diff --git a/blacklist.conf b/blacklist.conf index eec2c45..5a11bd3 100644 --- a/blacklist.conf +++ b/blacklist.conf @@ -1844,3 +1844,6 @@ e183d4e414b64711baf7a04e214b61969ca08dfa # incorrect, reverted by 5369ead83f5aff 3b1902b87bf11f1c6a84368470dc13da6f3da3bd # feature requests were rejected. So blacklist those fixes here too. fa13680f5668cff05302a2f4753c49334a83a064 # b166a20b07382b8bc1dcee2a448715c9c2c81b5b # reverted by 01bfe5e8e428, replaced by 34e5b0118685 +36e2d7cfdcf17b6126863d884d4200191e922524 # Missing dependencies +596efd57cfa1e1bee575e2a2df44fd8ec5e4a42d # Missing dependencies +e86be3a04bc4aeaf12f93af35f08f8d4385bcd98 # doesn't apply diff --git a/patches.kabi/kABI-powerpc-64-add-back-start_tb-and-accum_tb-to-th.patch b/patches.kabi/kABI-powerpc-64-add-back-start_tb-and-accum_tb-to-th.patch new file mode 100644 index 0000000..539da85 --- /dev/null +++ b/patches.kabi/kABI-powerpc-64-add-back-start_tb-and-accum_tb-to-th.patch @@ -0,0 +1,38 @@ +From 5dd6cdca8b67cf4e976fc0d9437045388c04811c Mon Sep 17 00:00:00 2001 +From: Michal Suchanek +Date: Thu, 27 May 2021 15:36:33 +0200 +Subject: [PATCH] kABI: powerpc/64: add back start_tb and accum_tb to + thread_struct + +Also rename the members to make sure no users remain. + +References: bsc#1186487 ltc#177613 +Patch-mainline: never, kABI + +Signed-off-by: Michal Suchanek +--- + arch/powerpc/include/asm/processor.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h +index 8c082cb7d9fc..18ef6b44b91f 100644 +--- a/arch/powerpc/include/asm/processor.h ++++ b/arch/powerpc/include/asm/processor.h +@@ -264,6 +264,14 @@ struct thread_struct { + struct thread_fp_state *fp_save_area; + int fpexc_mode; /* floating-point exception mode */ + unsigned int align_ctl; /* alignment handling control */ ++#ifdef CONFIG_PPC64 ++#ifdef __GENKSYMS__ ++ unsigned long start_tb; /* Start purr when proc switched in */ ++ unsigned long accum_tb; /* Total accumulated purr for process */ ++#else ++ unsigned long __unused_padding[2]; ++#endif ++#endif + #ifdef CONFIG_HAVE_HW_BREAKPOINT + struct perf_event *ptrace_bps[HBP_NUM]; + /* +-- +2.26.2 + diff --git a/patches.suse/ACPI-GTDT-Don-t-corrupt-interrupt-mappings-on-watchd.patch b/patches.suse/ACPI-GTDT-Don-t-corrupt-interrupt-mappings-on-watchd.patch new file mode 100644 index 0000000..bfcf21c --- /dev/null +++ b/patches.suse/ACPI-GTDT-Don-t-corrupt-interrupt-mappings-on-watchd.patch @@ -0,0 +1,87 @@ +From 1ecd5b129252249b9bc03d7645a7bda512747277 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Wed, 21 Apr 2021 17:43:16 +0100 +Subject: [PATCH] ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure +Git-commit: 1ecd5b129252249b9bc03d7645a7bda512747277 +Patch-mainline: v5.13-rc1 +References: git-fixes + +When failing the driver probe because of invalid firmware properties, +the GTDT driver unmaps the interrupt that it mapped earlier. + +However, it never checks whether the mapping of the interrupt actially +succeeded. Even more, should the firmware report an illegal interrupt +number that overlaps with the GIC SGI range, this can result in an +IPI being unmapped, and subsequent fireworks (as reported by Dann +Frazier). + +Rework the driver to have a slightly saner behaviour and actually +check whether the interrupt has been mapped before unmapping things. + +Reported-by: dann frazier +Fixes: ca9ae5ec4ef0 ("acpi/arm64: Add SBSA Generic Watchdog support in GTDT driver") +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/YH87dtTfwYgavusz@xps13.dannf +Cc: +Cc: Fu Wei +Reviewed-by: Sudeep Holla +Tested-by: dann frazier +Tested-by: Hanjun Guo +Reviewed-by: Hanjun Guo +Reviewed-by: Lorenzo Pieralisi +Link: https://lore.kernel.org/r/20210421164317.1718831-2-maz@kernel.org +Signed-off-by: Catalin Marinas +Acked-by: Takashi Iwai + +--- + drivers/acpi/arm64/gtdt.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/acpi/arm64/gtdt.c b/drivers/acpi/arm64/gtdt.c +index f2d0e5915dab..0a0a982f9c28 100644 +--- a/drivers/acpi/arm64/gtdt.c ++++ b/drivers/acpi/arm64/gtdt.c +@@ -329,7 +329,7 @@ static int __init gtdt_import_sbsa_gwdt(struct acpi_gtdt_watchdog *wd, + int index) + { + struct platform_device *pdev; +- int irq = map_gt_gsi(wd->timer_interrupt, wd->timer_flags); ++ int irq; + + /* + * According to SBSA specification the size of refresh and control +@@ -338,7 +338,7 @@ static int __init gtdt_import_sbsa_gwdt(struct acpi_gtdt_watchdog *wd, + struct resource res[] = { + DEFINE_RES_MEM(wd->control_frame_address, SZ_4K), + DEFINE_RES_MEM(wd->refresh_frame_address, SZ_4K), +- DEFINE_RES_IRQ(irq), ++ {}, + }; + int nr_res = ARRAY_SIZE(res); + +@@ -348,10 +348,11 @@ static int __init gtdt_import_sbsa_gwdt(struct acpi_gtdt_watchdog *wd, + + if (!(wd->refresh_frame_address && wd->control_frame_address)) { + pr_err(FW_BUG "failed to get the Watchdog base address.\n"); +- acpi_unregister_gsi(wd->timer_interrupt); + return -EINVAL; + } + ++ irq = map_gt_gsi(wd->timer_interrupt, wd->timer_flags); ++ res[2] = (struct resource)DEFINE_RES_IRQ(irq); + if (irq <= 0) { + pr_warn("failed to map the Watchdog interrupt.\n"); + nr_res--; +@@ -364,7 +365,8 @@ static int __init gtdt_import_sbsa_gwdt(struct acpi_gtdt_watchdog *wd, + */ + pdev = platform_device_register_simple("sbsa-gwdt", index, res, nr_res); + if (IS_ERR(pdev)) { +- acpi_unregister_gsi(wd->timer_interrupt); ++ if (irq > 0) ++ acpi_unregister_gsi(wd->timer_interrupt); + return PTR_ERR(pdev); + } + +-- +2.26.2 + diff --git a/patches.suse/ACPI-custom_method-fix-a-possible-memory-leak.patch b/patches.suse/ACPI-custom_method-fix-a-possible-memory-leak.patch new file mode 100644 index 0000000..8adc0a6 --- /dev/null +++ b/patches.suse/ACPI-custom_method-fix-a-possible-memory-leak.patch @@ -0,0 +1,41 @@ +From 1cfd8956437f842836e8a066b40d1ec2fc01f13e Mon Sep 17 00:00:00 2001 +From: Mark Langsdorf +Date: Tue, 27 Apr 2021 13:54:33 -0500 +Subject: [PATCH] ACPI: custom_method: fix a possible memory leak +Git-commit: 1cfd8956437f842836e8a066b40d1ec2fc01f13e +Patch-mainline: v5.13-rc1 +References: git-fixes + +In cm_write(), if the 'buf' is allocated memory but not fully consumed, +it is possible to reallocate the buffer without freeing it by passing +'*ppos' as 0 on a subsequent call. + +Add an explicit kfree() before kzalloc() to prevent the possible memory +leak. + +Fixes: 526b4af47f44 ("ACPI: Split out custom_method functionality into an own driver") +Signed-off-by: Mark Langsdorf +Cc: 5.4+ # 5.4+ +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/custom_method.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c +index 8844f895f9be..d39a9b474727 100644 +--- a/drivers/acpi/custom_method.c ++++ b/drivers/acpi/custom_method.c +@@ -42,6 +42,8 @@ static ssize_t cm_write(struct file *file, const char __user *user_buf, + sizeof(struct acpi_table_header))) + return -EFAULT; + uncopied_bytes = max_size = table.length; ++ /* make sure the buf is not allocated */ ++ kfree(buf); + buf = kzalloc(max_size, GFP_KERNEL); + if (!buf) + return -ENOMEM; +-- +2.26.2 + diff --git a/patches.suse/ACPI-custom_method-fix-potential-use-after-free-issu.patch b/patches.suse/ACPI-custom_method-fix-potential-use-after-free-issu.patch new file mode 100644 index 0000000..ea26fd4 --- /dev/null +++ b/patches.suse/ACPI-custom_method-fix-potential-use-after-free-issu.patch @@ -0,0 +1,50 @@ +From e483bb9a991bdae29a0caa4b3a6d002c968f94aa Mon Sep 17 00:00:00 2001 +From: Mark Langsdorf +Date: Fri, 23 Apr 2021 10:28:17 -0500 +Subject: [PATCH] ACPI: custom_method: fix potential use-after-free issue +Git-commit: e483bb9a991bdae29a0caa4b3a6d002c968f94aa +Patch-mainline: v5.13-rc1 +References: git-fixes + +In cm_write(), buf is always freed when reaching the end of the +function. If the requested count is less than table.length, the +allocated buffer will be freed but subsequent calls to cm_write() will +still try to access it. + +Remove the unconditional kfree(buf) at the end of the function and +set the buf to NULL in the -EINVAL error path to match the rest of +function. + +Fixes: 03d1571d9513 ("ACPI: custom_method: fix memory leaks") +Signed-off-by: Mark Langsdorf +Cc: 5.4+ # 5.4+ +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/custom_method.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c +index 443fdf62dd22..8844f895f9be 100644 +--- a/drivers/acpi/custom_method.c ++++ b/drivers/acpi/custom_method.c +@@ -55,6 +55,7 @@ static ssize_t cm_write(struct file *file, const char __user *user_buf, + (*ppos + count < count) || + (count > uncopied_bytes)) { + kfree(buf); ++ buf = NULL; + return -EINVAL; + } + +@@ -76,7 +77,6 @@ static ssize_t cm_write(struct file *file, const char __user *user_buf, + add_taint(TAINT_OVERRIDDEN_ACPI_TABLE, LOCKDEP_NOW_UNRELIABLE); + } + +- kfree(buf); + return count; + } + +-- +2.26.2 + diff --git a/patches.suse/ACPI-hotplug-PCI-Fix-reference-count-leak-in-enable_.patch b/patches.suse/ACPI-hotplug-PCI-Fix-reference-count-leak-in-enable_.patch new file mode 100644 index 0000000..e5d2315 --- /dev/null +++ b/patches.suse/ACPI-hotplug-PCI-Fix-reference-count-leak-in-enable_.patch @@ -0,0 +1,38 @@ +From 3bbfd319034ddce59e023837a4aa11439460509b Mon Sep 17 00:00:00 2001 +From: Feilong Lin +Date: Thu, 25 Mar 2021 15:26:00 +0800 +Subject: [PATCH] ACPI / hotplug / PCI: Fix reference count leak in enable_slot() +Git-commit: 3bbfd319034ddce59e023837a4aa11439460509b +Patch-mainline: v5.13-rc1 +References: git-fixes + +In enable_slot(), if pci_get_slot() returns NULL, we clear the SLOT_ENABLED +flag. When pci_get_slot() finds a device, it increments the device's +reference count. In this case, we did not call pci_dev_put() to decrement +the reference count, so the memory of the device (struct pci_dev type) will +eventually leak. + +Call pci_dev_put() to decrement its reference count when pci_get_slot() +returns a PCI device. + +Link: https://lore.kernel.org/r/b411af88-5049-a1c6-83ac-d104a1f429be@huawei.com +Signed-off-by: Feilong Lin +Signed-off-by: Zhiqiang Liu +Signed-off-by: Bjorn Helgaas +Reviewed-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/pci/hotplug/acpiphp_glue.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/pci/hotplug/acpiphp_glue.c ++++ b/drivers/pci/hotplug/acpiphp_glue.c +@@ -554,6 +554,7 @@ static void enable_slot(struct acpiphp_s + slot->flags &= (~SLOT_ENABLED); + continue; + } ++ pci_dev_put(dev); + } + } + diff --git a/patches.suse/ALSA-bebob-oxfw-fix-Kconfig-entry-for-Mackie-d.2-Pro.patch b/patches.suse/ALSA-bebob-oxfw-fix-Kconfig-entry-for-Mackie-d.2-Pro.patch new file mode 100644 index 0000000..94f56eb --- /dev/null +++ b/patches.suse/ALSA-bebob-oxfw-fix-Kconfig-entry-for-Mackie-d.2-Pro.patch @@ -0,0 +1,81 @@ +From 0edabdfe89581669609eaac5f6a8d0ae6fe95e7f Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Thu, 13 May 2021 21:56:49 +0900 +Subject: [PATCH] ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro +Git-commit: 0edabdfe89581669609eaac5f6a8d0ae6fe95e7f +Patch-mainline: v5.13-rc3 +References: git-fixes + +Mackie d.2 has an extension card for IEEE 1394 communication, which uses +BridgeCo DM1000 ASIC. On the other hand, Mackie d.4 Pro has built-in +function for IEEE 1394 communication by Oxford Semiconductor OXFW971, +according to schematic diagram available in Mackie website. Although I +misunderstood that Mackie d.2 Pro would be also a model with OXFW971, +it's wrong. Mackie d.2 Pro is a model which includes the extension card +as factory settings. + +This commit fixes entries in Kconfig and comment in ALSA OXFW driver. + +Cc: +Fixes: fd6f4b0dc167 ("ALSA: bebob: Add skelton for BeBoB based devices") +Fixes: ec4dba5053e1 ("ALSA: oxfw: Add support for Behringer/Mackie devices") +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20210513125652.110249-3-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai + +--- + sound/firewire/Kconfig | 4 ++-- + sound/firewire/bebob/bebob.c | 2 +- + sound/firewire/oxfw/oxfw.c | 1 - + 3 files changed, 3 insertions(+), 4 