index 0000000..68640a4 --- /dev/null +++ b/patches.suse/Input-bcm5974-set-missing-URB_NO_TRANSFER_DMA_MAP-ur.patch @@ -0,0 +1,60 @@ +From c42e65664390be7c1ef3838cd84956d3a2739d60 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 7 Jun 2022 12:11:33 -0700 +Subject: [PATCH] Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag +Git-commit: c42e65664390be7c1ef3838cd84956d3a2739d60 +Patch-mainline: v5.19-rc2 +References: git-fixes + +The bcm5974 driver does the allocation and dma mapping of the usb urb +data buffer, but driver does not set the URB_NO_TRANSFER_DMA_MAP flag +to let usb core know the buffer is already mapped. + +usb core tries to map the already mapped buffer, causing a warning: +"xhci_hcd 0000:00:14.0: rejecting DMA map of vmalloc memory" + +Fix this by setting the URB_NO_TRANSFER_DMA_MAP, letting usb core +know buffer is already mapped by bcm5974 driver + +Signed-off-by: Mathias Nyman +Cc: stable@vger.kernel.org +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215890 +Link: https://lore.kernel.org/r/20220606113636.588955-1-mathias.nyman@linux.intel.com +Signed-off-by: Dmitry Torokhov +Acked-by: Takashi Iwai + +--- + drivers/input/mouse/bcm5974.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c +index 59a14505b9cd..ca150618d32f 100644 +--- a/drivers/input/mouse/bcm5974.c ++++ b/drivers/input/mouse/bcm5974.c +@@ -942,17 +942,22 @@ static int bcm5974_probe(struct usb_interface *iface, + if (!dev->tp_data) + goto err_free_bt_buffer; + +- if (dev->bt_urb) ++ if (dev->bt_urb) { + usb_fill_int_urb(dev->bt_urb, udev, + usb_rcvintpipe(udev, cfg->bt_ep), + dev->bt_data, dev->cfg.bt_datalen, + bcm5974_irq_button, dev, 1); + ++ dev->bt_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; ++ } ++ + usb_fill_int_urb(dev->tp_urb, udev, + usb_rcvintpipe(udev, cfg->tp_ep), + dev->tp_data, dev->cfg.tp_datalen, + bcm5974_irq_trackpad, dev, 1); + ++ dev->tp_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; ++ + /* create bcm5974 device */ + usb_make_path(udev, dev->phys, sizeof(dev->phys)); + strlcat(dev->phys, "/input0", sizeof(dev->phys)); +-- +2.35.3 + diff --git a/patches.suse/Input-goodix-fix-spurious-key-release-events.patch b/patches.suse/Input-goodix-fix-spurious-key-release-events.patch new file mode 100644 index 0000000..890f069 --- /dev/null +++ b/patches.suse/Input-goodix-fix-spurious-key-release-events.patch @@ -0,0 +1,38 @@ +From 24ef83f6e31d20fc121a7cd732b04b498475fca3 Mon Sep 17 00:00:00 2001 +From: Dmitry Mastykin +Date: Tue, 24 Mar 2020 11:38:28 -0700 +Subject: [PATCH] Input: goodix - fix spurious key release events +Git-commit: 24ef83f6e31d20fc121a7cd732b04b498475fca3 +Patch-mainline: v5.7-rc1 +References: git-fixes + +The goodix panel sends spurious interrupts after a 'finger up' event, +which always cause a timeout. +We were exiting the interrupt handler by reporting touch_num == 0, but +this was still processed as valid and caused the code to use the +uninitialised point_data, creating spurious key release events. + +Report an error from the interrupt handler so as to avoid processing +invalid point_data further. + +Signed-off-by: Dmitry Mastykin +Reviewed-by: Bastien Nocera +Link: https://lore.kernel.org/r/20200316075302.3759-2-dmastykin@astralinux.ru +Signed-off-by: Dmitry Torokhov +Acked-by: Takashi Iwai + +--- + drivers/input/touchscreen/goodix.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/touchscreen/goodix.c ++++ b/drivers/input/touchscreen/goodix.c +@@ -320,7 +320,7 @@ static int goodix_ts_read_input_report(s + * The Goodix panel will send spurious interrupts after a + * 'finger up' event, which will always cause a timeout. + */ +- return 0; ++ return -ENOMSG; + } + + static void goodix_ts_report_touch(struct goodix_ts_data *ts, u8 *coor_data) diff --git a/patches.suse/PM-devfreq-rk3399_dmc-Disable-edev-on-remove.patch b/patches.suse/PM-devfreq-rk3399_dmc-Disable-edev-on-remove.patch new file mode 100644 index 0000000..5ea1c68 --- /dev/null +++ b/patches.suse/PM-devfreq-rk3399_dmc-Disable-edev-on-remove.patch @@ -0,0 +1,64 @@ +From 2fccf9e6050e0e3b8b4cd275d41daf7f7fa22804 Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Tue, 8 Mar 2022 11:08:59 -0800 +Subject: [PATCH] PM / devfreq: rk3399_dmc: Disable edev on remove() +Git-commit: 2fccf9e6050e0e3b8b4cd275d41daf7f7fa22804 +Patch-mainline: v5.19-rc1 +References: git-fixes + +Otherwise we hit an unablanced enable-count when unbinding the DFI +Device: + +[ 1279.659119] ------------[ cut here ]------------ +[ 1279.659179] WARNING: CPU: 2 PID: 5638 at drivers/devfreq/devfreq-event.c:360 devfreq_event_remove_edev+0x84/0x8c +... +[ 1279.659352] Hardware name: Google Kevin (DT) +[ 1279.659363] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO BTYPE=--) +[ 1279.659371] pc : devfreq_event_remove_edev+0x84/0x8c +[ 1279.659380] lr : devm_devfreq_event_release+0x1c/0x28 +... +[ 1279.659571] Call trace: +[ 1279.659582] devfreq_event_remove_edev+0x84/0x8c +[ 1279.659590] devm_devfreq_event_release+0x1c/0x28 +[ 1279.659602] release_nodes+0x1cc/0x244 +[ 1279.659611] devres_release_all+0x44/0x60 +[ 1279.659621] device_release_driver_internal+0x11c/0x1ac +[ 1279.659629] device_driver_detach+0x20/0x2c +[ 1279.659641] unbind_store+0x7c/0xb0 +[ 1279.659650] drv_attr_store+0x2c/0x40 +[ 1279.659663] sysfs_kf_write+0x44/0x58 +[ 1279.659672] kernfs_fop_write_iter+0xf4/0x190 +[ 1279.659684] vfs_write+0x2b0/0x2e4 +[ 1279.659693] ksys_write+0x80/0xec +[ 1279.659701] __arm64_sys_write+0x24/0x30 +[ 1279.659714] el0_svc_common+0xf0/0x1d8 +[ 1279.659724] do_el0_svc_compat+0x28/0x3c +[ 1279.659738] el0_svc_compat+0x10/0x1c +[ 1279.659746] el0_sync_compat_handler+0xa8/0xcc +[ 1279.659758] el0_sync_compat+0x188/0x1c0 +[ 1279.659768] ---[ end trace cec200e5094155b4 ]--- + +Signed-off-by: Brian Norris +Signed-off-by: Chanwoo Choi +Acked-by: Takashi Iwai + +--- + drivers/devfreq/rk3399_dmc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/devfreq/rk3399_dmc.c b/drivers/devfreq/rk3399_dmc.c +index f778564cab49..fca9fcbd4249 100644 +--- a/drivers/devfreq/rk3399_dmc.c ++++ b/drivers/devfreq/rk3399_dmc.c +@@ -452,6 +452,8 @@ static int rk3399_dmcfreq_remove(struct platform_device *pdev) + { + struct rk3399_dmcfreq *dmcfreq = dev_get_drvdata(&pdev->dev); + ++ devfreq_event_disable_edev(dmcfreq->edev); ++ + /* + * Before remove the opp table we need to unregister the opp notifier. + */ +-- +2.35.3 + diff --git a/patches.suse/USB-hcd-pci-Fully-suspend-across-freeze-thaw-cycle.patch b/patches.suse/USB-hcd-pci-Fully-suspend-across-freeze-thaw-cycle.patch new file mode 100644 index 0000000..1bad98d --- /dev/null +++ b/patches.suse/USB-hcd-pci-Fully-suspend-across-freeze-thaw-cycle.patch @@ -0,0 +1,50 @@ +From 63acaa8e9c65dc34dc249440216f8e977f5d2748 Mon Sep 17 00:00:00 2001 +From: Evan Green +Date: Thu, 21 Apr 2022 10:39:27 -0700 +Subject: [PATCH] USB: hcd-pci: Fully suspend across freeze/thaw cycle +Git-commit: 63acaa8e9c65dc34dc249440216f8e977f5d2748 +Patch-mainline: v5.19-rc1 +References: git-fixes + +The documentation for the freeze() method says that it "should quiesce +the device so that it doesn't generate IRQs or DMA". The unspoken +consequence of not doing this is that MSIs aimed at non-boot CPUs may +get fully lost if they're sent during the period where the target CPU is +offline. + +The current callbacks for USB HCD do not fully quiesce interrupts, +specifically on XHCI. Change to use the full suspend/resume flow for +freeze/thaw to ensure interrupts are fully quiesced. This fixes issues +where USB devices fail to thaw during hibernation because XHCI misses +its interrupt and cannot recover. + +Acked-by: Alan Stern +Signed-off-by: Evan Green +Link: https://lore.kernel.org/r/20220421103751.v3.2.I8226c7fdae88329ef70957b96a39b346c69a914e@changeid +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/core/hcd-pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c +index f192925f74f7..482dae72ef1c 100644 +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -615,10 +615,10 @@ const struct dev_pm_ops usb_hcd_pci_pm_ops = { + .suspend_noirq = hcd_pci_suspend_noirq, + .resume_noirq = hcd_pci_resume_noirq, + .resume = hcd_pci_resume, +- .freeze = check_root_hub_suspended, ++ .freeze = hcd_pci_suspend, + .freeze_noirq = check_root_hub_suspended, + .thaw_noirq = NULL, +- .thaw = NULL, ++ .thaw = hcd_pci_resume, + .poweroff = hcd_pci_suspend, + .poweroff_noirq = hcd_pci_suspend_noirq, + .restore_noirq = hcd_pci_resume_noirq, +-- +2.35.3 + diff --git a/patches.suse/USB-host-isp116x-check-return-value-after-calling-pl.patch b/patches.suse/USB-host-isp116x-check-return-value-after-calling-pl.patch new file mode 100644 index 0000000..b353bb2 --- /dev/null +++ b/patches.suse/USB-host-isp116x-check-return-value-after-calling-pl.patch @@ -0,0 +1,42 @@ +From 134a3408c2d3f7e23eb0e4556e0a2d9f36c2614e Mon Sep 17 00:00:00 2001 +From: Zhen Ni +Date: Wed, 2 Mar 2022 11:37:16 +0800 +Subject: [PATCH] USB: host: isp116x: check return value after calling platform_get_resource() +Git-commit: 134a3408c2d3f7e23eb0e4556e0a2d9f36c2614e +Patch-mainline: v5.19-rc1 +References: git-fixes + +It will cause null-ptr-deref if platform_get_resource() returns NULL, +we need check the return value. + +Signed-off-by: Zhen Ni +Link: https://lore.kernel.org/r/20220302033716.31272-1-nizhen@uniontech.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/isp116x-hcd.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c +index 8835f6bd528e..8c7f0991c21b 100644 +--- a/drivers/usb/host/isp116x-hcd.c ++++ b/drivers/usb/host/isp116x-hcd.c +@@ -1541,10 +1541,12 @@ static int isp116x_remove(struct platform_device *pdev) + + iounmap(isp116x->data_reg); + res = platform_get_resource(pdev, IORESOURCE_MEM, 1); +- release_mem_region(res->start, 2); ++ if (res) ++ release_mem_region(res->start, 2); + iounmap(isp116x->addr_reg); + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- release_mem_region(res->start, 2); ++ if (res) ++ release_mem_region(res->start, 2); + + usb_put_hcd(hcd); + return 0; +-- +2.35.3 + diff --git a/patches.suse/USB-new-quirk-for-Dell-Gen-2-devices.patch b/patches.suse/USB-new-quirk-for-Dell-Gen-2-devices.patch new file mode 100644 index 0000000..f2f2657 --- /dev/null +++ b/patches.suse/USB-new-quirk-for-Dell-Gen-2-devices.patch @@ -0,0 +1,40 @@ +From 97fa5887cf283bb75ffff5f6b2c0e71794c02400 Mon Sep 17 00:00:00 2001 +From: Monish Kumar R +Date: Fri, 20 May 2022 18:30:44 +0530 +Subject: [PATCH] USB: new quirk for Dell Gen 2 devices +Git-commit: 97fa5887cf283bb75ffff5f6b2c0e71794c02400 +Patch-mainline: v5.19-rc1 +References: git-fixes + +Add USB_QUIRK_NO_LPM and USB_QUIRK_RESET_RESUME quirks for Dell usb gen +2 device to not fail during enumeration. + +Found this bug on own testing + +Signed-off-by: Monish Kumar R +Cc: stable +Link: https://lore.kernel.org/r/20220520130044.17303-1-monish.kumar.r@intel.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 97b44a68668a..f99a65a64588 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -510,6 +510,9 @@ static const struct usb_device_id usb_quirk_list[] = { + /* DJI CineSSD */ + { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, + ++ /* DELL USB GEN2 */ ++ { USB_DEVICE(0x413c, 0xb062), .driver_info = USB_QUIRK_NO_LPM | USB_QUIRK_RESET_RESUME }, ++ + /* VCOM device */ + { USB_DEVICE(0x4296, 0x7570), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS }, + +-- +2.35.3 + diff --git a/patches.suse/USB-serial-option-add-Quectel-BG95-modem.patch b/patches.suse/USB-serial-option-add-Quectel-BG95-modem.patch new file mode 100644 index 0000000..4ec2fcf --- /dev/null +++ b/patches.suse/USB-serial-option-add-Quectel-BG95-modem.patch @@ -0,0 +1,118 @@ +From 33b7af2f459df453feb0d44628d820c47fefe7a8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Carl=20Yin=28=E6=AE=B7=E5=BC=A0=E6=88=90=29?= +Date: Thu, 19 May 2022 02:34:43 +0000 +Subject: [PATCH] USB: serial: option: add Quectel BG95 modem +Git-commit: 33b7af2f459df453feb0d44628d820c47fefe7a8 +Patch-mainline: v5.19-rc1 +References: git-fixes + +The BG95 modem has 3 USB configurations that are configurable via the AT +command AT+QCFGEXT="usbnet",["ecm"|"modem"|"rmnet"] which make the modem +enumerate with the following interfaces, respectively: + +"modem": Diag + GNSS + Modem + Modem +"ecm" : Diag + GNSS + Modem + ECM +"rmnet": Diag + GNSS + Modem + QMI Don't support Full QMI messages (e.g WDS_START_NETWORK_INTERFACE) + +A detailed description of the USB configuration for each mode follows: + ++qcfgext: "usbnet","modem" +Acked-by: Takashi Iwai + +-------------------------- +T: Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0700 Rev= 0.00 +S: Manufacturer=Quectel, Incorporated +S: Product=Quectel LPWA Module +S: SerialNumber=884328a2 +C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + ++QCFGEXT: "usbnet","ecm" +------------------------ +T: Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0700 Rev= 0.00 +S: Manufacturer=Quectel, Incorporated +S: Product=Quectel LPWA Module +S: SerialNumber=884328a2 +C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +A: FirstIf#= 3 IfCount= 2 Cls=02(comm.) Sub=00 Prot=00 +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +I: If#= 4 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + ++QCFGEXT: "usbnet","rmnet" +-------------------------- +T: Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0700 Rev= 0.00 +S: Manufacturer=Quectel, Incorporated +S: Product=Quectel LPWA Module +S: SerialNumber=884328a2 +C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Carl Yin +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 1364ce7f0abf..ac444a66e781 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1137,6 +1137,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0620, 0xff, 0xff, 0x30) }, /* EM160R-GL */ + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0620, 0xff, 0, 0) }, ++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, 0x0700, 0xff), /* BG95 */ ++ .driver_info = RSVD(3) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10), +-- +2.35.3 + diff --git a/patches.suse/ata-libata-transport-fix-dma-pio-xfer-_mode-sysfs-fi.patch b/patches.suse/ata-libata-transport-fix-dma-pio-xfer-_mode-sysfs-fi.patch new file mode 100644 index 0000000..5dca22e --- /dev/null +++ b/patches.suse/ata-libata-transport-fix-dma-pio-xfer-_mode-sysfs-fi.patch @@ -0,0 +1,81 @@ +From 72aad489f992871e908ff6d9055b26c6366fb864 Mon Sep 17 00:00:00 2001 +From: Sergey Shtylyov +Date: Wed, 8 Jun 2022 22:51:07 +0300 +Subject: [PATCH] ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files +Git-commit: 72aad489f992871e908ff6d9055b26c6366fb864 +Patch-mainline: v5.19-rc2 +References: git-fixes + +The {dma|pio}_mode sysfs files are incorrectly documented as having a +list of the supported DMA/PIO transfer modes, while the corresponding +fields of the *struct* ata_device hold the transfer mode IDs, not masks. + +To match these docs, the {dma|pio}_mode (and even xfer_mode!) sysfs +files are handled by the ata_bitfield_name_match() macro which leads to +reading such kind of nonsense from them: + +$ cat /sys/class/ata_device/dev3.0/pio_mode +XFER_UDMA_7, XFER_UDMA_6, XFER_UDMA_5, XFER_UDMA_4, XFER_MW_DMA_4, +XFER_PIO_6, XFER_PIO_5, XFER_PIO_4, XFER_PIO_3, XFER_PIO_2, XFER_PIO_1, +XFER_PIO_0 + +Using the correct ata_bitfield_name_search() macro fixes that: + +$ cat /sys/class/ata_device/dev3.0/pio_mode +XFER_PIO_4 + +While fixing the file documentation, somewhat reword the {dma|pio}_mode +file doc and add a note about being mostly useful for PATA devices to +the xfer_mode file doc... + +Fixes: d9027470b886 ("[libata] Add ATA transport class") +Signed-off-by: Sergey Shtylyov +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Acked-by: Takashi Iwai + +--- + Documentation/ABI/testing/sysfs-ata | 11 ++++++----- + drivers/ata/libata-transport.c | 2 +- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/Documentation/ABI/testing/sysfs-ata b/Documentation/ABI/testing/sysfs-ata +index 2f726c914752..3daecac48964 100644 +--- a/Documentation/ABI/testing/sysfs-ata ++++ b/Documentation/ABI/testing/sysfs-ata +@@ -107,13 +107,14 @@ Description: + described in ATA8 7.16 and 7.17. Only valid if + the device is not a PM. + +- pio_mode: (RO) Transfer modes supported by the device when +- in PIO mode. Mostly used by PATA device. ++ pio_mode: (RO) PIO transfer mode used by the device. ++ Mostly used by PATA devices. + +- xfer_mode: (RO) Current transfer mode ++ xfer_mode: (RO) Current transfer mode. Mostly used by ++ PATA devices. + +- dma_mode: (RO) Transfer modes supported by the device when +- in DMA mode. Mostly used by PATA device. ++ dma_mode: (RO) DMA transfer mode used by the device. ++ Mostly used by PATA devices. + + class: (RO) Device class. Can be "ata" for disk, + "atapi" for packet device, "pmp" for PM, or +diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c +index ca129854a88c..c38027887499 100644 +--- a/drivers/ata/libata-transport.c ++++ b/drivers/ata/libata-transport.c +@@ -196,7 +196,7 @@ static struct { + { XFER_PIO_0, "XFER_PIO_0" }, + { XFER_PIO_SLOW, "XFER_PIO_SLOW" } + }; +-ata_bitfield_name_match(xfer,ata_xfer_names) ++ata_bitfield_name_search(xfer, ata_xfer_names) + + /* + * ATA Port attributes +-- +2.35.3 + diff --git a/patches.suse/ath9k-fix-QCA9561-PA-bias-level.patch b/patches.suse/ath9k-fix-QCA9561-PA-bias-level.patch new file mode 100644 index 0000000..e2d9ce5 --- /dev/null +++ b/patches.suse/ath9k-fix-QCA9561-PA-bias-level.patch @@ -0,0 +1,54 @@ +From e999a5da28a0e0f7de242d841ef7d5e48f4646ae Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Thibaut=20VAR=C3=88NE?= +Date: Sun, 17 Apr 2022 16:51:45 +0200 +Subject: [PATCH] ath9k: fix QCA9561 PA bias level +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: e999a5da28a0e0f7de242d841ef7d5e48f4646ae +Patch-mainline: v5.19-rc1 +References: git-fixes + +This patch fixes an invalid TX PA DC bias level on QCA9561, which +results in a very low output power and very low throughput as devices +are further away from the AP (compared to other 2.4GHz APs). + +This patch was suggested by Felix Fietkau, who noted[1]: +"The value written to that register is wrong, because while the mask +definition AR_CH0_TOP2_XPABIASLVL uses a different value for 9561, the +shift definition AR_CH0_TOP2_XPABIASLVL_S is hardcoded to 12, which is +wrong for 9561." + +In real life testing, without this patch the 2.4GHz throughput on +Yuncore XD3200 is around 10Mbps sitting next to the AP, and closer to +practical maximum with the patch applied. + +[1] https://lore.kernel.org/all/91c58969-c60e-2f41-00ac-737786d435ae@nbd.name + +Signed-off-by: Thibaut VARÈNE +Acked-by: Felix Fietkau +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220417145145.1847-1-hacks+kernel@slashdirt.org +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/ath/ath9k/ar9003_phy.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h +index a171dbb29fbb..ad949eb02f3d 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h ++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h +@@ -720,7 +720,7 @@ + #define AR_CH0_TOP2 (AR_SREV_9300(ah) ? 0x1628c : \ + (AR_SREV_9462(ah) ? 0x16290 : 0x16284)) + #define AR_CH0_TOP2_XPABIASLVL (AR_SREV_9561(ah) ? 0x1e00 : 0xf000) +-#define AR_CH0_TOP2_XPABIASLVL_S 12 ++#define AR_CH0_TOP2_XPABIASLVL_S (AR_SREV_9561(ah) ? 9 : 12) + + #define AR_CH0_XTAL (AR_SREV_9300(ah) ? 0x16294 : \ + ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16298 : \ +-- +2.35.3 + diff --git a/patches.suse/b43-Fix-assigning-negative-value-to-unsigned-variabl.patch b/patches.suse/b43-Fix-assigning-negative-value-to-unsigned-variabl.patch new file mode 100644 index 0000000..893f019 --- /dev/null +++ b/patches.suse/b43-Fix-assigning-negative-value-to-unsigned-variabl.patch @@ -0,0 +1,37 @@ +From 11800d893b38e0e12d636c170c1abc19c43c730c Mon Sep 17 00:00:00 2001 +From: Haowen Bai +Date: Fri, 25 Mar 2022 18:15:15 +0800 +Subject: [PATCH] b43: Fix assigning negative value to unsigned variable +Git-commit: 11800d893b38e0e12d636c170c1abc19c43c730c +Patch-mainline: v5.19-rc1 +References: git-fixes + +fix warning reported by smatch: +drivers/net/wireless/broadcom/b43/phy_n.c:585 b43_nphy_adjust_lna_gain_table() +Warn: assigning (-2) to unsigned variable '*(lna_gain[0])' + +Signed-off-by: Haowen Bai +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1648203315-28093-1-git-send-email-baihaowen@meizu.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/broadcom/b43/phy_n.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/b43/phy_n.c b/drivers/net/wireless/broadcom/b43/phy_n.c +index cf3ccf4ddfe7..aa5c99465674 100644 +--- a/drivers/net/wireless/broadcom/b43/phy_n.c ++++ b/drivers/net/wireless/broadcom/b43/phy_n.c +@@ -582,7 +582,7 @@ static void b43_nphy_adjust_lna_gain_table(struct b43_wldev *dev) + u16 data[4]; + s16 gain[2]; + u16 minmax[2]; +- static const u16 lna_gain[4] = { -2, 10, 19, 25 }; ++ static const s16 lna_gain[4] = { -2, 10, 19, 25 }; + + if (nphy->hang_avoid) + b43_nphy_stay_in_carrier_search(dev, 1); +-- +2.35.3 + diff --git a/patches.suse/b43legacy-Fix-assigning-negative-value-to-unsigned-v.patch b/patches.suse/b43legacy-Fix-assigning-negative-value-to-unsigned-v.patch new file mode 100644 index 0000000..61f95be --- /dev/null +++ b/patches.suse/b43legacy-Fix-assigning-negative-value-to-unsigned-v.patch @@ -0,0 +1,37 @@ +From 3f6b867559b3d43a7ce1b4799b755e812fc0d503 Mon Sep 17 00:00:00 2001 +From: Haowen Bai +Date: Fri, 25 Mar 2022 18:17:13 +0800 +Subject: [PATCH] b43legacy: Fix assigning negative value to unsigned variable +Git-commit: 3f6b867559b3d43a7ce1b4799b755e812fc0d503 +Patch-mainline: v5.19-rc1 +References: git-fixes + +fix warning reported by smatch: +drivers/net/wireless/broadcom/b43legacy/phy.c:1181 b43legacy_phy_lo_b_measure() +Warn: assigning (-772) to unsigned variable 'fval' + +Signed-off-by: Haowen Bai +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1648203433-8736-1-git-send-email-baihaowen@meizu.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/broadcom/b43legacy/phy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/b43legacy/phy.c b/drivers/net/wireless/broadcom/b43legacy/phy.c +index 05404fbd1e70..c1395e622759 100644 +--- a/drivers/net/wireless/broadcom/b43legacy/phy.c ++++ b/drivers/net/wireless/broadcom/b43legacy/phy.c +@@ -1123,7 +1123,7 @@ void b43legacy_phy_lo_b_measure(struct b43legacy_wldev *dev) + struct b43legacy_phy *phy = &dev->phy; + u16 regstack[12] = { 0 }; + u16 mls; +- u16 fval; ++ s16 fval; + int i; + int j; + +-- +2.35.3 + diff --git a/patches.suse/cfg80211-set-custom-regdomain-after-wiphy-registrati.patch b/patches.suse/cfg80211-set-custom-regdomain-after-wiphy-registrati.patch new file mode 100644 index 0000000..a1bd89a --- /dev/null +++ b/patches.suse/cfg80211-set-custom-regdomain-after-wiphy-registrati.patch @@ -0,0 +1,75 @@ +From 1b7b3ac8ff3317cdcf07a1c413de9bdb68019c2b Mon Sep 17 00:00:00 2001 +From: Miri Korenblit +Date: Fri, 18 Jun 2021 13:41:46 +0300 +Subject: [PATCH] cfg80211: set custom regdomain after wiphy registration +Git-commit: 1b7b3ac8ff3317cdcf07a1c413de9bdb68019c2b +Patch-mainline: v5.14-rc1 +References: git-fixes + +We used to set regulatory info before the registration of +the device and then the regulatory info didn't get set, because +the device isn't registered so there isn't a device to set the +regulatory info for. So set the regulatory info after the device +registration. +Call reg_process_self_managed_hints() once again after the device +registration because it does nothing before it. + +Signed-off-by: Miri Korenblit +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20210618133832.c96eadcffe80.I86799c2c866b5610b4cf91115c21d8ceb525c5aa@changeid +Signed-off-by: Johannes Berg +Acked-by: Takashi Iwai + +--- + net/wireless/core.c | 8 ++++---- + net/wireless/reg.c | 1 + + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/net/wireless/core.c b/net/wireless/core.c +index 41c15cc7791f..03323121ca50 100644 +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -5,7 +5,7 @@ + * Copyright 2006-2010 Johannes Berg + * Copyright 2013-2014 Intel Mobile Communications GmbH + * Copyright 2015-2017 Intel Deutschland GmbH +- * Copyright (C) 2018-2020 Intel Corporation ++ * Copyright (C) 2018-2021 Intel Corporation + */ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt +@@ -928,9 +928,6 @@ int wiphy_register(struct wiphy *wiphy) + return res; + } + +- /* set up regulatory info */ +- wiphy_regulatory_register(wiphy); +- + list_add_rcu(&rdev->list, &cfg80211_rdev_list); + cfg80211_rdev_list_generation++; + +@@ -941,6 +938,9 @@ int wiphy_register(struct wiphy *wiphy) + cfg80211_debugfs_rdev_add(rdev); + nl80211_notify_wiphy(rdev, NL80211_CMD_NEW_WIPHY); + ++ /* set up regulatory info */ ++ wiphy_regulatory_register(wiphy); ++ + if (wiphy->regulatory_flags & REGULATORY_CUSTOM_REG) { + struct regulatory_request request; + +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index 2f654a4fc53b..c2d0ff7f089f 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -4051,6 +4051,7 @@ void wiphy_regulatory_register(struct wiphy *wiphy) + + wiphy_update_regulatory(wiphy, lr->initiator); + wiphy_all_share_dfs_chan_state(wiphy); ++ reg_process_self_managed_hints(); + } + + void wiphy_regulatory_deregister(struct wiphy *wiphy) +-- +2.35.3 + diff --git a/patches.suse/clocksource-drivers-oxnas-rps-Fix-irq_of_parse_and_m.patch b/patches.suse/clocksource-drivers-oxnas-rps-Fix-irq_of_parse_and_m.patch new file mode 100644 index 0000000..1cd2fec --- /dev/null +++ b/patches.suse/clocksource-drivers-oxnas-rps-Fix-irq_of_parse_and_m.patch @@ -0,0 +1,37 @@ +From 9c04a8ff03def4df3f81219ffbe1ec9b44ff5348 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 22 Apr 2022 12:41:01 +0200 +Subject: [PATCH] clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value +Git-commit: 9c04a8ff03def4df3f81219ffbe1ec9b44ff5348 +Patch-mainline: v5.19-rc1 +References: git-fixes + +The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO. + +Fixes: 89355274e1f7 ("clocksource/drivers/oxnas-rps: Add Oxford Semiconductor RPS Dual Timer") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20220422104101.55754-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Daniel Lezcano +Acked-by: Takashi Iwai + +--- + drivers/clocksource/timer-oxnas-rps.