deletions(-) + +diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig +index 25778765cbfe..9897bd26a438 100644 +--- a/sound/firewire/Kconfig ++++ b/sound/firewire/Kconfig +@@ -38,7 +38,7 @@ config SND_OXFW + * Mackie(Loud) Onyx 1640i (former model) + * Mackie(Loud) Onyx Satellite + * Mackie(Loud) Tapco Link.Firewire +- * Mackie(Loud) d.2 pro/d.4 pro ++ * Mackie(Loud) d.4 pro + * Mackie(Loud) U.420/U.420d + * TASCAM FireOne + * Stanton Controllers & Systems 1 Deck/Mixer +@@ -84,7 +84,7 @@ config SND_BEBOB + * PreSonus FIREBOX/FIREPOD/FP10/Inspire1394 + * BridgeCo RDAudio1/Audio5 + * Mackie Onyx 1220/1620/1640 (FireWire I/O Card) +- * Mackie d.2 (FireWire Option) ++ * Mackie d.2 (FireWire Option) and d.2 Pro + * Stanton FinalScratch 2 (ScratchAmp) + * Tascam IF-FW/DM + * Behringer XENIX UFX 1204/1604 +diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c +index 2c8e3392a490..daeecfa8b9aa 100644 +--- a/sound/firewire/bebob/bebob.c ++++ b/sound/firewire/bebob/bebob.c +@@ -387,7 +387,7 @@ static const struct ieee1394_device_id bebob_id_table[] = { + SND_BEBOB_DEV_ENTRY(VEN_BRIDGECO, 0x00010049, &spec_normal), + /* Mackie, Onyx 1220/1620/1640 (Firewire I/O Card) */ + SND_BEBOB_DEV_ENTRY(VEN_MACKIE2, 0x00010065, &spec_normal), +- /* Mackie, d.2 (Firewire Option) */ ++ // Mackie, d.2 (Firewire option card) and d.2 Pro (the card is built-in). + SND_BEBOB_DEV_ENTRY(VEN_MACKIE1, 0x00010067, &spec_normal), + /* Stanton, ScratchAmp */ + SND_BEBOB_DEV_ENTRY(VEN_STANTON, 0x00000001, &spec_normal), +diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c +index 1f1e3236efb8..9eea25c46dc7 100644 +--- a/sound/firewire/oxfw/oxfw.c ++++ b/sound/firewire/oxfw/oxfw.c +@@ -355,7 +355,6 @@ static const struct ieee1394_device_id oxfw_id_table[] = { + * Onyx-i series (former models): 0x081216 + * Mackie Onyx Satellite: 0x00200f + * Tapco LINK.firewire 4x6: 0x000460 +- * d.2 pro: Unknown + * d.4 pro: Unknown + * U.420: Unknown + * U.420d: Unknown +-- +2.26.2 + diff --git a/patches.suse/ALSA-emu8000-Fix-a-use-after-free-in-snd_emu8000_cre.patch b/patches.suse/ALSA-emu8000-Fix-a-use-after-free-in-snd_emu8000_cre.patch new file mode 100644 index 0000000..a8efad8 --- /dev/null +++ b/patches.suse/ALSA-emu8000-Fix-a-use-after-free-in-snd_emu8000_cre.patch @@ -0,0 +1,48 @@ +From 1c98f574403dbcf2eb832d5535a10d967333ef2d Mon Sep 17 00:00:00 2001 +From: Lv Yunlong +Date: Mon, 26 Apr 2021 06:11:29 -0700 +Subject: [PATCH] ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer +Git-commit: 1c98f574403dbcf2eb832d5535a10d967333ef2d +Patch-mainline: v5.13-rc1 +References: git-fixes + +Our code analyzer reported a uaf. + +In snd_emu8000_create_mixer, the callee snd_ctl_add(..,emu->controls[i]) +calls snd_ctl_add_replace(.., kcontrol,..). Inside snd_ctl_add_replace(), +if error happens, kcontrol will be freed by snd_ctl_free_one(kcontrol). +Then emu->controls[i] points to a freed memory, and the execution comes +to __error branch of snd_emu8000_create_mixer. The freed emu->controls[i] +is used in snd_ctl_remove(card, emu->controls[i]). + +My patch set emu->controls[i] to NULL if snd_ctl_add() failed to avoid +the uaf. + +Signed-off-by: Lv Yunlong +Cc: +Link: https://lore.kernel.org/r/20210426131129.4796-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Takashi Iwai + +--- + sound/isa/sb/emu8000.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/isa/sb/emu8000.c b/sound/isa/sb/emu8000.c +index 0aa545ac6e60..1c90421a88dc 100644 +--- a/sound/isa/sb/emu8000.c ++++ b/sound/isa/sb/emu8000.c +@@ -1029,8 +1029,10 @@ snd_emu8000_create_mixer(struct snd_card *card, struct snd_emu8000 *emu) + + memset(emu->controls, 0, sizeof(emu->controls)); + for (i = 0; i < EMU8000_NUM_CONTROLS; i++) { +- if ((err = snd_ctl_add(card, emu->controls[i] = snd_ctl_new1(mixer_defs[i], emu))) < 0) ++ if ((err = snd_ctl_add(card, emu->controls[i] = snd_ctl_new1(mixer_defs[i], emu))) < 0) { ++ emu->controls[i] = NULL; + goto __error; ++ } + } + return 0; + +-- +2.26.2 + diff --git a/patches.suse/ALSA-hda-conexant-Re-order-CX5066-quirk-table-entrie.patch b/patches.suse/ALSA-hda-conexant-Re-order-CX5066-quirk-table-entrie.patch new file mode 100644 index 0000000..19f4118 --- /dev/null +++ b/patches.suse/ALSA-hda-conexant-Re-order-CX5066-quirk-table-entrie.patch @@ -0,0 +1,50 @@ +From 2e6a731296be9d356fdccee9fb6ae345dad96438 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 28 Apr 2021 13:27:04 +0200 +Subject: [PATCH] ALSA: hda/conexant: Re-order CX5066 quirk table entries +Git-commit: 2e6a731296be9d356fdccee9fb6ae345dad96438 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Just re-order the cx5066_fixups[] entries for HP devices for avoiding +the oversight of the duplicated or unapplied item in future. +No functional changes. + +Also Cc-to-stable for the further patch applications. + +Cc: +Link: https://lore.kernel.org/r/20210428112704.23967-14-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_conexant.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -911,18 +911,18 @@ static const struct snd_pci_quirk cxt506 + SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK), +- SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK), +- SND_PCI_QUIRK(0x103c, 0x83b2, "HP EliteBook 840 G5", CXT_FIXUP_HP_DOCK), +- SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK), +- SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK), +- SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), + SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC), + SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO), ++ SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), + SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO), +- SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO), +- SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO), ++ SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO), ++ SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO), ++ SND_PCI_QUIRK(0x103c, 0x83b2, "HP EliteBook 840 G5", CXT_FIXUP_HP_DOCK), ++ SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK), ++ SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x8402, "HP ProBook 645 G4", CXT_FIXUP_MUTE_LED_GPIO), + SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x8456, "HP Z2 G4 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), diff --git a/patches.suse/ALSA-hda-realtek-Re-order-ALC269-Lenovo-quirk-table-.patch b/patches.suse/ALSA-hda-realtek-Re-order-ALC269-Lenovo-quirk-table-.patch new file mode 100644 index 0000000..83a9cd8 --- /dev/null +++ b/patches.suse/ALSA-hda-realtek-Re-order-ALC269-Lenovo-quirk-table-.patch @@ -0,0 +1,56 @@ +From f552ff54c2a700616a02b038e4bf3cbf859f65b7 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 28 Apr 2021 13:27:00 +0200 +Subject: [PATCH] ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries +Git-commit: f552ff54c2a700616a02b038e4bf3cbf859f65b7 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Just re-order the alc269_fixup_tbl[] entries for Lenovo devices for +avoiding the oversight of the duplicated or unapplied item in future. +No functional changes. + +Also Cc-to-stable for the further patch applications. + +Cc: +Link: https://lore.kernel.org/r/20210428112704.23967-10-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 53967d50d382..539bae66a4ba 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8266,9 +8266,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x21ca, "Thinkpad L412", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE), ++ SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST), + SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK), +- SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2203, "Thinkpad X230 Tablet", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2208, "Thinkpad T431s", ALC269_FIXUP_LENOVO_DOCK), +@@ -8313,6 +8313,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), + SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI), ++ SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K), + SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC), + SND_PCI_QUIRK(0x17aa, 0x501e, "Thinkpad L440", ALC292_FIXUP_TPT440_DOCK), +@@ -8331,7 +8332,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x17aa, 0x511e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), +- SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K), + SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD), + SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS), + SND_PCI_QUIRK(0x1b35, 0x1235, "CZC B20", ALC269_FIXUP_CZC_B20), +-- +2.26.2 + diff --git a/patches.suse/ALSA-hda-realtek-Re-order-ALC269-Sony-quirk-table-en.patch b/patches.suse/ALSA-hda-realtek-Re-order-ALC269-Sony-quirk-table-en.patch new file mode 100644 index 0000000..b4cf998 --- /dev/null +++ b/patches.suse/ALSA-hda-realtek-Re-order-ALC269-Sony-quirk-table-en.patch @@ -0,0 +1,44 @@ +From cab561f8d4bc9b196ae20c960aa5da89fd786ab5 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 28 Apr 2021 13:26:59 +0200 +Subject: [PATCH] ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries +Git-commit: cab561f8d4bc9b196ae20c960aa5da89fd786ab5 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Just re-order the alc269_fixup_tbl[] entries for Sony devices for +avoiding the oversight of the duplicated or unapplied item in future. +No functional changes. + +Also Cc-to-stable for the further patch applications. + +Cc: +Link: https://lore.kernel.org/r/20210428112704.23967-9-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index d99666c706b7..53967d50d382 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8186,12 +8186,12 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x8516, "ASUS X101CH", ALC269_FIXUP_ASUS_X101), +- SND_PCI_QUIRK(0x104d, 0x90b5, "Sony VAIO Pro 11", ALC286_FIXUP_SONY_MIC_NO_PRESENCE), +- SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x104d, 0x9073, "Sony VAIO", ALC275_FIXUP_SONY_VAIO_GPIO2), + SND_PCI_QUIRK(0x104d, 0x907b, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ), + SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ), + SND_PCI_QUIRK(0x104d, 0x9099, "Sony VAIO S13", ALC275_FIXUP_SONY_DISABLE_AAMIX), ++ SND_PCI_QUIRK(0x104d, 0x90b5, "Sony VAIO Pro 11", ALC286_FIXUP_SONY_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK), + SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT), + SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN), +-- +2.26.2 + diff --git a/patches.suse/ALSA-hda-realtek-Re-order-ALC882-Acer-quirk-table-en.patch b/patches.suse/ALSA-hda-realtek-Re-order-ALC882-Acer-quirk-table-en.patch new file mode 100644 index 0000000..43cf022 --- /dev/null +++ b/patches.suse/ALSA-hda-realtek-Re-order-ALC882-Acer-quirk-table-en.patch @@ -0,0 +1,46 @@ +From b265047ac56bad8c4f3d0c8bf9cb4e828ee0d28e Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 28 Apr 2021 13:26:52 +0200 +Subject: [PATCH] ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries +Git-commit: b265047ac56bad8c4f3d0c8bf9cb4e828ee0d28e +Patch-mainline: v5.13-rc1 +References: git-fixes + +Just re-order the alc882_fixup_tbl[] entries for Acer devices for +avoiding the oversight of the duplicated or unapplied item in future. +No functional changes. + +Also Cc-to-stable for the further patch applications. + +Cc: +Link: https://lore.kernel.org/r/20210428112704.23967-2-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 4a3939c45a12..bc4136b2b82f 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2470,13 +2470,13 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { + ALC882_FIXUP_ACER_ASPIRE_8930G), + SND_PCI_QUIRK(0x1025, 0x0146, "Acer Aspire 6935G", + ALC882_FIXUP_ACER_ASPIRE_8930G), ++ SND_PCI_QUIRK(0x1025, 0x0142, "Acer Aspire 7730G", ++ ALC882_FIXUP_ACER_ASPIRE_4930G), ++ SND_PCI_QUIRK(0x1025, 0x0155, "Packard-Bell M5120", ALC882_FIXUP_PB_M5210), + SND_PCI_QUIRK(0x1025, 0x015e, "Acer Aspire 6930G", + ALC882_FIXUP_ACER_ASPIRE_4930G), + SND_PCI_QUIRK(0x1025, 0x0166, "Acer Aspire 6530G", + ALC882_FIXUP_ACER_ASPIRE_4930G), +- SND_PCI_QUIRK(0x1025, 0x0142, "Acer