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clocksource/timer-oxnas-rps.c b/drivers/clocksource/timer-oxnas-rps.c +index 56c0cc32d0ac..d514b44e67dd 100644 +--- a/drivers/clocksource/timer-oxnas-rps.c ++++ b/drivers/clocksource/timer-oxnas-rps.c +@@ -236,7 +236,7 @@ static int __init oxnas_rps_timer_init(struct device_node *np) + } + + rps->irq = irq_of_parse_and_map(np, 0); +- if (rps->irq < 0) { ++ if (!rps->irq) { + ret = -EINVAL; + goto err_iomap; + } +-- +2.35.3 + diff --git a/patches.suse/clocksource-drivers-sp804-Avoid-error-on-multiple-in.patch b/patches.suse/clocksource-drivers-sp804-Avoid-error-on-multiple-in.patch new file mode 100644 index 0000000..40cdc96 --- /dev/null +++ b/patches.suse/clocksource-drivers-sp804-Avoid-error-on-multiple-in.patch @@ -0,0 +1,60 @@ +From a98399cbc1e05f7b977419f03905501d566cf54e Mon Sep 17 00:00:00 2001 +From: Andre Przywara +Date: Fri, 6 May 2022 17:25:22 +0100 +Subject: [PATCH] clocksource/drivers/sp804: Avoid error on multiple instances +Git-commit: a98399cbc1e05f7b977419f03905501d566cf54e +Patch-mainline: v5.19-rc1 +References: git-fixes + +When a machine sports more than one SP804 timer instance, we only bring +up the first one, since multiple timers of the same kind are not useful +to Linux. As this is intentional behaviour, we should not return an +error message, as we do today: +=============== +[ 0.000800] Failed to initialize '/bus@8000000/motherboard-bus@8000000/iofpga-bus@300000000/timer@120000': -22 +=============== + +Replace the -EINVAL return with a debug message and return 0 instead. + +Also we do not reach the init function anymore if the DT node is +disabled (as this is now handled by OF_DECLARE), so remove the explicit +check for that case. + +This fixes a long standing bogus error when booting ARM's fastmodels. + +Signed-off-by: Andre Przywara +Reviewed-by: Robin Murphy +Link: https://lore.kernel.org/r/20220506162522.3675399-1-andre.przywara@arm.com +Signed-off-by: Daniel Lezcano +Acked-by: Takashi Iwai + +--- + drivers/clocksource/timer-sp804.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/clocksource/timer-sp804.c ++++ b/drivers/clocksource/timer-sp804.c +@@ -215,6 +215,11 @@ static int __init sp804_of_init(struct d + struct clk *clk1, *clk2; + const char *name = of_get_property(np, "compatible", NULL); + ++ if (initialized) { ++ pr_debug("%pOF: skipping further SP804 timer device\n", np); ++ return 0; ++ } ++ + base = of_iomap(np, 0); + if (!base) + return -ENXIO; +@@ -223,11 +228,6 @@ static int __init sp804_of_init(struct d + writel(0, base + TIMER_CTRL); + writel(0, base + TIMER_2_BASE + TIMER_CTRL); + +- if (initialized || !of_device_is_available(np)) { +- ret = -EINVAL; +- goto err; +- } +- + clk1 = of_clk_get(np, 0); + if (IS_ERR(clk1)) + clk1 = NULL; diff --git a/patches.suse/dmaengine-zynqmp_dma-In-struct-zynqmp_dma_chan-fix-d.patch b/patches.suse/dmaengine-zynqmp_dma-In-struct-zynqmp_dma_chan-fix-d.patch new file mode 100644 index 0000000..b6057ec --- /dev/null +++ b/patches.suse/dmaengine-zynqmp_dma-In-struct-zynqmp_dma_chan-fix-d.patch @@ -0,0 +1,63 @@ +From f9a9f43a62a04ec3183fb0da9226c7706eed0115 Mon Sep 17 00:00:00 2001 +From: Radhey Shyam Pandey +Date: Tue, 10 May 2022 12:42:40 +0530 +Subject: [PATCH] dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type +Git-commit: f9a9f43a62a04ec3183fb0da9226c7706eed0115 +Patch-mainline: v5.19-rc1 +References: git-fixes + +In zynqmp_dma_alloc/free_chan_resources functions there is a +potential overflow in the below expressions. + +dma_alloc_coherent(chan->dev, (2 * chan->desc_size * + ZYNQMP_DMA_NUM_DESCS), + &chan->desc_pool_p, GFP_KERNEL); + +dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) * + ZYNQMP_DMA_NUM_DESCS), + chan->desc_pool_v, chan->desc_pool_p); + +The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though +this overflow condition is not observed but it is a potential problem +in the case of 32-bit multiplication. Hence fix it by changing the +desc_size data type to size_t. + +In addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in +dma_alloc_coherent API argument. + +Addresses-coverity: Event overflow_before_widen. +Signed-off-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/1652166762-18317-2-git-send-email-radhey.shyam.pandey@xilinx.com +Signed-off-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/dma/xilinx/zynqmp_dma.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c +index 7aa63b652027..3ffa7f37c701 100644 +--- a/drivers/dma/xilinx/zynqmp_dma.c ++++ b/drivers/dma/xilinx/zynqmp_dma.c +@@ -229,7 +229,7 @@ struct zynqmp_dma_chan { + bool is_dmacoherent; + struct tasklet_struct tasklet; + bool idle; +- u32 desc_size; ++ size_t desc_size; + bool err; + u32 bus_width; + u32 src_burst_len; +@@ -486,7 +486,8 @@ static int zynqmp_dma_alloc_chan_resources(struct dma_chan *dchan) + } + + chan->desc_pool_v = dma_alloc_coherent(chan->dev, +- (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS), ++ (2 * ZYNQMP_DMA_DESC_SIZE(chan) * ++ ZYNQMP_DMA_NUM_DESCS), + &chan->desc_pool_p, GFP_KERNEL); + if (!chan->desc_pool_v) + return -ENOMEM; +-- +2.35.3 + diff --git a/patches.suse/drivers-i2c-thunderx-Allow-driver-to-work-with-ACPI-.patch b/patches.suse/drivers-i2c-thunderx-Allow-driver-to-work-with-ACPI-.patch new file mode 100644 index 0000000..5c11d8f --- /dev/null +++ b/patches.suse/drivers-i2c-thunderx-Allow-driver-to-work-with-ACPI-.patch @@ -0,0 +1,35 @@ +From 03a35bc856ddc09f2cc1f4701adecfbf3b464cb3 Mon Sep 17 00:00:00 2001 +From: Piyush Malgujar +Date: Wed, 11 May 2022 06:36:59 -0700 +Subject: [PATCH] drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers +Git-commit: 03a35bc856ddc09f2cc1f4701adecfbf3b464cb3 +Patch-mainline: v5.18 +References: git-fixes + +Due to i2c->adap.dev.fwnode not being set, ACPI_COMPANION() wasn't properly +found for TWSI controllers. + +Signed-off-by: Szymon Balcerak +Signed-off-by: Piyush Malgujar +Signed-off-by: Wolfram Sang +Acked-by: Takashi Iwai + +--- + drivers/i2c/busses/i2c-thunderx-pcidrv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-thunderx-pcidrv.c b/drivers/i2c/busses/i2c-thunderx-pcidrv.c +index 12c90aa0900e..a77cd86fe75e 100644 +--- a/drivers/i2c/busses/i2c-thunderx-pcidrv.c ++++ b/drivers/i2c/busses/i2c-thunderx-pcidrv.c +@@ -213,6 +213,7 @@ static int thunder_i2c_probe_pci(struct pci_dev *pdev, + i2c->adap.bus_recovery_info = &octeon_i2c_recovery_info; + i2c->adap.dev.parent = dev; + i2c->adap.dev.of_node = pdev->dev.of_node; ++ i2c->adap.dev.fwnode = dev->fwnode; + snprintf(i2c->adap.name, sizeof(i2c->adap.name), + "Cavium ThunderX i2c adapter at %s", dev_name(dev)); + i2c_set_adapdata(&i2c->adap, i2c); +-- +2.35.3 + diff --git a/patches.suse/drivers-staging-rtl8192e-Fix-deadlock-in-rtllib_beac.patch b/patches.suse/drivers-staging-rtl8192e-Fix-deadlock-in-rtllib_beac.patch new file mode 100644 index 0000000..fbed058 --- /dev/null +++ b/patches.suse/drivers-staging-rtl8192e-Fix-deadlock-in-rtllib_beac.patch @@ -0,0 +1,55 @@ +From 9b6bdbd9337de3917945847bde262a34a87a6303 Mon Sep 17 00:00:00 2001 +From: Duoming Zhou +Date: Sun, 17 Apr 2022 22:16:41 +0800 +Subject: [PATCH] drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() +Git-commit: 9b6bdbd9337de3917945847bde262a34a87a6303 +Patch-mainline: v5.19-rc1 +References: git-fixes + +There is a deadlock in rtllib_beacons_stop(), which is shown +Below: + + (Thread 1) | (Thread 2) + | rtllib_send_beacon() +rtllib_beacons_stop() | mod_timer() + spin_lock_irqsave() //(1) | (wait a time) + ... | rtllib_send_beacon_cb() + del_timer_sync() | spin_lock_irqsave() //(2) + (wait timer to stop) | ... + +We hold ieee->beacon_lock in position (1) of thread 1 and +use del_timer_sync() to wait timer to stop, but timer handler +also need ieee->beacon_lock in position (2) of thread 2. +As a result, rtllib_beacons_stop() will block forever. + +This patch extracts del_timer_sync() from the protection of +spin_lock_irqsave(), which could let timer handler to obtain +the needed lock. + +Signed-off-by: Duoming Zhou +Link: https://lore.kernel.org/r/20220417141641.124388-1-duoming@zju.edu.cn +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/staging/rtl8192e/rtllib_softmac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c +index 82bf05eb1cbf..ef35889cbb96 100644 +--- a/drivers/staging/rtl8192e/rtllib_softmac.c ++++ b/drivers/staging/rtl8192e/rtllib_softmac.c +@@ -651,9 +651,9 @@ static void rtllib_beacons_stop(struct rtllib_device *ieee) + spin_lock_irqsave(&ieee->beacon_lock, flags); + + ieee->beacon_txing = 0; +- del_timer_sync(&ieee->beacon_timer); + + spin_unlock_irqrestore(&ieee->beacon_lock, flags); ++ del_timer_sync(&ieee->beacon_timer); + + } + +-- +2.35.3 + diff --git a/patches.suse/drivers-staging-rtl8192u-Fix-deadlock-in-ieee80211_b.patch b/patches.suse/drivers-staging-rtl8192u-Fix-deadlock-in-ieee80211_b.patch new file mode 100644 index 0000000..074f522 --- /dev/null +++ b/patches.suse/drivers-staging-rtl8192u-Fix-deadlock-in-ieee80211_b.patch @@ -0,0 +1,54 @@ +From 806c7b53414934ba2a39449b31fd1a038e500273 Mon Sep 17 00:00:00 2001 +From: Duoming Zhou +Date: Sun, 17 Apr 2022 21:54:07 +0800 +Subject: [PATCH] drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() +Git-commit: 806c7b53414934ba2a39449b31fd1a038e500273 +Patch-mainline: v5.19-rc1 +References: git-fixes + +There is a deadlock in ieee80211_beacons_stop(), which is shown below: + + (Thread 1) | (Thread 2) + | ieee80211_send_beacon() +ieee80211_beacons_stop() | mod_timer() + spin_lock_irqsave() //(1) | (wait a time) + ... | ieee80211_send_beacon_cb() + del_timer_sync() | spin_lock_irqsave() //(2) + (wait timer to stop) | ... + +We hold ieee->beacon_lock in position (1) of thread 1 and use +del_timer_sync() to wait timer to stop, but timer handler +also need ieee->beacon_lock in position (2) of thread 2. +As a result, ieee80211_beacons_stop() will block forever. + +This patch extracts del_timer_sync() from the protection of +spin_lock_irqsave(), which could let timer handler to obtain +the needed lock. + +Signed-off-by: Duoming Zhou +Link: https://lore.kernel.org/r/20220417135407.109536-1-duoming@zju.edu.cn +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c +index 4e8fbd2410a1..f0ee018b8106 100644 +--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c ++++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c +@@ -528,9 +528,9 @@ static void ieee80211_beacons_stop(struct ieee80211_device *ieee) + spin_lock_irqsave(&ieee->beacon_lock, flags); + + ieee->beacon_txing = 0; +- del_timer_sync(&ieee->beacon_timer); + + spin_unlock_irqrestore(&ieee->beacon_lock, flags); ++ del_timer_sync(&ieee->beacon_timer); + } + + void ieee80211_stop_send_beacons(struct ieee80211_device *ieee) +-- +2.35.3 + diff --git a/patches.suse/drivers-tty-serial-Fix-deadlock-in-sa1100_set_termio.patch b/patches.suse/drivers-tty-serial-Fix-deadlock-in-sa1100_set_termio.patch new file mode 100644 index 0000000..74ca21c --- /dev/null +++ b/patches.suse/drivers-tty-serial-Fix-deadlock-in-sa1100_set_termio.patch @@ -0,0 +1,61 @@ +From 62b2caef400c1738b6d22f636c628d9f85cd4c4c Mon Sep 17 00:00:00 2001 +From: Duoming Zhou +Date: Sun, 17 Apr 2022 19:16:26 +0800 +Subject: [PATCH] drivers: tty: serial: Fix deadlock in sa1100_set_termios() +Git-commit: 62b2caef400c1738b6d22f636c628d9f85cd4c4c +Patch-mainline: v5.19-rc1 +References: git-fixes + +There is a deadlock in sa1100_set_termios(), which is shown +Below: + + (Thread 1) | (Thread 2) + | sa1100_enable_ms() +sa1100_set_termios() | mod_timer() + spin_lock_irqsave() //(1) | (wait a time) + ... | sa1100_timeout() + del_timer_sync() | spin_lock_irqsave() //(2) + (wait timer to stop) | ... + +We hold sport->port.lock in position (1) of thread 1 and +use del_timer_sync() to wait timer to stop, but timer handler +also need sport->port.lock in position (2) of thread 2. As a result, +sa1100_set_termios() will block forever. + +This patch moves del_timer_sync() before spin_lock_irqsave() +in order to prevent the deadlock. + +Signed-off-by: Duoming Zhou +Link: https://lore.kernel.org/r/20220417111626.7802-1-duoming@zju.edu.cn +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/sa1100.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/sa1100.c b/drivers/tty/serial/sa1100.c +index 5fe6cccfc1ae..e64e42a19d1a 100644 +--- a/drivers/tty/serial/sa1100.c ++++ b/drivers/tty/serial/sa1100.c +@@ -446,6 +446,8 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios, + baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16); + quot = uart_get_divisor(port, baud); + ++ del_timer_sync(&sport->timer); ++ + spin_lock_irqsave(&sport->port.lock, flags); + + sport->port.read_status_mask &= UTSR0_TO_SM(UTSR0_TFS); +@@ -476,8 +478,6 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios, + UTSR1_TO_SM(UTSR1_ROR); + } + +- del_timer_sync(&sport->timer); +- + /* + * Update the per-port timeout. + */ +-- +2.35.3 + diff --git a/patches.suse/drivers-usb-host-Fix-deadlock-in-oxu_bus_suspend.patch b/patches.suse/drivers-usb-host-Fix-deadlock-in-oxu_bus_suspend.patch new file mode 100644 index 0000000..bd93900 --- /dev/null +++ b/patches.suse/drivers-usb-host-Fix-deadlock-in-oxu_bus_suspend.patch @@ -0,0 +1,54 @@ +From 4d378f2ae58138d4c55684e1d274e7dd94aa6524 Mon Sep 17 00:00:00 2001 +From: Duoming Zhou +Date: Sun, 17 Apr 2022 20:03:05 +0800 +Subject: [PATCH] drivers: usb: host: Fix deadlock in oxu_bus_suspend() +Git-commit: 4d378f2ae58138d4c55684e1d274e7dd94aa6524 +Patch-mainline: v5.19-rc1 +References: git-fixes + +There is a deadlock in oxu_bus_suspend(), which is shown below: + + (Thread 1) | (Thread 2) + | timer_action() +oxu_bus_suspend() | mod_timer() + spin_lock_irq() //(1) | (wait a time) + ... | oxu_watchdog() + del_timer_sync() | spin_lock_irq() //(2) + (wait timer to stop) | ... + +We hold oxu->lock in position (1) of thread 1, and use +del_timer_sync() to wait timer to stop, but timer handler +also need oxu->lock in position (2) of thread 2. As a result, +oxu_bus_suspend() will block forever. + +This patch extracts del_timer_sync() from the protection of +spin_lock_irq(), which could let timer handler to obtain +the needed lock. + +Signed-off-by: Duoming Zhou +Link: https://lore.kernel.org/r/20220417120305.64577-1-duoming@zju.edu.cn +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/oxu210hp-hcd.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c +index ddc155850bfc..8b73c61f86c9 100644 +--- a/drivers/usb/host/oxu210hp-hcd.c ++++ b/drivers/usb/host/oxu210hp-hcd.c +@@ -3909,8 +3909,10 @@ static int oxu_bus_suspend(struct usb_hcd *hcd) + } + } + ++ spin_unlock_irq(&oxu->lock); + /* turn off now-idle HC */ + del_timer_sync(&oxu->watchdog); ++ spin_lock_irq(&oxu->lock); + ehci_halt(oxu); + hcd->state = HC_STATE_SUSPENDED; + +-- +2.35.3 + diff --git a/patches.suse/drm-amdgpu-cs-make-commands-with-0-chunks-illegal-be.patch b/patches.suse/drm-amdgpu-cs-make-commands-with-0-chunks-illegal-be.patch new file mode 100644 index 0000000..02c99d5 --- /dev/null +++ b/patches.suse/drm-amdgpu-cs-make-commands-with-0-chunks-illegal-be.patch @@ -0,0 +1,64 @@ +From 31ab27b14daaa75541a415c6794d6f3567fea44a Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Mon, 23 May 2022 10:24:18 +1000 +Subject: [PATCH] drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. +Git-commit: 31ab27b14daaa75541a415c6794d6f3567fea44a +Patch-mainline: v5.19-rc1 +References: git-fixes + +Submitting a cs with 0 chunks, causes an oops later, found trying +to execute the wrong userspace driver. + +MESA_LOADER_DRIVER_OVERRIDE=v3d glxinfo + +[172536.665184] BUG: kernel NULL pointer dereference, address: 00000000000001d8 +[172536.665188] #PF: supervisor read access in kernel mode +[172536.665189] #PF: error_code(0x0000) - not-present page +[172536.665191] PGD 6712a0067 P4D 6712a0067 PUD 5af9ff067 PMD 0 +[172536.665195] Oops: 0000 [#1] SMP NOPTI +[172536.665197] CPU: 7 PID: 2769838 Comm: glxinfo Tainted: P O 5.10.81 #1-NixOS +[172536.665199] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CROSSHAIR V FORMULA-Z, BIOS 2201 03/23/2015 +[172536.665272] RIP: 0010:amdgpu_cs_ioctl+0x96/0x1ce0 [amdgpu] +[172536.665274] Code: 75 18 00 00 4c 8b b2 88 00 00 00 8b 46 08 48 89 54 24 68 49 89 f7 4c 89 5c 24 60 31 d2 4c 89 74 24 30 85 c0 0f 85 c0 01 00 00 <48> 83 ba d8 01 00 00 00 48 8b b4 24 90 00 00 00 74 16 48 8b 46 10 +[172536.665276] RSP: 0018:ffffb47c0e81bbe0 EFLAGS: 00010246 +[172536.665277] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 +[172536.665278] RDX: 0000000000000000 RSI: ffffb47c0e81be28 RDI: ffffb47c0e81bd68 +[172536.665279] RBP: ffff936524080010 R08: 0000000000000000 R09: ffffb47c0e81be38 +[172536.665281] R10: ffff936524080010 R11: ffff936524080000 R12: ffffb47c0e81bc40 +[172536.665282] R13: ffffb47c0e81be28 R14: ffff9367bc410000 R15: ffffb47c0e81be28 +[172536.665283] FS: 00007fe35e05d740(0000) GS:ffff936c1edc0000(0000) knlGS:0000000000000000 +[172536.665284] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[172536.665286] CR2: 00000000000001d8 CR3: 0000000532e46000 CR4: 00000000000406e0 +[172536.665287] Call Trace: +[172536.665322] ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu] +[172536.665332] drm_ioctl_kernel+0xaa/0xf0 [drm] +[172536.665338] drm_ioctl+0x201/0x3b0 [drm] +[172536.665369] ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu] +[172536.665372] ? selinux_file_ioctl+0x135/0x230 +[172536.665399] amdgpu_drm_ioctl+0x49/0x80 [amdgpu] +[172536.665403] __x64_sys_ioctl+0x83/0xb0 +[172536.665406] do_syscall_64+0x33/0x40 +[172536.665409] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2018 +Signed-off-by: Dave Airlie +Cc: stable@vger.kernel.org +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -116,7 +116,7 @@ static int amdgpu_cs_parser_init(struct + int ret; + + if (cs->in.num_chunks == 0) +- return 0; ++ return -EINVAL; + + chunk_array = kmalloc_array(cs->in.num_chunks, sizeof(uint64_t), GFP_KERNEL); + if (!chunk_array) diff --git a/patches.suse/drm-amdgpu-ucode-Remove-firmware-load-type-check-in-.patch b/patches.suse/drm-amdgpu-ucode-Remove-firmware-load-type-check-in-.patch new file mode 100644 index 0000000..b08dead --- /dev/null +++ b/patches.suse/drm-amdgpu-ucode-Remove-firmware-load-type-check-in-.patch @@ -0,0 +1,39 @@ +From ab0cd4a9ae5b4679b714d8dbfedc0901fecdce9f Mon Sep 17 00:00:00 2001 +From: Alice Wong +Date: Mon, 2 May 2022 11:40:18 -0400 +Subject: [PATCH] drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo +Git-commit: ab0cd4a9ae5b4679b714d8dbfedc0901fecdce9f +Patch-mainline: v5.19-rc1 +References: git-fixes + +When psp_hw_init failed, it will set the load_type to AMDGPU_FW_LOAD_DIRECT. +During amdgpu_device_ip_fini, amdgpu_ucode_free_bo checks that load_type is +AMDGPU_FW_LOAD_DIRECT and skips deallocating fw_buf causing memory leak. +Remove load_type check in amdgpu_ucode_free_bo. + +Signed-off-by: Alice Wong +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +index 6218bd62d172..62ce16c77d13 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +@@ -787,8 +787,7 @@ int amdgpu_ucode_create_bo(struct amdgpu_device *adev) + + void amdgpu_ucode_free_bo(struct amdgpu_device *adev) + { +- if (adev->firmware.load_type != AMDGPU_FW_LOAD_DIRECT) +- amdgpu_bo_free_kernel(&adev->firmware.fw_buf, ++ amdgpu_bo_free_kernel(&adev->firmware.fw_buf, + &adev->firmware.fw_buf_mc, + &adev->firmware.fw_buf_ptr); + } +-- +2.35.3 + diff --git a/patches.suse/drm-atomic-Force-bridge-self-refresh-exit-on-CRTC-sw.patch b/patches.suse/drm-atomic-Force-bridge-self-refresh-exit-on-CRTC-sw.patch new file mode 100644 index 0000000..4ada4ce --- /dev/null +++ b/patches.suse/drm-atomic-Force-bridge-self-refresh-exit-on-CRTC-sw.patch @@ -0,0 +1,79 @@ +From e54a4424925a27ed94dff046db3ce5caf4b1e748 Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Mon, 28 Feb 2022 12:25:32 -0800 +Subject: [PATCH] drm/atomic: Force bridge self-refresh-exit on CRTC switch +Git-commit: e54a4424925a27ed94dff046db3ce5caf4b1e748 +Patch-mainline: v5.19-rc2 +References: git-fixes + +It's possible to change which CRTC is in use for a given +connector/encoder/bridge while we're in self-refresh without fully +disabling the connector/encoder/bridge along the way. This can confuse +the bridge encoder/bridge, because +(a) it needs to track the SR state (trying to perform "active" + operations while the panel is still in SR can be Bad(TM)); and +(b) it tracks the SR state via the CRTC state (and after the switch, the + previous SR state is lost). + +Thus, we need to either somehow carry the self-refresh state over to the +new CRTC, or else force an encoder/bridge self-refresh transition during +such a switch. + +I choose the latter, so we disable the encoder (and exit PSR) before +attaching it to the new CRTC (where we can continue to assume a clean +(non-self-refresh) state). + +This fixes PSR issues seen on Rockchip RK3399 systems with +drivers/gpu/drm/bridge/analogix/analogix_dp_core.c. + +Change in v2: + +- Drop "->enable" condition; this could possibly be "->active" to + reflect the intended hardware state, but it also is a little + over-specific. We want to make a transition through "disabled" any + time we're exiting PSR at the same time as a CRTC switch. + (Thanks Liu Ying) + +Cc: Liu Ying +Cc: +Fixes: 1452c25b0e60 ("drm: Add helpers to kick off self refresh mode in drivers") +Signed-off-by: Brian Norris +Reviewed-by: Sean Paul +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20220228122522.v2.2.Ic15a2ef69c540aee8732703103e2cff51fb9c399@changeid +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/drm_atomic_helper.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c +index 9603193d2fa1..987e4b212e9f 100644 +--- a/drivers/gpu/drm/drm_atomic_helper.c ++++ b/drivers/gpu/drm/drm_atomic_helper.c +@@ -1011,9 +1011,19 @@ crtc_needs_disable(struct drm_crtc_state *old_state, + return drm_atomic_crtc_effectively_active(old_state); + + /* +- * We need to run through the crtc_funcs->disable() function if the CRTC +- * is currently on, if it's transitioning to self refresh mode, or if +- * it's in self refresh mode and needs to be fully disabled. ++ * We need to disable bridge(s) and CRTC if we're transitioning out of ++ * self-refresh and changing CRTCs at the same time, because the ++ * bridge tracks self-refresh status via CRTC state. ++ */ ++ if (old_state->self_refresh_active && ++ old_state->crtc != new_state->crtc) ++ return true; ++ ++ /* ++ * We also need to run through the crtc_funcs->disable() function if ++ * the CRTC is currently on, if it's transitioning to self refresh ++ * mode, or if it's in self refresh mode and needs to be fully ++ * disabled. + */ + return old_state->active || + (old_state->self_refresh_active && !new_state->active) || +-- +2.35.3 + diff --git a/patches.suse/drm-bridge-analogix_dp-Support-PSR-exit-to-disable-t.patch b/patches.suse/drm-bridge-analogix_dp-Support-PSR-exit-to-disable-t.patch new file mode 100644 index 0000000..7cc994b --- /dev/null +++ b/patches.suse/drm-bridge-analogix_dp-Support-PSR-exit-to-disable-t.patch @@ -0,0 +1,114 @@ +From ca871659ec1606d33b1e76de8d4cf924cf627e34 Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Mon, 28 Feb 2022 12:25:31 -0800 +Subject: [PATCH] drm/bridge: analogix_dp: Support PSR-exit to disable transition +Git-commit: ca871659ec1606d33b1e76de8d4cf924cf627e34 +Patch-mainline: v5.19-rc2 +References: git-fixes + +Most eDP panel functions only work correctly when the panel is not in +self-refresh. In particular, analogix_dp_bridge_disable() tends to hit +AUX channel errors if the panel is in self-refresh. + +Given the above, it appears that so far, this driver assumes that we are +never in self-refresh when it comes time to fully disable the bridge. +Prior to commit 846c7dfc1193 ("drm/atomic: Try to preserve the crtc +enabled state in drm_atomic_remove_fb, v2."), this tended to be true, +because we would automatically disable the pipe when framebuffers were +removed, and so we'd typically disable the bridge shortly after the last +display activity. + +However, that is not guaranteed: an idle (self-refresh) display pipe may +be disabled, e.g., when switching CRTCs. We need to exit PSR first. + +Stable notes: this is definitely a bugfix, and the bug has likely +existed in some form for quite a while. It may predate the "PSR helpers" +refactor, but the code looked very different before that, and it's +probably not worth rewriting the fix. + +Cc: +Fixes: 6c836d965bad ("drm/rockchip: Use the helpers for PSR") +Signed-off-by: Brian Norris +Reviewed-by: Sean Paul +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20220228122522.v2.1.I161904be17ba14526f78536ccd78b85818449b51@changeid +Acked-by: Takashi Iwai + +--- + .../drm/bridge/analogix/analogix_dp_core.c | 42 +++++++++++++++++-- + 1 file changed, 38 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +index eb590fb8e8d0..0300f670a4fd 100644 +--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c ++++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +@@ -1268,6 +1268,25 @@ static int analogix_dp_bridge_attach(struct drm_bridge *bridge, + return 0; + } + ++static ++struct drm_crtc *analogix_dp_get_old_crtc(struct analogix_dp_device *dp, ++ struct drm_atomic_state *state) ++{ ++ struct drm_encoder *encoder = dp->encoder; ++ struct drm_connector *connector; ++ struct drm_connector_state *conn_state; ++ ++ connector = drm_atomic_get_old_connector_for_encoder(state, encoder); ++ if (!connector) ++ return NULL; ++ ++ conn_state = drm_atomic_get_old_connector_state(state, connector); ++ if (!conn_state) ++ return NULL; ++ ++ return conn_state->crtc; ++} ++ + static + struct drm_crtc *analogix_dp_get_new_crtc(struct analogix_dp_device *dp, + struct drm_atomic_state *state) +@@ -1448,14 +1467,16 @@ analogix_dp_bridge_atomic_disable(struct drm_bridge *bridge, + { + struct drm_atomic_state *old_state = old_bridge_state->base.state; + struct analogix_dp_device *dp = bridge->driver_private; +- struct drm_crtc *crtc; ++ struct drm_crtc *old_crtc, *new_crtc; ++ struct drm_crtc_state *old_crtc_state = NULL; + struct drm_crtc_state *new_crtc_state = NULL; ++ int ret; + +- crtc = analogix_dp_get_new_crtc(dp, old_state); +- if (!crtc) ++ new_crtc = analogix_dp_get_new_crtc(dp, old_state); ++ if (!new_crtc) + goto out; + +- new_crtc_state = drm_atomic_get_new_crtc_state(old_state, crtc); ++ new_crtc_state = drm_atomic_get_new_crtc_state(old_state, new_crtc); + if (!new_crtc_state) + goto out; + +@@ -1464,6 +1485,19 @@ analogix_dp_bridge_atomic_disable(struct drm_bridge *bridge, + return; + + out: ++ old_crtc = analogix_dp_get_old_crtc(dp, old_state); ++ if (old_crtc) { ++ old_crtc_state = drm_atomic_get_old_crtc_state(old_state, ++ old_crtc); ++ ++ /* When moving from PSR to fully disabled, exit PSR first. */ ++ if (old_crtc_state && old_crtc_state->self_refresh_active) { ++ ret = analogix_dp_disable_psr(dp); ++ if (ret) ++ DRM_ERROR("Failed to disable psr (%d)\n", ret); ++ } ++ } ++ + analogix_dp_bridge_disable(bridge); + } + +-- +2.35.3 + diff --git a/patches.suse/drm-i915-Fix-Wstringop-overflow-warning-in-call-to-i.patch b/patches.suse/drm-i915-Fix-Wstringop-overflow-warning-in-call-to-i.patch new file mode 100644 index 0000000..86a000f --- /dev/null +++ b/patches.suse/drm-i915-Fix-Wstringop-overflow-warning-in-call-to-i.patch @@ -0,0 +1,62 @@ +From 336feb502a715909a8136eb6a62a83d7268a353b Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Wed, 27 Apr 2022 17:47:14 -0500 +Subject: [PATCH] drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency() +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 336feb502a715909a8136eb6a62a83d7268a353b +Patch-mainline: v5.19-rc1 +References: git-fixes + +Fix the following -Wstringop-overflow warnings when building with GCC-11: + +drivers/gpu/drm/i915/intel_pm.c:3106:9: warning: ‘intel_read_wm_latency’ accessing 16 bytes in a region of size 10 [-Wstringop-overflow=] + 3106 | intel_read_wm_latency(dev_priv, dev_priv->wm.pri_latency); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/i915/intel_pm.c:3106:9: note: referencing argument 2 of type ‘u16 *’ {aka ‘short unsigned int *’} +drivers/gpu/drm/i915/intel_pm.c:2861:13: note: in a call to function ‘intel_read_wm_latency’ + 2861 | static void intel_read_wm_latency(struct drm_i915_private *dev_priv, + | ^~~~~~~~~~~~~~~~~~~~~ + +by removing the over-specified array size from the argument declarations. + +It seems that this code is actually safe because the size of the +array depends on the hardware generation, and the function checks +for that. + +Notice that wm can be an array of 5 elements: +drivers/gpu/drm/i915/intel_pm.c:3109: intel_read_wm_latency(dev_priv, dev_priv->wm.pri_latency); + +or an array of 8 elements: +drivers/gpu/drm/i915/intel_pm.c:3131: intel_read_wm_latency(dev_priv, dev_priv->wm.skl_latency); + +and the compiler legitimately complains about that. + +This helps with the ongoing efforts to globally enable +-Wstringop-overflow. + +Link: https://github.com/KSPP/linux/issues/181 +Signed-off-by: Gustavo A. R. Silva +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/i915/intel_pm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index 9333f732cda8..5167d63010b9 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -2859,7 +2859,7 @@ static void ilk_compute_wm_level(const struct drm_i915_private *dev_priv, + } + + static void intel_read_wm_latency(struct drm_i915_private *dev_priv, +- u16 wm[8]) ++ u16 wm[]) + { + struct intel_uncore *uncore = &dev_priv->uncore; + +-- +2.35.3 + diff --git a/patches.suse/drm-imx-fix-compiler-warning-with-gcc-12.patch b/patches.suse/drm-imx-fix-compiler-warning-with-gcc-12.patch new file mode 100644 index 0000000..4674668 --- /dev/null +++ b/patches.suse/drm-imx-fix-compiler-warning-with-gcc-12.patch @@ -0,0 +1,51 @@ +From 7aefd8b53815274f3ef398d370a3c9b27dd9f00c Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Wed, 8 Jun 2022 16:59:29 -0700 +Subject: [PATCH] drm: imx: fix compiler warning with gcc-12 +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 7aefd8b53815274f3ef398d370a3c9b27dd9f00c +Patch-mainline: v5.19-rc2 +References: git-fixes + +Gcc-12 correctly warned about this code using a non-NULL pointer as a +truth value: + + drivers/gpu/drm/imx/ipuv3-crtc.c: In function ‘ipu_crtc_disable_planes’: + drivers/gpu/drm/imx/ipuv3-crtc.c:72:21: error: the comparison will always evaluate as ‘true’ for the address of ‘plane’ will never be NULL [-Werror=address] + 72 | if (&ipu_crtc->plane[1] && plane == &ipu_crtc->plane[1]->base) + | ^ + +due to the extraneous '&' address-of operator. + +Philipp Zabel points out that The mistake had no adverse effect since +the following condition doesn't actually dereference the NULL pointer, +but the intent of the code was obviously to check for it, not to take +the address of the member. + +Fixes: eb8c88808c83 ("drm/imx: add deferred plane disabling") +Acked-by: Philipp Zabel +Signed-off-by: Linus Torvalds +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/imx/ipuv3-crtc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c +index 9c8829f945b2..f7863d6dea80 100644 +--- a/drivers/gpu/drm/imx/ipuv3-crtc.c ++++ b/drivers/gpu/drm/imx/ipuv3-crtc.c +@@ -69,7 +69,7 @@ static void ipu_crtc_disable_planes(struct ipu_crtc *ipu_crtc, + drm_atomic_crtc_state_for_each_plane(plane, old_crtc_state) { + if (plane == &ipu_crtc->plane[0]->base) + disable_full = true; +- if (&ipu_crtc->plane[1] && plane == &ipu_crtc->plane[1]->base) ++ if (ipu_crtc->plane[1] && plane == &ipu_crtc->plane[1]->base) + disable_partial = true; + } + +-- +2.35.3 + diff --git a/patches.suse/drm-komeda-return-early-if-drm_universal_plane_init-.patch b/patches.suse/drm-komeda-return-early-if-drm_universal_plane_init-.patch new file mode 100644 index 0000000..5d49389 --- /dev/null +++ b/patches.suse/drm-komeda-return-early-if-drm_universal_plane_init-.patch @@ -0,0 +1,43 @@ +From c8f76c37cc3668ee45e081e76a15f24a352ebbdd Mon Sep 17 00:00:00 2001 +From: Liviu Dudau +Date: Thu, 2 Dec 2021 17:00:33 +0000 +Subject: [PATCH] drm/komeda: return early if drm_universal_plane_init() fails. +Git-commit: c8f76c37cc3668ee45e081e76a15f24a352ebbdd +Patch-mainline: v5.19-rc1 +References: git-fixes + +If drm_universal_plane_init() fails early we jump to the common cleanup code +that calls komeda_plane_destroy() which in turn could access the uninitalised +drm_plane and crash. Return early if an error is detected without going through +the common code. + +Reported-by: Steven Price +Reviewed-by: Steven Price +Signed-off-by: Liviu Dudau +Link: https://lore.kernel.org/dri-devel/20211203100946.2706922-1-liviu.dudau@arm.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/arm/display/komeda/komeda_plane.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_plane.c b/drivers/gpu/drm/arm/display/komeda/komeda_plane.c +index 9a8197a23c45..e0b9f7063b20 100644 +--- a/drivers/gpu/drm/arm/display/komeda/komeda_plane.c ++++ b/drivers/gpu/drm/arm/display/komeda/komeda_plane.c +@@ -270,8 +270,10 @@ static int komeda_plane_add(struct komeda_kms_dev *kms, + + komeda_put_fourcc_list(formats); + +- if (err) +- goto cleanup; ++ if (err) { ++ kfree(kplane); ++ return err; ++ } + + drm_plane_helper_add(plane, &komeda_plane_helper_funcs); + +-- +2.35.3 + diff --git a/patches.suse/drm-msm-fix-error-check-return-value-of-irq_of_parse.patch b/patches.suse/drm-msm-fix-error-check-return-value-of-irq_of_parse.patch new file mode 100644 index 0000000..e48d969 --- /dev/null +++ b/patches.suse/drm-msm-fix-error-check-return-value-of-irq_of_parse.patch @@ -0,0 +1,38 @@ +From b9e4f1d2b505df8e2439b63e67afaa287c1c43e2 Mon Sep 17 00:00:00 2001 +From: Lv Ruyi +Date: Sun, 24 Apr 2022 03:19:59 +0000 +Subject: [PATCH] drm: msm: fix error check return value of irq_of_parse_and_map() +Git-commit: b9e4f1d2b505df8e2439b63e67afaa287c1c43e2 +Patch-mainline: v5.19-rc1 +References: git-fixes + +The irq_of_parse_and_map() function returns 0 on failure, and does not +return an negative value. + +Reported-by: Zeal Robot +Signed-off-by: Lv Ruyi +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/483175/ +Link: https://lore.kernel.org/r/20220424031959.3172406-1-lv.ruyi@zte.com.cn +Signed-off-by: Dmitry Baryshkov +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c ++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c +@@ -598,9 +598,9 @@ struct msm_kms *mdp5_kms_init(struct drm + pdev = mdp5_kms->pdev; + + irq = irq_of_parse_and_map(pdev->dev.of_node, 0); +- if (irq < 0) { +- ret = irq; +- DRM_DEV_ERROR(&pdev->dev, "failed to get irq: %d\n", ret); ++ if (!irq) { ++ ret = -EINVAL; ++ DRM_DEV_ERROR(&pdev->dev, "failed to get irq\n"); + goto fail; + } + diff --git a/patches.suse/drm-plane-Move-range-check-for-format_count-earlier.patch b/patches.suse/drm-plane-Move-range-check-for-format_count-earlier.patch new file mode 100644 index 0000000..a170092 --- /dev/null +++ b/patches.suse/drm-plane-Move-range-check-for-format_count-earlier.patch @@ -0,0 +1,59 @@ +From 4b674dd69701c2e22e8e7770c1706a69f3b17269 Mon Sep 17 00:00:00 2001 +From: Steven Price +Date: Fri, 3 Dec 2021 10:28:15 +0000 +Subject: [PATCH] drm/plane: Move range check for format_count earlier +Git-commit: 4b674dd69701c2e22e8e7770c1706a69f3b17269 +Patch-mainline: v5.19-rc1 +References: git-fixes + +While the check for format_count > 64 in __drm_universal_plane_init() +shouldn't be hit (it's a WARN_ON), in its current position it will then +leak the plane->format_types array and fail to call +drm_mode_object_unregister() leaking the modeset identifier. Move it to +the start of the function to avoid allocating those resources in the +first place. + +Signed-off-by: Steven Price +Signed-off-by: Liviu Dudau +Link: https://lore.kernel.org/dri-devel/20211203102815.38624-1-steven.price@arm.com/ +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/drm_plane.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c +index bf0daa8d9bbd..726f2f163c26 100644 +--- a/drivers/gpu/drm/drm_plane.c ++++ b/drivers/gpu/drm/drm_plane.c +@@ -247,6 +247,13 @@ static int __drm_universal_plane_init(struct drm_device *dev, + if (WARN_ON(config->num_total_plane >= 32)) + return -EINVAL; + ++ /* ++ * First driver to need more than 64 formats needs to fix this. Each ++ * format is encoded as a bit and the current code only supports a u64. ++ */ ++ if (WARN_ON(format_count > 64)) ++ return -EINVAL; ++ + WARN_ON(drm_drv_uses_atomic_modeset(dev) && + (!funcs->atomic_destroy_state || + !funcs->atomic_duplicate_state)); +@@ -268,13 +275,6 @@ static int __drm_universal_plane_init(struct drm_device *dev, + return -ENOMEM; + } + +- /* +- * First driver to need more than 64 formats needs to fix this. Each +- * format is encoded as a bit and the current code only supports a u64. +- */ +- if (WARN_ON(format_count > 64)) +- return -EINVAL; +- + if (format_modifiers) { + const uint64_t *temp_modifiers = format_modifiers; + +-- +2.35.3 + diff --git a/patches.suse/drm-radeon-fix-a-possible-null-pointer-dereference.patch b/patches.suse/drm-radeon-fix-a-possible-null-pointer-dereference.patch new file mode 100644 index 0000000..eb234a6 --- /dev/null +++ b/patches.suse/drm-radeon-fix-a-possible-null-pointer-dereference.patch @@ -0,0 +1,47 @@ +From a2b28708b645c5632dc93669ab06e97874c8244f Mon Sep 17 00:00:00 2001 +From: Gong Yuanjun +Date: Tue, 17 May 2022 17:57:00 +0800 +Subject: [PATCH] drm/radeon: fix a possible null pointer dereference +Git-commit: a2b28708b645c5632dc93669ab06e97874c8244f +Patch-mainline: v5.19-rc1 +References: git-fixes + +In radeon_fp_native_mode(), the return value of drm_mode_duplicate() +is assigned to mode, which will lead to a NULL pointer dereference +on failure of drm_mode_duplicate(). Add a check to avoid npd. + +The failure status of drm_cvt_mode() on the other path is checked too. + +Signed-off-by: Gong Yuanjun +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/radeon/radeon_connectors.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c +index a16892c16f60..58db79921cd3 100644 +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -473,6 +473,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode + native_mode->vdisplay != 0 && + native_mode->clock != 0) { + mode = drm_mode_duplicate(dev, native_mode); ++ if (!mode) ++ return NULL; + mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; + drm_mode_set_name(mode); + +@@ -487,6 +489,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode + * simpler. + */ + mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false); ++ if (!mode) ++ return NULL; + mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; + DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode->name); + } +-- +2.35.3 + diff --git a/patches.suse/drm-virtio-fix-NULL-pointer-dereference-in-virtio_gp.patch b/patches.suse/drm-virtio-fix-NULL-pointer-dereference-in-virtio_gp.patch new file mode 100644 index 0000000..5024181 --- /dev/null +++ b/patches.suse/drm-virtio-fix-NULL-pointer-dereference-in-virtio_gp.patch @@ -0,0 +1,88 @@ +From 194d250cdc4a40ccbd179afd522a9e9846957402 Mon Sep 17 00:00:00 2001 +From: Liu Zixian +Date: Tue, 22 Mar 2022 17:17:30 +0800 +Subject: [PATCH] drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes +Git-commit: 194d250cdc4a40ccbd179afd522a9e9846957402 +Patch-mainline: v5.19-rc1 +References: git-fixes + +drm_cvt_mode may return NULL and we should check it. + +This bug is found by syzkaller: + +FAULT_INJECTION stacktrace: +[ 168.567394] FAULT_INJECTION: forcing a failure. +name failslab, interval 1, probability 0, space 0, times 1 +[ 168.567403] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 +[ 168.567406] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 +[ 168.567408] Call trace: +[ 168.567414] dump_backtrace+0x0/0x310 +[ 168.567418] show_stack+0x28/0x38 +[ 168.567423] dump_stack+0xec/0x15c +[ 168.567427] should_fail+0x3ac/0x3d0 +[ 168.567437] __should_failslab+0xb8/0x120 +[ 168.567441] should_failslab+0x28/0xc0 +[ 168.567445] kmem_cache_alloc_trace+0x50/0x640 +[ 168.567454] drm_mode_create+0x40/0x90 +[ 168.567458] drm_cvt_mode+0x48/0xc78 +[ 168.567477] virtio_gpu_conn_get_modes+0xa8/0x140 [virtio_gpu] +[ 168.567485] drm_helper_probe_single_connector_modes+0x3a4/0xd80 +[ 168.567492] drm_mode_getconnector+0x2e0/0xa70 +[ 168.567496] drm_ioctl_kernel+0x11c/0x1d8 +[ 168.567514] drm_ioctl+0x558/0x6d0 +[ 168.567522] do_vfs_ioctl+0x160/0xf30 +[ 168.567525] ksys_ioctl+0x98/0xd8 +[ 168.567530] __arm64_sys_ioctl+0x50/0xc8 +[ 168.567536] el0_svc_common+0xc8/0x320 +[ 168.567540] el0_svc_handler+0xf8/0x160 +[ 168.567544] el0_svc+0x10/0x218 + +KASAN stacktrace: +[ 168.567561] BUG: KASAN: null-ptr-deref in virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] +[ 168.567565] Read of size 4 at addr 0000000000000054 by task syz/6425 +[ 168.567566] +[ 168.567571] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 +[ 168.567573] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 +[ 168.567575] Call trace: +[ 168.567578] dump_backtrace+0x0/0x310 +[ 168.567582] show_stack+0x28/0x38 +[ 168.567586] dump_stack+0xec/0x15c +[ 168.567591] kasan_report+0x244/0x2f0 +[ 168.567594] __asan_load4+0x58/0xb0 +[ 168.567607] virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] +[ 168.567612] drm_helper_probe_single_connector_modes+0x3a4/0xd80 +[ 168.567617] drm_mode_getconnector+0x2e0/0xa70 +[ 168.567621] drm_ioctl_kernel+0x11c/0x1d8 +[ 168.567624] drm_ioctl+0x558/0x6d0 +[ 168.567628] do_vfs_ioctl+0x160/0xf30 +[ 168.567632] ksys_ioctl+0x98/0xd8 +[ 168.567636] __arm64_sys_ioctl+0x50/0xc8 +[ 168.567641] el0_svc_common+0xc8/0x320 +[ 168.567645] el0_svc_handler+0xf8/0x160 +[ 168.567649] el0_svc+0x10/0x218 + +Signed-off-by: Liu Zixian +Link: http://patchwork.freedesktop.org/patch/msgid/20220322091730.1653-1-liuzixian4@huawei.com +Signed-off-by: Gerd Hoffmann +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/virtio/virtgpu_display.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/virtio/virtgpu_display.c b/drivers/gpu/drm/virtio/virtgpu_display.c +index 5b00310ac4cd..f73352e7b832 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_display.c ++++ b/drivers/gpu/drm/virtio/virtgpu_display.c +@@ -179,6 +179,8 @@ static int virtio_gpu_conn_get_modes(struct drm_connector *connector) + DRM_DEBUG("add mode: %dx%d\n", width, height); + mode = drm_cvt_mode(connector->dev, width, height, 60, + false, false, false); ++ if (!mode) ++ return count; + mode->type |= DRM_MODE_TYPE_PREFERRED; + drm_mode_probed_add(connector, mode); + count++; +-- +2.35.3 + diff --git a/patches.suse/efi-Add-missing-prototype-for-efi_capsule_setup_info.patch b/patches.suse/efi-Add-missing-prototype-for-efi_capsule_setup_info.patch new file mode 100644 index 0000000..8ae765d --- /dev/null +++ b/patches.suse/efi-Add-missing-prototype-for-efi_capsule_setup_info.patch @@ -0,0 +1,32 @@ +From aa480379d8bdb33920d68acfd90f823c8af32578 Mon Sep 17 00:00:00 2001 +From: Jan Kiszka +Date: Fri, 4 Mar 2022 07:36:37 +0100 +Subject: [PATCH] efi: Add missing prototype for efi_capsule_setup_info +Git-commit: aa480379d8bdb33920d68acfd90f823c8af32578 +Patch-mainline: v5.19-rc1 +References: git-fixes + +Fixes "no previous declaration for 'efi_capsule_setup_info'" warnings +under W=1. + +Fixes: 2959c95d510c ("efi/capsule: Add support for Quark security header") +Signed-off-by: Jan Kiszka +Link: https://lore.kernel.org/r/c28d3f86-dd72-27d1-e2c2-40971b8da6bd@siemens.com +Signed-off-by: Ard Biesheuvel +Acked-by: Takashi Iwai + +--- + include/linux/efi.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -167,6 +167,8 @@ struct capsule_info { + size_t page_bytes_remain; + }; + ++int efi_capsule_setup_info(struct capsule_info *cap_info, void *kbuff, ++ size_t hdr_bytes); + int __efi_capsule_setup_info(struct capsule_info *cap_info); + + typedef int (*efi_freemem_callback_t) (u64 start, u64 end, void *arg); diff --git a/patches.suse/efi-Do-not-import-certificates-from-UEFI-Secure-Boot.patch b/patches.suse/efi-Do-not-import-certificates-from-UEFI-Secure-Boot.patch new file mode 100644 index 0000000..4985651 --- /dev/null +++ b/patches.suse/efi-Do-not-import-certificates-from-UEFI-Secure-Boot.patch @@ -0,0 +1,134 @@ +From 155ca952c7ca19aa32ecfb7373a32bbc2e1ec6eb Mon Sep 17 00:00:00 2001 +From: Aditya Garg +Date: Fri, 15 Apr 2022 17:02:46 +0000 +Subject: [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs +Git-commit: 155ca952c7ca19aa32ecfb7373a32bbc2e1ec6eb +Patch-mainline: v5.19-rc1 +References: git-fixes + +On Apple T2 Macs, when Linux attempts to read the db and dbx efi variables +at early boot to load UEFI Secure Boot certificates, a page fault occurs +in Apple firmware code and EFI runtime services are disabled with the +following logs: + +[Firmware Bug]: Page fault caused by firmware at PA: 0xffffb1edc0068000 +Warning: CPU: 3 PID: 104 at arch/x86/platform/efi/quirks.c:735 efi_crash_gracefully_on_page_fault+0x50/0xf0 +(Removed some logs from here) +Call Trace: + + page_fault_oops+0x4f/0x2c0 + ? search_bpf_extables+0x6b/0x80 + ? search_module_extables+0x50/0x80 + ? search_exception_tables+0x5b/0x60 + kernelmode_fixup_or_oops+0x9e/0x110 + __bad_area_nosemaphore+0x155/0x190 + bad_area_nosemaphore+0x16/0x20 + do_kern_addr_fault+0x8c/0xa0 + exc_page_fault+0xd8/0x180 + asm_exc_page_fault+0x1e/0x30 +(Removed some logs from here) + ? __efi_call+0x28/0x30 + ? switch_mm+0x20/0x30 + ? efi_call_rts+0x19a/0x8e0 + ? process_one_work+0x222/0x3f0 + ? worker_thread+0x4a/0x3d0 + ? kthread+0x17a/0x1a0 + ? process_one_work+0x3f0/0x3f0 + ? set_kthread_struct+0x40/0x40 + ? ret_from_fork+0x22/0x30 + + +Acked-by: Takashi Iwai + +---[ end trace 1f82023595a5927f ]--- +efi: Froze efi_rts_wq and disabled EFI Runtime Services +integrity: Couldn't get size: 0x8000000000000015 +integrity: MODSIGN: Couldn't get UEFI db list +efi: EFI Runtime Services are disabled! +integrity: Couldn't get size: 0x8000000000000015 +integrity: Couldn't get UEFI dbx list +integrity: Couldn't get size: 0x8000000000000015 +integrity: Couldn't get mokx list +integrity: Couldn't get size: 0x80000000 + +So we avoid reading these UEFI variables and thus prevent the crash. + +Cc: stable@vger.kernel.org +Signed-off-by: Aditya Garg +Reviewed-by: Mimi Zohar +Signed-off-by: Mimi Zohar +--- + security/integrity/platform_certs/keyring_handler.h | 8 ++++ + security/integrity/platform_certs/load_uefi.c | 33 ++++++++++++++++++++ + 2 files changed, 41 insertions(+) + +--- a/security/integrity/platform_certs/keyring_handler.h ++++ b/security/integrity/platform_certs/keyring_handler.h +@@ -30,3 +30,11 @@ efi_element_handler_t get_handler_for_db + efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_type); + + #endif ++ ++#ifndef UEFI_QUIRK_SKIP_CERT ++#define UEFI_QUIRK_SKIP_CERT(vendor, product) \ ++ .matches = { \ ++ DMI_MATCH(DMI_BOARD_VENDOR, vendor), \ ++ DMI_MATCH(DMI_PRODUCT_NAME, product), \ ++ }, ++#endif +--- a/security/integrity/platform_certs/load_uefi.c ++++ b/security/integrity/platform_certs/load_uefi.c +@@ -3,6 +3,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -12,6 +13,31 @@ + #include "keyring_handler.h" + + /* ++ * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot ++ * certificates causes occurrence of a page fault in Apple's firmware and ++ * a crash disabling EFI runtime services. The following quirk skips reading ++ * these variables. ++ */ ++static const struct dmi_system_id uefi_skip_cert[] = { ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,1") }, ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,2") }, ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,3") }, ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,4") }, ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,1") }, ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,2") }, ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,3") }, ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,4") }, ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") }, ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") }, ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") }, ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacMini8,1") }, ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") }, ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") }, ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") }, ++ { } ++}; ++ ++/* + * Look to see if a UEFI variable called MokIgnoreDB exists and return true if + * it does. + * +@@ -75,6 +101,13 @@ static int __init load_uefi_certs(void) + void *db = NULL, *dbx = NULL, *mok = NULL; + unsigned long dbsize = 0, dbxsize = 0, moksize = 0; + int rc = 0; ++ const struct dmi_system_id *dmi_id; ++ ++ dmi_id = dmi_first_match(uefi_skip_cert); ++ if (dmi_id) { ++ pr_err("Reading UEFI Secure Boot Certs is not supported on T2 Macs.