Aspire 7730G", +- ALC882_FIXUP_ACER_ASPIRE_4930G), +- SND_PCI_QUIRK(0x1025, 0x0155, "Packard-Bell M5120", ALC882_FIXUP_PB_M5210), + SND_PCI_QUIRK(0x1025, 0x021e, "Acer Aspire 5739G", + ALC882_FIXUP_ACER_ASPIRE_4930G), + SND_PCI_QUIRK(0x1025, 0x0259, "Acer Aspire 5935", ALC889_FIXUP_DAC_ROUTE), +-- +2.26.2 + diff --git a/patches.suse/ALSA-hda-realtek-Re-order-ALC882-Sony-quirk-table-en.patch b/patches.suse/ALSA-hda-realtek-Re-order-ALC882-Sony-quirk-table-en.patch new file mode 100644 index 0000000..37feff2 --- /dev/null +++ b/patches.suse/ALSA-hda-realtek-Re-order-ALC882-Sony-quirk-table-en.patch @@ -0,0 +1,43 @@ +From b7529c18feecb1af92f9db08c8e7fe446a82d96d Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 28 Apr 2021 13:26:53 +0200 +Subject: [PATCH] ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries +Git-commit: b7529c18feecb1af92f9db08c8e7fe446a82d96d +Patch-mainline: v5.13-rc1 +References: git-fixes + +Just re-order the alc882_fixup_tbl[] entries for Sony devices for +avoiding the oversight of the duplicated or unapplied item in future. +No functional changes. + +Also Cc-to-stable for the further patch applications. + +Cc: +Link: https://lore.kernel.org/r/20210428112704.23967-3-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index bc4136b2b82f..61a7c2f7a648 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2489,11 +2489,11 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601), + SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS), + SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3), ++ SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP), ++ SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP), + SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT), + SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP), + SND_PCI_QUIRK(0x104d, 0x9060, "Sony Vaio VPCL14M1R", ALC882_FIXUP_NO_PRIMARY_HP), +- SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP), +- SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP), + + /* All Apple entries are in codec SSIDs */ + SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF), +-- +2.26.2 + diff --git a/patches.suse/ALSA-hda-realtek-Remove-redundant-entry-for-ALC861-H.patch b/patches.suse/ALSA-hda-realtek-Remove-redundant-entry-for-ALC861-H.patch new file mode 100644 index 0000000..bcf0b74 --- /dev/null +++ b/patches.suse/ALSA-hda-realtek-Remove-redundant-entry-for-ALC861-H.patch @@ -0,0 +1,40 @@ +From defce244b01ee12534910a4544e11be5eb927d25 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 28 Apr 2021 13:27:03 +0200 +Subject: [PATCH] ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices +Git-commit: defce244b01ee12534910a4544e11be5eb927d25 +Patch-mainline: v5.13-rc1 +References: git-fixes + +The quirk entry for Uniwill ECS M31EI is with the PCI SSID device 0, +which means matching with all. That is, it's essentially equivalent +with SND_PCI_QUIRK_VENDOR(0x1584), which also matches with the +previous entry for Haier W18 applying the very same quirk. + +Let's unify them with the single vendor-quirk entry. + +Cc: +Link: https://lore.kernel.org/r/20210428112704.23967-13-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index cbed3c610170..bd7bfd7c9ee7 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9290,8 +9290,7 @@ static const struct snd_pci_quirk alc861_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", ALC861_FIXUP_ASUS_A6RP), + SND_PCI_QUIRK_VENDOR(0x1043, "ASUS laptop", ALC861_FIXUP_AMP_VREF_0F), + SND_PCI_QUIRK(0x1462, 0x7254, "HP DX2200", ALC861_FIXUP_NO_JACK_DETECT), +- SND_PCI_QUIRK(0x1584, 0x2b01, "Haier W18", ALC861_FIXUP_AMP_VREF_0F), +- SND_PCI_QUIRK(0x1584, 0x0000, "Uniwill ECS M31EI", ALC861_FIXUP_AMP_VREF_0F), ++ SND_PCI_QUIRK_VENDOR(0x1584, "Haier/Uniwill", ALC861_FIXUP_AMP_VREF_0F), + SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", ALC861_FIXUP_FSC_AMILO_PI1505), + {} + }; +-- +2.26.2 + diff --git a/patches.suse/ALSA-hda-realtek-reset-eapd-coeff-to-default-value-f.patch b/patches.suse/ALSA-hda-realtek-reset-eapd-coeff-to-default-value-f.patch new file mode 100644 index 0000000..db90303 --- /dev/null +++ b/patches.suse/ALSA-hda-realtek-reset-eapd-coeff-to-default-value-f.patch @@ -0,0 +1,57 @@ +From 8822702f6e4c8917c83ba79e0ebf2c8c218910d4 Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Fri, 7 May 2021 10:44:52 +0800 +Subject: [PATCH] ALSA: hda/realtek: reset eapd coeff to default value for alc287 +Git-commit: 8822702f6e4c8917c83ba79e0ebf2c8c218910d4 +Patch-mainline: v5.13-rc3 +References: git-fixes + +Ubuntu users reported an audio bug on the Lenovo Yoga Slim 7 14IIL05, +he installed dual OS (Windows + Linux), if he booted to the Linux +from Windows, the Speaker can't work well, it has crackling noise, +if he poweroff the machine first after Windows, the Speaker worked +well. + +Before rebooting or shutdown from Windows, the Windows changes the +codec eapd coeff value, but the BIOS doesn't re-initialize its value, +when booting into the Linux from Windows, the eapd coeff value is not +correct. To fix it, set the codec default value to that coeff register +in the alsa driver. + +Buglink: http://bugs.launchpad.net/bugs/1925057 +Suggested-by: Kailang Yang +Cc: +Signed-off-by: Hui Wang +Link: https://lore.kernel.org/r/20210507024452.8300-1-hui.wang@canonical.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 6d58f24c9702..a5f3e78ec04e 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -395,7 +395,6 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0282: + case 0x10ec0283: + case 0x10ec0286: +- case 0x10ec0287: + case 0x10ec0288: + case 0x10ec0285: + case 0x10ec0298: +@@ -406,6 +405,10 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0275: + alc_update_coef_idx(codec, 0xe, 0, 1<<0); + break; ++ case 0x10ec0287: ++ alc_update_coef_idx(codec, 0x10, 1<<9, 0); ++ alc_write_coef_idx(codec, 0x8, 0x4ab7); ++ break; + case 0x10ec0293: + alc_update_coef_idx(codec, 0xa, 1<<13, 0); + break; +-- +2.26.2 + diff --git a/patches.suse/ALSA-hdsp-don-t-disable-if-not-enabled.patch b/patches.suse/ALSA-hdsp-don-t-disable-if-not-enabled.patch new file mode 100644 index 0000000..1008ec9 --- /dev/null +++ b/patches.suse/ALSA-hdsp-don-t-disable-if-not-enabled.patch @@ -0,0 +1,48 @@ +From 507cdb9adba006a7798c358456426e1aea3d9c4f Mon Sep 17 00:00:00 2001 +From: Tong Zhang +Date: Sun, 21 Mar 2021 11:38:38 -0400 +Subject: [PATCH] ALSA: hdsp: don't disable if not enabled +Git-commit: 507cdb9adba006a7798c358456426e1aea3d9c4f +Patch-mainline: v5.13-rc1 +References: git-fixes + +hdsp wants to disable a not enabled pci device, which makes kernel +throw a warning. Make sure the device is enabled before calling disable. + +[ 1.758292] snd_hdsp 0000:00:03.0: disabling already-disabled device +[ 1.758327] WARNING: CPU: 0 PID: 180 at drivers/pci/pci.c:2146 pci_disable_device+0x91/0xb0 +[ 1.766985] Call Trace: +[ 1.767121] snd_hdsp_card_free+0x94/0xf0 [snd_hdsp] +[ 1.767388] release_card_device+0x4b/0x80 [snd] +[ 1.767639] device_release+0x3b/0xa0 +[ 1.767838] kobject_put+0x94/0x1b0 +[ 1.768027] put_device+0x13/0x20 +[ 1.768207] snd_card_free+0x61/0x90 [snd] +[ 1.768430] snd_hdsp_probe+0x524/0x5e0 [snd_hdsp] + +Suggested-by: Takashi Iwai +Signed-off-by: Tong Zhang +Link: https://lore.kernel.org/r/20210321153840.378226-2-ztong0001@gmail.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/rme9652/hdsp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c +index 6d9029333a12..ab9a32a2f5bb 100644 +--- a/sound/pci/rme9652/hdsp.c ++++ b/sound/pci/rme9652/hdsp.c +@@ -5393,7 +5393,8 @@ static int snd_hdsp_free(struct hdsp *hdsp) + if (hdsp->port) + pci_release_regions(hdsp->pci); + +- pci_disable_device(hdsp->pci); ++ if (pci_is_enabled(hdsp->pci)) ++ pci_disable_device(hdsp->pci); + return 0; + } + +-- +2.26.2 + diff --git a/patches.suse/ALSA-hdspm-don-t-disable-if-not-enabled.patch b/patches.suse/ALSA-hdspm-don-t-disable-if-not-enabled.patch new file mode 100644 index 0000000..ff7e23f --- /dev/null +++ b/patches.suse/ALSA-hdspm-don-t-disable-if-not-enabled.patch @@ -0,0 +1,48 @@ +From 790f5719b85e12e10c41753b864e74249585ed08 Mon Sep 17 00:00:00 2001 +From: Tong Zhang +Date: Sun, 21 Mar 2021 11:38:39 -0400 +Subject: [PATCH] ALSA: hdspm: don't disable if not enabled +Git-commit: 790f5719b85e12e10c41753b864e74249585ed08 +Patch-mainline: v5.13-rc1 +References: git-fixes + +hdspm wants to disable a not enabled pci device, which makes kernel +throw a warning. Make sure the device is enabled before calling disable. + +[ 1.786391] snd_hdspm 0000:00:03.0: disabling already-disabled device +[ 1.786400] WARNING: CPU: 0 PID: 182 at drivers/pci/pci.c:2146 pci_disable_device+0x91/0xb0 +[ 1.795181] Call Trace: +[ 1.795320] snd_hdspm_card_free+0x58/0xa0 [snd_hdspm] +[ 1.795595] release_card_device+0x4b/0x80 [snd] +[ 1.795860] device_release+0x3b/0xa0 +[ 1.796072] kobject_put+0x94/0x1b0 +[ 1.796260] put_device+0x13/0x20 +[ 1.796438] snd_card_free+0x61/0x90 [snd] +[ 1.796659] snd_hdspm_probe+0x97b/0x1440 [snd_hdspm] + +Suggested-by: Takashi Iwai +Signed-off-by: Tong Zhang +Link: https://lore.kernel.org/r/20210321153840.378226-3-ztong0001@gmail.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/rme9652/hdspm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c +index b66711574b1a..6edc31b44b22 100644 +--- a/sound/pci/rme9652/hdspm.c ++++ b/sound/pci/rme9652/hdspm.c +@@ -6884,7 +6884,8 @@ static int snd_hdspm_free(struct hdspm * hdspm) + if (hdspm->port) + pci_release_regions(hdspm->pci); + +- pci_disable_device(hdspm->pci); ++ if (pci_is_enabled(hdspm->pci)) ++ pci_disable_device(hdspm->pci); + return 0; + } + +-- +2.26.2 + diff --git a/patches.suse/ALSA-line6-Fix-racy-initialization-of-LINE6-MIDI.patch b/patches.suse/ALSA-line6-Fix-racy-initialization-of-LINE6-MIDI.patch new file mode 100644 index 0000000..a3890db --- /dev/null +++ b/patches.suse/ALSA-line6-Fix-racy-initialization-of-LINE6-MIDI.patch @@ -0,0 +1,93 @@ +From 05ca447630334c323c9e2b788b61133ab75d60d3 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 18 May 2021 10:39:39 +0200 +Subject: [PATCH] ALSA: line6: Fix racy initialization of LINE6 MIDI +Git-commit: 05ca447630334c323c9e2b788b61133ab75d60d3 +Patch-mainline: v5.13-rc3 +References: git-fixes + +The initialization of MIDI devices that are found on some LINE6 +drivers are currently done in a racy way; namely, the MIDI buffer +instance is allocated and initialized in each private_init callback +while the communication with the interface is already started via +line6_init_cap_control() call before that point. This may lead to +Oops in line6_data_received() when a spurious event is received, as +reported by syzkaller. + +This patch moves the MIDI initialization to line6_init_cap_control() +as well instead of the too-lately-called private_init for avoiding the +race. Also this reduces slightly more lines, so it's a win-win +change. + +Reported-by: syzbot+0d2b3feb0a2887862e06@syzkallerlkml..appspotmail.com +Link: https://lore.kernel.org/r/000000000000a4be9405c28520de@google.com +Link: https://lore.kernel.org/r/20210517132725.GA50495@hyeyoo +Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> +Cc: +Link: https://lore.kernel.org/r/20210518083939.1927-1-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/usb/line6/driver.c | 4 ++++ + sound/usb/line6/pod.c | 5 ----- + sound/usb/line6/variax.c | 6 ------ + 3 files changed, 4 insertions(+), 11 deletions(-) + +diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c +index a030dd65eb28..9602929b7de9 100644 +--- a/sound/usb/line6/driver.c ++++ b/sound/usb/line6/driver.c +@@ -699,6 +699,10 @@ static int line6_init_cap_control(struct usb_line6 *line6) + line6->buffer_message = kmalloc(LINE6_MIDI_MESSAGE_MAXLEN, GFP_KERNEL); + if (!line6->buffer_message) + return -ENOMEM; ++ ++ ret = line6_init_midi(line6); ++ if (ret < 0) ++ return ret; + } else { + ret = line6_hwdep_init(line6); + if (ret < 0) +diff --git a/sound/usb/line6/pod.c b/sound/usb/line6/pod.c +index cd44cb5f1310..16e644330c4d 