\n"); ++ return false; ++ } + + if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) + return false; diff --git a/patches.suse/fbcon-Consistently-protect-deferred_takeover-with-co.patch b/patches.suse/fbcon-Consistently-protect-deferred_takeover-with-co.patch new file mode 100644 index 0000000..a2e9480 --- /dev/null +++ b/patches.suse/fbcon-Consistently-protect-deferred_takeover-with-co.patch @@ -0,0 +1,54 @@ +From 43553559121ca90965b572cf8a1d6d0fd618b449 Mon Sep 17 00:00:00 2001 +From: Daniel Vetter +Date: Tue, 5 Apr 2022 23:03:31 +0200 +Subject: [PATCH] fbcon: Consistently protect deferred_takeover with console_lock() +Git-commit: 43553559121ca90965b572cf8a1d6d0fd618b449 +Patch-mainline: v5.19-rc1 +References: git-fixes + +This shouldn't be a problem in practice since until we've actually +taken over the console there's nothing we've registered with the +console/vt subsystem, so the exit/unbind path that check this can't +do the wrong thing. But it's confusing, so fix it by moving it a tad +later. + +Acked-by: Sam Ravnborg +Signed-off-by: Daniel Vetter +Cc: Daniel Vetter +Cc: Du Cheng +Cc: Tetsuo Handa +Cc: Claudio Suarez +Cc: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20220405210335.3434130-14-daniel.vetter@ffwll.ch +Acked-by: Takashi Iwai + +--- + drivers/video/fbdev/core/fbcon.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index cc960bf49991..4f9752ee9189 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -3227,6 +3227,9 @@ static void fbcon_register_existing_fbs(struct work_struct *work) + + console_lock(); + ++ deferred_takeover = false; ++ logo_shown = FBCON_LOGO_DONTSHOW; ++ + for_each_registered_fb(i) + fbcon_fb_registered(registered_fb[i]); + +@@ -3244,8 +3247,6 @@ static int fbcon_output_notifier(struct notifier_block *nb, + pr_info("fbcon: Taking over console\n"); + + dummycon_unregister_output_notifier(&fbcon_output_nb); +- deferred_takeover = false; +- logo_shown = FBCON_LOGO_DONTSHOW; + + /* We may get called in atomic context */ + schedule_work(&fbcon_deferred_takeover_work); +-- +2.35.3 + diff --git a/patches.suse/hwmon-Make-chip-parameter-for-with_info-API-mandator.patch b/patches.suse/hwmon-Make-chip-parameter-for-with_info-API-mandator.patch new file mode 100644 index 0000000..8bdb264 --- /dev/null +++ b/patches.suse/hwmon-Make-chip-parameter-for-with_info-API-mandator.patch @@ -0,0 +1,75 @@ +From ddaefa209c4ac791c1262e97c9b2d0440c8ef1d5 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Wed, 11 May 2022 06:22:51 -0700 +Subject: [PATCH] hwmon: Make chip parameter for with_info API mandatory +Git-commit: ddaefa209c4ac791c1262e97c9b2d0440c8ef1d5 +Patch-mainline: v5.19-rc1 +References: git-fixes + +Various attempts were made recently to "convert" the old +hwmon_device_register() API to devm_hwmon_device_register_with_info() +by just changing the function name without actually converting the +driver. Prevent this from happening by making the 'chip' parameter of +devm_hwmon_device_register_with_info() mandatory. + +Signed-off-by: Guenter Roeck +Acked-by: Takashi Iwai + +--- + Documentation/hwmon/hwmon-kernel-api.rst | 2 +- + drivers/hwmon/hwmon.c | 16 +++++++--------- + 2 files changed, 8 insertions(+), 10 deletions(-) + +diff --git a/Documentation/hwmon/hwmon-kernel-api.rst b/Documentation/hwmon/hwmon-kernel-api.rst +index e2975d5caf34..f3276b3a381a 100644 +--- a/Documentation/hwmon/hwmon-kernel-api.rst ++++ b/Documentation/hwmon/hwmon-kernel-api.rst +@@ -76,7 +76,7 @@ hwmon_device_register_with_info is the most comprehensive and preferred means + to register a hardware monitoring device. It creates the standard sysfs + attributes in the hardware monitoring core, letting the driver focus on reading + from and writing to the chip instead of having to bother with sysfs attributes. +-The parent device parameter cannot be NULL with non-NULL chip info. Its ++The parent device parameter as well as the chip parameter must not be NULL. Its + parameters are described in more detail below. + + devm_hwmon_device_register_with_info is similar to +diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c +index 13053a4edc9e..22de7a9e7ba7 100644 +--- a/drivers/hwmon/hwmon.c ++++ b/drivers/hwmon/hwmon.c +@@ -886,11 +886,12 @@ EXPORT_SYMBOL_GPL(hwmon_device_register_with_groups); + + /** + * hwmon_device_register_with_info - register w/ hwmon +- * @dev: the parent device +- * @name: hwmon name attribute +- * @drvdata: driver data to attach to created device +- * @chip: pointer to hwmon chip information ++ * @dev: the parent device (mandatory) ++ * @name: hwmon name attribute (mandatory) ++ * @drvdata: driver data to attach to created device (optional) ++ * @chip: pointer to hwmon chip information (mandatory) + * @extra_groups: pointer to list of additional non-standard attribute groups ++ * (optional) + * + * hwmon_device_unregister() must be called when the device is no + * longer needed. +@@ -903,13 +904,10 @@ hwmon_device_register_with_info(struct device *dev, const char *name, + const struct hwmon_chip_info *chip, + const struct attribute_group **extra_groups) + { +- if (!name) +- return ERR_PTR(-EINVAL); +- +- if (chip && (!chip->ops || !chip->ops->is_visible || !chip->info)) ++ if (!dev || !name || !chip) + return ERR_PTR(-EINVAL); + +- if (chip && !dev) ++ if (!chip->ops || !chip->ops->is_visible || !chip->info) + return ERR_PTR(-EINVAL); + + return __hwmon_device_register(dev, name, drvdata, chip, extra_groups); +-- +2.35.3 + diff --git a/patches.suse/i2c-cadence-Increase-timeout-per-message-if-necessar.patch b/patches.suse/i2c-cadence-Increase-timeout-per-message-if-necessar.patch new file mode 100644 index 0000000..d97075b --- /dev/null +++ b/patches.suse/i2c-cadence-Increase-timeout-per-message-if-necessar.patch @@ -0,0 +1,64 @@ +From 96789dce043f5bff8b7d62aa28d52a7c59403a84 Mon Sep 17 00:00:00 2001 +From: Lucas Tanure +Date: Wed, 13 Apr 2022 10:14:10 +0100 +Subject: [PATCH] i2c: cadence: Increase timeout per message if necessary +Git-commit: 96789dce043f5bff8b7d62aa28d52a7c59403a84 +Patch-mainline: v5.19-rc1 +References: git-fixes + +Timeout as 1 second sets an upper limit on the length +of the transfer executed, but there is no maximum length +of a write or read message set in i2c_adapter_quirks for +this controller. + +This upper limit affects devices that require sending +large firmware blobs over I2C. + +To remove that limitation, calculate the minimal time +necessary, plus some wiggle room, for every message and +use it instead of the default one second, if more than +one second. + +Signed-off-by: Lucas Tanure +Acked-by: Michal Simek +Signed-off-by: Wolfram Sang +Acked-by: Takashi Iwai + +--- + drivers/i2c/busses/i2c-cadence.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c +index 805c77143a0f..b4c1ad19cdae 100644 +--- a/drivers/i2c/busses/i2c-cadence.c ++++ b/drivers/i2c/busses/i2c-cadence.c +@@ -760,7 +760,7 @@ static void cdns_i2c_master_reset(struct i2c_adapter *adap) + static int cdns_i2c_process_msg(struct cdns_i2c *id, struct i2c_msg *msg, + struct i2c_adapter *adap) + { +- unsigned long time_left; ++ unsigned long time_left, msg_timeout; + u32 reg; + + id->p_msg = msg; +@@ -785,8 +785,16 @@ static int cdns_i2c_process_msg(struct cdns_i2c *id, struct i2c_msg *msg, + else + cdns_i2c_msend(id); + ++ /* Minimal time to execute this message */ ++ msg_timeout = msecs_to_jiffies((1000 * msg->len * BITS_PER_BYTE) / id->i2c_clk); ++ /* Plus some wiggle room */ ++ msg_timeout += msecs_to_jiffies(500); ++ ++ if (msg_timeout < adap->timeout) ++ msg_timeout = adap->timeout; ++ + /* Wait for the signal of completion */ +- time_left = wait_for_completion_timeout(&id->xfer_done, adap->timeout); ++ time_left = wait_for_completion_timeout(&id->xfer_done, msg_timeout); + if (time_left == 0) { + cdns_i2c_master_reset(adap); + dev_err(id->adap.dev.parent, +-- +2.35.3 + diff --git a/patches.suse/i2c-ismt-Provide-a-DMA-buffer-for-Interrupt-Cause-Lo.patch b/patches.suse/i2c-ismt-Provide-a-DMA-buffer-for-Interrupt-Cause-Lo.patch new file mode 100644 index 0000000..be1f08f --- /dev/null +++ b/patches.suse/i2c-ismt-Provide-a-DMA-buffer-for-Interrupt-Cause-Lo.patch @@ -0,0 +1,83 @@ +From 17a0f3acdc6ec8b89ad40f6e22165a4beee25663 Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Wed, 27 Apr 2022 13:19:10 +0300 +Subject: [PATCH] i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging +Git-commit: 17a0f3acdc6ec8b89ad40f6e22165a4beee25663 +Patch-mainline: v5.18 +References: git-fixes + +Before sending a MSI the hardware writes information pertinent to the +interrupt cause to a memory location pointed by SMTICL register. This +memory holds three double words where the least significant bit tells +whether the interrupt cause of master/target/error is valid. The driver +does not use this but we need to set it up because otherwise it will +perform DMA write to the default address (0) and this will cause an +IOMMU fault such as below: + + DMAR: DRHD: handling fault status reg 2 + DMAR: [DMA Write] Request device [00:12.0] PASID ffffffff fault addr 0 + [fault reason 05] PTE Write access is not set + +To prevent this from happening, provide a proper DMA buffer for this +that then gets mapped by the IOMMU accordingly. + +Signed-off-by: Mika Westerberg +Reviewed-by: From: Andy Shevchenko +Signed-off-by: Wolfram Sang +Acked-by: Takashi Iwai + +--- + drivers/i2c/busses/i2c-ismt.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/i2c/busses/i2c-ismt.c ++++ b/drivers/i2c/busses/i2c-ismt.c +@@ -82,6 +82,7 @@ + + #define ISMT_DESC_ENTRIES 2 /* number of descriptor entries */ + #define ISMT_MAX_RETRIES 3 /* number of SMBus retries to attempt */ ++#define ISMT_LOG_ENTRIES 3 /* number of interrupt cause log entries */ + + /* Hardware Descriptor Constants - Control Field */ + #define ISMT_DESC_CWRL 0x01 /* Command/Write Length */ +@@ -175,6 +176,8 @@ struct ismt_priv { + u8 head; /* ring buffer head pointer */ + struct completion cmp; /* interrupt completion */ + u8 buffer[I2C_SMBUS_BLOCK_MAX + 16]; /* temp R/W data buffer */ ++ dma_addr_t log_dma; ++ u32 *log; + }; + + /** +@@ -410,6 +413,9 @@ static int ismt_access(struct i2c_adapte + memset(desc, 0, sizeof(struct ismt_desc)); + desc->tgtaddr_rw = ISMT_DESC_ADDR_RW(addr, read_write); + ++ /* Always clear the log entries */ ++ memset(priv->log, 0, ISMT_LOG_ENTRIES * sizeof(u32)); ++ + /* Initialize common control bits */ + if (likely(pci_dev_msi_enabled(priv->pci_dev))) + desc->control = ISMT_DESC_INT | ISMT_DESC_FAIR; +@@ -699,6 +705,8 @@ static void ismt_hw_init(struct ismt_pri + /* initialize the Master Descriptor Base Address (MDBA) */ + writeq(priv->io_rng_dma, priv->smba + ISMT_MSTR_MDBA); + ++ writeq(priv->log_dma, priv->smba + ISMT_GR_SMTICL); ++ + /* initialize the Master Control Register (MCTRL) */ + writel(ISMT_MCTRL_MEIE, priv->smba + ISMT_MSTR_MCTRL); + +@@ -788,6 +796,12 @@ static int ismt_dev_init(struct ismt_pri + priv->head = 0; + init_completion(&priv->cmp); + ++ priv->log = dmam_alloc_coherent(&priv->pci_dev->dev, ++ ISMT_LOG_ENTRIES * sizeof(u32), ++ &priv->log_dma, GFP_KERNEL); ++ if (!priv->log) ++ return -ENOMEM; ++ + return 0; + } + diff --git a/patches.suse/iio-dummy-iio_simple_dummy-check-the-return-value-of.patch b/patches.suse/iio-dummy-iio_simple_dummy-check-the-return-value-of.patch new file mode 100644 index 0000000..d4e50c2 --- /dev/null +++ b/patches.suse/iio-dummy-iio_simple_dummy-check-the-return-value-of.patch @@ -0,0 +1,83 @@ +From ba93642188a6fed754bf7447f638bc410e05a929 Mon Sep 17 00:00:00 2001 +From: Xiaoke Wang +Date: Sat, 5 Mar 2022 11:14:05 +0800 +Subject: [PATCH] iio: dummy: iio_simple_dummy: check the return value of kstrdup() +Git-commit: ba93642188a6fed754bf7447f638bc410e05a929 +Patch-mainline: v5.19-rc1 +References: git-fixes + +kstrdup() is also a memory allocation-related function, it returns NULL +when some memory errors happen. So it is better to check the return +value of it so to catch the memory error in time. Besides, there should +have a kfree() to clear up the allocation if we get a failure later in +this function to prevent memory leak. + +Signed-off-by: Xiaoke Wang +Link: https://lore.kernel.org/r/tencent_C920CFCC33B9CC1C63141FE1334A39FF8508@qq.com +Signed-off-by: Jonathan Cameron +Acked-by: Takashi Iwai + +--- + drivers/iio/dummy/iio_simple_dummy.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +--- a/drivers/iio/dummy/iio_simple_dummy.c ++++ b/drivers/iio/dummy/iio_simple_dummy.c +@@ -568,10 +568,9 @@ static struct iio_sw_device *iio_dummy_p + struct iio_sw_device *swd; + + swd = kzalloc(sizeof(*swd), GFP_KERNEL); +- if (!swd) { +- ret = -ENOMEM; +- goto error_kzalloc; +- } ++ if (!swd) ++ return ERR_PTR(-ENOMEM); ++ + /* + * Allocate an IIO device. + * +@@ -583,7 +582,7 @@ static struct iio_sw_device *iio_dummy_p + indio_dev = iio_device_alloc(sizeof(*st)); + if (!indio_dev) { + ret = -ENOMEM; +- goto error_ret; ++ goto error_free_swd; + } + + st = iio_priv(indio_dev); +@@ -614,6 +613,10 @@ static struct iio_sw_device *iio_dummy_p + * indio_dev->name = spi_get_device_id(spi)->name; + */ + indio_dev->name = kstrdup(name, GFP_KERNEL); ++ if (!indio_dev->name) { ++ ret = -ENOMEM; ++ goto error_free_device; ++ } + + /* Provide description of available channels */ + indio_dev->channels = iio_dummy_channels; +@@ -630,7 +633,7 @@ static struct iio_sw_device *iio_dummy_p + + ret = iio_simple_dummy_events_register(indio_dev); + if (ret < 0) +- goto error_free_device; ++ goto error_free_name; + + ret = iio_simple_dummy_configure_buffer(indio_dev); + if (ret < 0) +@@ -647,11 +650,12 @@ error_unconfigure_buffer: + iio_simple_dummy_unconfigure_buffer(indio_dev); + error_unregister_events: + iio_simple_dummy_events_unregister(indio_dev); ++error_free_name: ++ kfree(indio_dev->name); + error_free_device: + iio_device_free(indio_dev); +-error_ret: ++error_free_swd: + kfree(swd); +-error_kzalloc: + return ERR_PTR(ret); + } + diff --git a/patches.suse/ipw2x00-Fix-potential-NULL-dereference-in-libipw_xmi.patch b/patches.suse/ipw2x00-Fix-potential-NULL-dereference-in-libipw_xmi.patch new file mode 100644 index 0000000..8d7515d --- /dev/null +++ b/patches.suse/ipw2x00-Fix-potential-NULL-dereference-in-libipw_xmi.patch @@ -0,0 +1,36 @@ +From e8366bbabe1d207cf7c5b11ae50e223ae6fc278b Mon Sep 17 00:00:00 2001 +From: Haowen Bai +Date: Fri, 1 Apr 2022 15:10:54 +0800 +Subject: [PATCH] ipw2x00: Fix potential NULL dereference in libipw_xmit() +Git-commit: e8366bbabe1d207cf7c5b11ae50e223ae6fc278b +Patch-mainline: v5.19-rc1 +References: git-fixes + +crypt and crypt->ops could be null, so we need to checking null +before dereference + +Signed-off-by: Haowen Bai +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1648797055-25730-1-git-send-email-baihaowen@meizu.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/intel/ipw2x00/libipw_tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/ipw2x00/libipw_tx.c b/drivers/net/wireless/intel/ipw2x00/libipw_tx.c +index 36d1e6b2568d..4aec1fce1ae2 100644 +--- a/drivers/net/wireless/intel/ipw2x00/libipw_tx.c ++++ b/drivers/net/wireless/intel/ipw2x00/libipw_tx.c +@@ -383,7 +383,7 @@ netdev_tx_t libipw_xmit(struct sk_buff *skb, struct net_device *dev) + + /* Each fragment may need to have room for encryption + * pre/postfix */ +- if (host_encrypt) ++ if (host_encrypt && crypt && crypt->ops) + bytes_per_frag -= crypt->ops->extra_mpdu_prefix_len + + crypt->ops->extra_mpdu_postfix_len; + +-- +2.35.3 + diff --git a/patches.suse/irqchip-armada-370-xp-Do-not-touch-Performance-Count.patch b/patches.suse/irqchip-armada-370-xp-Do-not-touch-Performance-Count.patch new file mode 100644 index 0000000..93520e0 --- /dev/null +++ b/patches.suse/irqchip-armada-370-xp-Do-not-touch-Performance-Count.patch @@ -0,0 +1,53 @@ +From a3d66a76348daf559873f19afc912a2a7c2ccdaf Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pali=20Roh=C3=A1r?= +Date: Mon, 25 Apr 2022 13:37:05 +0200 +Subject: [PATCH] irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: a3d66a76348daf559873f19afc912a2a7c2ccdaf +Patch-mainline: v5.19-rc1 +References: git-fixes + +Register ARMADA_370_XP_INT_FABRIC_MASK_OFFS is Armada 370 and XP specific +and on new Armada platforms it has different meaning. It does not configure +Performance Counter Overflow interrupt masking. So do not touch this +register on non-A370/XP platforms (A375, A38x and A39x). + +Signed-off-by: Pali Rohár +Cc: stable@vger.kernel.org +Fixes: 28da06dfd9e4 ("irqchip: armada-370-xp: Enable the PMU interrupts") +Reviewed-by: Andrew Lunn +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20220425113706.29310-1-pali@kernel.org +Acked-by: Takashi Iwai + +--- + drivers/irqchip/irq-armada-370-xp.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c +index c877285d7095..ee18eb3e72b7 100644 +--- a/drivers/irqchip/irq-armada-370-xp.c ++++ b/drivers/irqchip/irq-armada-370-xp.c +@@ -327,7 +327,16 @@ static inline int armada_370_xp_msi_init(struct device_node *node, + + static void armada_xp_mpic_perf_init(void) + { +- unsigned long cpuid = cpu_logical_map(smp_processor_id()); ++ unsigned long cpuid; ++ ++ /* ++ * This Performance Counter Overflow interrupt is specific for ++ * Armada 370 and XP. It is not available on Armada 375, 38x and 39x. ++ */ ++ if (!of_machine_is_compatible("marvell,armada-370-xp")) ++ return; ++ ++ cpuid = cpu_logical_map(smp_processor_id()); + + /* Enable Performance Counter Overflow interrupts */ + writel(ARMADA_370_XP_INT_CAUSE_PERF(cpuid), +-- +2.35.3 + diff --git a/patches.suse/irqchip-aspeed-i2c-ic-Fix-irq_of_parse_and_map-retur.patch b/patches.suse/irqchip-aspeed-i2c-ic-Fix-irq_of_parse_and_map-retur.patch new file mode 100644 index 0000000..66cf141 --- /dev/null +++ b/patches.suse/irqchip-aspeed-i2c-ic-Fix-irq_of_parse_and_map-retur.patch @@ -0,0 +1,38 @@ +From 50f0f26e7c8665763d0d7d3372dbcf191f94d077 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Sat, 23 Apr 2022 11:42:26 +0200 +Subject: [PATCH] irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value +Git-commit: 50f0f26e7c8665763d0d7d3372dbcf191f94d077 +Patch-mainline: v5.19-rc1 +References: git-fixes + +The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO. + +Fixes: f48e699ddf70 ("irqchip/aspeed-i2c-ic: Add I2C IRQ controller for Aspeed") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20220423094227.33148-1-krzysztof.kozlowski@linaro.org +Acked-by: Takashi Iwai + +--- + drivers/irqchip/irq-aspeed-i2c-ic.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/irqchip/irq-aspeed-i2c-ic.c b/drivers/irqchip/irq-aspeed-i2c-ic.c +index a47db16ff960..9c9fc3e2967e 100644 +--- a/drivers/irqchip/irq-aspeed-i2c-ic.c ++++ b/drivers/irqchip/irq-aspeed-i2c-ic.c +@@ -77,8 +77,8 @@ static int __init aspeed_i2c_ic_of_init(struct device_node *node, + } + + i2c_ic->parent_irq = irq_of_parse_and_map(node, 0); +- if (i2c_ic->parent_irq < 0) { +- ret = i2c_ic->parent_irq; ++ if (!i2c_ic->parent_irq) { ++ ret = -EINVAL; + goto err_iounmap; + } + +-- +2.35.3 + diff --git a/patches.suse/irqchip-exiu-Fix-acknowledgment-of-edge-triggered-in.patch b/patches.suse/irqchip-exiu-Fix-acknowledgment-of-edge-triggered-in.patch new file mode 100644 index 0000000..d2111be --- /dev/null +++ b/patches.suse/irqchip-exiu-Fix-acknowledgment-of-edge-triggered-in.patch @@ -0,0 +1,109 @@ +From 4efc851c36e389f7ed432edac0149acc5f94b0c7 Mon Sep 17 00:00:00 2001 +From: Daniel Thompson +Date: Tue, 3 May 2022 14:45:41 +0100 +Subject: [PATCH] irqchip/exiu: Fix acknowledgment of edge triggered interrupts +Git-commit: 4efc851c36e389f7ed432edac0149acc5f94b0c7 +Patch-mainline: v5.19-rc1 +References: git-fixes + +Currently the EXIU uses the fasteoi interrupt flow that is configured by +it's parent (irq-gic-v3.c). With this flow the only chance to clear the +interrupt request happens during .irq_eoi() and (obviously) this happens +after the interrupt handler has run. EXIU requires edge triggered +interrupts to be acked prior to interrupt handling. Without this we +risk incorrect interrupt dismissal when a new interrupt is delivered +after the handler reads and acknowledges the peripheral but before the +irq_eoi() takes place. + +Fix this by clearing the interrupt request from .irq_ack() if we are +configured for edge triggered interrupts. This requires adopting the +fasteoi-ack flow instead of the fasteoi to ensure the ack gets called. + +These changes have been tested using the power button on a +Developerbox/SC2A11 combined with some hackery in gpio-keys so I can +play with the different trigger mode [and an mdelay(500) so I can +can check what happens on a double click in both modes]. + +Fixes: 706cffc1b912 ("irqchip/exiu: Add support for Socionext Synquacer EXIU controller") +Signed-off-by: Daniel Thompson +Reviewed-by: Ard Biesheuvel +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20220503134541.2566457-1-daniel.thompson@linaro.org +Acked-by: Takashi Iwai + +--- + arch/arm64/Kconfig.platforms | 1 + + drivers/irqchip/irq-sni-exiu.c | 25 ++++++++++++++++++++++--- + 2 files changed, 23 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms +index 30b123cde02c..aaeaf57c8222 100644 +--- a/arch/arm64/Kconfig.platforms ++++ b/arch/arm64/Kconfig.platforms +@@ -253,6 +253,7 @@ config ARCH_INTEL_SOCFPGA + + config ARCH_SYNQUACER + bool "Socionext SynQuacer SoC Family" ++ select IRQ_FASTEOI_HIERARCHY_HANDLERS + + config ARCH_TEGRA + bool "NVIDIA Tegra SoC Family" +diff --git a/drivers/irqchip/irq-sni-exiu.c b/drivers/irqchip/irq-sni-exiu.c +index abd011fcecf4..c7db617e1a2f 100644 +--- a/drivers/irqchip/irq-sni-exiu.c ++++ b/drivers/irqchip/irq-sni-exiu.c +@@ -37,11 +37,26 @@ struct exiu_irq_data { + u32 spi_base; + }; + +-static void exiu_irq_eoi(struct irq_data *d) ++static void exiu_irq_ack(struct irq_data *d) + { + struct exiu_irq_data *data = irq_data_get_irq_chip_data(d); + + writel(BIT(d->hwirq), data->base + EIREQCLR); ++} ++ ++static void exiu_irq_eoi(struct irq_data *d) ++{ ++ struct exiu_irq_data *data = irq_data_get_irq_chip_data(d); ++ ++ /* ++ * Level triggered interrupts are latched and must be cleared during ++ * EOI or the interrupt will be jammed on. Of course if a level ++ * triggered interrupt is still asserted then the write will not clear ++ * the interrupt. ++ */ ++ if (irqd_is_level_type(d)) ++ writel(BIT(d->hwirq), data->base + EIREQCLR); ++ + irq_chip_eoi_parent(d); + } + +@@ -91,10 +106,13 @@ static int exiu_irq_set_type(struct irq_data *d, unsigned int type) + writel_relaxed(val, data->base + EILVL); + + val = readl_relaxed(data->base + EIEDG); +- if (type == IRQ_TYPE_LEVEL_LOW || type == IRQ_TYPE_LEVEL_HIGH) ++ if (type == IRQ_TYPE_LEVEL_LOW || type == IRQ_TYPE_LEVEL_HIGH) { + val &= ~BIT(d->hwirq); +- else ++ irq_set_handler_locked(d, handle_fasteoi_irq); ++ } else { + val |= BIT(d->hwirq); ++ irq_set_handler_locked(d, handle_fasteoi_ack_irq); ++ } + writel_relaxed(val, data->base + EIEDG); + + writel_relaxed(BIT(d->hwirq), data->base + EIREQCLR); +@@ -104,6 +122,7 @@ static int exiu_irq_set_type(struct irq_data *d, unsigned int type) + + static struct irq_chip exiu_irq_chip = { + .name = "EXIU", ++ .irq_ack = exiu_irq_ack, + .irq_eoi = exiu_irq_eoi, + .irq_enable = exiu_irq_enable, + .irq_mask = exiu_irq_mask, +-- +2.35.3 + diff --git a/patches.suse/irqchip-irq-xtensa-mx-fix-initial-IRQ-affinity.patch b/patches.suse/irqchip-irq-xtensa-mx-fix-initial-IRQ-affinity.patch new file mode 100644 index 0000000..356d8f7 --- /dev/null +++ b/patches.suse/irqchip-irq-xtensa-mx-fix-initial-IRQ-affinity.patch @@ -0,0 +1,67 @@ +From a255ee29252066d621df5d6b420bf534c6ba5bc0 Mon Sep 17 00:00:00 2001 +From: Max Filippov +Date: Tue, 26 Apr 2022 09:01:18 -0700 +Subject: [PATCH] irqchip: irq-xtensa-mx: fix initial IRQ affinity +Git-commit: a255ee29252066d621df5d6b420bf534c6ba5bc0 +Patch-mainline: v5.19-rc1 +References: git-fixes + +When irq-xtensa-mx chip is used in non-SMP configuration its +irq_set_affinity callback is not called leaving IRQ affinity set empty. +As a result IRQ delivery does not work in that configuration. +Initialize IRQ affinity of the xtensa MX interrupt distributor to CPU 0 +for all external IRQ lines. + +Cc: stable@vger.kernel.org +Signed-off-by: Max Filippov +Acked-by: Takashi Iwai + +--- + drivers/irqchip/irq-xtensa-mx.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/irqchip/irq-xtensa-mx.c b/drivers/irqchip/irq-xtensa-mx.c +index 27933338f7b3..8c581c985aa7 100644 +--- a/drivers/irqchip/irq-xtensa-mx.c ++++ b/drivers/irqchip/irq-xtensa-mx.c +@@ -151,14 +151,25 @@ static struct irq_chip xtensa_mx_irq_chip = { + .irq_set_affinity = xtensa_mx_irq_set_affinity, + }; + ++static void __init xtensa_mx_init_common(struct irq_domain *root_domain) ++{ ++ unsigned int i; ++ ++ irq_set_default_host(root_domain); ++ secondary_init_irq(); ++ ++ /* Initialize default IRQ routing to CPU 0 */ ++ for (i = 0; i < XCHAL_NUM_EXTINTERRUPTS; ++i) ++ set_er(1, MIROUT(i)); ++} ++ + int __init xtensa_mx_init_legacy(struct device_node *interrupt_parent) + { + struct irq_domain *root_domain = + irq_domain_add_legacy(NULL, NR_IRQS - 1, 1, 0, + &xtensa_mx_irq_domain_ops, + &xtensa_mx_irq_chip); +- irq_set_default_host(root_domain); +- secondary_init_irq(); ++ xtensa_mx_init_common(root_domain); + return 0; + } + +@@ -168,8 +179,7 @@ static int __init xtensa_mx_init(struct device_node *np, + struct irq_domain *root_domain = + irq_domain_add_linear(np, NR_IRQS, &xtensa_mx_irq_domain_ops, + &xtensa_mx_irq_chip); +- irq_set_default_host(root_domain); +- secondary_init_irq(); ++ xtensa_mx_init_common(root_domain); + return 0; + } + IRQCHIP_DECLARE(xtensa_mx_irq_chip, "cdns,xtensa-mx", xtensa_mx_init); +-- +2.35.3 + diff --git a/patches.suse/iwlwifi-mvm-fix-assert-1F04-upon-reconfig.patch b/patches.suse/iwlwifi-mvm-fix-assert-1F04-upon-reconfig.patch new file mode 100644 index 0000000..9f5327f --- /dev/null +++ b/patches.suse/iwlwifi-mvm-fix-assert-1F04-upon-reconfig.patch @@ -0,0 +1,41 @@ +From 9d096e3d3061dbf4ee10e2b59fc2c06e05bdb997 Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Tue, 17 May 2022 12:05:09 +0300 +Subject: [PATCH] iwlwifi: mvm: fix assert 1F04 upon reconfig +Git-commit: 9d096e3d3061dbf4ee10e2b59fc2c06e05bdb997 +Patch-mainline: v5.19-rc1 +References: git-fixes + +When we reconfig we must not send the MAC_POWER command that relates to +a MAC that was not yet added to the firmware. + +Ignore those in the iterator. + +Cc: stable@vger.kernel.org +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20220517120044.ed2ffc8ce732.If786e19512d0da4334a6382ea6148703422c7d7b@changeid +Signed-off-by: Johannes Berg +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/intel/iwlwifi/mvm/power.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/power.c b/drivers/net/wireless/intel/iwlwifi/mvm/power.c +index b2ea2fca5376..b9bd81242b21 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/power.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/power.c +@@ -563,6 +563,9 @@ static void iwl_mvm_power_get_vifs_iterator(void *_data, u8 *mac, + struct iwl_power_vifs *power_iterator = _data; + bool active = mvmvif->phy_ctxt && mvmvif->phy_ctxt->id < NUM_PHY_CTX; + ++ if (!mvmvif->uploaded) ++ return; ++ + switch (ieee80211_vif_type_p2p(vif)) { + case NL80211_IFTYPE_P2P_DEVICE: + break; +-- +2.35.3 + diff --git a/patches.suse/mac80211-upgrade-passive-scan-to-active-scan-on-DFS-.patch b/patches.suse/mac80211-upgrade-passive-scan-to-active-scan-on-DFS-.patch new file mode 100644 index 0000000..4704982 --- /dev/null +++ b/patches.suse/mac80211-upgrade-passive-scan-to-active-scan-on-DFS-.patch @@ -0,0 +1,110 @@ +From b041b7b9de6e1d4362de855ab90f9d03ef323edd Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Wed, 20 Apr 2022 12:49:07 +0200 +Subject: [PATCH] mac80211: upgrade passive scan to active scan on DFS channels after beacon rx +Git-commit: b041b7b9de6e1d4362de855ab90f9d03ef323edd +Patch-mainline: v5.19-rc1 +References: git-fixes + +In client mode, we can't connect to hidden SSID APs or SSIDs not advertised +in beacons on DFS channels, since we're forced to passive scan. Fix this by +sending out a probe request immediately after the first beacon, if active +scan was requested by the user. + +Cc: stable@vger.kernel.org +Reported-by: Catrinel Catrinescu +Signed-off-by: Felix Fietkau +Link: https://lore.kernel.org/r/20220420104907.36275-1-nbd@nbd.name +Signed-off-by: Johannes Berg +Acked-by: Takashi Iwai + +--- + net/mac80211/ieee80211_i.h | 5 +++++ + net/mac80211/scan.c | 20 ++++++++++++++++++++ + 2 files changed, 25 insertions(+) + +diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h +index d4a7ba4a8202..e58aa6fa58f2 100644 +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -1148,6 +1148,9 @@ struct tpt_led_trigger { + * a scan complete for an aborted scan. + * @SCAN_HW_CANCELLED: Set for our scan work function when the scan is being + * cancelled. ++ * @SCAN_BEACON_WAIT: Set whenever we're passive scanning because of radar/no-IR ++ * and could send a probe request after receiving a beacon. ++ * @SCAN_BEACON_DONE: Beacon received, we can now send a probe request + */ + enum { + SCAN_SW_SCANNING, +@@ -1156,6 +1159,8 @@ enum { + SCAN_COMPLETED, + SCAN_ABORTED, + SCAN_HW_CANCELLED, ++ SCAN_BEACON_WAIT, ++ SCAN_BEACON_DONE, + }; + + /** +diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c +index 5e6b275afc9e..b698756887eb 100644 +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -281,6 +281,16 @@ void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb) + if (likely(!sdata1 && !sdata2)) + return; + ++ if (test_and_clear_bit(SCAN_BEACON_WAIT, &local->scanning)) { ++ /* ++ * we were passive scanning because of radar/no-IR, but ++ * the beacon/proberesp rx gives us an opportunity to upgrade ++ * to active scan ++ */ ++ set_bit(SCAN_BEACON_DONE, &local->scanning); ++ ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 0); ++ } ++ + if (ieee80211_is_probe_resp(mgmt->frame_control)) { + struct cfg80211_scan_request *scan_req; + struct cfg80211_sched_scan_request *sched_scan_req; +@@ -787,6 +797,8 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata, + IEEE80211_CHAN_RADAR)) || + !req->n_ssids) { + next_delay = IEEE80211_PASSIVE_CHANNEL_TIME; ++ if (req->n_ssids) ++ set_bit(SCAN_BEACON_WAIT, &local->scanning); + } else { + ieee80211_scan_state_send_probe(local, &next_delay); + next_delay = IEEE80211_CHANNEL_TIME; +@@ -998,6 +1010,8 @@ static void ieee80211_scan_state_set_channel(struct ieee80211_local *local, + !scan_req->n_ssids) { + *next_delay = IEEE80211_PASSIVE_CHANNEL_TIME; + local->next_scan_state = SCAN_DECISION; ++ if (scan_req->n_ssids) ++ set_bit(SCAN_BEACON_WAIT, &local->scanning); + return; + } + +@@ -1090,6 +1104,8 @@ void ieee80211_scan_work(struct work_struct *work) + goto out; + } + ++ clear_bit(SCAN_BEACON_WAIT, &local->scanning); ++ + /* + * as long as no delay is required advance immediately + * without scheduling a new work +@@ -1100,6 +1116,10 @@ void ieee80211_scan_work(struct work_struct *work) + goto out_complete; + } + ++ if (test_and_clear_bit(SCAN_BEACON_DONE, &local->scanning) && ++ local->next_scan_state == SCAN_DECISION) ++ local->next_scan_state = SCAN_SEND_PROBE; ++ + switch (local->next_scan_state) { + case SCAN_DECISION: + /* if no more bands/channels left, complete scan */ +-- +2.35.3 + diff --git a/patches.suse/media-cx25821-Fix-the-warning-when-removing-the-modu.patch b/patches.suse/media-cx25821-Fix-the-warning-when-removing-the-modu.patch new file mode 100644 index 0000000..ffde674 --- /dev/null +++ b/patches.suse/media-cx25821-Fix-the-warning-when-removing-the-modu.patch @@ -0,0 +1,57 @@ +From 2203436a4d24302871617373a7eb21bc17e38762 Mon Sep 17 00:00:00 2001 +From: Zheyu Ma +Date: Sun, 10 Apr 2022 08:44:09 +0100 +Subject: [PATCH] media: cx25821: Fix the warning when removing the module +Git-commit: 2203436a4d24302871617373a7eb21bc17e38762 +Patch-mainline: v5.19-rc1 +References: git-fixes + +When removing the module, we will get the following warning: + +[ 14.746697] remove_proc_entry: removing non-empty directory 'irq/21', leaking at least 'cx25821[1]' +[ 14.747449] WARNING: CPU: 4 PID: 368 at fs/proc/generic.c:717 remove_proc_entry+0x389/0x3f0 +[ 14.751611] RIP: 0010:remove_proc_entry+0x389/0x3f0 +[ 14.759589] Call Trace: +[ 14.759792] +[ 14.759975] unregister_irq_proc+0x14c/0x170 +[ 14.760340] irq_free_descs+0x94/0xe0 +[ 14.760640] mp_unmap_irq+0xb6/0x100 +[ 14.760937] acpi_unregister_gsi_ioapic+0x27/0x40 +[ 14.761334] acpi_pci_irq_disable+0x1d3/0x320 +[ 14.761688] pci_disable_device+0x1ad/0x380 +[ 14.762027] ? _raw_spin_unlock_irqrestore+0x2d/0x60 +[ 14.762442] ? cx25821_shutdown+0x20/0x9f0 [cx25821] +[ 14.762848] cx25821_finidev+0x48/0xc0 [cx25821] +[ 14.763242] pci_device_remove+0x92/0x240 + +Fix this by freeing the irq before call pci_disable_device(). + +Signed-off-by: Zheyu Ma +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/pci/cx25821/cx25821-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c +index 3078a39f0b95..6627fa9166d3 100644 +--- a/drivers/media/pci/cx25821/cx25821-core.c ++++ b/drivers/media/pci/cx25821/cx25821-core.c +@@ -1332,11 +1332,11 @@ static void cx25821_finidev(struct pci_dev *pci_dev) + struct cx25821_dev *dev = get_cx25821(v4l2_dev); + + cx25821_shutdown(dev); +- pci_disable_device(pci_dev); + + /* unregister stuff */ + if (pci_dev->irq) + free_irq(pci_dev->irq, dev); ++ pci_disable_device(pci_dev); + + cx25821_dev_unregister(dev); + v4l2_device_unregister(v4l2_dev); +-- +2.35.3 + diff --git a/patches.suse/media-pci-cx23885-Fix-the-error-handling-in-cx23885_.patch b/patches.suse/media-pci-cx23885-Fix-the-error-handling-in-cx23885_.patch new file mode 100644 index 0000000..fd879fe --- /dev/null +++ b/patches.suse/media-pci-cx23885-Fix-the-error-handling-in-cx23885_.patch @@ -0,0 +1,61 @@ +From e8123311cf06d7dae71e8c5fe78e0510d20cd30b Mon Sep 17 00:00:00 2001 +From: Zheyu Ma +Date: Sun, 10 Apr 2022 08:34:41 +0100 +Subject: [PATCH] media: pci: cx23885: Fix the error handling in cx23885_initdev() +Git-commit: e8123311cf06d7dae71e8c5fe78e0510d20cd30b +Patch-mainline: v5.19-rc1 +References: git-fixes + +When the driver fails to call the dma_set_mask(), the driver will get +the following splat: + +[ 55.853884] BUG: KASAN: use-after-free in __process_removed_driver+0x3c/0x240 +[ 55.854486] Read of size 8 at addr ffff88810de60408 by task modprobe/590 +[ 55.856822] Call Trace: +[ 55.860327] __process_removed_driver+0x3c/0x240 +[ 55.861347] bus_for_each_dev+0x102/0x160 +[ 55.861681] i2c_del_driver+0x2f/0x50 + +This is because the driver has initialized the i2c related resources +in cx23885_dev_setup() but not released them in error handling, fix this +bug by modifying the error path that jumps after failing to call the +dma_set_mask(). + +Signed-off-by: Zheyu Ma +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/pci/cx23885/cx23885-core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/media/pci/cx23885/cx23885-core.c ++++ b/drivers/media/pci/cx23885/cx23885-core.c +@@ -2154,7 +2154,7 @@ static int cx23885_initdev(struct pci_de + err = pci_set_dma_mask(pci_dev, 0xffffffff); + if (err) { + pr_err("%s/0: Oops: no 32bit PCI DMA ???\n", dev->name); +- goto fail_ctrl; ++ goto fail_dma_set_mask; + } + + err = request_irq(pci_dev->irq, cx23885_irq, +@@ -2162,7 +2162,7 @@ static int cx23885_initdev(struct pci_de + if (err < 0) { + pr_err("%s: can't get IRQ %d\n", + dev->name, pci_dev->irq); +- goto fail_irq; ++ goto fail_dma_set_mask; + } + + switch (dev->board) { +@@ -2184,7 +2184,7 @@ static int cx23885_initdev(struct pci_de + + return 0; + +-fail_irq: ++fail_dma_set_mask: + cx23885_dev_unregister(dev); + fail_ctrl: + v4l2_ctrl_handler_free(hdl); diff --git a/patches.suse/media-venus-hfi-avoid-null-dereference-in-deinit.patch b/patches.suse/media-venus-hfi-avoid-null-dereference-in-deinit.patch new file mode 100644 index 0000000..2bd1740 --- /dev/null +++ b/patches.suse/media-venus-hfi-avoid-null-dereference-in-deinit.patch @@ -0,0 +1,41 @@ +From 86594f6af867b5165d2ba7b5a71fae3a5961e56c Mon Sep 17 00:00:00 2001 +From: Luca Weiss +Date: Fri, 14 Jan 2022 11:02:26 +0000 +Subject: [PATCH] media: venus: hfi: avoid null dereference in deinit +Git-commit: 86594f6af867b5165d2ba7b5a71fae3a5961e56c +Patch-mainline: v5.19-rc1 +References: git-fixes + +If venus_probe fails at pm_runtime_put_sync the error handling first +calls hfi_destroy and afterwards hfi_core_deinit. As hfi_destroy sets +core->ops to NULL, hfi_core_deinit cannot call the core_deinit function +anymore. + +Avoid this null pointer derefence by skipping the call when necessary. + +Signed-off-by: Luca Weiss +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/platform/qcom/venus/hfi.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/platform/qcom/venus/hfi.c b/drivers/media/platform/qcom/venus/hfi.c +index 4e2151fb47f0..1968f09ad177 100644 +--- a/drivers/media/platform/qcom/venus/hfi.c ++++ b/drivers/media/platform/qcom/venus/hfi.c +@@ -104,6 +104,9 @@ int hfi_core_deinit(struct venus_core *core, bool blocking) + mutex_lock(&core->lock); + } + ++ if (!core->ops) ++ goto unlock; ++ + ret = core->ops->core_deinit(core); + + if (!ret) +-- +2.35.3 + diff --git a/patches.suse/misc-rtsx-set-NULL-intfdata-when-probe-fails.patch b/patches.suse/misc-rtsx-set-NULL-intfdata-when-probe-fails.patch new file mode 100644 index 0000000..8e4e2ee --- /dev/null +++ b/patches.suse/misc-rtsx-set-NULL-intfdata-when-probe-fails.patch @@ -0,0 +1,39 @@ +From f861d36e021e1ac4a0a2a1f6411d623809975d63 Mon Sep 17 00:00:00 2001 +From: Shuah Khan +Date: Fri, 29 Apr 2022 15:09:13 -0600 +Subject: [PATCH] misc: rtsx: set NULL intfdata when probe fails +Git-commit: f861d36e021e1ac4a0a2a1f6411d623809975d63 +Patch-mainline: v5.19-rc1 +References: git-fixes + +rtsx_usb_probe() doesn't call usb_set_intfdata() to null out the +interface pointer when probe fails. This leaves a stale pointer. +Noticed the missing usb_set_intfdata() while debugging an unrelated +invalid DMA mapping problem. + +Fix it with a call to usb_set_intfdata(..., NULL). + +Signed-off-by: Shuah Khan +Link: https://lore.kernel.org/r/20220429210913.46804-1-skhan@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/misc/cardreader/rtsx_usb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/misc/cardreader/rtsx_usb.c b/drivers/misc/cardreader/rtsx_usb.c +index 59eda55d92a3..1ef9b61077c4 100644 +--- a/drivers/misc/cardreader/rtsx_usb.c ++++ b/drivers/misc/cardreader/rtsx_usb.c +@@ -667,6 +667,7 @@ static int rtsx_usb_probe(struct usb_interface *intf, + return 0; + + out_init_fail: ++ usb_set_intfdata(ucr->pusb_intf, NULL); + usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf, + ucr->iobuf_dma); + return ret; +-- +2.35.3 + diff --git a/patches.suse/mmc-block-Fix-CQE-recovery-reset-success.patch b/patches.suse/mmc-block-Fix-CQE-recovery-reset-success.patch new file mode 100644 index 0000000..791c200 --- /dev/null +++ b/patches.suse/mmc-block-Fix-CQE-recovery-reset-success.patch @@ -0,0 +1,46 @@ +From a051246b786af7e4a9d9219cc7038a6e8a411531 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Tue, 31 May 2022 20:19:22 +0300 +Subject: [PATCH] mmc: block: Fix CQE recovery reset success +Git-commit: a051246b786af7e4a9d9219cc7038a6e8a411531 +Patch-mainline: v5.19-rc2 +References: git-fixes + +The intention of the use of mmc_blk_reset_success() in +mmc_blk_cqe_recovery() was to prevent repeated resets when retrying and +getting the same error. However, that may not be the case - any amount +of time and I/O may pass before another recovery is needed, in which +case there would be no reason to deny it the opportunity to recover via +a reset if necessary. CQE recovery is expected seldom and failure to +recover (if the clear tasks command fails), even more seldom, so it is +better to allow the reset always, which can be done by calling +mmc_blk_reset_success() always. + +Fixes: 1e8e55b67030c6 ("mmc: block: Add CQE support") +Cc: stable@vger.kernel.org +Signed-off-by: Adrian Hunter +Link: https://lore.kernel.org/r/20220531171922.76080-1-adrian.hunter@intel.com +Signed-off-by: Ulf Hansson +Acked-by: Takashi Iwai + +--- + drivers/mmc/core/block.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index 1259ca22d625..f4a1281658db 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -1499,8 +1499,7 @@ void mmc_blk_cqe_recovery(struct mmc_queue *mq) + err = mmc_cqe_recovery(host); + if (err) + mmc_blk_reset(mq->blkdata, host, MMC_BLK_CQE_RECOVERY); +- else +- mmc_blk_reset_success(mq->blkdata, MMC_BLK_CQE_RECOVERY); ++ mmc_blk_reset_success(mq->blkdata, MMC_BLK_CQE_RECOVERY); + + pr_debug("%s: CQE recovery done\n", mmc_hostname(host)); + } +-- +2.35.3 + diff --git a/patches.suse/mmc-jz4740-Apply-DMA-engine-limits-to-maximum-segmen.patch b/patches.suse/mmc-jz4740-Apply-DMA-engine-limits-to-maximum-segmen.patch new file mode 100644 index 0000000..7fb51ee --- /dev/null +++ b/patches.suse/mmc-jz4740-Apply-DMA-engine-limits-to-maximum-segmen.patch @@ -0,0 +1,89 @@ +From afadb04f1d6e74b18a253403f5274cde5e3fd7bd Mon Sep 17 00:00:00 2001 +From: Aidan MacDonald +Date: Mon, 11 Apr 2022 16:37:53 +0100 +Subject: [PATCH] mmc: jz4740: Apply DMA engine limits to maximum segment size +Git-commit: afadb04f1d6e74b18a253403f5274cde5e3fd7bd +Patch-mainline: v5.19-rc1 +References: git-fixes + +Do what is done in other DMA-enabled MMC host drivers (cf. host/mmci.c) and +limit the maximum segment size based on the DMA engine's capabilities. This +is needed to avoid warnings like the following with CONFIG_DMA_API_DEBUG=y. + +Acked-by: Takashi Iwai + +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 21 at kernel/dma/debug.c:1162 debug_dma_map_sg+0x2f4/0x39c +DMA-API: jz4780-dma 13420000.dma-controller: mapping sg segment longer than device claims to support [len=98304] [max=65536] +CPU: 0 PID: 21 Comm: kworker/0:1H Not tainted 5.18.0-rc1 #19 +Workqueue: kblockd blk_mq_run_work_fn +Stack : 81575aec 00000004 80620000 80620000 80620000 805e7358 00000009 801537ac + 814c832c 806276e3 806e34b4 80620000 81575aec 00000001 81575ab8 09291444 + 00000000 00000000 805e7358 81575958 ffffffea 8157596c 00000000 636f6c62 + 6220646b 80387a70 0000000f 6d5f6b6c 80620000 00000000 81575ba4 00000009 + 805e170c 80896640 00000001 00010000 00000000 00000000 00006098 806e0000 + ... +Call Trace: +[<80107670>] show_stack+0x84/0x120 +[<80528cd8>] __warn+0xb8/0xec +[<80528d78>] warn_slowpath_fmt+0x6c/0xb8 +[<8016f1d4>] debug_dma_map_sg+0x2f4/0x39c +[<80169d4c>] __dma_map_sg_attrs+0xf0/0x118 +[<8016a27c>] dma_map_sg_attrs+0x14/0x28 +[<804f66b4>] jz4740_mmc_prepare_dma_data+0x74/0xa4 +[<804f6714>] jz4740_mmc_pre_request+0x30/0x54 +[<804f4ff4>] mmc_blk_mq_issue_rq+0x6e0/0x7bc +[<804f5590>] mmc_mq_queue_rq+0x220/0x2d4 +[<8038b2c0>] blk_mq_dispatch_rq_list+0x480/0x664 +[<80391040>] blk_mq_do_dispatch_sched+0x2dc/0x370 +[<80391468>] __blk_mq_sched_dispatch_requests+0xec/0x164 +[<80391540>] blk_mq_sched_dispatch_requests+0x44/0x94 +[<80387900>] __blk_mq_run_hw_queue+0xb0/0xcc +[<80134c14>] process_one_work+0x1b8/0x264 +[<80134ff8>] worker_thread+0x2ec/0x3b8 +[<8013b13c>] kthread+0x104/0x10c +[<80101dcc>] ret_from_kernel_thread+0x14/0x1c + +---[ end trace 0000000000000000 ]--- + +Signed-off-by: Aidan MacDonald +Link: https://lore.kernel.org/r/20220411153753.50443-1-aidanmacdonald.0x0@gmail.com +Signed-off-by: Ulf Hansson +--- + drivers/mmc/host/jz4740_mmc.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/mmc/host/jz4740_mmc.c b/drivers/mmc/host/jz4740_mmc.c +index 7ab1b38a7be5..b1d563b2ed1b 100644 +--- a/drivers/mmc/host/jz4740_mmc.c ++++ b/drivers/mmc/host/jz4740_mmc.c +@@ -247,6 +247,26 @@ static int jz4740_mmc_acquire_dma_channels(struct jz4740_mmc_host *host) + return PTR_ERR(host->dma_rx); + } + ++ /* ++ * Limit the maximum segment size in any SG entry according to ++ * the parameters of the DMA engine device. ++ */ ++ if (host->dma_tx) { ++ struct device *dev = host->dma_tx->device->dev; ++ unsigned int max_seg_size = dma_get_max_seg_size(dev); ++ ++ if (max_seg_size < host->mmc->max_seg_size) ++ host->mmc->max_seg_size = max_seg_size; ++ } ++ ++ if (host->dma_rx) { ++ struct device *dev = host->dma_rx->device->dev; ++ unsigned int max_seg_size = dma_get_max_seg_size(dev); ++ ++ if (max_seg_size < host->mmc->max_seg_size) ++ host->mmc->max_seg_size = max_seg_size; ++ } ++ + return 0; + } + +-- +2.35.3 + diff --git a/patches.suse/modpost-fix-removing-numeric-suffixes.patch b/patches.suse/modpost-fix-removing-numeric-suffixes.patch new file mode 100644 index 0000000..4d7d18c --- /dev/null +++ b/patches.suse/modpost-fix-removing-numeric-suffixes.patch @@ -0,0 +1,53 @@ +From b5beffa20d83c4e15306c991ffd00de0d8628338 Mon Sep 17 00:00:00 2001 +From: Alexander Lobakin +Date: Tue, 24 May 2022 17:27:18 +0200 +Subject: [PATCH] modpost: fix removing numeric suffixes +Git-commit: b5beffa20d83c4e15306c991ffd00de0d8628338 +Patch-mainline: v5.19-rc1 +References: git-fixes + +With the `-z unique-symbol` linker flag or any similar mechanism, +it is possible to trigger the following: + +Error: modpost: "param_set_uint.0" [vmlinux] is a static EXPORT_SYMBOL + +The reason is that for now the condition from remove_dot(): + +if (m && (s[n + m] == '.' || s[n + m] == 0)) + +which was designed to test if it's a dot or a '\0' after the suffix +is never satisfied. +This is due to that `s[n + m]` always points to the last digit of a +numeric suffix, not on the symbol next to it (from a custom debug +print added to modpost): + +param_set_uint.0, s[n + m] is '0', s[n + m + 1] is '\0' + +So it's off-by-one and was like that since 2014. + +Fix this for the sake of any potential upcoming features, but don't +bother stable-backporting, as it's well hidden -- apart from that +LD flag, it can be triggered only with GCC LTO which never landed +upstream. + +Fixes: fcd38ed0ff26 ("scripts: modpost: fix compilation warning") +Signed-off-by: Alexander Lobakin +Reviewed-by: Petr Mladek +Signed-off-by: Masahiro Yamada +Acked-by: Takashi Iwai + +--- + scripts/mod/modpost.