100644 +--- a/sound/usb/line6/pod.c ++++ b/sound/usb/line6/pod.c +@@ -376,11 +376,6 @@ static int pod_init(struct usb_line6 *line6, + if (err < 0) + return err; + +- /* initialize MIDI subsystem: */ +- err = line6_init_midi(line6); +- if (err < 0) +- return err; +- + /* initialize PCM subsystem: */ + err = line6_init_pcm(line6, &pod_pcm_properties); + if (err < 0) +diff --git a/sound/usb/line6/variax.c b/sound/usb/line6/variax.c +index ed158f04de80..c2245aa93b08 100644 +--- a/sound/usb/line6/variax.c ++++ b/sound/usb/line6/variax.c +@@ -159,7 +159,6 @@ static int variax_init(struct usb_line6 *line6, + const struct usb_device_id *id) + { + struct usb_line6_variax *variax = line6_to_variax(line6); +- int err; + + line6->process_message = line6_variax_process_message; + line6->disconnect = line6_variax_disconnect; +@@ -172,11 +171,6 @@ static int variax_init(struct usb_line6 *line6, + if (variax->buffer_activate == NULL) + return -ENOMEM; + +- /* initialize MIDI subsystem: */ +- err = line6_init_midi(&variax->line6); +- if (err < 0) +- return err; +- + /* initiate startup procedure: */ + schedule_delayed_work(&line6->startup_work, + msecs_to_jiffies(VARIAX_STARTUP_DELAY1)); +-- +2.26.2 + diff --git a/patches.suse/ALSA-rme9652-don-t-disable-if-not-enabled.patch b/patches.suse/ALSA-rme9652-don-t-disable-if-not-enabled.patch new file mode 100644 index 0000000..dff601d --- /dev/null +++ b/patches.suse/ALSA-rme9652-don-t-disable-if-not-enabled.patch @@ -0,0 +1,48 @@ +From f57a741874bb6995089020e97a1dcdf9b165dcbe Mon Sep 17 00:00:00 2001 +From: Tong Zhang +Date: Sun, 21 Mar 2021 11:38:40 -0400 +Subject: [PATCH] ALSA: rme9652: don't disable if not enabled +Git-commit: f57a741874bb6995089020e97a1dcdf9b165dcbe +Patch-mainline: v5.13-rc1 +References: git-fixes + +rme9652 wants to disable a not enabled pci device, which makes kernel +throw a warning. Make sure the device is enabled before calling disable. + +[ 1.751595] snd_rme9652 0000:00:03.0: disabling already-disabled device +[ 1.751605] WARNING: CPU: 0 PID: 174 at drivers/pci/pci.c:2146 pci_disable_device+0x91/0xb0 +[ 1.759968] Call Trace: +[ 1.760145] snd_rme9652_card_free+0x76/0xa0 [snd_rme9652] +[ 1.760434] release_card_device+0x4b/0x80 [snd] +[ 1.760679] device_release+0x3b/0xa0 +[ 1.760874] kobject_put+0x94/0x1b0 +[ 1.761059] put_device+0x13/0x20 +[ 1.761235] snd_card_free+0x61/0x90 [snd] +[ 1.761454] snd_rme9652_probe+0x3be/0x700 [snd_rme9652] + +Suggested-by: Takashi Iwai +Signed-off-by: Tong Zhang +Link: https://lore.kernel.org/r/20210321153840.378226-4-ztong0001@gmail.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/rme9652/rme9652.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/rme9652/rme9652.c b/sound/pci/rme9652/rme9652.c +index 012fbec5e6a7..0f4ab86a29f6 100644 +--- a/sound/pci/rme9652/rme9652.c ++++ b/sound/pci/rme9652/rme9652.c +@@ -1733,7 +1733,8 @@ static int snd_rme9652_free(struct snd_rme9652 *rme9652) + if (rme9652->port) + pci_release_regions(rme9652->pci); + +- pci_disable_device(rme9652->pci); ++ if (pci_is_enabled(rme9652->pci)) ++ pci_disable_device(rme9652->pci); + return 0; + } + +-- +2.26.2 + diff --git a/patches.suse/ALSA-sb-Fix-two-use-after-free-in-snd_sb_qsound_buil.patch b/patches.suse/ALSA-sb-Fix-two-use-after-free-in-snd_sb_qsound_buil.patch new file mode 100644 index 0000000..16d858b --- /dev/null +++ b/patches.suse/ALSA-sb-Fix-two-use-after-free-in-snd_sb_qsound_buil.patch @@ -0,0 +1,54 @@ +From 4fb44dd2c1dda18606348acdfdb97e8759dde9df Mon Sep 17 00:00:00 2001 +From: Lv Yunlong +Date: Mon, 26 Apr 2021 07:55:41 -0700 +Subject: [PATCH] ALSA: sb: Fix two use after free in snd_sb_qsound_build +Git-commit: 4fb44dd2c1dda18606348acdfdb97e8759dde9df +Patch-mainline: v5.13-rc1 +References: git-fixes + +In snd_sb_qsound_build, snd_ctl_add(..,p->qsound_switch...) and +snd_ctl_add(..,p->qsound_space..) are called. But the second +arguments of snd_ctl_add() could be freed via snd_ctl_add_replace() +->snd_ctl_free_one(). After the error code is returned, +snd_sb_qsound_destroy(p) is called in __error branch. + +But in snd_sb_qsound_destroy(), the freed p->qsound_switch and +p->qsound_space are still used by snd_ctl_remove(). + +My patch set p->qsound_switch and p->qsound_space to NULL if +snd_ctl_add() failed to avoid the uaf bugs. But these codes need +to further be improved with the code style. + +Signed-off-by: Lv Yunlong +Cc: +Link: https://lore.kernel.org/r/20210426145541.8070-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Takashi Iwai + +--- + sound/isa/sb/sb16_csp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c +index 8635a2b6b36b..4789345a8fdd 100644 +--- a/sound/isa/sb/sb16_csp.c ++++ b/sound/isa/sb/sb16_csp.c +@@ -1045,10 +1045,14 @@ static int snd_sb_qsound_build(struct snd_sb_csp * p) + + spin_lock_init(&p->q_lock); + +- if ((err = snd_ctl_add(card, p->qsound_switch = snd_ctl_new1(&snd_sb_qsound_switch, p))) < 0) ++ if ((err = snd_ctl_add(card, p->qsound_switch = snd_ctl_new1(&snd_sb_qsound_switch, p))) < 0) { ++ p->qsound_switch = NULL; + goto __error; +- if ((err = snd_ctl_add(card, p->qsound_space = snd_ctl_new1(&snd_sb_qsound_space, p))) < 0) ++ } ++ if ((err = snd_ctl_add(card, p->qsound_space = snd_ctl_new1(&snd_sb_qsound_space, p))) < 0) { ++ p->qsound_space = NULL; + goto __error; ++ } + + return 0; + +-- +2.26.2 + diff --git a/patches.suse/ALSA-usb-audio-Add-MIDI-quirk-for-Vox-ToneLab-EX.patch b/patches.suse/ALSA-usb-audio-Add-MIDI-quirk-for-Vox-ToneLab-EX.patch new file mode 100644 index 0000000..4123238 --- /dev/null +++ b/patches.suse/ALSA-usb-audio-Add-MIDI-quirk-for-Vox-ToneLab-EX.patch @@ -0,0 +1,44 @@ +From 64f40f9be14106e7df0098c427cb60be645bddb7 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 7 Apr 2021 16:45:49 +0200 +Subject: [PATCH] ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX +Git-commit: 64f40f9be14106e7df0098c427cb60be645bddb7 +Patch-mainline: v5.13-rc1 +References: git-fixes + +ToneLab EX guitar pedal device requires the same quirk like ToneLab ST +for supporting the MIDI. + +Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=212593 +Cc: +Link: https://lore.kernel.org/r/20210407144549.1530-1-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/usb/quirks-table.h | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 92f525b1c992..bdba37d0faab 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -2397,6 +2397,16 @@ YAMAHA_DEVICE(0x7010, "UB99"), + } + }, + ++{ ++ USB_DEVICE_VENDOR_SPEC(0x0944, 0x0204), ++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { ++ .vendor_name = "KORG, Inc.", ++ /* .product_name = "ToneLab EX", */ ++ .ifnum = 3, ++ .type = QUIRK_MIDI_STANDARD_INTERFACE, ++ } ++}, ++ + /* AKAI devices */ + { + USB_DEVICE(0x09e8, 0x0062), +-- +2.26.2 + diff --git a/patches.suse/ARM-footbridge-fix-PCI-interrupt-mapping.patch b/patches.suse/ARM-footbridge-fix-PCI-interrupt-mapping.patch new file mode 100644 index 0000000..90dd80e --- /dev/null +++ b/patches.suse/ARM-footbridge-fix-PCI-interrupt-mapping.patch @@ -0,0 +1,97 @@ +From: Russell King +Date: Thu, 25 Mar 2021 10:26:21 +0000 +Subject: ARM: footbridge: fix PCI interrupt mapping + +Git-commit: 30e3b4f256b4e366a61658c294f6a21b8626dda7 +Patch-mainline: v5.12-rc8 +References: git-fixes + +Since commit 30fdfb929e82 ("PCI: Add a call to pci_assign_irq() in +pci_device_probe()"), the PCI code will call the IRQ mapping function +whenever a PCI driver is probed. If these are marked as __init, this +causes an oops if a PCI driver is loaded or bound after the kernel has +initialised. + +Fixes: 30fdfb929e82 ("PCI: Add a call to pci_assign_irq() in pci_device_probe()") +Signed-off-by: Russell King +Signed-off-by: Mian Yousaf Kaukab +--- + arch/arm/mach-footbridge/cats-pci.c | 4 ++-- + arch/arm/mach-footbridge/ebsa285-pci.c | 4 ++-- + arch/arm/mach-footbridge/netwinder-pci.c | 2 +- + arch/arm/mach-footbridge/personal-pci.c | 5 ++--- + 4 files changed, 7 insertions(+), 8 deletions(-) + +diff --git a/arch/arm/mach-footbridge/cats-pci.c b/arch/arm/mach-footbridge/cats-pci.c +index 0b2fd7e2e9b4..90b1e9be430e 100644 +--- a/arch/arm/mach-footbridge/cats-pci.c ++++ b/arch/arm/mach-footbridge/cats-pci.c +@@ -15,14 +15,14 @@ + #include + + /* cats host-specific stuff */ +-static int irqmap_cats[] __initdata = { IRQ_PCI, IRQ_IN0, IRQ_IN1, IRQ_IN3 }; ++static int irqmap_cats[] = { IRQ_PCI, IRQ_IN0, IRQ_IN1, IRQ_IN3 }; + + static u8 cats_no_swizzle(struct pci_dev *dev, u8 *pin) + { + return 0; + } + +-static int __init cats_map_irq(const struct pci_dev *dev, u8 slot, u8 pin) ++static int cats_map_irq(const struct pci_dev *dev, u8 slot, u8 pin) + { + if (dev->irq >= 255) + return -1; /* not a valid interrupt. */ +diff --git a/arch/arm/mach-footbridge/ebsa285-pci.c b/arch/arm/mach-footbridge/ebsa285-pci.c +index 6f28aaa9ca79..c3f280d08fa7 100644 +--- a/arch/arm/mach-footbridge/ebsa285-pci.c ++++ b/arch/arm/mach-footbridge/ebsa285-pci.c +@@ -14,9 +14,9 @@ + #include + #include + +-static int irqmap_ebsa285[] __initdata = { IRQ_IN3, IRQ_IN1, IRQ_IN0, IRQ_PCI }; ++static int irqmap_ebsa285[] = { IRQ_IN3, IRQ_IN1, IRQ_IN0, IRQ_PCI }; + +-static int __init ebsa285_map_irq(const struct pci_dev *dev, u8 slot, u8 pin) ++static int ebsa285_map_irq(const struct pci_dev *dev, u8 slot, u8 pin) + { + if (dev->vendor == PCI_VENDOR_ID_CONTAQ && + dev->device == PCI_DEVICE_ID_CONTAQ_82C693) +diff --git a/arch/arm/mach-footbridge/netwinder-pci.c b/arch/arm/mach-footbridge/netwinder-pci.c +index 9473aa0305e5..e8304392074b 100644 +--- a/arch/arm/mach-footbridge/netwinder-pci.c ++++ b/arch/arm/mach-footbridge/netwinder-pci.c +@@ -18,7 +18,7 @@ + * We now use the slot ID instead of the device identifiers to select + * which interrupt is routed where. + */ +-static int __init netwinder_map_irq(const struct pci_dev *dev, u8 slot, u8 pin) ++static int netwinder_map_irq(const struct pci_dev *dev, u8 slot, u8 pin) + { + switch (slot) { + case 0: /* host bridge */ +diff --git a/arch/arm/mach-footbridge/personal-pci.c b/arch/arm/mach-footbridge/personal-pci.c +index 4391e433a4b2..9d19aa98a663 100644 +--- a/arch/arm/mach-footbridge/personal-pci.c ++++ b/arch/arm/mach-footbridge/personal-pci.c +@@ -14,13 +14,12 @@ + #include + #include + +-static int irqmap_personal_server[] __initdata = { ++static int irqmap_personal_server[] = { + IRQ_IN0, IRQ_IN1, IRQ_IN2, IRQ_IN3, 0, 0, 0, + IRQ_DOORBELLHOST, IRQ_DMA1, IRQ_DMA2, IRQ_PCI + }; + +-static int __init personal_server_map_irq(const struct pci_dev *dev, u8 slot, +- u8 pin) ++static int personal_server_map_irq(const struct pci_dev *dev, u8 slot, u8 pin) + { + unsigned char line; + +-- +2.26.2 + diff --git a/patches.suse/ASoC-cs35l33-fix-an-error-code-in-probe.patch b/patches.suse/ASoC-cs35l33-fix-an-error-code-in-probe.patch new file mode 100644 index 0000000..a8a7ea2 --- /dev/null +++ b/patches.suse/ASoC-cs35l33-fix-an-error-code-in-probe.patch @@ -0,0 +1,36 @@ +From 833bc4cf9754643acc69b3c6b65988ca78df4460 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 20 May 2021 08:08:24 +0300 +Subject: [PATCH] ASoC: cs35l33: fix an error code in probe() +Git-commit: 833bc4cf9754643acc69b3c6b65988ca78df4460 +Patch-mainline: v5.13-rc4 +References: git-fixes + +This error path returns zero (success) but it should return -EINVAL. + +Fixes: 3333cb7187b9 ("ASoC: cs35l33: Initial commit of the cs35l33 CODEC driver.") +Signed-off-by: Dan Carpenter +Reviewed-by: Charles Keepax +Link: https://lore.kernel.org/r/YKXuyGEzhPT35R3G@mwanda +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/cs35l33.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/cs35l33.c b/sound/soc/codecs/cs35l33.c +index 7ad7b733af9b..e8f3dcfd144d 100644 +--- a/sound/soc/codecs/cs35l33.c ++++ b/sound/soc/codecs/cs35l33.c +@@ -1201,6 +1201,7 @@ static int cs35l33_i2c_probe(struct i2c_client *i2c_client, + dev_err(&i2c_client->dev, + "CS35L33 Device ID (%X). Expected ID %X\n", + devid, CS35L33_CHIP_ID); ++ ret = -EINVAL; + goto err_enable; + } + +-- +2.26.2 + diff --git a/patches.suse/ASoC-cs42l42-Regmap-must-use_single_read-write.patch b/patches.suse/ASoC-cs42l42-Regmap-must-use_single_read-write.patch new file mode 100644 index 0000000..41e0d00 --- /dev/null +++ b/patches.suse/ASoC-cs42l42-Regmap-must-use_single_read-write.patch @@ -0,0 +1,43 @@ +From 0fad605fb0bdc00d8ad78696300ff2fbdee6e048 Mon Sep 17 00:00:00 2001 +From: Richard Fitzgerald +Date: Tue, 11 May 2021 14:28:55 +0100 +Subject: [PATCH] ASoC: cs42l42: Regmap must use_single_read/write +Git-commit: 0fad605fb0bdc00d8ad78696300ff2fbdee6e048 +Patch-mainline: v5.13-rc4 +References: git-fixes + +cs42l42 does not support standard burst transfers so the use_single_read +and use_single_write flags must be set in the regmap config. + +Because of this bug, the patch: + +commit 0a0eb567e1d4 ("ASoC: cs42l42: Minor error paths fixups") + +broke cs42l42 probe() because without the use_single_* flags it causes +regmap to issue a burst read. + +However, the missing use_single_* could cause problems anyway because the +regmap cache can attempt burst transfers if these flags are not set. + +Fixes: 2c394ca79604 ("ASoC: Add support for CS42L42 codec") +Signed-off-by: Richard Fitzgerald +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20210511132855.27159-1-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/cs42l42.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/soc/codecs/cs42l42.c ++++ b/sound/soc/codecs/cs42l42.c +@@ -402,6 +402,8 @@ static const struct regmap_config cs42l4 + .reg_defaults = cs42l42_reg_defaults, + .num_reg_defaults = ARRAY_SIZE(cs42l42_reg_defaults), + .cache_type = REGCACHE_RBTREE, ++ ++ .use_single_rw = true, + }; + + static DECLARE_TLV_DB_SCALE(adc_tlv, -9600, 100, false); diff --git a/patches.suse/ASoC-rt286-Generalize-support-for-ALC3263-codec.patch b/patches.suse/ASoC-rt286-Generalize-support-for-ALC3263-codec.patch new file mode 100644 index 0000000..ee75eb4 --- /dev/null +++ b/patches.suse/ASoC-rt286-Generalize-support-for-ALC3263-codec.patch @@ -0,0 +1,99 @@ +From aa2f9c12821e6a4ba1df4fb34a3dbc6a2a1ee7fe Mon Sep 17 00:00:00 2001 +From: David Ward +Date: Sun, 18 Apr 2021 09:46:58 -0400 +Subject: [PATCH] ASoC: rt286: Generalize support for ALC3263 codec +Git-commit: aa2f9c12821e6a4ba1df4fb34a3dbc6a2a1ee7fe +Patch-mainline: v5.13-rc1 +References: git-fixes + +The ALC3263 codec on the XPS 13 9343 is also found on the Latitude 13 7350 +and Venue 11 Pro 7140. They require the same handling for the combo jack to +work with a headset: GPIO pin 6 must be set. + +The HDA driver always sets this pin on the ALC3263, which it distinguishes +by the codec vendor/device ID 0x10ec0288 and PCI subsystem vendor ID 0x1028 +(Dell). The ASoC driver does not use PCI, so adapt this check to use DMI to +determine if Dell is the system vendor. + +Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=150601 +Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=205961 +Signed-off-by: David Ward +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210418134658.4333-6-david.ward@gatech.edu +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/rt286.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c +index 45e4a48ef5bf..802f4851c3df 100644 +--- a/sound/soc/codecs/rt286.c ++++ b/sound/soc/codecs/rt286.c +@@ -1125,12 +1125,11 @@ static const struct dmi_system_id force_combo_jack_table[] = { + { } + }; + +-static const struct dmi_system_id dmi_dell_dino[] = { ++static const struct dmi_system_id dmi_dell[] = { + { +- .ident = "Dell Dino", ++ .ident = "Dell", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9343") + } + }, + { } +@@ -1141,7 +1140,7 @@ static int rt286_i2c_probe(struct i2c_client *i2c, + { + struct rt286_platform_data *pdata = dev_get_platdata(&i2c->dev); + struct rt286_priv *rt286; +- int i, ret, val; ++ int i, ret, vendor_id; + + rt286 = devm_kzalloc(&i2c->dev, sizeof(*rt286), + GFP_KERNEL); +@@ -1157,14 +1156,15 @@ static int rt286_i2c_probe(struct i2c_client *i2c, + } + + ret = regmap_read(rt286->regmap, +- RT286_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &val); ++ RT286_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &vendor_id); + if (ret != 0) { + dev_err(&i2c->dev, "I2C error %d\n", ret); + return ret; + } +- if (val != RT286_VENDOR_ID && val != RT288_VENDOR_ID) { ++ if (vendor_id != RT286_VENDOR_ID && vendor_id != RT288_VENDOR_ID) { + dev_err(&i2c->dev, +- "Device with ID register %#x is not rt286\n", val); ++ "Device with ID register %#x is not rt286\n", ++ vendor_id); + return -ENODEV; + } + +@@ -1188,8 +1188,8 @@ static int rt286_i2c_probe(struct i2c_client *i2c, + if (pdata) + rt286->pdata = *pdata; + +- if (dmi_check_system(force_combo_jack_table) || +- dmi_check_system(dmi_dell_dino)) ++ if ((vendor_id == RT288_VENDOR_ID && dmi_check_system(dmi_dell)) || ++ dmi_check_system(force_combo_jack_table)) + rt286->pdata.cbj_en = true; + + regmap_write(rt286->regmap, RT286_SET_AUDIO_POWER, AC_PWRST_D3); +@@ -1228,7 +1228,7 @@ static int rt286_i2c_probe(struct i2c_client *i2c, + regmap_update_bits(rt286->regmap, RT286_DEPOP_CTRL3, 0xf777, 0x4737); + regmap_update_bits(rt286->regmap, RT286_DEPOP_CTRL4, 0x00ff, 0x003f); + +- if (dmi_check_system(dmi_dell_dino)) { ++ if (vendor_id == RT288_VENDOR_ID && dmi_check_system(dmi_dell)) { + regmap_update_bits(rt286->regmap, + RT286_SET_GPIO_MASK, 0x40, 0x40); + regmap_update_bits(rt286->regmap, +-- +2.26.2 + diff --git a/patches.suse/ASoC-rt286-Make-RT286_SET_GPIO_-readable-and-writabl.patch b/patches.suse/ASoC-rt286-Make-RT286_SET_GPIO_-readable-and-writabl.patch new file mode 100644 index 0000000..9900ad2 --- /dev/null +++ b/patches.suse/ASoC-rt286-Make-RT286_SET_GPIO_-readable-and-writabl.patch @@ -0,0 +1,39 @@ +From cd8499d5c03ba260e3191e90236d0e5f6b147563 Mon Sep 17 00:00:00 2001 +From: David Ward +Date: Sun, 18 Apr 2021 09:46:57 -0400 +Subject: [PATCH] ASoC: rt286: Make RT286_SET_GPIO_* readable and writable +Git-commit: cd8499d5c03ba260e3191e90236d0e5f6b147563 +Patch-mainline: v5.13-rc1 +References: git-fixes + +The GPIO configuration cannot be applied if the registers are inaccessible. +This prevented the headset mic from working on the Dell XPS 13 9343. + +Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=114171 +Signed-off-by: David Ward +Link: https://lore.kernel.org/r/20210418134658.4333-5-david.ward@gatech.edu +Reviewed-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/rt286.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c +index f9b29782b62a..e16e7237156f 100644 +--- a/sound/soc/codecs/rt286.c ++++ b/sound/soc/codecs/rt286.c +@@ -171,6 +171,9 @@ static bool rt286_readable_register(struct device *dev, unsigned int reg) + case RT286_PROC_COEF: + case RT286_SET_AMP_GAIN_ADC_IN1: + case RT286_SET_AMP_GAIN_ADC_IN2: ++ case RT286_SET_GPIO_MASK: ++ case RT286_SET_GPIO_DIRECTION: ++ case RT286_SET_GPIO_DATA: + case RT286_SET_POWER(RT286_DAC_OUT1): + case RT286_SET_POWER(RT286_DAC_OUT2): + case RT286_SET_POWER(RT286_ADC_IN1): +-- +2.26.2 + diff --git a/patches.suse/Bluetooth-SMP-Fail-if-remote-and-local-public-keys-a.patch b/patches.suse/Bluetooth-SMP-Fail-if-remote-and-local-public-keys-a.patch new file mode 100644 index 0000000..e590397 --- /dev/null +++ b/patches.suse/Bluetooth-SMP-Fail-if-remote-and-local-public-keys-a.patch @@ -0,0 +1,42 @@ +From 6d19628f539fccf899298ff02ee4c73e4bf6df3f Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Wed, 10 Mar 2021 14:13:08 -0800 +Subject: [PATCH] Bluetooth: SMP: Fail if remote and local public keys are identical +Git-commit: 6d19628f539fccf899298ff02ee4c73e4bf6df3f +Patch-mainline: v5.13-rc1 +References: git-fixes + +This fails the pairing procedure when both remote and local non-debug +public keys are identical. + +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Acked-by: Takashi Iwai + +--- + net/bluetooth/smp.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c +index b0c1ee110eff..e03cc284161c 100644 +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -2732,6 +2732,15 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb) + if (skb->len < sizeof(*key)) + return SMP_INVALID_PARAMS; + ++ /* Check if remote and local public keys are the same and debug key is ++ * not in use. ++ */ ++ if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) && ++ !crypto_memneq(key, smp->local_pk, 64)) { ++ bt_dev_err(hdev, "Remote and local public keys are identical"); ++ return SMP_UNSPECIFIED; ++ } ++ + memcpy(smp->remote_pk, key, 64); + + if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) { +-- +2.26.2 + diff --git a/patches.suse/Bluetooth-Set-CONF_NOT_COMPLETE-as-l2cap_chan-defaul.patch b/patches.suse/Bluetooth-Set-CONF_NOT_COMPLETE-as-l2cap_chan-defaul.patch new file mode 100644 index 0000000..736a98f --- /dev/null +++ b/patches.suse/Bluetooth-Set-CONF_NOT_COMPLETE-as-l2cap_chan-defaul.patch @@ -0,0 +1,77 @@ +From 3a9d54b1947ecea8eea9a902c0b7eb58a98add8a Mon Sep 17 00:00:00 2001 +From: Archie Pusaka +Date: Mon, 22 Mar 2021 14:02:15 +0800 +Subject: [PATCH] Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default +Git-commit: 3a9d54b1947ecea8eea9a902c0b7eb58a98add8a +Patch-mainline: v5.13-rc1 +References: git-fixes + +Currently l2cap_chan_set_defaults() reset chan->conf_state to zero. +However, there is a flag CONF_NOT_COMPLETE which is set when +creating the l2cap_chan. It is suggested that the flag should be +cleared when l2cap_chan is ready, but when l2cap_chan_set_defaults() +is called, l2cap_chan is not yet ready. Therefore, we must set this +flag as the default. + +Example crash call trace: +__dump_stack lib/dump_stack.c:15 [inline] +dump_stack+0xc4/0x118 lib/dump_stack.c:56 +panic+0x1c6/0x38b kernel/panic.c:117 +__warn+0x170/0x1b9 kernel/panic.c:471 +warn_slowpath_fmt+0xc7/0xf8 kernel/panic.c:494 +debug_print_object+0x175/0x193 lib/debugobjects.c:260 +debug_object_assert_init+0x171/0x1bf lib/debugobjects.c:614 +debug_timer_assert_init kernel/time/timer.c:629 [inline] +debug_assert_init kernel/time/timer.c:677 [inline] +del_timer+0x7c/0x179 kernel/time/timer.c:1034 +try_to_grab_pending+0x81/0x2e5 kernel/workqueue.c:1230 +cancel_delayed_work+0x7c/0x1c4 kernel/workqueue.c:2929 +l2cap_clear_timer+0x1e/0x41 include/net/bluetooth/l2cap.h:834 +l2cap_chan_del+0x2d8/0x37e net/bluetooth/l2cap_core.c:640 +l2cap_chan_close+0x532/0x5d8 net/bluetooth/l2cap_core.c:756 +l2cap_sock_shutdown+0x806/0x969 net/bluetooth/l2cap_sock.c:1174 +l2cap_sock_release+0x64/0x14d net/bluetooth/l2cap_sock.c:1217 +__sock_release+0xda/0x217 net/socket.c:580 +sock_close+0x1b/0x1f net/socket.c:1039 +__fput+0x322/0x55c fs/file_table.c:208 +____fput+0x17/0x19 fs/file_table.c:244 +task_work_run+0x19b/0x1d3 kernel/task_work.c:115 +exit_task_work include/linux/task_work.h:21 [inline] +do_exit+0xe4c/0x204a kernel/exit.c:766 +do_group_exit+0x291/0x291 kernel/exit.c:891 +get_signal+0x749/0x1093 kernel/signal.c:2396 +do_signal+0xa5/0xcdb arch/x86/kernel/signal.c:737 +exit_to_usermode_loop arch/x86/entry/common.c:243 [inline] +prepare_exit_to_usermode+0xed/0x235 arch/x86/entry/common.c:277 +syscall_return_slowpath+0x3a7/0x3b3 arch/x86/entry/common.c:348 +int_ret_from_sys_call+0x25/0xa3 + +Signed-off-by: Archie Pusaka +Reported-by: syzbot+338f014a98367a08a114@syzkaller.appspotmail.com +Reviewed-by: Alain Michaud +Reviewed-by: Abhishek Pandit-Subedi +Reviewed-by: Guenter Roeck +Signed-off-by: Marcel Holtmann +Acked-by: Takashi Iwai + +--- + net/bluetooth/l2cap_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 374cc32d7138..59ab9689b37d 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -516,7 +516,9 @@ void l2cap_chan_set_defaults(struct l2cap_chan *chan) + chan->flush_to = L2CAP_DEFAULT_FLUSH_TO; + chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO; + chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO; ++ + chan->conf_state = 0; ++ set_bit(CONF_NOT_COMPLETE, &chan->conf_state); + + set_bit(FLAG_FORCE_ACTIVE, &chan->flags); + } +-- +2.26.2 + diff --git a/patches.suse/Bluetooth-initialize-skb_queue_head-at-l2cap_chan_cr.patch