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1997,7 +1997,7 @@ static char *remove_dot(char *s) + + if (n && s[n]) { + size_t m = strspn(s + n + 1, "0123456789"); +- if (m && (s[n + m] == '.' || s[n + m] == 0)) ++ if (m && (s[n + m + 1] == '.' || s[n + m + 1] == 0)) + s[n] = 0; + } + return s; diff --git a/patches.suse/modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch b/patches.suse/modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch new file mode 100644 index 0000000..f353b96 --- /dev/null +++ b/patches.suse/modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch @@ -0,0 +1,64 @@ +From d6b732666a1bae0df3c3ae06925043bba34502b1 Mon Sep 17 00:00:00 2001 +From: Masahiro Yamada +Date: Tue, 24 May 2022 01:46:22 +0900 +Subject: [PATCH] modpost: fix undefined behavior of is_arm_mapping_symbol() +Git-commit: d6b732666a1bae0df3c3ae06925043bba34502b1 +Patch-mainline: v5.19-rc1 +References: git-fixes + +The return value of is_arm_mapping_symbol() is unpredictable when "$" +is passed in. + +strchr(3) says: + The strchr() and strrchr() functions return a pointer to the matched + character or NULL if the character is not found. The terminating null + byte is considered part of the string, so that if c is specified as + '\0', these functions return a pointer to the terminator. + +When str[1] is '\0', strchr("axtd", str[1]) is not NULL, and str[2] is +referenced (i.e. buffer overrun). + +Test code + +Acked-by: Takashi Iwai + +--------- + + char str1[] = "abc"; + char str2[] = "ab"; + + strcpy(str1, "$"); + strcpy(str2, "$"); + + printf("test1: %d\n", is_arm_mapping_symbol(str1)); + printf("test2: %d\n", is_arm_mapping_symbol(str2)); + +Result +------ + + test1: 0 + test2: 1 + +Signed-off-by: Masahiro Yamada +Reviewed-by: Nick Desaulniers +--- + scripts/mod/modpost.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 08f6989437bd..1092906867f0 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1180,7 +1180,8 @@ static int secref_whitelist(const struct sectioncheck *mismatch, + + static inline int is_arm_mapping_symbol(const char *str) + { +- return str[0] == '$' && strchr("axtd", str[1]) ++ return str[0] == '$' && ++ (str[1] == 'a' || str[1] == 'd' || str[1] == 't' || str[1] == 'x') + && (str[2] == '\0' || str[2] == '.'); + } + +-- +2.35.3 + diff --git a/patches.suse/mwifiex-add-mutex-lock-for-call-in-mwifiex_dfs_chan_.patch b/patches.suse/mwifiex-add-mutex-lock-for-call-in-mwifiex_dfs_chan_.patch new file mode 100644 index 0000000..8f5d16d --- /dev/null +++ b/patches.suse/mwifiex-add-mutex-lock-for-call-in-mwifiex_dfs_chan_.patch @@ -0,0 +1,49 @@ +From 3e12968f6d12a34b540c39cbd696a760cc4616f0 Mon Sep 17 00:00:00 2001 +From: Niels Dossche +Date: Mon, 21 Mar 2022 23:55:16 +0100 +Subject: [PATCH] mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue +Git-commit: 3e12968f6d12a34b540c39cbd696a760cc4616f0 +Patch-mainline: v5.19-rc1 +References: git-fixes + +cfg80211_ch_switch_notify uses ASSERT_WDEV_LOCK to assert that +net_device->ieee80211_ptr->mtx (which is the same as priv->wdev.mtx) +is held during the function's execution. +mwifiex_dfs_chan_sw_work_queue is one of its callers, which does not +hold that lock, therefore violating the assertion. +Add a lock around the call. + +Disclaimer: +I am currently working on a static analyser to detect missing locks. +This was a reported case. I manually verified the report by looking +at the code, so that I do not send wrong information or patches. +After concluding that this seems to be a true positive, I created +this patch. +However, as I do not in fact have this particular hardware, +I was unable to test it. + +Reviewed-by: Brian Norris +Signed-off-by: Niels Dossche +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220321225515.32113-1-dossche.niels@gmail.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/marvell/mwifiex/11h.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/marvell/mwifiex/11h.c b/drivers/net/wireless/marvell/mwifiex/11h.c +index d2ee6469e67b..3fa25cd64cda 100644 +--- a/drivers/net/wireless/marvell/mwifiex/11h.c ++++ b/drivers/net/wireless/marvell/mwifiex/11h.c +@@ -303,5 +303,7 @@ void mwifiex_dfs_chan_sw_work_queue(struct work_struct *work) + + mwifiex_dbg(priv->adapter, MSG, + "indicating channel switch completion to kernel\n"); ++ mutex_lock(&priv->wdev.mtx); + cfg80211_ch_switch_notify(priv->netdev, &priv->dfs_chandef); ++ mutex_unlock(&priv->wdev.mtx); + } +-- +2.35.3 + diff --git a/patches.suse/nfc-st21nfca-fix-incorrect-sizing-calculations-in-EV.patch b/patches.suse/nfc-st21nfca-fix-incorrect-sizing-calculations-in-EV.patch new file mode 100644 index 0000000..8cd2d18 --- /dev/null +++ b/patches.suse/nfc-st21nfca-fix-incorrect-sizing-calculations-in-EV.patch @@ -0,0 +1,132 @@ +From f2e19b36593caed4c977c2f55aeba7408aeb2132 Mon Sep 17 00:00:00 2001 +From: Martin Faltesek +Date: Mon, 6 Jun 2022 21:57:29 -0500 +Subject: [PATCH] nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION +Git-commit: f2e19b36593caed4c977c2f55aeba7408aeb2132 +Patch-mainline: v5.19-rc2 +References: git-fixes + +The transaction buffer is allocated by using the size of the packet buf, +and subtracting two which seem intended to remove the two tags which are +not present in the target structure. This calculation leads to under +counting memory because of differences between the packet contents and the +target structure. The aid_len field is a u8 in the packet, but a u32 in +the structure, resulting in at least 3 bytes always being under counted. +Further, the aid data is a variable length field in the packet, but fixed +in the structure, so if this field is less than the max, the difference is +added to the under counting. + +The last validation check for transaction->params_len is also incorrect +since it employs the same accounting error. + +To fix, perform validation checks progressively to safely reach the +next field, to determine the size of both buffers and verify both tags. +Once all validation checks pass, allocate the buffer and copy the data. +This eliminates freeing memory on the error path, as those checks are +moved ahead of memory allocation. + +Fixes: 26fc6c7f02cb ("NFC: st21nfca: Add HCI transaction event support") +Fixes: 4fbcc1a4cb20 ("nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION") +Cc: stable@vger.kernel.org +Signed-off-by: Martin Faltesek +Reviewed-by: Guenter Roeck +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Jakub Kicinski +Acked-by: Takashi Iwai + +--- + drivers/nfc/st21nfca/se.c | 63 ++++++++++++++++++++++------------------------ + 1 file changed, 31 insertions(+), 32 deletions(-) + +--- a/drivers/nfc/st21nfca/se.c ++++ b/drivers/nfc/st21nfca/se.c +@@ -304,6 +304,8 @@ int st21nfca_connectivity_event_received + int r = 0; + struct device *dev = &hdev->ndev->dev; + struct nfc_evt_transaction *transaction; ++ u32 aid_len; ++ u8 params_len; + + pr_debug("connectivity gate event: %x\n", event); + +@@ -312,51 +314,48 @@ int st21nfca_connectivity_event_received + r = nfc_se_connectivity(hdev->ndev, host); + break; + case ST21NFCA_EVT_TRANSACTION: +- /* +- * According to specification etsi 102 622 ++ /* According to specification etsi 102 622 + * 11.2.2.4 EVT_TRANSACTION Table 52 + * Description Tag Length + * AID 81 5 to 16 + * PARAMETERS 82 0 to 255 ++ * ++ * The key differences are aid storage length is variably sized ++ * in the packet, but fixed in nfc_evt_transaction, and that the aid_len ++ * is u8 in the packet, but u32 in the structure, and the tags in ++ * the packet are not included in nfc_evt_transaction. ++ * ++ * size in bytes: 1 1 5-16 1 1 0-255 ++ * offset: 0 1 2 aid_len + 2 aid_len + 3 aid_len + 4 ++ * member name: aid_tag(M) aid_len aid params_tag(M) params_len params ++ * example: 0x81 5-16 X 0x82 0-255 X + */ +- if (skb->len < NFC_MIN_AID_LENGTH + 2 || +- skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG) ++ if (skb->len < 2 || skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG) + return -EPROTO; + +- transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev, +- skb->len - 2, GFP_KERNEL); +- if (!transaction) +- return -ENOMEM; ++ aid_len = skb->data[1]; ++ ++ if (skb->len < aid_len + 4 || aid_len > sizeof(transaction->aid)) ++ return -EPROTO; + +- transaction->aid_len = skb->data[1]; ++ params_len = skb->data[aid_len + 3]; + +- /* Checking if the length of the AID is valid */ +- if (transaction->aid_len > sizeof(transaction->aid)) { +- devm_kfree(dev, transaction); +- return -EINVAL; +- } +- +- memcpy(transaction->aid, &skb->data[2], +- transaction->aid_len); +- +- /* Check next byte is PARAMETERS tag (82) */ +- if (skb->data[transaction->aid_len + 2] != +- NFC_EVT_TRANSACTION_PARAMS_TAG) { +- devm_kfree(dev, transaction); ++ /* Verify PARAMETERS tag is (82), and final check that there is enough ++ * space in the packet to read everything. ++ */ ++ if ((skb->data[aid_len + 2] != NFC_EVT_TRANSACTION_PARAMS_TAG) || ++ (skb->len < aid_len + 4 + params_len)) + return -EPROTO; +- } + +- transaction->params_len = skb->data[transaction->aid_len + 3]; ++ transaction = devm_kzalloc(dev, sizeof(*transaction) + params_len, GFP_KERNEL); ++ if (!transaction) ++ return -ENOMEM; + +- /* Total size is allocated (skb->len - 2) minus fixed array members */ +- if (transaction->params_len > ((skb->len - 2) - +- sizeof(struct nfc_evt_transaction))) { +- devm_kfree(dev, transaction); +- return -EINVAL; +- } ++ transaction->aid_len = aid_len; ++ transaction->params_len = params_len; + +- memcpy(transaction->params, skb->data + +- transaction->aid_len + 4, transaction->params_len); ++ memcpy(transaction->aid, &skb->data[2], aid_len); ++ memcpy(transaction->params, &skb->data[aid_len + 4], params_len); + + r = nfc_se_transaction(hdev->ndev, host, transaction); + break; diff --git a/patches.suse/nfc-st21nfca-fix-incorrect-validating-logic-in-EVT_T.patch b/patches.suse/nfc-st21nfca-fix-incorrect-validating-logic-in-EVT_T.patch new file mode 100644 index 0000000..5003b60 --- /dev/null +++ b/patches.suse/nfc-st21nfca-fix-incorrect-validating-logic-in-EVT_T.patch @@ -0,0 +1,41 @@ +From 77e5fe8f176a525523ae091d6fd0fbb8834c156d Mon Sep 17 00:00:00 2001 +From: Martin Faltesek +Date: Mon, 6 Jun 2022 21:57:27 -0500 +Subject: [PATCH] nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION +Git-commit: 77e5fe8f176a525523ae091d6fd0fbb8834c156d +Patch-mainline: v5.19-rc2 +References: git-fixes + +The first validation check for EVT_TRANSACTION has two different checks +tied together with logical AND. One is a check for minimum packet length, +and the other is for a valid aid_tag. If either condition is true (fails), +then an error should be triggered. The fix is to change && to ||. + +Fixes: 26fc6c7f02cb ("NFC: st21nfca: Add HCI transaction event support") +Cc: stable@vger.kernel.org +Signed-off-by: Martin Faltesek +Reviewed-by: Guenter Roeck +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Jakub Kicinski +Acked-by: Takashi Iwai + +--- + drivers/nfc/st21nfca/se.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c +index 7e213f8ddc98..9645777f2544 100644 +--- a/drivers/nfc/st21nfca/se.c ++++ b/drivers/nfc/st21nfca/se.c +@@ -315,7 +315,7 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, + * AID 81 5 to 16 + * PARAMETERS 82 0 to 255 + */ +- if (skb->len < NFC_MIN_AID_LENGTH + 2 && ++ if (skb->len < NFC_MIN_AID_LENGTH + 2 || + skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG) + return -EPROTO; + +-- +2.35.3 + diff --git a/patches.suse/nfc-st21nfca-fix-memory-leaks-in-EVT_TRANSACTION-han.patch b/patches.suse/nfc-st21nfca-fix-memory-leaks-in-EVT_TRANSACTION-han.patch new file mode 100644 index 0000000..84780a0 --- /dev/null +++ b/patches.suse/nfc-st21nfca-fix-memory-leaks-in-EVT_TRANSACTION-han.patch @@ -0,0 +1,64 @@ +From 996419e0594abb311fb958553809f24f38e7abbe Mon Sep 17 00:00:00 2001 +From: Martin Faltesek +Date: Mon, 6 Jun 2022 21:57:28 -0500 +Subject: [PATCH] nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling +Git-commit: 996419e0594abb311fb958553809f24f38e7abbe +Patch-mainline: v5.19-rc2 +References: git-fixes + +Error paths do not free previously allocated memory. Add devm_kfree() to +those failure paths. + +Fixes: 26fc6c7f02cb ("NFC: st21nfca: Add HCI transaction event support") +Fixes: 4fbcc1a4cb20 ("nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION") +Cc: stable@vger.kernel.org +Signed-off-by: Martin Faltesek +Reviewed-by: Guenter Roeck +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Jakub Kicinski +Acked-by: Takashi Iwai + +--- + drivers/nfc/st21nfca/se.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c +index 9645777f2544..8e1113ce139b 100644 +--- a/drivers/nfc/st21nfca/se.c ++++ b/drivers/nfc/st21nfca/se.c +@@ -326,22 +326,29 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, + transaction->aid_len = skb->data[1]; + + /* Checking if the length of the AID is valid */ +- if (transaction->aid_len > sizeof(transaction->aid)) ++ if (transaction->aid_len > sizeof(transaction->aid)) { ++ devm_kfree(dev, transaction); + return -EINVAL; ++ } + + memcpy(transaction->aid, &skb->data[2], + transaction->aid_len); + + /* Check next byte is PARAMETERS tag (82) */ + if (skb->data[transaction->aid_len + 2] != +- NFC_EVT_TRANSACTION_PARAMS_TAG) ++ NFC_EVT_TRANSACTION_PARAMS_TAG) { ++ devm_kfree(dev, transaction); + return -EPROTO; ++ } + + transaction->params_len = skb->data[transaction->aid_len + 3]; + + /* Total size is allocated (skb->len - 2) minus fixed array members */ +- if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction))) ++ if (transaction->params_len > ((skb->len - 2) - ++ sizeof(struct nfc_evt_transaction))) { ++ devm_kfree(dev, transaction); + return -EINVAL; ++ } + + memcpy(transaction->params, skb->data + + transaction->aid_len + 4, transaction->params_len); +-- +2.35.3 + diff --git a/patches.suse/pcmcia-db1xxx_ss-restrict-to-MIPS_DB1XXX-boards.patch b/patches.suse/pcmcia-db1xxx_ss-restrict-to-MIPS_DB1XXX-boards.patch new file mode 100644 index 0000000..89c016f --- /dev/null +++ b/patches.suse/pcmcia-db1xxx_ss-restrict-to-MIPS_DB1XXX-boards.patch @@ -0,0 +1,48 @@ +From 3928cf08334ed895a31458cbebd8d4ec6d84c080 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Sun, 23 Jan 2022 09:40:31 -0800 +Subject: [PATCH] pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards +Git-commit: 3928cf08334ed895a31458cbebd8d4ec6d84c080 +Patch-mainline: v5.19-rc1 +References: git-fixes + +When the MIPS_ALCHEMY board selection is MIPS_XXS1500 instead of +MIPS_DB1XXX, the PCMCIA driver 'db1xxx_ss' has build errors due +to missing DB1XXX symbols. The PCMCIA driver should be restricted +to MIPS_DB1XXX instead of MIPS_ALCHEMY to fix this build error. + +Error: modpost: "bcsr_read" [drivers/pcmcia/db1xxx_ss.ko] undefined! +Error: modpost: "bcsr_mod" [drivers/pcmcia/db1xxx_ss.ko] undefined! + +Fixes: 42a4f17dc356 ("MIPS: Alchemy: remove SOC_AU1X00 in favor of MIPS_ALCHEMY") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Arnd Bergmann +Cc: Daniel Vetter +Cc: Kees Cook +Cc: Thomas Bogendoerfer +Cc: linux-mips@vger.kernel.org +Acked-by: Manuel Lauss +Signed-off-by: Dominik Brodowski +Acked-by: Takashi Iwai + +--- + drivers/pcmcia/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig +index ab53eab635f6..1740a63b814d 100644 +--- a/drivers/pcmcia/Kconfig ++++ b/drivers/pcmcia/Kconfig +@@ -151,7 +151,7 @@ config TCIC + + config PCMCIA_ALCHEMY_DEVBOARD + tristate "Alchemy Db/Pb1xxx PCMCIA socket services" +- depends on MIPS_ALCHEMY && PCMCIA ++ depends on MIPS_DB1XXX && PCMCIA + help + Enable this driver of you want PCMCIA support on your Alchemy + Db1000, Db/Pb1100, Db/Pb1500, Db/Pb1550, Db/Pb1200, DB1300 +-- +2.35.3 + diff --git a/patches.suse/pinctrl-sunxi-fix-f1c100s-uart2-function.patch b/patches.suse/pinctrl-sunxi-fix-f1c100s-uart2-function.patch new file mode 100644 index 0000000..0814096 --- /dev/null +++ b/patches.suse/pinctrl-sunxi-fix-f1c100s-uart2-function.patch @@ -0,0 +1,45 @@ +From fa8785e5931367e2b43f2c507f26bcf3e281c0ca Mon Sep 17 00:00:00 2001 +From: IotaHydrae +Date: Wed, 4 May 2022 19:59:04 +0800 +Subject: [PATCH] pinctrl: sunxi: fix f1c100s uart2 function +Git-commit: fa8785e5931367e2b43f2c507f26bcf3e281c0ca +Patch-mainline: v5.18 +References: git-fixes + +Change suniv f1c100s pinctrl,PD14 multiplexing function lvds1 to uart2 + +When the pin PD13 and PD14 is setting up to uart2 function in dts, +there's an error occurred: +1c20800.pinctrl: unsupported function uart2 on pin PD14 + +Because 'uart2' is not any one multiplexing option of PD14, +and pinctrl don't know how to configure it. + +So change the pin PD14 lvds1 function to uart2. + +Signed-off-by: IotaHydrae +Reviewed-by: Andre Przywara +Link: https://lore.kernel.org/r/tencent_70C1308DDA794C81CAEF389049055BACEC09@qq.com +Signed-off-by: Linus Walleij +Acked-by: Takashi Iwai + +--- + drivers/pinctrl/sunxi/pinctrl-suniv-f1c100s.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/sunxi/pinctrl-suniv-f1c100s.c b/drivers/pinctrl/sunxi/pinctrl-suniv-f1c100s.c +index 2801ca706273..68a5b627fb9b 100644 +--- a/drivers/pinctrl/sunxi/pinctrl-suniv-f1c100s.c ++++ b/drivers/pinctrl/sunxi/pinctrl-suniv-f1c100s.c +@@ -204,7 +204,7 @@ static const struct sunxi_desc_pin suniv_f1c100s_pins[] = { + SUNXI_FUNCTION(0x0, "gpio_in"), + SUNXI_FUNCTION(0x1, "gpio_out"), + SUNXI_FUNCTION(0x2, "lcd"), /* D20 */ +- SUNXI_FUNCTION(0x3, "lvds1"), /* RX */ ++ SUNXI_FUNCTION(0x3, "uart2"), /* RX */ + SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 14)), + SUNXI_PIN(SUNXI_PINCTRL_PIN(D, 15), + SUNXI_FUNCTION(0x0, "gpio_in"), +-- +2.35.3 + diff --git a/patches.suse/platform-chrome-cros_ec_proto-Send-command-again-whe.patch b/patches.suse/platform-chrome-cros_ec_proto-Send-command-again-whe.patch new file mode 100644 index 0000000..15345a4 --- /dev/null +++ b/patches.suse/platform-chrome-cros_ec_proto-Send-command-again-whe.patch @@ -0,0 +1,46 @@ +From 3abc16af57c9939724df92fcbda296b25cc95168 Mon Sep 17 00:00:00 2001 +From: Patryk Duda +Date: Tue, 18 May 2021 16:07:58 +0200 +Subject: [PATCH] platform/chrome: cros_ec_proto: Send command again when timeout occurs +Git-commit: 3abc16af57c9939724df92fcbda296b25cc95168 +Patch-mainline: v5.15-rc1 +References: git-fixes + +Sometimes kernel is trying to probe Fingerprint MCU (FPMCU) when it +hasn't initialized SPI yet. This can happen because FPMCU is restarted +during system boot and kernel can send message in short window +eg. between sysjump to RW and SPI initialization. + +Cc: # 4.4+ +Signed-off-by: Patryk Duda +Link: https://lore.kernel.org/r/20210518140758.29318-1-pdk@semihalf.com +Signed-off-by: Benson Leung +Acked-by: Takashi Iwai + +--- + drivers/platform/chrome/cros_ec_proto.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c +index aa7f7aa77297..a7404d69b2d3 100644 +--- a/drivers/platform/chrome/cros_ec_proto.c ++++ b/drivers/platform/chrome/cros_ec_proto.c +@@ -279,6 +279,15 @@ static int cros_ec_host_command_proto_query(struct cros_ec_device *ec_dev, + msg->insize = sizeof(struct ec_response_get_protocol_info); + + ret = send_command(ec_dev, msg); ++ /* ++ * Send command once again when timeout occurred. ++ * Fingerprint MCU (FPMCU) is restarted during system boot which ++ * introduces small window in which FPMCU won't respond for any ++ * messages sent by kernel. There is no need to wait before next ++ * attempt because we waited at least EC_MSG_DEADLINE_MS. ++ */ ++ if (ret == -ETIMEDOUT) ++ ret = send_command(ec_dev, msg); + + if (ret < 0) { + dev_dbg(ec_dev->dev, +-- +2.35.3 + diff --git a/patches.suse/rtl818x-Prevent-using-not-initialized-queues.patch b/patches.suse/rtl818x-Prevent-using-not-initialized-queues.patch new file mode 100644 index 0000000..3b30e2f --- /dev/null +++ b/patches.suse/rtl818x-Prevent-using-not-initialized-queues.patch @@ -0,0 +1,69 @@ +From 746285cf81dc19502ab238249d75f5990bd2d231 Mon Sep 17 00:00:00 2001 +From: Alexander Wetzel +Date: Fri, 22 Apr 2022 16:52:28 +0200 +Subject: [PATCH] rtl818x: Prevent using not initialized queues +Git-commit: 746285cf81dc19502ab238249d75f5990bd2d231 +Patch-mainline: v5.19-rc1 +References: git-fixes + +Using not existing queues can panic the kernel with rtl8180/rtl8185 cards. +Ignore the skb priority for those cards, they only have one tx queue. Pierre +Asselin (pa@panix.com) reported the kernel crash in the Gentoo forum: + +https://forums.gentoo.org/viewtopic-t-1147832-postdays-0-postorder-asc-start-25.html + +He also confirmed that this patch fixes the issue. In summary this happened: + +After updating wpa_supplicant from 2.9 to 2.10 the kernel crashed with a +"divide error: 0000" when connecting to an AP. Control port tx now tries to +use IEEE80211_AC_VO for the priority, which wpa_supplicants starts to use in +2.10. + +Since only the rtl8187se part of the driver supports QoS, the priority +of the skb is set to IEEE80211_AC_BE (2) by mac80211 for rtl8180/rtl8185 +cards. + +rtl8180 is then unconditionally reading out the priority and finally crashes on +drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c line 544 without this +Patch: idx = (ring->idx + skb_queue_len(&ring->queue)) % ring->entries + +"ring->entries" is zero for rtl8180/rtl8185 cards, tx_ring[2] never got +initialized. + +Cc: stable@vger.kernel.org +Reported-by: pa@panix.com +Tested-by: pa@panix.com +Signed-off-by: Alexander Wetzel +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220422145228.7567-1-alexander@wetzel-home.de +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c ++++ b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c +@@ -460,8 +460,10 @@ static void rtl8180_tx(struct ieee80211_ + struct rtl8180_priv *priv = dev->priv; + struct rtl8180_tx_ring *ring; + struct rtl8180_tx_desc *entry; ++ unsigned int prio = 0; + unsigned long flags; +- unsigned int idx, prio, hw_prio; ++ unsigned int idx, hw_prio; ++ + dma_addr_t mapping; + u32 tx_flags; + u8 rc_flags; +@@ -470,7 +472,9 @@ static void rtl8180_tx(struct ieee80211_ + /* do arithmetic and then convert to le16 */ + u16 frame_duration = 0; + +- prio = skb_get_queue_mapping(skb); ++ /* rtl8180/rtl8185 only has one useable tx queue */ ++ if (dev->queues > IEEE80211_AC_BK) ++ prio = skb_get_queue_mapping(skb); + ring = &priv->tx_ring[prio]; + + mapping = pci_map_single(priv->pdev, skb->data, diff --git a/patches.suse/rtlwifi-Use-pr_warn-instead-of-WARN_ONCE.patch b/patches.suse/rtlwifi-Use-pr_warn-instead-of-WARN_ONCE.patch new file mode 100644 index 0000000..ea95857 --- /dev/null +++ b/patches.suse/rtlwifi-Use-pr_warn-instead-of-WARN_ONCE.patch @@ -0,0 +1,39 @@ +From ad732da434a2936128769216eddaece3b1af4588 Mon Sep 17 00:00:00 2001 +From: Dongliang Mu +Date: Wed, 11 May 2022 09:44:52 +0800 +Subject: [PATCH] rtlwifi: Use pr_warn instead of WARN_ONCE +Git-commit: ad732da434a2936128769216eddaece3b1af4588 +Patch-mainline: v5.19-rc1 +References: git-fixes + +This memory allocation failure can be triggered by fault injection or +high pressure testing, resulting a WARN. + +Fix this by replacing WARN with pr_warn. + +Reported-by: syzkaller +Signed-off-by: Dongliang Mu +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220511014453.1621366-1-dzm91@hust.edu.cn +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/realtek/rtlwifi/usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index 86a236873254..a8eebafb9a7e 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1014,7 +1014,7 @@ int rtl_usb_probe(struct usb_interface *intf, + hw = ieee80211_alloc_hw(sizeof(struct rtl_priv) + + sizeof(struct rtl_usb_priv), &rtl_ops); + if (!hw) { +- WARN_ONCE(true, "rtl_usb: ieee80211 alloc failed\n"); ++ pr_warn("rtl_usb: ieee80211 alloc failed\n"); + return -ENOMEM; + } + rtlpriv = hw->priv; +-- +2.35.3 + diff --git a/patches.suse/serial-msm_serial-disable-interrupts-in-__msm_consol.patch b/patches.suse/serial-msm_serial-disable-interrupts-in-__msm_consol.patch new file mode 100644 index 0000000..b816f2a --- /dev/null +++ b/patches.suse/serial-msm_serial-disable-interrupts-in-__msm_consol.patch @@ -0,0 +1,59 @@ +From aabdbb1b7a5819e18c403334a31fb0cc2c06ad41 Mon Sep 17 00:00:00 2001 +From: John Ogness +Date: Fri, 6 May 2022 23:39:24 +0206 +Subject: [PATCH] serial: msm_serial: disable interrupts in __msm_console_write() +Git-commit: aabdbb1b7a5819e18c403334a31fb0cc2c06ad41 +Patch-mainline: v5.19-rc1 +References: git-fixes + +__msm_console_write() assumes that interrupts are disabled, but +with threaded console printers it is possible that the write() +callback of the console is called with interrupts enabled. + +Explicitly disable interrupts using local_irq_save() to preserve +the assumed context. + +Reported-by: Marek Szyprowski +Reviewed-by: Petr Mladek +Signed-off-by: John Ogness +Link: https://lore.kernel.org/r/20220506213324.470461-1-john.ogness@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/msm_serial.