b/patches.suse/Bluetooth-initialize-skb_queue_head-at-l2cap_chan_cr.patch new file mode 100644 index 0000000..5b9ff8c --- /dev/null +++ b/patches.suse/Bluetooth-initialize-skb_queue_head-at-l2cap_chan_cr.patch @@ -0,0 +1,43 @@ +From be8597239379f0f53c9710dd6ab551bbf535bec6 Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Mon, 22 Mar 2021 07:52:07 +0900 +Subject: [PATCH] Bluetooth: initialize skb_queue_head at l2cap_chan_create() +Git-commit: be8597239379f0f53c9710dd6ab551bbf535bec6 +Patch-mainline: v5.13-rc1 +References: git-fixes + +syzbot is hitting "INFO: trying to register non-static key." message [1], +for "struct l2cap_chan"->tx_q.lock spinlock is not yet initialized when +l2cap_chan_del() is called due to e.g. timeout. + +Since "struct l2cap_chan"->lock mutex is initialized at l2cap_chan_create() +immediately after "struct l2cap_chan" is allocated using kzalloc(), let's +as well initialize "struct l2cap_chan"->{tx_q,srej_q}.lock spinlocks there. + +[1] https://syzkaller.appspot.com/bug?extid=fadfba6a911f6bf71842 + +Reported-and-tested-by: syzbot +Signed-off-by: Tetsuo Handa +Signed-off-by: Marcel Holtmann +Acked-by: Takashi Iwai + +--- + net/bluetooth/l2cap_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 59ab9689b37d..56e1975cdef1 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -451,6 +451,8 @@ struct l2cap_chan *l2cap_chan_create(void) + if (!chan) + return NULL; + ++ skb_queue_head_init(&chan->tx_q); ++ skb_queue_head_init(&chan->srej_q); + mutex_init(&chan->lock); + + /* Set default lock nesting level */ +-- +2.26.2 + diff --git a/patches.suse/Input-elants_i2c-do-not-bind-to-i2c-hid-compatible-A.patch b/patches.suse/Input-elants_i2c-do-not-bind-to-i2c-hid-compatible-A.patch new file mode 100644 index 0000000..531d32d --- /dev/null +++ b/patches.suse/Input-elants_i2c-do-not-bind-to-i2c-hid-compatible-A.patch @@ -0,0 +1,131 @@ +From 65299e8bfb24774e6340e93ae49f6626598917c8 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 9 Apr 2021 22:29:07 -0700 +Subject: [PATCH] Input: elants_i2c - do not bind to i2c-hid compatible ACPI instantiated devices +Git-commit: 65299e8bfb24774e6340e93ae49f6626598917c8 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Several users have been reporting that elants_i2c gives several errors +during probe and that their touchscreen does not work on their Lenovo AMD +based laptops with a touchscreen with a ELAN0001 ACPI hardware-id: + +[ 0.550596] elants_i2c i2c-ELAN0001:00: i2c-ELAN0001:00 supply vcc33 not found, using dummy regulator +[ 0.551836] elants_i2c i2c-ELAN0001:00: i2c-ELAN0001:00 supply vccio not found, using dummy regulator +[ 0.560932] elants_i2c i2c-ELAN0001:00: elants_i2c_send failed (77 77 77 77): -121 +[ 0.562427] elants_i2c i2c-ELAN0001:00: software reset failed: -121 +[ 0.595925] elants_i2c i2c-ELAN0001:00: elants_i2c_send failed (77 77 77 77): -121 +[ 0.597974] elants_i2c i2c-ELAN0001:00: software reset failed: -121 +[ 0.621893] elants_i2c i2c-ELAN0001:00: elants_i2c_send failed (77 77 77 77): -121 +[ 0.622504] elants_i2c i2c-ELAN0001:00: software reset failed: -121 +[ 0.632650] elants_i2c i2c-ELAN0001:00: elants_i2c_send failed (4d 61 69 6e): -121 +[ 0.634256] elants_i2c i2c-ELAN0001:00: boot failed: -121 +[ 0.699212] elants_i2c i2c-ELAN0001:00: invalid 'hello' packet: 00 00 ff ff +[ 1.630506] elants_i2c i2c-ELAN0001:00: Failed to read fw id: -121 +[ 1.645508] elants_i2c i2c-ELAN0001:00: unknown packet 00 00 ff ff + +Despite these errors, the elants_i2c driver stays bound to the device +(it returns 0 from its probe method despite the errors), blocking the +i2c-hid driver from binding. + +Manually unbinding the elants_i2c driver and binding the i2c-hid driver +makes the touchscreen work. + +Check if the ACPI-fwnode for the touchscreen contains one of the i2c-hid +compatiblity-id strings and if it has the I2C-HID spec's DSM to get the +HID descriptor address, If it has both then make elants_i2c not bind, +so that the i2c-hid driver can bind. + +This assumes that non of the (older) elan touchscreens which actually +need the elants_i2c driver falsely advertise an i2c-hid compatiblity-id ++ DSM in their ACPI-fwnodes. If some of them actually do have this +false advertising, then this change may lead to regressions. + +While at it also drop the unnecessary DEVICE_NAME prefixing of the +"I2C check functionality error", dev_err already outputs the driver-name. + +Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=207759 +Acked-by: Benjamin Tissoires +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20210405202756.16830-1-hdegoede@redhat.com + +Signed-off-by: Dmitry Torokhov +Acked-by: Takashi Iwai + +--- + drivers/input/touchscreen/elants_i2c.c | 44 ++++++++++++++++++++++++-- + 1 file changed, 42 insertions(+), 2 deletions(-) + +diff --git a/drivers/input/touchscreen/elants_i2c.c b/drivers/input/touchscreen/elants_i2c.c +index 4c2b579f6c8b..36cf5694bfcc 100644 +--- a/drivers/input/touchscreen/elants_i2c.c ++++ b/drivers/input/touchscreen/elants_i2c.c +@@ -38,6 +38,7 @@ + #include + #include + #include ++#include + #include + + /* Device, Driver information */ +@@ -1334,6 +1335,40 @@ static void elants_i2c_power_off(void *_data) + } + } + ++#ifdef CONFIG_ACPI ++static const struct acpi_device_id i2c_hid_ids[] = { ++ {"ACPI0C50", 0 }, ++ {"PNP0C50", 0 }, ++ { }, ++}; ++ ++static const guid_t i2c_hid_guid = ++ GUID_INIT(0x3CDFF6F7, 0x4267, 0x4555, ++ 0xAD, 0x05, 0xB3, 0x0A, 0x3D, 0x89, 0x38, 0xDE); ++ ++static bool elants_acpi_is_hid_device(struct device *dev) ++{ ++ acpi_handle handle = ACPI_HANDLE(dev); ++ union acpi_object *obj; ++ ++ if (acpi_match_device_ids(ACPI_COMPANION(dev), i2c_hid_ids)) ++ return false; ++ ++ obj = acpi_evaluate_dsm_typed(handle, &i2c_hid_guid, 1, 1, NULL, ACPI_TYPE_INTEGER); ++ if (obj) { ++ ACPI_FREE(obj); ++ return true; ++ } ++ ++ return false; ++} ++#else ++static bool elants_acpi_is_hid_device(struct device *dev) ++{ ++ return false; ++} ++#endif ++ + static int elants_i2c_probe(struct i2c_client *client, + const struct i2c_device_id *id) + { +@@ -1342,9 +1377,14 @@ static int elants_i2c_probe(struct i2c_client *client, + unsigned long irqflags; + int error; + ++ /* Don't bind to i2c-hid compatible devices, these are handled by the i2c-hid drv. */ ++ if (elants_acpi_is_hid_device(&client->dev)) { ++ dev_warn(&client->dev, "This device appears to be an I2C-HID device, not binding\n"); ++ return -ENODEV; ++ } ++ + if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) { +- dev_err(&client->dev, +- "%s: i2c check functionality error\n", DEVICE_NAME); ++ dev_err(&client->dev, "I2C check functionality error\n"); + return -ENXIO; + } + +-- +2.26.2 + diff --git a/patches.suse/Input-silead-add-workaround-for-x86-BIOS-es-which-br.patch b/patches.suse/Input-silead-add-workaround-for-x86-BIOS-es-which-br.patch new file mode 100644 index 0000000..1829ce6 --- /dev/null +++ b/patches.suse/Input-silead-add-workaround-for-x86-BIOS-es-which-br.patch @@ -0,0 +1,127 @@ +From e479187748a8f151a85116a7091c599b121fdea5 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 9 Apr 2021 22:29:49 -0700 +Subject: [PATCH] Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck state +Git-commit: e479187748a8f151a85116a7091c599b121fdea5 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Some buggy BIOS-es bring up the touchscreen-controller in a stuck +state where it blocks the I2C bus. Specifically this happens on +the Jumper EZpad 7 tablet model. + +After much poking at this problem I have found that the following steps +are necessary to unstuck the chip / bus: + +1. Turn off the Silead chip. +2. Try to do an I2C transfer with the chip, this will fail in response to + which the I2C-bus-driver will call: i2c_recover_bus() which will unstuck + the I2C-bus. Note the unstuck-ing of the I2C bus only works if we first + drop the chip of the bus by turning it off. +3. Turn the chip back on. + +On the x86/ACPI systems were this problem is seen, step 1. and 3. require +making ACPI calls and dealing with ACPI Power Resources. This commit adds +a workaround which runtime-suspends the chip to turn it off, leaving it up +to the ACPI subsystem to deal with all the ACPI specific details. + +There is no good way to detect this bug, so the workaround gets activated +by a new "silead,stuck-controller-bug" boolean device-property. Since this +is only used on x86/ACPI, this will be set by model specific device-props +set by drivers/platform/x86/touchscreen_dmi.c. Therefor this new +device-property is not documented in the DT-bindings. + +Dmesg will contain the following messages on systems where the workaround +is activated: + +[ 54.309029] silead_ts i2c-MSSL1680:00: [Firmware Bug]: Stuck I2C bus: please ignore the next 'controller timed out' error +[ 55.373593] i2c_designware 808622C1:04: controller timed out +[ 55.582186] silead_ts i2c-MSSL1680:00: Silead chip ID: 0x80360000 + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20210405202745.16777-1-hdegoede@redhat.com +Signed-off-by: Dmitry Torokhov +Acked-by: Takashi Iwai + +--- + drivers/input/touchscreen/silead.c | 44 +++++++++++++++++++++++++++--- + 1 file changed, 40 insertions(+), 4 deletions(-) + +diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c +index 32725d7422de..1ee760bac0cf 100644 +--- a/drivers/input/touchscreen/silead.c ++++ b/drivers/input/touchscreen/silead.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -335,10 +336,8 @@ static int silead_ts_get_id(struct i2c_client *client) + + error = i2c_smbus_read_i2c_block_data(client, SILEAD_REG_ID, + sizeof(chip_id), (u8 *)&chip_id); +- if (error < 0) { +- dev_err(&client->dev, "Chip ID read error %d\n", error); ++ if (error < 0) + return error; +- } + + data->chip_id = le32_to_cpu(chip_id); + dev_info(&client->dev, "Silead chip ID: 0x%8X", data->chip_id); +@@ -351,12 +350,49 @@ static int silead_ts_setup(struct i2c_client *client) + int error; + u32 status; + ++ /* ++ * Some buggy BIOS-es bring up the chip in a stuck state where it ++ * blocks the I2C bus. The following steps are necessary to ++ * unstuck the chip / bus: ++ * 1. Turn off the Silead chip. ++ * 2. Try to do an I2C transfer with the chip, this will fail in ++ * response to which the I2C-bus-driver will call: ++ * i2c_recover_bus() which will unstuck the I2C-bus. Note the ++ * unstuck-ing of the I2C bus only works if we first drop the ++ * chip off the bus by turning it off. ++ * 3. Turn the chip back on. ++ * ++ * On the x86/ACPI systems were this problem is seen, step 1. and ++ * 3. require making ACPI calls and dealing with ACPI Power ++ * Resources. The workaround below runtime-suspends the chip to ++ * turn it off, leaving it up to the ACPI subsystem to deal with ++ * this. ++ */ ++ ++ if (device_property_read_bool(&client->dev, ++ "silead,stuck-controller-bug")) { ++ pm_runtime_set_active(&client->dev); ++ pm_runtime_enable(&client->dev); ++ pm_runtime_allow(&client->dev); ++ ++ pm_runtime_suspend(&client->dev); ++ ++ dev_warn(&client->dev, FW_BUG "Stuck I2C bus: please ignore the next 'controller timed out' error\n"); ++ silead_ts_get_id(client); ++ ++ /* The forbid will also resume the device */ ++ pm_runtime_forbid(&client->dev); ++ pm_runtime_disable(&client->dev); ++ } ++ + silead_ts_set_power(client, SILEAD_POWER_OFF); + silead_ts_set_power(client, SILEAD_POWER_ON); + + error = silead_ts_get_id(client); +- if (error) ++ if (error) { ++ dev_err(&client->dev, "Chip ID read error %d\n", error); + return error; ++ } + + error = silead_ts_init(client); + if (error) +-- +2.26.2 + diff --git a/patches.suse/NFC-fix-possible-resource-leak.patch b/patches.suse/NFC-fix-possible-resource-leak.patch new file mode 100644 index 0000000..ccea9f4 --- /dev/null +++ b/patches.suse/NFC-fix-possible-resource-leak.patch @@ -0,0 +1,36 @@ +From d8f923c3ab96dbbb4e3c22d1afc1dc1d3b195cd8 Mon Sep 17 00:00:00 2001 +From: Pan Bian +Date: Thu, 21 Jan 2021 07:37:45 -0800 +Subject: [PATCH] NFC: fix possible resource leak +Git-commit: d8f923c3ab96dbbb4e3c22d1afc1dc1d3b195cd8 +Patch-mainline: v5.11-rc6 +References: git-fixes + +Put the device to avoid resource leak on path that the polling flag is +invalid. + +Fixes: a831b9132065 ("NFC: Do not return EBUSY when stopping a poll that's already stopped") +Signed-off-by: Pan Bian +Link: https://lore.kernel.org/r/20210121153745.122184-1-bianpan2016@163.com +Signed-off-by: Jakub Kicinski +Acked-by: Takashi Iwai + +--- + net/nfc/netlink.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c +index 573b38ad2f8e..e161ef2d4720 100644 +--- a/net/nfc/netlink.c ++++ b/net/nfc/netlink.c +@@ -852,6 +852,7 @@ static int nfc_genl_stop_poll(struct sk_buff *skb, struct genl_info *info) + + if (!dev->polling) { + device_unlock(&dev->dev); ++ nfc_put_device(dev); + return -EINVAL; + } + +-- +2.26.2 + diff --git a/patches.suse/NFC-fix-resource-leak-when-target-index-is-invalid.patch b/patches.suse/NFC-fix-resource-leak-when-target-index-is-invalid.patch new file mode 100644 index 0000000..c36896b --- /dev/null +++ b/patches.suse/NFC-fix-resource-leak-when-target-index-is-invalid.patch @@ -0,0 +1,37 @@ +From 3a30537cee233fb7da302491b28c832247d89bbe Mon Sep 17 00:00:00 2001 +From: Pan Bian +Date: Thu, 21 Jan 2021 07:27:48 -0800 +Subject: [PATCH] NFC: fix resource leak when target index is invalid +Git-commit: 3a30537cee233fb7da302491b28c832247d89bbe +Patch-mainline: v5.11-rc6 +References: git-fixes + +Goto to the label put_dev instead of the label error to fix potential +resource leak on path that the target index is invalid. + +Fixes: c4fbb6515a4d ("NFC: The core part should generate the target index") +Signed-off-by: Pan Bian +Link: https://lore.kernel.org/r/20210121152748.98409-1-bianpan2016@163.com +Signed-off-by: Jakub Kicinski +Acked-by: Takashi Iwai + +--- + net/nfc/rawsock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c +index 955c195ae14b..9c7eb8455ba8 100644 +--- a/net/nfc/rawsock.c ++++ b/net/nfc/rawsock.c +@@ -105,7 +105,7 @@ static int rawsock_connect(struct socket *sock, struct sockaddr *_addr, + if (addr->target_idx > dev->target_next_idx - 1 || + addr->target_idx < dev->target_next_idx - dev->n_targets) { + rc = -EINVAL; +- goto error; ++ goto put_dev; + } + + rc = nfc_activate_target(dev, addr->target_idx, addr->nfc_protocol); +-- +2.26.2 + diff --git a/patches.suse/NFC-nci-fix-memory-leak-in-nci_allocate_device.patch b/patches.suse/NFC-nci-fix-memory-leak-in-nci_allocate_device.patch new file mode 100644 index 0000000..962fb8c --- /dev/null +++ b/patches.suse/NFC-nci-fix-memory-leak-in-nci_allocate_device.patch @@ -0,0 +1,90 @@ +From e0652f8bb44d6294eeeac06d703185357f25d50b Mon Sep 17 00:00:00 2001 +From: Dongliang Mu +Date: Sat, 15 May 2021 07:29:06 +0800 +Subject: [PATCH] NFC: nci: fix memory leak in nci_allocate_device +Git-commit: e0652f8bb44d6294eeeac06d703185357f25d50b +Patch-mainline: v5.13-rc4 +References: git-fixes + +nfcmrvl_disconnect fails to free the hci_dev field in struct nci_dev. +Fix this by freeing hci_dev in nci_free_device. + +Bug: memory leak +unreferenced object 0xffff888111ea6800 (size 1024): + comm "kworker/1:0", pid 19, jiffies 4294942308 (age 13.580s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 60 fd 0c 81 88 ff ff .........`...... + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<000000004bc25d43>] kmalloc include/linux/slab.h:552 [inline] + [<000000004bc25d43>] kzalloc include/linux/slab.h:682 [inline] + [<000000004bc25d43>] nci_hci_allocate+0x21/0xd0 net/nfc/nci/hci.c:784 + [<00000000c59cff92>] nci_allocate_device net/nfc/nci/core.c:1170 [inline] + [<00000000c59cff92>] nci_allocate_device+0x10b/0x160 net/nfc/nci/core.c:1132 + [<00000000006e0a8e>] nfcmrvl_nci_register_dev+0x10a/0x1c0 drivers/nfc/nfcmrvl/main.c:153 + [<000000004da1b57e>] nfcmrvl_probe+0x223/0x290 drivers/nfc/nfcmrvl/usb.c:345 + [<00000000d506aed9>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 + [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554 + [<00000000f5009125>] driver_probe_device+0x84/0x100 drivers/base/dd.c:740 + [<000000000ce658ca>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:846 + [<000000007067d05f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431 + [<00000000f8e13372>] __device_attach+0x122/0x250 drivers/base/dd.c:914 + [<000000009cf68860>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491 + [<00000000359c965a>] device_add+0x5be/0xc30 drivers/base/core.c:3109 + [<00000000086e4bd3>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164 + [<00000000ca036872>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 + [<00000000d40d36f6>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 + [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554 + +Reported-by: syzbot+19bcfc64a8df1318d1c3@syzkaller.appspotmail.com +Fixes: 11f54f228643 ("NFC: nci: Add HCI over NCI protocol support") +Signed-off-by: Dongliang Mu +Signed-off-by: David S. Miller +Acked-by: Takashi Iwai + +--- + include/net/nfc/nci_core.h | 1 + + net/nfc/nci/core.c | 1 + + net/nfc/nci/hci.c | 5 +++++ + 3 files changed, 7 insertions(+) + +diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h +index bd76e8e082c0..1df0f8074c9d 100644 +--- a/include/net/nfc/nci_core.h ++++ b/include/net/nfc/nci_core.h +@@ -298,6 +298,7 @@ int nci_nfcc_loopback(struct nci_dev *ndev, void *data, size_t data_len, + struct sk_buff **resp); + + struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev); ++void nci_hci_deallocate(struct nci_dev *ndev); + int nci_hci_send_event(struct nci_dev *ndev, u8 gate, u8 event, + const u8 *param, size_t param_len); + int nci_hci_send_cmd(struct nci_dev *ndev, u8 gate, +diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c +index 9a585332ea84..da7fe9db1b00 100644 +--- a/net/nfc/nci/core.c ++++ b/net/nfc/nci/core.c +@@ -1191,6 +1191,7 @@ EXPORT_SYMBOL(nci_allocate_device); + void nci_free_device(struct nci_dev *ndev) + { + nfc_free_device(ndev->nfc_dev); ++ nci_hci_deallocate(ndev); + kfree(ndev); + } + EXPORT_SYMBOL(nci_free_device); +diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c +index 6b275a387a92..96865142104f 100644 +--- a/net/nfc/nci/hci.c ++++ b/net/nfc/nci/hci.c +@@ -792,3 +792,8 @@ struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev) + + return hdev; + } ++ ++void nci_hci_deallocate(struct nci_dev *ndev) ++{ ++ kfree(ndev->hci_dev); ++} +-- +2.26.2 + diff --git a/patches.suse/PCI-PM-Do-not-read-power-state-in-pci_enable_device_.patch b/patches.suse/PCI-PM-Do-not-read-power-state-in-pci_enable_device_.patch new file mode 100644 index 0000000..8ca0e39 --- /dev/null +++ b/patches.suse/PCI-PM-Do-not-read-power-state-in-pci_enable_device_.patch @@ -0,0 +1,72 @@ +From 4514d991d99211f225d83b7e640285f29f0755d0 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Tue, 16 Mar 2021 16:51:40 +0100 +Subject: [PATCH] PCI: PM: Do not read power state in pci_enable_device_flags() +Git-commit: 4514d991d99211f225d83b7e640285f29f0755d0 +Patch-mainline: v5.13-rc1 +References: git-fixes + +It should not be necessary to update the current_state field of +struct pci_dev in pci_enable_device_flags() before calling +do_pci_enable_device() for the device, because none of the +code between that point and the pci_set_power_state() call in +do_pci_enable_device() invoked later depends on it. + +Moreover, doing that is actively harmful in some cases. For example, +if the given PCI device depends on an ACPI power resource whose _STA +method initially returns 0 ("off"), but the config space of the PCI +device is accessible and the power state retrieved from the +PCI_PM_CTRL register is D0, the current_state field in the struct +pci_dev representing that device will get out of sync with the +power.state of its ACPI companion object and that will lead to +power management issues going forward. + +To avoid such issues it is better to leave the current_state value +as is until it is changed to PCI_D0 by do_pci_enable_device() as +appropriate. However, the power state of the device is not changed +to PCI_D0 if it is already enabled when pci_enable_device_flags() +gets called for it, so update its current_state in that case, but +use pci_update_current_state() covering platform PM too for that. + +Link: https://lore.kernel.org/lkml/20210314000439.3138941-1-luzmaximilian@gmail.com/ +Reported-by: Maximilian Luz +Tested-by: Maximilian Luz +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Mika Westerberg +Acked-by: Takashi Iwai + +--- + drivers/pci/pci.c | 16 +++------------- + 1 file changed, 3 insertions(+), 13 deletions(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 16a17215f633..e4d4e399004b 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1870,20 +1870,10 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags) + int err; + int i, bars = 0; + +- /* +- * Power state could be unknown at this point, either due to a fresh +- * boot or a device removal call. So get the current power state +- * so that things like MSI message writing will behave as expected +- * (e.g. if the device really is in D0 at enable time). +- */ +- if (dev->pm_cap) { +- u16 pmcsr; +- pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr); +- dev->current_state = (pmcsr & PCI_PM_CTRL_STATE_MASK); +- } +- +- if (atomic_inc_return(&dev->enable_cnt) > 1) ++ if (atomic_inc_return(&dev->enable_cnt) > 1) { ++ pci_update_current_state(dev, dev->current_state); + return 0; /* already enabled */ ++ } + + bridge = pci_upstream_bridge(dev); + if (bridge) +-- +2.26.2 + diff --git a/patches.suse/Revert-leds-lp5523-fix-a-missing-check-of-return-val.patch b/patches.suse/Revert-leds-lp5523-fix-a-missing-check-of-return-val.patch new file mode 100644 index 0000000..5dfebd8 --- /dev/null +++ b/patches.suse/Revert-leds-lp5523-fix-a-missing-check-of-return-val.patch @@ -0,0 +1,51 @@ +From 8d1beda5f11953ffe135a5213287f0b25b4da41b Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Mon, 3 May 2021 13:56:35 +0200 +Subject: [PATCH] Revert "leds: lp5523: fix a missing check of return value of lp55xx_read" +Git-commit: 8d1beda5f11953ffe135a5213287f0b25b4da41b +Patch-mainline: v5.13-rc3 +References: git-fixes + +This reverts commit 248b57015f35c94d4eae2fdd8c6febf5cd703900. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +The original commit does not properly unwind if there is an error +condition so it needs to be reverted at this point in time. + +Cc: Kangjie Lu +Cc: Jacek Anaszewski +Cc: stable +Fixes: 248b57015f35 ("leds: lp5523: fix a missing check of return value of lp55xx_read") +Link: https://lore.kernel.org/r/20210503115736.2104747-9-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/leds/leds-lp5523.