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c +index 23c94b927776..e676ec761f18 100644 +--- a/drivers/tty/serial/msm_serial.c ++++ b/drivers/tty/serial/msm_serial.c +@@ -1599,6 +1599,7 @@ static inline struct uart_port *msm_get_port_from_line(unsigned int line) + static void __msm_console_write(struct uart_port *port, const char *s, + unsigned int count, bool is_uartdm) + { ++ unsigned long flags; + int i; + int num_newlines = 0; + bool replaced = false; +@@ -1616,6 +1617,8 @@ static void __msm_console_write(struct uart_port *port, const char *s, + num_newlines++; + count += num_newlines; + ++ local_irq_save(flags); ++ + if (port->sysrq) + locked = 0; + else if (oops_in_progress) +@@ -1661,6 +1664,8 @@ static void __msm_console_write(struct uart_port *port, const char *s, + + if (locked) + spin_unlock(&port->lock); ++ ++ local_irq_restore(flags); + } + + static void msm_console_write(struct console *co, const char *s, +-- +2.35.3 + diff --git a/patches.suse/spi-spi-rspi-Remove-setting-src-dst-_-addr-addr_widt.patch b/patches.suse/spi-spi-rspi-Remove-setting-src-dst-_-addr-addr_widt.patch new file mode 100644 index 0000000..8835758 --- /dev/null +++ b/patches.suse/spi-spi-rspi-Remove-setting-src-dst-_-addr-addr_widt.patch @@ -0,0 +1,70 @@ +From 6f381481a5b236cb53d6de2c49c6ef83a4d0f432 Mon Sep 17 00:00:00 2001 +From: Biju Das +Date: Mon, 11 Apr 2022 18:31:15 +0100 +Subject: [PATCH] spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA direction +Git-commit: 6f381481a5b236cb53d6de2c49c6ef83a4d0f432 +Patch-mainline: v5.19-rc1 +References: git-fixes + +The direction field in the DMA config is deprecated. The rspi driver +sets {src,dst}_{addr,addr_width} based on the DMA direction and +it results in dmaengine_slave_config() failure as RZ DMAC driver +validates {src,dst}_addr_width values independent of DMA direction. + +This patch fixes the issue by passing both {src,dst}_{addr,addr_width} +values independent of DMA direction. + +Signed-off-by: Biju Das +Suggested-by: Vinod Koul +Reviewed-by: Vinod Koul +Reviewed-by: Geert Uytterhoeven +Tested-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20220411173115.6619-1-biju.das.jz@bp.renesas.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/spi/spi-rspi.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c +index bd5708d7e5a1..7a014eeec2d0 100644 +--- a/drivers/spi/spi-rspi.c ++++ b/drivers/spi/spi-rspi.c +@@ -1108,14 +1108,11 @@ static struct dma_chan *rspi_request_dma_chan(struct device *dev, + } + + memset(&cfg, 0, sizeof(cfg)); ++ cfg.dst_addr = port_addr + RSPI_SPDR; ++ cfg.src_addr = port_addr + RSPI_SPDR; ++ cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE; ++ cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE; + cfg.direction = dir; +- if (dir == DMA_MEM_TO_DEV) { +- cfg.dst_addr = port_addr; +- cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE; +- } else { +- cfg.src_addr = port_addr; +- cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE; +- } + + ret = dmaengine_slave_config(chan, &cfg); + if (ret) { +@@ -1146,12 +1143,12 @@ static int rspi_request_dma(struct device *dev, struct spi_controller *ctlr, + } + + ctlr->dma_tx = rspi_request_dma_chan(dev, DMA_MEM_TO_DEV, dma_tx_id, +- res->start + RSPI_SPDR); ++ res->start); + if (!ctlr->dma_tx) + return -ENODEV; + + ctlr->dma_rx = rspi_request_dma_chan(dev, DMA_DEV_TO_MEM, dma_rx_id, +- res->start + RSPI_SPDR); ++ res->start); + if (!ctlr->dma_rx) { + dma_release_channel(ctlr->dma_tx); + ctlr->dma_tx = NULL; +-- +2.35.3 + diff --git a/patches.suse/spi-stm32-qspi-Fix-wait_cmd-timeout-in-APM-mode.patch b/patches.suse/spi-stm32-qspi-Fix-wait_cmd-timeout-in-APM-mode.patch new file mode 100644 index 0000000..36e456d --- /dev/null +++ b/patches.suse/spi-stm32-qspi-Fix-wait_cmd-timeout-in-APM-mode.patch @@ -0,0 +1,38 @@ +From d83d89ea68b4726700fa87b22db075e4217e691c Mon Sep 17 00:00:00 2001 +From: Patrice Chotard +Date: Wed, 11 May 2022 09:46:42 +0200 +Subject: [PATCH] spi: stm32-qspi: Fix wait_cmd timeout in APM mode +Git-commit: d83d89ea68b4726700fa87b22db075e4217e691c +Patch-mainline: v5.19-rc1 +References: git-fixes + +In APM mode, TCF and TEF flags are not set. To avoid timeout in +stm32_qspi_wait_cmd(), don't check if TCF/TEF are set. + +Signed-off-by: Patrice Chotard +Reported-by: eberhard.stoll@kontron.de +Link: https://lore.kernel.org/r/20220511074644.558874-2-patrice.chotard@foss.st.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/spi/spi-stm32-qspi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-stm32-qspi.c b/drivers/spi/spi-stm32-qspi.c +index ffdc55f87e82..dd38cb8ffbc2 100644 +--- a/drivers/spi/spi-stm32-qspi.c ++++ b/drivers/spi/spi-stm32-qspi.c +@@ -308,7 +308,8 @@ static int stm32_qspi_wait_cmd(struct stm32_qspi *qspi, + if (!op->data.nbytes) + goto wait_nobusy; + +- if (readl_relaxed(qspi->io_base + QSPI_SR) & SR_TCF) ++ if ((readl_relaxed(qspi->io_base + QSPI_SR) & SR_TCF) || ++ qspi->fmode == CCR_FMODE_APM) + goto out; + + reinit_completion(&qspi->data_completion); +-- +2.35.3 + diff --git a/patches.suse/staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch b/patches.suse/staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch new file mode 100644 index 0000000..d9d24df --- /dev/null +++ b/patches.suse/staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch @@ -0,0 +1,56 @@ +From 0458e5428e5e959d201a40ffe71d762a79ecedc4 Mon Sep 17 00:00:00 2001 +From: Wang Cheng +Date: Mon, 16 May 2022 17:22:41 +0800 +Subject: [PATCH] staging: rtl8712: fix uninit-value in r871xu_drv_init() +Git-commit: 0458e5428e5e959d201a40ffe71d762a79ecedc4 +Patch-mainline: v5.19-rc1 +References: git-fixes + +When 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0, +'mac[6]' will not be initialized. + +Bug: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541 r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541 usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 really_probe+0x653/0x14b0 drivers/base/dd.c:596 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238 usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293 really_probe+0x653/0x14b0 drivers/base/dd.c:596 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566 hub_port_connect drivers/usb/core/hub.c:5358 [inline] hub_port_connect_change drivers/usb/core/hub.c:5502 [inline] port_event drivers/usb/core/hub.c:5660 [inline] hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742 process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307 worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454 kthread+0x3c7/0x500 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 + +Local variable mac created at: + r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394 + usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 + +Kmsan: uninit-value in r871xu_drv_init +https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8 + +Reported-by: +Tested-by: +Reviewed-by: Dan Carpenter +Signed-off-by: Wang Cheng +Link: https://lore.kernel.org/r/14c3886173dfa4597f0704547c414cfdbcd11d16.1652618244.git.wanngchenng@gmail.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/staging/rtl8712/usb_intf.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c +index 8cbd419dd868..37364d3101e2 100644 +--- a/drivers/staging/rtl8712/usb_intf.c ++++ b/drivers/staging/rtl8712/usb_intf.c +@@ -536,13 +536,13 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf, + } else { + AutoloadFail = false; + } +- if (((mac[0] == 0xff) && (mac[1] == 0xff) && ++ if ((!AutoloadFail) || ++ ((mac[0] == 0xff) && (mac[1] == 0xff) && + (mac[2] == 0xff) && (mac[3] == 0xff) && + (mac[4] == 0xff) && (mac[5] == 0xff)) || + ((mac[0] == 0x00) && (mac[1] == 0x00) && + (mac[2] == 0x00) && (mac[3] == 0x00) && +- (mac[4] == 0x00) && (mac[5] == 0x00)) || +- (!AutoloadFail)) { ++ (mac[4] == 0x00) && (mac[5] == 0x00))) { + mac[0] = 0x00; + mac[1] = 0xe0; + mac[2] = 0x4c; +-- +2.35.3 + diff --git a/patches.suse/staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch b/patches.suse/staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch new file mode 100644 index 0000000..2a994cb --- /dev/null +++ b/patches.suse/staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch @@ -0,0 +1,109 @@ +From d1b57669732d09da7e13ef86d058dab0cd57f6e0 Mon Sep 17 00:00:00 2001 +From: Wang Cheng +Date: Mon, 16 May 2022 17:22:23 +0800 +Subject: [PATCH] staging: rtl8712: fix uninit-value in usb_read8() and friends +Git-commit: d1b57669732d09da7e13ef86d058dab0cd57f6e0 +Patch-mainline: v5.19-rc1 +References: git-fixes + +When r8712_usbctrl_vendorreq() returns negative, 'data' in +usb_read{8,16,32} will not be initialized. + +Bug: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:643 [inline] +Bug: KMSAN: uninit-value in string+0x4ec/0x6f0 lib/vsprintf.c:725 string_nocheck lib/vsprintf.c:643 [inline] string+0x4ec/0x6f0 lib/vsprintf.c:725 vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806 va_format lib/vsprintf.c:1704 [inline] pointer+0x18e6/0x1f70 lib/vsprintf.c:2443 vsnprintf+0x1a9b/0x3650 lib/vsprintf.c:2810 vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158 vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256 dev_vprintk_emit+0x5ef/0x6d0 drivers/base/core.c:4604 dev_printk_emit+0x1dd/0x21f drivers/base/core.c:4615 __dev_printk+0x3be/0x440 drivers/base/core.c:4627 _dev_info+0x1ea/0x22f drivers/base/core.c:4673 r871xu_drv_init+0x1929/0x3070 drivers/staging/rtl8712/usb_intf.c:401 usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 really_probe+0x6c7/0x1350 drivers/base/dd.c:621 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238 usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293 really_probe+0x6c7/0x1350 drivers/base/dd.c:621 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_new_device+0x1b91/0x2950 drivers/usb/core/hub.c:2566 hub_port_connect drivers/usb/core/hub.c:5363 [inline] hub_port_connect_change drivers/usb/core/hub.c:5507 [inline] port_event drivers/usb/core/hub.c:5665 [inline] hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5747 process_one_work+0xdb6/0x1820 kernel/workqueue.c:2289 worker_thread+0x10d0/0x2240 kernel/workqueue.c:2436 kthread+0x3c7/0x500 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 + +Local variable data created at: + usb_read8+0x5d/0x130 drivers/staging/rtl8712/usb_ops.c:33 + r8712_read8+0xa5/0xd0 drivers/staging/rtl8712/rtl8712_io.c:29 + +Kmsan: uninit-value in r871xu_drv_init +https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8 + +Reported-by: +Tested-by: +Reviewed-by: Dan Carpenter +Signed-off-by: Wang Cheng +Link: https://lore.kernel.org/r/b9b7a6ee02c02aa28054f5cf16129977775f3cd9.1652618244.git.wanngchenng@gmail.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/staging/rtl8712/usb_ops.c | 27 ++++++++++++++++++--------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/drivers/staging/rtl8712/usb_ops.c b/drivers/staging/rtl8712/usb_ops.c +index e64845e6adf3..af9966d03979 100644 +--- a/drivers/staging/rtl8712/usb_ops.c ++++ b/drivers/staging/rtl8712/usb_ops.c +@@ -29,7 +29,8 @@ static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr) + u16 wvalue; + u16 index; + u16 len; +- __le32 data; ++ int status; ++ __le32 data = 0; + struct intf_priv *intfpriv = intfhdl->pintfpriv; + + request = 0x05; +@@ -37,8 +38,10 @@ static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr) + index = 0; + wvalue = (u16)(addr & 0x0000ffff); + len = 1; +- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len, +- requesttype); ++ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, ++ &data, len, requesttype); ++ if (status < 0) ++ return 0; + return (u8)(le32_to_cpu(data) & 0x0ff); + } + +@@ -49,7 +52,8 @@ static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr) + u16 wvalue; + u16 index; + u16 len; +- __le32 data; ++ int status; ++ __le32 data = 0; + struct intf_priv *intfpriv = intfhdl->pintfpriv; + + request = 0x05; +@@ -57,8 +61,10 @@ static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr) + index = 0; + wvalue = (u16)(addr & 0x0000ffff); + len = 2; +- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len, +- requesttype); ++ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, ++ &data, len, requesttype); ++ if (status < 0) ++ return 0; + return (u16)(le32_to_cpu(data) & 0xffff); + } + +@@ -69,7 +75,8 @@ static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr) + u16 wvalue; + u16 index; + u16 len; +- __le32 data; ++ int status; ++ __le32 data = 0; + struct intf_priv *intfpriv = intfhdl->pintfpriv; + + request = 0x05; +@@ -77,8 +84,10 @@ static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr) + index = 0; + wvalue = (u16)(addr & 0x0000ffff); + len = 4; +- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len, +- requesttype); ++ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, ++ &data, len, requesttype); ++ if (status < 0) ++ return 0; + return le32_to_cpu(data); + } + +-- +2.35.3 + diff --git a/patches.suse/tty-Fix-a-possible-resource-leak-in-icom_probe.patch b/patches.suse/tty-Fix-a-possible-resource-leak-in-icom_probe.patch new file mode 100644 index 0000000..f6f3228 --- /dev/null +++ b/patches.suse/tty-Fix-a-possible-resource-leak-in-icom_probe.patch @@ -0,0 +1,37 @@ +From ee157a79e7c82b01ae4c25de0ac75899801f322c Mon Sep 17 00:00:00 2001 +From: Huang Guobin +Date: Thu, 31 Mar 2022 17:10:05 +0800 +Subject: [PATCH] tty: Fix a possible resource leak in icom_probe +Git-commit: ee157a79e7c82b01ae4c25de0ac75899801f322c +Patch-mainline: v5.19-rc1 +References: git-fixes + +When pci_read_config_dword failed, call pci_release_regions() and +pci_disable_device() to recycle the resource previously allocated. + +Reviewed-by: Jiri Slaby +Signed-off-by: Huang Guobin +Link: https://lore.kernel.org/r/20220331091005.3290753-1-huangguobin4@huawei.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/icom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/icom.c b/drivers/tty/serial/icom.c +index 03a2fe9f4c9a..02b375ba2f07 100644 +--- a/drivers/tty/serial/icom.c ++++ b/drivers/tty/serial/icom.c +@@ -1501,7 +1501,7 @@ static int icom_probe(struct pci_dev *dev, + retval = pci_read_config_dword(dev, PCI_COMMAND, &command_reg); + if (retval) { + dev_err(&dev->dev, "PCI Config read FAILED\n"); +- return retval; ++ goto probe_exit0; + } + + pci_write_config_dword(dev, PCI_COMMAND, +-- +2.35.3 + diff --git a/patches.suse/tty-synclink_gt-Fix-null-pointer-dereference-in-slgt.patch b/patches.suse/tty-synclink_gt-Fix-null-pointer-dereference-in-slgt.patch new file mode 100644 index 0000000..49718e2 --- /dev/null +++ b/patches.suse/tty-synclink_gt-Fix-null-pointer-dereference-in-slgt.patch @@ -0,0 +1,47 @@ +From 689ca31c542687709ba21ec2195c1fbce34fd029 Mon Sep 17 00:00:00 2001 +From: Zheyu Ma +Date: Sun, 10 Apr 2022 19:48:14 +0800 +Subject: [PATCH] tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() +Git-commit: 689ca31c542687709ba21ec2195c1fbce34fd029 +Patch-mainline: v5.19-rc1 +References: git-fixes + +When the driver fails at alloc_hdlcdev(), and then we remove the driver +module, we will get the following splat: + +[ 25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI +[ 25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17] +[ 25.069262] RIP: 0010:detach_hdlc_protocol+0x2a/0x3e0 +[ 25.077709] Call Trace: +[ 25.077924] +[ 25.078108] unregister_hdlc_device+0x16/0x30 +[ 25.078481] slgt_cleanup+0x157/0x9f0 [synclink_gt] + +Fix this by checking whether the 'info->netdev' is a null pointer first. + +Reviewed-by: Jiri Slaby +Signed-off-by: Zheyu Ma +Link: https://lore.kernel.org/r/20220410114814.3920474-1-zheyuma97@gmail.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/synclink_gt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c +index 25c558e65ece..9bc2a9265277 100644 +--- a/drivers/tty/synclink_gt.c ++++ b/drivers/tty/synclink_gt.c +@@ -1746,6 +1746,8 @@ static int hdlcdev_init(struct slgt_info *info) + */ + static void hdlcdev_exit(struct slgt_info *info) + { ++ if (!info->netdev) ++ return; + unregister_hdlc_device(info->netdev); + free_netdev(info->netdev); + info->netdev = NULL; +-- +2.35.3 + diff --git a/patches.suse/usb-core-hcd-Add-support-for-deferring-roothub-regis.patch b/patches.suse/usb-core-hcd-Add-support-for-deferring-roothub-regis.patch new file mode 100644 index 0000000..1f1fd81 --- /dev/null +++ b/patches.suse/usb-core-hcd-Add-support-for-deferring-roothub-regis.patch @@ -0,0 +1,130 @@ +From a44623d9279086c89f631201d993aa332f7c9e66 Mon Sep 17 00:00:00 2001 +From: Kishon Vijay Abraham I +Date: Tue, 10 May 2022 14:46:29 +0530 +Subject: [PATCH] usb: core: hcd: Add support for deferring roothub registration +Git-commit: a44623d9279086c89f631201d993aa332f7c9e66 +Patch-mainline: v5.19-rc1 +References: git-fixes + +It has been observed with certain PCIe USB cards (like Inateck connected +to AM64 EVM or J7200 EVM) that as soon as the primary roothub is +registered, port status change is handled even before xHC is running +leading to cold plug USB devices not detected. For such cases, registering +both the root hubs along with the second HCD is required. Add support for +deferring roothub registration in usb_add_hcd(), so that both primary and +secondary roothubs are registered along with the second HCD. + +This patch has been added and reverted earier as it triggered a race +in usb device enumeration. +That race is now fixed in 5.16-rc3, and in stable back to 5.4 +commit 6cca13de26ee ("usb: hub: Fix locking issues with address0_mutex") +commit 6ae6dc22d2d1 ("usb: hub: Fix usb enumeration issue due to address0 +race") + +Cc: stable@vger.kernel.org # 5.4+ +Suggested-by: Mathias Nyman +Tested-by: Chris Chiu +Acked-by: Alan Stern +Signed-off-by: Kishon Vijay Abraham I +Link: https://lore.kernel.org/r/20220510091630.16564-2-kishon@ti.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/core/hcd.c | 29 +++++++++++++++++++++++------ + include/linux/usb/hcd.h | 2 ++ + 2 files changed, 25 insertions(+), 6 deletions(-) + +diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c +index d9712c2602af..06eea8848ccc 100644 +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -2816,6 +2816,7 @@ int usb_add_hcd(struct usb_hcd *hcd, + { + int retval; + struct usb_device *rhdev; ++ struct usb_hcd *shared_hcd; + + if (!hcd->skip_phy_initialization && usb_hcd_is_primary_hcd(hcd)) { + hcd->phy_roothub = usb_phy_roothub_alloc(hcd->self.sysdev); +@@ -2976,13 +2977,26 @@ int usb_add_hcd(struct usb_hcd *hcd, + goto err_hcd_driver_start; + } + ++ /* starting here, usbcore will pay attention to the shared HCD roothub */ ++ shared_hcd = hcd->shared_hcd; ++ if (!usb_hcd_is_primary_hcd(hcd) && shared_hcd && HCD_DEFER_RH_REGISTER(shared_hcd)) { ++ retval = register_root_hub(shared_hcd); ++ if (retval != 0) ++ goto err_register_root_hub; ++ ++ if (shared_hcd->uses_new_polling && HCD_POLL_RH(shared_hcd)) ++ usb_hcd_poll_rh_status(shared_hcd); ++ } ++ + /* starting here, usbcore will pay attention to this root hub */ +- retval = register_root_hub(hcd); +- if (retval != 0) +- goto err_register_root_hub; ++ if (!HCD_DEFER_RH_REGISTER(hcd)) { ++ retval = register_root_hub(hcd); ++ if (retval != 0) ++ goto err_register_root_hub; + +- if (hcd->uses_new_polling && HCD_POLL_RH(hcd)) +- usb_hcd_poll_rh_status(hcd); ++ if (hcd->uses_new_polling && HCD_POLL_RH(hcd)) ++ usb_hcd_poll_rh_status(hcd); ++ } + + return retval; + +@@ -3020,6 +3034,7 @@ EXPORT_SYMBOL_GPL(usb_add_hcd); + void usb_remove_hcd(struct usb_hcd *hcd) + { + struct usb_device *rhdev = hcd->self.root_hub; ++ bool rh_registered; + + dev_info(hcd->self.controller, "remove, state %x\n", hcd->state); + +@@ -3030,6 +3045,7 @@ void usb_remove_hcd(struct usb_hcd *hcd) + + dev_dbg(hcd->self.controller, "roothub graceful disconnect\n"); + spin_lock_irq (&hcd_root_hub_lock); ++ rh_registered = hcd->rh_registered; + hcd->rh_registered = 0; + spin_unlock_irq (&hcd_root_hub_lock); + +@@ -3039,7 +3055,8 @@ void usb_remove_hcd(struct usb_hcd *hcd) + cancel_work_sync(&hcd->died_work); + + mutex_lock(&usb_bus_idr_lock); +- usb_disconnect(&rhdev); /* Sets rhdev to NULL */ ++ if (rh_registered) ++ usb_disconnect(&rhdev); /* Sets rhdev to NULL */ + mutex_unlock(&usb_bus_idr_lock); + + /* +diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h +index 548a028f2dab..2c1fc9212cf2 100644 +--- a/include/linux/usb/hcd.h ++++ b/include/linux/usb/hcd.h +@@ -124,6 +124,7 @@ struct usb_hcd { + #define HCD_FLAG_RH_RUNNING 5 /* root hub is running? */ + #define HCD_FLAG_DEAD 6 /* controller has died? */ + #define HCD_FLAG_INTF_AUTHORIZED 7 /* authorize interfaces? */ ++#define HCD_FLAG_DEFER_RH_REGISTER 8 /* Defer roothub registration */ + + /* The flags can be tested using these macros; they are likely to + * be slightly faster than test_bit(). +@@ -134,6 +135,7 @@ struct usb_hcd { + #define HCD_WAKEUP_PENDING(hcd) ((hcd)->flags & (1U << HCD_FLAG_WAKEUP_PENDING)) + #define HCD_RH_RUNNING(hcd) ((hcd)->flags & (1U << HCD_FLAG_RH_RUNNING)) + #define HCD_DEAD(hcd) ((hcd)->flags & (1U << HCD_FLAG_DEAD)) ++#define HCD_DEFER_RH_REGISTER(hcd) ((hcd)->flags & (1U << HCD_FLAG_DEFER_RH_REGISTER)) + + /* + * Specifies if interfaces are authorized by default +-- +2.35.3 + diff --git a/patches.suse/usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch b/patches.suse/usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch new file mode 100644 index 0000000..84e8878 --- /dev/null +++ b/patches.suse/usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch @@ -0,0 +1,67 @@ +From 3120aac6d0ecd9accf56894aeac0e265f74d3d5a Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Thu, 5 May 2022 12:46:18 +0200 +Subject: [PATCH] usb: dwc2: gadget: don't reset gadget's driver->bus +Git-commit: 3120aac6d0ecd9accf56894aeac0e265f74d3d5a +Patch-mainline: v5.19-rc1 +References: git-fixes + +UDC driver should not touch gadget's driver internals, especially it +should not reset driver->bus. This wasn't harmful so far, but since +commit fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") gadget +subsystem got it's own bus and messing with ->bus triggers the +following NULL pointer dereference: + +dwc2 12480000.hsotg: bound driver g_ether +8<--- cut here --- +Unable to handle kernel NULL pointer dereference at virtual address 00000000 +[00000000] *pgd=00000000 +Internal error: Oops: 5 [#1] SMP ARM +Modules linked in: ... +Cpu: 0 PID: 620 Comm: modprobe Not tainted 5.18.0-rc5-next-20220504 #11862 +Hardware name: Samsung Exynos (Flattened Device Tree) +PC is at module_add_driver+0x44/0xe8 +LR is at sysfs_do_create_link_sd+0x84/0xe0 +... +Process modprobe (pid: 620, stack limit = 0x(ptrval)) +... + module_add_driver from bus_add_driver+0xf4/0x1e4 + bus_add_driver from driver_register+0x78/0x10c + driver_register from usb_gadget_register_driver_owner+0x40/0xb4 + usb_gadget_register_driver_owner from do_one_initcall+0x44/0x1e0 + do_one_initcall from do_init_module+0x44/0x1c8 + do_init_module from load_module+0x19b8/0x1b9c + load_module from sys_finit_module+0xdc/0xfc + sys_finit_module from ret_fast_syscall+0x0/0x54 +Exception stack(0xf1771fa8 to 0xf1771ff0) +... +dwc2 12480000.hsotg: new device is high-speed + +Acked-by: Takashi Iwai + +---[ end trace 0000000000000000 ]--- + +Fix this by removing driver->bus entry reset. + +Signed-off-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20220505104618.22729-1-m.szyprowski@samsung.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/gadget.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index eee3504397e6..fe2a58c75861 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -4544,7 +4544,6 @@ static int dwc2_hsotg_udc_start(struct usb_gadget *gadget, + + WARN_ON(hsotg->driver); + +- driver->driver.bus = NULL; + hsotg->driver = driver; + hsotg->gadget.dev.of_node = hsotg->dev->of_node; + hsotg->gadget.speed = USB_SPEED_UNKNOWN; +-- +2.35.3 + diff --git a/patches.suse/video-fbdev-pxa3xx-gcu-release-the-resources-correct.patch b/patches.suse/video-fbdev-pxa3xx-gcu-release-the-resources-correct.patch new file mode 100644 index 0000000..d8a092f --- /dev/null +++ b/patches.suse/video-fbdev-pxa3xx-gcu-release-the-resources-correct.patch @@ -0,0 +1,66 @@ +From d87ad457f7e1b8d2492ca5b1531eb35030a1cc8f Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Fri, 13 May 2022 18:05:41 +0800 +Subject: [PATCH] video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove() +Git-commit: d87ad457f7e1b8d2492ca5b1531eb35030a1cc8f +Patch-mainline: v5.19-rc1 +References: git-fixes + +In pxa3xx_gcu_probe(), the sequence of error lable is wrong, it will +leads some resource leaked, so adjust the sequence to handle the error +correctly, and if pxa3xx_gcu_add_buffer() fails, pxa3xx_gcu_free_buffers() +need be called. +In pxa3xx_gcu_remove(), add missing clk_disable_unpreprare(). + +Signed-off-by: Yang Yingliang +Signed-off-by: Helge Deller +Acked-by: Takashi Iwai + +--- + drivers/video/fbdev/pxa3xx-gcu.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/video/fbdev/pxa3xx-gcu.c b/drivers/video/fbdev/pxa3xx-gcu.c +index 350b3139c863..043cc8f9ef1c 100644 +--- a/drivers/video/fbdev/pxa3xx-gcu.c ++++ b/drivers/video/fbdev/pxa3xx-gcu.c +@@ -646,6 +646,7 @@ static int pxa3xx_gcu_probe(struct platform_device *pdev) + for (i = 0; i < 8; i++) { + ret = pxa3xx_gcu_add_buffer(dev, priv); + if (ret) { ++ pxa3xx_gcu_free_buffers(dev, priv); + dev_err(dev, "failed to allocate DMA memory\n"); + goto err_disable_clk; + } +@@ -662,15 +663,15 @@ static int pxa3xx_gcu_probe(struct platform_device *pdev) + SHARED_SIZE, irq); + return 0; + +-err_free_dma: +- dma_free_coherent(dev, SHARED_SIZE, +- priv->shared, priv->shared_phys); ++err_disable_clk: ++ clk_disable_unprepare(priv->clk); + + err_misc_deregister: + misc_deregister(&priv->misc_dev); + +-err_disable_clk: +- clk_disable_unprepare(priv->clk); ++err_free_dma: ++ dma_free_coherent(dev, SHARED_SIZE, ++ priv->shared, priv->shared_phys); + + return ret; + } +@@ -683,6 +684,7 @@ static int pxa3xx_gcu_remove(struct platform_device *pdev) + pxa3xx_gcu_wait_idle(priv); + misc_deregister(&priv->misc_dev); + dma_free_coherent(dev, SHARED_SIZE, priv->shared, priv->shared_phys); ++ clk_disable_unprepare(priv->clk); + pxa3xx_gcu_free_buffers(dev, priv); + + return 0; +-- +2.35.3 + diff --git a/patches.suse/vringh-Fix-loop-descriptors-check-in-the-indirect-ca.patch b/patches.suse/vringh-Fix-loop-descriptors-check-in-the-indirect-ca.patch new file mode 100644 index 0000000..6036505 --- /dev/null +++ b/patches.suse/vringh-Fix-loop-descriptors-check-in-the-indirect-ca.patch @@ -0,0 +1,58 @@ +From dbd29e0752286af74243cf891accf472b2f3edd8 Mon Sep 17 00:00:00 2001 +From: Xie Yongji +Date: Thu, 5 May 2022 18:09:10 +0800 +Subject: [PATCH] vringh: Fix loop descriptors check in the indirect cases +Git-commit: dbd29e0752286af74243cf891accf472b2f3edd8 +Patch-mainline: v5.19-rc2 +References: git-fixes + +We should use size of descriptor chain to test loop condition +in the indirect case. And another statistical count is also introduced +for indirect descriptors to avoid conflict with the statistical count +of direct descriptors. + +Fixes: f87d0fbb5798 ("vringh: host-side implementation of virtio rings.") +Signed-off-by: Xie Yongji +Signed-off-by: Fam Zheng +Message-id: <20220505100910.137-1-xieyongji@bytedance.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Acked-by: Takashi Iwai + +--- + drivers/vhost/vringh.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/vhost/vringh.c ++++ b/drivers/vhost/vringh.c +@@ -264,7 +264,7 @@ __vringh_iov(struct vringh *vrh, u16 i, + gfp_t gfp, + int (*copy)(void *dst, const void *src, size_t len)) + { +- int err, count = 0, up_next, desc_max; ++ int err, count = 0, indirect_count = 0, up_next, desc_max; + struct vring_desc desc, *descs; + struct vringh_range range = { -1ULL, 0 }, slowrange; + bool slow = false; +@@ -320,7 +320,12 @@ __vringh_iov(struct vringh *vrh, u16 i, + continue; + } + +- if (count++ == vrh->vring.num) { ++ if (up_next == -1) ++ count++; ++ else ++ indirect_count++; ++ ++ if (count > vrh->vring.num || indirect_count > desc_max) { + vringh_bad("Descriptor loop in %p", descs); + err = -ELOOP; + goto fail; +@@ -382,6 +387,7 @@ __vringh_iov(struct vringh *vrh, u16 i, + i = return_from_indirect(vrh, &up_next, + &descs, &desc_max); + slow = false; ++ indirect_count = 0; + } else + break; + } diff --git a/patches.suse/watchdog-wdat_wdt-Stop-watchdog-when-rebooting-the-s.patch b/patches.suse/watchdog-wdat_wdt-Stop-watchdog-when-rebooting-the-s.patch new file mode 100644 index 0000000..4621cb2 --- /dev/null +++ b/patches.suse/watchdog-wdat_wdt-Stop-watchdog-when-rebooting-the-s.patch @@ -0,0 +1,48 @@ +From 27fdf84510a1374748904db43f6755f912736d92 Mon Sep 17 00:00:00 2001 +From: Liu Xinpeng +Date: Tue, 26 Apr 2022 22:53:29 +0800 +Subject: [PATCH] watchdog: wdat_wdt: Stop watchdog when rebooting the system +Git-commit: 27fdf84510a1374748904db43f6755f912736d92 +Patch-mainline: v5.19-rc1 +References: git-fixes + +Executing reboot command several times on the machine "Dell +PowerEdge R740", UEFI security detection stopped machine +with the following prompt: + +Uefi0082: The system was reset due to a timeout from the watchdog +timer. Check the System Event Log (SEL) or crash dumps from +Operating Sysstem to identify the source that triggered the +watchdog timer reset. Update the firmware or driver for the +identified device. + +iDRAC has warning event: "The watchdog timer reset the system". + +This patch fixes this issue by adding the reboot notifier. + +Signed-off-by: Liu Xinpeng +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/1650984810-6247-3-git-send-email-liuxp11@chinatelecom.cn +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Acked-by: Takashi Iwai + +--- + drivers/watchdog/wdat_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/wdat_wdt.c b/drivers/watchdog/wdat_wdt.c +index df0865a61a70..6f36a653767b 100644 +--- a/drivers/watchdog/wdat_wdt.c ++++ b/drivers/watchdog/wdat_wdt.c +@@ -462,6 +462,7 @@ static int wdat_wdt_probe(struct platform_device *pdev) + return ret; + + watchdog_set_nowayout(&wdat->wdd, nowayout); ++ watchdog_stop_on_reboot(&wdat->wdd); + return devm_watchdog_register_device(dev, &wdat->wdd); + } + +-- +2.35.3 + diff --git a/series.conf b/series.conf index 1b8b332..fd68cec 100644 --- a/series.conf +++ b/series.conf @@ -28384,6 +28384,7 @@ patches.suse/thermal-imx8mm-fix-build-warning-of-incorrect-argument-type.patch patches.suse/thermal-devfreq_cooling-inline-all-stubs-for-CONFIG_.patch patches.suse/Input-goodix-fix-touch-coordinates-on-Cube-I15-TC.patch + patches.suse/Input-goodix-fix-spurious-key-release-events.patch patches.suse/Input-i8042-add-Acer-Aspire-5738z-to-nomux-list.patch patches.suse/1405-drm-i915-gvt-Add-some-regs-to-force-to-nonpriv-white.patch patches.suse/1406-drm-i915-gvt-Fix-display-port-type-issue.patch @@ -51247,6 +51248,7 @@ patches.suse/ACPI-processor-idle-Fix-up-C-state-latency-if-not-or.patch patches.suse/ACPI-resources-Add-checks-for-ACPI-IRQ-override.patch patches.suse/ACPI-sysfs-Fix-a-buffer-overrun-problem-with-descrip.patch + patches.suse/ACPI-sysfs-Make-sparse-happy-about-address-space-in-.patch patches.suse/ACPI-EC-Make-more-Asus-laptops-use-ECDT-_GPE.patch patches.suse/ACPI-APEI-fix-synchronous-external-aborts-in-user-mo.patch patches.suse/ACPI-bus-Call-kobject_put-in-acpi_init-error-path.patch @@ -51384,6 +51386,7 @@ patches.suse/mac80211-consider-per-CPU-statistics-if-present.patch patches.suse/mac80211_hwsim-add-concurrent-channels-scanning-supp.patch patches.suse/mac80211-remove-iwlwifi-specific-workaround-that-bro.patch + patches.suse/cfg80211-set-custom-regdomain-after-wiphy-registrati.patch patches.suse/mac80211-remove-iwlwifi-specific-workaround-NDPs-of-.patch patches.suse/xfrm-delete-xfrm4_output_finish-xfrm6_output_finish-.patch patches.suse/media-bpf-Do-not-copy-more-entries-than-user-space-r.patch @@ -52803,6 +52806,7 @@ patches.suse/Kconfig.debug-drop-selecting-non-existing-HARDLOCKUP.patch patches.suse/ipc-replace-costly-bailout-check-in-sysvipc_find_ipc.patch patches.suse/SUNRPC-improve-error-response-to-over-size-gss-crede.patch + patches.suse/platform-chrome-cros_ec_proto-Send-command-again-whe.patch patches.suse/mm-hugetlb-initialize-hugetlb_usage-in-mm_init.patch patches.suse/dmaengine-sprd-Add-missing-MODULE_DEVICE_TABLE.patch patches.suse/dmaengine-idxd-fix-wq-slot-allocation-index-check.patch @@ -55349,6 +55353,7 @@ patches.suse/ALSA-usb-audio-Restore-Rane-SL-1-quirk.patch patches.suse/Fix-double-fget-in-vhost_net_set_backend.patch patches.suse/NFC-nci-fix-sleep-in-atomic-context-bugs-caused-by-n.patch + patches.suse/pinctrl-sunxi-fix-f1c100s-uart2-function.patch patches.suse/arm64-paravirt-Use-RCU-read-locks-to-guard-stolen_ti.patch patches.suse/gpio-gpio-vf610-do-not-touch-other-bits-when-set-the.patch patches.suse/gpio-mvebu-pwm-Refuse-requests-with-inverted-polarit.patch @@ -55358,6 +55363,9 @@ patches.suse/clk-at91-generated-consider-range-when-calculating-b.patch patches.suse/Input-ili210x-fix-reset-timing.patch patches.suse/i2c-mt7621-fix-missing-clk_disable_unprepare-on-erro.patch + patches.suse/i2c-ismt-Provide-a-DMA-buffer-for-Interrupt-Cause-Lo.patch + patches.suse/drivers-i2c-thunderx-Allow-driver-to-work-with-ACPI-.patch + patches.suse/efi-Add-missing-prototype-for-efi_capsule_setup_info.patch patches.suse/drbd-remove-assign_p_sizes_qlim.patch patches.suse/drbd-use-bdev-based-limit-helpers-in-drbd_send_sizes.patch patches.suse/drbd-use-bdev_alignment_offset-instead-of-queue_alignment_offset.patch @@ -55366,22 +55374,39 @@ patches.suse/raid5-introduce-MD_BROKEN.patch patches.suse/md-fix-an-incorrect-NULL-check-in-does_sb_need_chang.patch patches.suse/md-fix-an-incorrect-NULL-check-in-md_reload_sb.patch + patches.suse/irqchip-exiu-Fix-acknowledgment-of-edge-triggered-in.patch + patches.suse/irqchip-aspeed-i2c-ic-Fix-irq_of_parse_and_map-retur.patch + patches.suse/irqchip-armada-370-xp-Do-not-touch-Performance-Count.patch + patches.suse/irqchip-irq-xtensa-mx-fix-initial-IRQ-affinity.patch patches.suse/lockdown-also-lock-down-previous-kgdb-use.patch patches.suse/tpm-ibmvtpm-Correct-the-return-value-in-tpm_ibmvtpm_.patch patches.suse/tpm-Fix-buffer-access-in-tpm2_get_tpm_pt.patch + patches.suse/efi-Do-not-import-certificates-from-UEFI-Secure-Boot.patch + patches.suse/hwmon-Make-chip-parameter-for-with_info-API-mandator.patch patches.suse/mtd-spi-nor-core-Check-written-SR-value-in-spi_nor_w.patch + patches.suse/mmc-jz4740-Apply-DMA-engine-limits-to-maximum-segmen.patch patches.suse/regulator-core-Fix-enable_count-imbalance-with-EXCLU.patch patches.suse/regulator-pfuze100-Fix-refcount-leak-in-pfuze_parse_.patch patches.suse/spi-spi-cadence-Fix-kernel-doc-format-for-resume-sus.patch patches.suse/spi-spi-ti-qspi-Fix-return-value-handling-of-wait_fo.patch + patches.suse/spi-spi-rspi-Remove-setting-src-dst-_-addr-addr_widt.patch patches.suse/spi-img-spfi-Fix-pm_runtime_get_sync-error-checking.patch patches.suse/spi-spi-fsl-qspi-check-return-value-after-calling-pl.patch + patches.suse/spi-stm32-qspi-Fix-wait_cmd-timeout-in-APM-mode.patch + patches.suse/HID-multitouch-Add-support-for-Google-Whiskers-Touch.patch patches.suse/HID-hid-led-fix-maximum-brightness-for-Dream-Cheeky.patch patches.suse/HID-elan-Fix-potential-double-free-in-elan_input_con.patch + patches.suse/HID-bigben-fix-slab-out-of-bounds-Write-in-bigben_pr.patch + patches.suse/ACPI-PM-Block-ASUS-B1400CEAE-from-suspend-to-idle-by.patch + patches.suse/ACPI-sysfs-Fix-BERT-error-region-memory-mapping.patch + patches.suse/PM-devfreq-rk3399_dmc-Disable-edev-on-remove.patch patches.suse/thermal-drivers-bcm2711-Don-t-clamp-temperature-at-z.patch patches.suse/thermal-drivers-broadcom-Fix-potential-NULL-derefere.patch patches.suse/ACPI-property-Release-subnode-properties-with-data-n.patch patches.suse/media-media-entity.h-Fix-documentation-for-media_cre.patch + patches.suse/media-venus-hfi-avoid-null-dereference-in-deinit.patch + patches.suse/media-pci-cx23885-Fix-the-error-handling-in-cx23885_.patch + patches.suse/media-cx25821-Fix-the-warning-when-removing-the-modu.patch patches.suse/media-uvcvideo-Fix-missing-check-to-determine-if-ele.patch patches.suse/media-pvrusb2-fix-array-index-out-of-bounds-in-pvr2_.patch patches.suse/media-ov7670-remove-ov7670_power_off-from-ov7670_rem.patch @@ -55390,14 +55415,25 @@ patches.suse/docs-submitting-patches-Fix-crossref-to-The-canonica.patch patches.suse/NFC-NULL-out-the-dev-rfkill-to-prevent-UAF.patch patches.suse/ath9k-fix-ar9003_get_eepmisc.patch + patches.suse/mwifiex-add-mutex-lock-for-call-in-mwifiex_dfs_chan_.patch + patches.suse/b43legacy-Fix-assigning-negative-value-to-unsigned-v.patch + patches.suse/b43-Fix-assigning-negative-value-to-unsigned-variabl.patch + patches.suse/ipw2x00-Fix-potential-NULL-dereference-in-libipw_xmi.patch patches.suse/nl80211-show-SSID-for-P2P_GO-interfaces.patch + patches.suse/rtl818x-Prevent-using-not-initialized-queues.patch patches.suse/ath9k_htc-fix-potential-out-of-bounds-access-with-in.patch + patches.suse/ath9k-fix-QCA9561-PA-bias-level.patch patches.suse/carl9170-tx-fix-an-incorrect-use-of-list-iterator.patch + patches.suse/mac80211-upgrade-passive-scan-to-active-scan-on-DFS-.patch + patches.suse/rtlwifi-Use-pr_warn-instead-of-WARN_ONCE.patch + patches.suse/iwlwifi-mvm-fix-assert-1F04-upon-reconfig.patch patches.suse/Bluetooth-fix-dangling-sco_conn-and-use-after-free-i.patch patches.suse/Bluetooth-hci_qca-Use-del_timer_sync-before-freeing.patch patches.suse/NFC-hci-fix-sleep-in-atomic-context-bugs-in-nfc_hci_.patch + patches.suse/drm-i915-Fix-Wstringop-overflow-warning-in-call-to-i.patch patches.suse/drm-bridge-analogix_dp-Grab-runtime-PM-reference-for.patch patches.suse/drm-blend-fix-typo-in-the-comment.patch + patches.suse/drm-virtio-fix-NULL-pointer-dereference-in-virtio_gp.patch patches.suse/drm-nouveau-kms-nv50-atom-fix-an-incorrect-NULL-chec.patch patches.suse/gma500-fix-an-incorrect-NULL-check-on-list-iterator.patch patches.suse/tilcdc-tilcdc_external-fix-an-incorrect-NULL-check-o.patch @@ -55405,13 +55441,16 @@ patches.suse/drm-bridge-adv7511-clean-up-CEC-adapter-when-probe-f.patch patches.suse/drm-nouveau-clk-Fix-an-incorrect-NULL-check-on-list-.patch patches.suse/drm-sti-don-t-use-kernel-doc-markers.patch + patches.suse/fbcon-Consistently-protect-deferred_takeover-with-co.patch patches.suse/drm-vc4-hvs-Reset-muxes-at-probe-time.patch patches.suse/drm-vc4-txp-Don-t-set-TXP_VSTART_AT_EOF.patch patches.suse/drm-vc4-txp-Force-alpha-to-be-0xff-if-it-s-disabled.patch patches.suse/drm-komeda-Fix-an-undefined-behavior-bug-in-komeda_p.patch + patches.suse/drm-komeda-return-early-if-drm_universal_plane_init-.patch patches.suse/drm-mali-dp-potential-dereference-of-null-pointer.patch patches.suse/drm-bridge-Fix-error-handling-in-analogix_dp_probe.patch patches.suse/drm-panel-simple-Add-missing-bus-flags-for-Innolux-G.patch + patches.suse/drm-plane-Move-range-check-for-format_count-earlier.patch patches.suse/drm-rockchip-vop-fix-possible-null-ptr-deref-in-vop_.patch patches.suse/drm-mediatek-Fix-mtk_cec_mask.patch patches.suse/drm-msm-dpu-adjust-display_v_end-for-eDP-and-DP.patch @@ -55419,25 +55458,32 @@ patches.suse/drm-msm-dsi-fix-error-checks-and-return-values-for-D.patch patches.suse/drm-msm-hdmi-check-return-value-after-calling-platfo.patch patches.suse/drm-msm-hdmi-fix-error-check-return-value-of-irq_of_.patch + patches.suse/drm-msm-fix-error-check-return-value-of-irq_of_parse.patch patches.suse/drm-msm-dsi-fix-address-for-second-DSI-PHY-on-SDM660.patch patches.suse/drm-msm-mdp5-Return-error-code-in-mdp5_pipe_release-.patch patches.suse/drm-msm-mdp5-Return-error-code-in-mdp5_mixer_release.patch patches.suse/drm-msm-return-an-error-pointer-in-msm_gem_prime_get.patch + patches.suse/drm-amdgpu-ucode-Remove-firmware-load-type-check-in-.patch patches.suse/drm-msm-a6xx-Fix-refcount-leak-in-a6xx_gpu_init.patch patches.suse/drm-msm-fix-possible-memory-leak-in-mdp5_crtc_cursor.patch patches.suse/drm-i915-Fix-CFI-violation-with-show_dynamic_id.patch patches.suse/ALSA-pcm-Check-for-null-pointer-of-pointer-substream.patch + patches.suse/ALSA-usb-audio-Workaround-for-clock-setup-on-TEAC-de.patch patches.suse/ALSA-usb-audio-Add-missing-ep_idx-in-fixed-EP-quirks.patch patches.suse/ALSA-ctxfi-Add-SB046x-PCI-ID.patch patches.suse/ASoC-mediatek-Fix-error-handling-in-mt8173_max98090_.patch patches.suse/ASoC-mediatek-Fix-missing-of_node_put-in-mt2701_wm89.patch patches.suse/ASoC-rk3328-fix-disabling-mclk-on-pclk-probe-failure.patch + patches.suse/ASoC-dapm-Don-t-fold-register-value-changes-into-not.patch patches.suse/ASoC-rt5514-Fix-event-generation-for-DSP-Voice-Wake-.patch patches.suse/ASoC-atmel-pdmic-Remove-endianness-flag-on-pdmic-com.patch patches.suse/ASoC-atmel-classd-Remove-endianness-flag-on-class-d-.patch + patches.suse/ASoC-tscs454-Add-endianness-flag-in-snd_soc_componen.patch patches.suse/ASoC-mxs-saif-Fix-refcount-leak-in-mxs_saif_probe.patch patches.suse/ASoC-ti-j721e-evm-Fix-refcount-leak-in-j721e_soc_pro.patch + patches.suse/ASoC-rt5645-Fix-errorenous-cleanup-order.patch patches.suse/ASoC-wm2000-fix-missing-clk_disable_unprepare-on-err.patch + patches.suse/ASoC-max98357a-remove-dependency-on-GPIOLIB.patch patches.suse/ASoC-max98090-Move-check-for-invalid-values-before-c.patch patches.suse/ALSA-usb-audio-Configure-sync-endpoints-before-data.patch patches.suse/ALSA-hda-realtek-Add-new-type-for-ALC245.patch @@ -55539,14 +55585,19 @@ patches.suse/tracing-Fix-return-value-of-trace_pid_write.patch patches.suse/ftrace-Clean-up-hash-direct_functions-on-register-failures.patch patches.suse/dmaengine-idxd-Fix-the-error-handling-path-in-idxd_c.patch + patches.suse/dmaengine-zynqmp_dma-In-struct-zynqmp_dma_chan-fix-d.patch patches.suse/dmaengine-stm32-mdma-remove-GISR1-register.patch patches.suse/video-fbdev-clcdfb-Fix-refcount-leak-in-clcdfb_of_vr.patch + patches.suse/video-fbdev-pxa3xx-gcu-release-the-resources-correct.patch patches.suse/iommu-amd-Increase-timeout-waiting-for-GA-log-enablement patches.suse/i2c-at91-use-dma-safe-buffers.patch patches.suse/i2c-at91-Initialize-dma_buf-in-at91_twi_xfer.patch + patches.suse/i2c-cadence-Increase-timeout-per-message-if-necessar.patch patches.suse/NFS-Don-t-report-ENOSPC-write-errors-twice.patch + patches.suse/pcmcia-db1xxx_ss-restrict-to-MIPS_DB1XXX-boards.patch patches.suse/pwm-lp3943-Fix-duty-calculation-in-case-period-was-c.patch patches.suse/pwm-raspberrypi-poe-Fix-endianness-in-firmware-struc.patch + patches.suse/watchdog-wdat_wdt-Stop-watchdog-when-rebooting-the-s.patch patches.suse/watchdog-ts4800_wdt-Fix-refcount-leak-in-ts4800_wdt_.patch patches.suse/rtc-mt6397-check-return-value-after-calling-platform.patch patches.suse/assoc_array-Fix-BUG_ON-during-garbage-collect.patch @@ -55555,18 +55606,29 @@ patches.suse/netfilter-nf_tables-sanitize-nft_set_desc_concat_par.patch patches.suse/wifi-mac80211-fix-use-after-free-in-chanctx-code.patch patches.suse/soc-rockchip-Fix-refcount-leak-in-rockchip_grf_init.patch + patches.suse/drm-radeon-fix-a-possible-null-pointer-dereference.patch + patches.suse/drm-amdgpu-cs-make-commands-with-0-chunks-illegal-be.patch patches.suse/ALSA-hda-realtek-Enable-4-speaker-output-for-Dell-XP-15dad62f4bdb.patch patches.suse/ALSA-hda-realtek-Fix-microphone-noise-on-ASUS-TUF-B5.patch + patches.suse/ALSA-usb-audio-Optimize-TEAC-clock-quirk.patch patches.suse/ASoC-fsl_sai-Fix-FSL_SAI_xDR-xFR-definition.patch patches.suse/block-fix-bio_clone_blkg_association-to-associate-wi.patch + patches.suse/drivers-staging-rtl8192u-Fix-deadlock-in-ieee80211_b.patch + patches.suse/drivers-staging-rtl8192e-Fix-deadlock-in-rtllib_beac.patch patches.suse/staging-fieldbus-Fix-the-error-handling-path-in-anyb.patch + patches.suse/staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch + patches.suse/staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch + patches.suse/tty-synclink_gt-Fix-null-pointer-dereference-in-slgt.patch patches.suse/tty-goldfish-Use-tty_port_destroy-to-destroy-port.patch + patches.suse/tty-Fix-a-possible-resource-leak-in-icom_probe.patch patches.suse/tty-serial-owl-Fix-missing-clk_disable_unprepare-in-.patch patches.suse/tty-serial-fsl_lpuart-fix-potential-bug-when-using-b.patch + patches.suse/drivers-tty-serial-Fix-deadlock-in-sa1100_set_termio.patch patches.suse/serial-8250-core-Remove-unneeded-linux-pm_runtime.h.patch patches.suse/serial-8250-pxa-Remove-unneeded-linux-pm_runtime.h.patch patches.suse/serial-pch-don-t-overwrite-xmit-buf-0-by-x_char.patch patches.suse/serial-meson-acquire-port-lock-in-startup.patch + patches.suse/serial-msm_serial-disable-interrupts-in-__msm_consol.patch patches.suse/serial-8250_fintek-Check-SER_RS485_RTS_-only-with-RS.patch patches.suse/serial-digicolor-usart-Don-t-allow-CS5-6.patch patches.suse/serial-rda-uart-Don-t-allow-CS5-6.patch @@ -55577,12 +55639,21 @@ patches.suse/serial-stm32-usart-Correct-CSIZE-bits-and-parity.patch patches.suse/usb-usbip-fix-a-refcount-leak-in-stub_probe.patch patches.suse/usb-usbip-add-missing-device-lock-on-tweak-configura.patch + patches.suse/USB-host-isp116x-check-return-value-after-calling-pl.patch patches.suse/USB-storage-karma-fix-rio_karma_init-return.patch patches.suse/usb-musb-Fix-missing-of_node_put-in-omap2430_probe.patch + patches.suse/drivers-usb-host-Fix-deadlock-in-oxu_bus_suspend.patch patches.suse/usb-dwc3-pci-Fix-pm_runtime_get_sync-error-checking.patch + patches.suse/USB-hcd-pci-Fully-suspend-across-freeze-thaw-cycle.patch patches.suse/usb-typec-mux-Check-dev_set_name-return-value.patch + patches.suse/usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch patches.suse/usb-ehci-omap-drop-unused-ehci_read-function.patch + patches.suse/usb-core-hcd-Add-support-for-deferring-roothub-regis.patch + patches.suse/USB-serial-option-add-Quectel-BG95-modem.patch + patches.suse/USB-new-quirk-for-Dell-Gen-2-devices.patch patches.suse/firmware-stratix10-svc-fix-a-missing-check-on-list-i.patch + patches.suse/misc-rtsx-set-NULL-intfdata-when-probe-fails.patch + patches.suse/iio-dummy-iio_simple_dummy-check-the-return-value-of.patch patches.suse/iio-adc-ad7124-Remove-shift-from-scan_type.patch patches.suse/iio-adc-stmpe-adc-Fix-wait_for_completion_timeout-re.patch patches.suse/iio-adc-sc27xx-fix-read-big-scale-voltage-not-right.patch @@ -55599,6 +55670,23 @@ patches.suse/s390-mcck-isolate-SIE-instruction-when-setting-CIF_MCCK_GUEST-flag patches.suse/gpio-pca953x-use-the-correct-register-address-to-do-.patch patches.suse/gpio-adp5588-Remove-support-for-platform-setup-and-t.patch + patches.suse/modpost-fix-removing-numeric-suffixes.patch + patches.suse/modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch + patches.suse/clocksource-drivers-sp804-Avoid-error-on-multiple-in.patch + patches.suse/clocksource-drivers-oxnas-rps-Fix-irq_of_parse_and_m.patch + patches.suse/mmc-block-Fix-CQE-recovery-reset-success.patch + patches.suse/Input-bcm5974-set-missing-URB_NO_TRANSFER_DMA_MAP-ur.patch + patches.suse/drm-imx-fix-compiler-warning-with-gcc-12.patch + patches.suse/nfc-st21nfca-fix-incorrect-validating-logic-in-EVT_T.patch + patches.suse/nfc-st21nfca-fix-memory-leaks-in-EVT_TRANSACTION-han.patch + patches.suse/nfc-st21nfca-fix-incorrect-sizing-calculations-in-EV.patch + patches.suse/drm-bridge-analogix_dp-Support-PSR-exit-to-disable-t.patch + patches.suse/drm-atomic-Force-bridge-self-refresh-exit-on-CRTC-sw.patch + patches.suse/ALSA-usb-audio-Skip-generic-sync-EP-parse-for-second.patch + patches.suse/ALSA-usb-audio-Set-up-implicit-sync-for-Saffire-6.patch + patches.suse/ALSA-hda-conexant-Fix-loopback-issue-with-CX20632.patch + patches.suse/ata-libata-transport-fix-dma-pio-xfer-_mode-sysfs-fi.patch + patches.suse/vringh-Fix-loop-descriptors-check-in-the-indirect-ca.patch # out-of-tree patches patches.suse/random-fix-crash-on-multiple-early-calls-to-add_bootloader_randomness.patch