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c +index fc433e63b1dc..5036d7d5f3d4 100644 +--- a/drivers/leds/leds-lp5523.c ++++ b/drivers/leds/leds-lp5523.c +@@ -305,9 +305,7 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip) + + /* Let the programs run for couple of ms and check the engine status */ + usleep_range(3000, 6000); +- ret = lp55xx_read(chip, LP5523_REG_STATUS, &status); +- if (ret) +- return ret; ++ lp55xx_read(chip, LP5523_REG_STATUS, &status); + status &= LP5523_ENG_STATUS_MASK; + + if (status != LP5523_ENG_STATUS_MASK) { +-- +2.26.2 + diff --git a/patches.suse/SUNRPC-More-fixes-for-backlog-congestion.patch b/patches.suse/SUNRPC-More-fixes-for-backlog-congestion.patch new file mode 100644 index 0000000..3ea5633 --- /dev/null +++ b/patches.suse/SUNRPC-More-fixes-for-backlog-congestion.patch @@ -0,0 +1,242 @@ +From: Trond Myklebust +Date: Tue, 25 May 2021 18:43:38 -0400 +Subject: [PATCH] SUNRPC: More fixes for backlog congestion +Git-commit: e86be3a04bc4aeaf12f93af35f08f8d4385bcd98 +Patch-mainline: v5.13 +References: bsc#1185428 + +Ensure that we fix the XPRT_CONGESTED starvation issue for RDMA as well +as socket based transports. +Ensure we always initialise the request after waking up from the backlog +list. + +Fixes: e877a88d1f06 ("SUNRPC in case of backlog, hand free slots directly to waiting task") +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + include/linux/sunrpc/xprt.h | 2 + + net/sunrpc/xprt.c | 76 +++++++++++++++++++--------------------- + net/sunrpc/xprtrdma/transport.c | 10 +++-- + net/sunrpc/xprtrdma/verbs.c | 24 ++++++++++++ + net/sunrpc/xprtrdma/xprt_rdma.h | 1 + 5 files changed, 70 insertions(+), 43 deletions(-) + +--- a/include/linux/sunrpc/xprt.h ++++ b/include/linux/sunrpc/xprt.h +@@ -349,6 +349,8 @@ struct rpc_xprt * xprt_alloc(struct net + unsigned int num_prealloc, + unsigned int max_req); + void xprt_free(struct rpc_xprt *); ++void xprt_add_backlog(struct rpc_xprt *xprt, struct rpc_task *task); ++bool xprt_wake_up_backlog(struct rpc_xprt *xprt, struct rpc_rqst *req); + + static inline __be32 *xprt_skip_transport_header(struct rpc_xprt *xprt, __be32 *p) + { +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -1083,11 +1083,18 @@ void xprt_transmit(struct rpc_task *task + } + } + +-static void xprt_add_backlog(struct rpc_xprt *xprt, struct rpc_task *task) ++static void xprt_complete_request_init(struct rpc_task *task) ++{ ++ if (task->tk_rqstp) ++ xprt_request_init(task); ++} ++ ++void xprt_add_backlog(struct rpc_xprt *xprt, struct rpc_task *task) + { + set_bit(XPRT_CONGESTED, &xprt->state); +- rpc_sleep_on(&xprt->backlog, task, NULL); ++ rpc_sleep_on(&xprt->backlog, task, xprt_complete_request_init); + } ++EXPORT_SYMBOL_GPL(xprt_add_backlog); + + static bool __xprt_set_rq(struct rpc_task *task, void *data) + { +@@ -1095,14 +1102,13 @@ static bool __xprt_set_rq(struct rpc_tas + + if (task->tk_rqstp == NULL) { + memset(req, 0, sizeof(*req)); /* mark unused */ +- task->tk_status = -EAGAIN; + task->tk_rqstp = req; + return true; + } + return false; + } + +-static bool xprt_wake_up_backlog(struct rpc_xprt *xprt, struct rpc_rqst *req) ++bool xprt_wake_up_backlog(struct rpc_xprt *xprt, struct rpc_rqst *req) + { + if (rpc_wake_up_first(&xprt->backlog, __xprt_set_rq, req) == NULL) { + clear_bit(XPRT_CONGESTED, &xprt->state); +@@ -1110,6 +1116,7 @@ static bool xprt_wake_up_backlog(struct + } + return true; + } ++EXPORT_SYMBOL_GPL(xprt_wake_up_backlog); + + static bool xprt_throttle_congested(struct rpc_xprt *xprt, struct rpc_task *task) + { +@@ -1119,7 +1126,7 @@ static bool xprt_throttle_congested(stru + goto out; + spin_lock(&xprt->reserve_lock); + if (test_bit(XPRT_CONGESTED, &xprt->state)) { +- rpc_sleep_on(&xprt->backlog, task, NULL); ++ xprt_add_backlog(xprt, task); + ret = true; + } + spin_unlock(&xprt->reserve_lock); +@@ -1289,10 +1296,6 @@ xprt_request_init(struct rpc_task *task) + struct rpc_xprt *xprt = task->tk_xprt; + struct rpc_rqst *req = task->tk_rqstp; + +- if (req->rq_task) +- /* Already initialized */ +- return; +- + INIT_LIST_HEAD(&req->rq_list); + req->rq_timeout = task->tk_client->cl_timeout->to_initval; + req->rq_task = task; +@@ -1355,10 +1358,8 @@ void xprt_retry_reserve(struct rpc_task + struct rpc_xprt *xprt = task->tk_xprt; + + task->tk_status = 0; +- if (task->tk_rqstp != NULL) { +- xprt_request_init(task); ++ if (task->tk_rqstp != NULL) + return; +- } + + task->tk_timeout = 0; + task->tk_status = -EAGAIN; +@@ -1385,33 +1386,30 @@ void xprt_release(struct rpc_task *task) + } + + xprt = req->rq_xprt; +- if (xprt) { +- if (task->tk_ops->rpc_count_stats != NULL) +- task->tk_ops->rpc_count_stats(task, task->tk_calldata); +- else if (task->tk_client) +- rpc_count_iostats(task, task->tk_client->cl_metrics); +- spin_lock(&xprt->recv_lock); +- if (!list_empty(&req->rq_list)) { +- list_del_init(&req->rq_list); +- xprt_wait_on_pinned_rqst(req); +- } +- spin_unlock(&xprt->recv_lock); +- spin_lock_bh(&xprt->transport_lock); +- xprt->ops->release_xprt(xprt, task); +- if (xprt->ops->release_request) +- xprt->ops->release_request(task); +- xprt->last_used = jiffies; +- xprt_schedule_autodisconnect(xprt); +- spin_unlock_bh(&xprt->transport_lock); +- if (req->rq_buffer) +- xprt->ops->buf_free(task); +- xprt_inject_disconnect(xprt); +- if (req->rq_cred != NULL) +- put_rpccred(req->rq_cred); +- if (req->rq_release_snd_buf) +- req->rq_release_snd_buf(req); +- } else +- xprt = task->tk_xprt; ++ if (task->tk_ops->rpc_count_stats != NULL) ++ task->tk_ops->rpc_count_stats(task, task->tk_calldata); ++ else if (task->tk_client) ++ rpc_count_iostats(task, task->tk_client->cl_metrics); ++ spin_lock(&xprt->recv_lock); ++ if (!list_empty(&req->rq_list)) { ++ list_del_init(&req->rq_list); ++ xprt_wait_on_pinned_rqst(req); ++ } ++ spin_unlock(&xprt->recv_lock); ++ spin_lock_bh(&xprt->transport_lock); ++ xprt->ops->release_xprt(xprt, task); ++ if (xprt->ops->release_request) ++ xprt->ops->release_request(task); ++ xprt->last_used = jiffies; ++ xprt_schedule_autodisconnect(xprt); ++ spin_unlock_bh(&xprt->transport_lock); ++ if (req->rq_buffer) ++ xprt->ops->buf_free(task); ++ xprt_inject_disconnect(xprt); ++ if (req->rq_cred != NULL) ++ put_rpccred(req->rq_cred); ++ if (req->rq_release_snd_buf) ++ req->rq_release_snd_buf(req); + + task->tk_rqstp = NULL; + dprintk("RPC: %5u release request %p\n", task->tk_pid, req); +--- a/net/sunrpc/xprtrdma/transport.c ++++ b/net/sunrpc/xprtrdma/transport.c +@@ -571,8 +571,8 @@ xprt_rdma_alloc_slot(struct rpc_xprt *xp + return; + + out_sleep: +- rpc_sleep_on(&xprt->backlog, task, NULL); + task->tk_status = -EAGAIN; ++ xprt_add_backlog(xprt, task); + } + + /** +@@ -584,9 +584,11 @@ out_sleep: + static void + xprt_rdma_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *rqst) + { +- memset(rqst, 0, sizeof(*rqst)); +- rpcrdma_buffer_put(rpcr_to_rdmar(rqst)); +- rpc_wake_up_next(&xprt->backlog); ++ rpcrdma_reply_put(rpcr_to_rdmar(rqst)); ++ if (!xprt_wake_up_backlog(xprt, rqst)) { ++ memset(rqst, 0, sizeof(*rqst)); ++ rpcrdma_buffer_put(rpcr_to_rdmar(rqst)); ++ } + } + + static bool +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -1345,6 +1345,30 @@ rpcrdma_buffer_get(struct rpcrdma_buffer + } + + /** ++ * rpcrdma_reply_put - Put reply buffers back into pool ++ * @req: object to return ++ * ++ */ ++void rpcrdma_reply_put(struct rpcrdma_req *req) ++{ ++ struct rpcrdma_buffer *buffers = req->rl_buffer; ++ struct rpcrdma_rep *rep = req->rl_reply; ++ ++ if (!rep) ++ return; ++ ++ req->rl_reply = NULL; ++ ++ if (rep->rr_temp) ++ rpcrdma_destroy_rep(rep); ++ else { ++ spin_lock(&buffers->rb_lock); ++ list_add(&rep->rr_list, &buffers->rb_recv_bufs); ++ spin_unlock(&buffers->rb_lock); ++ } ++} ++ ++/** + * rpcrdma_buffer_put - Put request/reply buffers back into pool + * @req: object to return + * +--- a/net/sunrpc/xprtrdma/xprt_rdma.h ++++ b/net/sunrpc/xprtrdma/xprt_rdma.h +@@ -583,6 +583,7 @@ void rpcrdma_mr_defer_recovery(struct rp + struct rpcrdma_req *rpcrdma_buffer_get(struct rpcrdma_buffer *); + void rpcrdma_buffer_put(struct rpcrdma_req *); + void rpcrdma_recv_buffer_put(struct rpcrdma_rep *); ++void rpcrdma_reply_put(struct rpcrdma_req *req); + + struct rpcrdma_regbuf *rpcrdma_alloc_regbuf(size_t, enum dma_data_direction, + gfp_t); diff --git a/patches.suse/SUNRPC-in-case-of-backlog-hand-free-slots-directly-t.patch b/patches.suse/SUNRPC-in-case-of-backlog-hand-free-slots-directly-t.patch new file mode 100644 index 0000000..cb4a345 --- /dev/null +++ b/patches.suse/SUNRPC-in-case-of-backlog-hand-free-slots-directly-t.patch @@ -0,0 +1,201 @@ +From: NeilBrown +Date: Mon, 17 May 2021 09:34:38 +1000 +Subject: [PATCH] SUNRPC in case of backlog, hand free slots directly to + waiting task +Git-commit: e877a88d1f069edced4160792f42c2a8e2dba942 +Patch-mainline: v5.13 +References: bsc#1185428 + +If sunrpc.tcp_max_slot_table_entries is small and there are tasks +on the backlog queue, then when a request completes it is freed and the +first task on the queue is woken. The expectation is that it will wake +and claim that request. However if it was a sync task and the waiting +process was killed at just that moment, it will wake and NOT claim the +request. + +As long as TASK_CONGESTED remains set, requests can only be claimed by +tasks woken from the backlog, and they are woken only as requests are +freed, so when a task doesn't claim a request, no other task can ever +get that request until TASK_CONGESTED is cleared. Each time this +happens the number of available requests is decreased by one. + +With a sufficiently high workload and sufficiently low setting of +max_slot (16 in the case where this was seen), TASK_CONGESTED can remain +set for an extended period, and the above scenario (of a process being +killed just as its task was woken) can repeat until no requests can be +allocated. Then traffic stops. + +This patch addresses the problem by introducing a positive handover of a +request from a completing task to a backlog task - the request is never +freed when there is a backlog. + +When a task is woken it might already have a request attached in which +case it is *not* freed (as with current code) but is initialised (if +needed) and used. If it isn't used it will eventually be freed by +rpc_exit_task(). xprt_release() is enhanced to be able to correctly +release an uninitialised request. + +Signed-off-by: NeilBrown +Acked-by: NeilBrown + +--- + net/sunrpc/clnt.c | 10 ------ + net/sunrpc/xprt.c | 86 +++++++++++++++++++++++++++++++++++------------------- + 2 files changed, 56 insertions(+), 40 deletions(-) + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -1630,16 +1630,6 @@ call_reserveresult(struct rpc_task *task + return; + } + +- /* +- * Even though there was an error, we may have acquired +- * a request slot somehow. Make sure not to leak it. +- */ +- if (task->tk_rqstp) { +- printk(KERN_ERR "%s: status=%d, request allocated anyway\n", +- __func__, status); +- xprt_release(task); +- } +- + switch (status) { + case -ENOMEM: + rpc_delay(task, HZ >> 2); +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -71,6 +71,7 @@ static void xprt_connect_status(struct r + static int __xprt_get_cong(struct rpc_xprt *, struct rpc_task *); + static void __xprt_put_cong(struct rpc_xprt *, struct rpc_rqst *); + static void xprt_destroy(struct rpc_xprt *xprt); ++static void xprt_request_init(struct rpc_task *task); + + static DEFINE_SPINLOCK(xprt_list_lock); + static LIST_HEAD(xprt_list); +@@ -1088,10 +1089,26 @@ static void xprt_add_backlog(struct rpc_ + rpc_sleep_on(&xprt->backlog, task, NULL); + } + +-static void xprt_wake_up_backlog(struct rpc_xprt *xprt) ++static bool __xprt_set_rq(struct rpc_task *task, void *data) + { +- if (rpc_wake_up_next(&xprt->backlog) == NULL) ++ struct rpc_rqst *req = data; ++ ++ if (task->tk_rqstp == NULL) { ++ memset(req, 0, sizeof(*req)); /* mark unused */ ++ task->tk_status = -EAGAIN; ++ task->tk_rqstp = req; ++ return true; ++ } ++ return false; ++} ++ ++static bool xprt_wake_up_backlog(struct rpc_xprt *xprt, struct rpc_rqst *req) ++{ ++ if (rpc_wake_up_first(&xprt->backlog, __xprt_set_rq, req) == NULL) { + clear_bit(XPRT_CONGESTED, &xprt->state); ++ return false; ++ } ++ return true; + } + + static bool xprt_throttle_congested(struct rpc_xprt *xprt, struct rpc_task *task) +@@ -1192,11 +1209,11 @@ EXPORT_SYMBOL_GPL(xprt_lock_and_alloc_sl + void xprt_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *req) + { + spin_lock(&xprt->reserve_lock); +- if (!xprt_dynamic_free_slot(xprt, req)) { ++ if (!xprt_wake_up_backlog(xprt, req) && ++ !xprt_dynamic_free_slot(xprt, req)) { + memset(req, 0, sizeof(*req)); /* mark unused */ + list_add(&req->rq_list, &xprt->free); + } +- xprt_wake_up_backlog(xprt); + spin_unlock(&xprt->reserve_lock); + } + EXPORT_SYMBOL_GPL(xprt_free_slot); +@@ -1272,6 +1289,10 @@ xprt_request_init(struct rpc_task *task) + struct rpc_xprt *xprt = task->tk_xprt; + struct rpc_rqst *req = task->tk_rqstp; + ++ if (req->rq_task) ++ /* Already initialized */ ++ return; ++ + INIT_LIST_HEAD(&req->rq_list); + req->rq_timeout = task->tk_client->cl_timeout->to_initval; + req->rq_task = task; +@@ -1334,8 +1355,10 @@ void xprt_retry_reserve(struct rpc_task + struct rpc_xprt *xprt = task->tk_xprt; + + task->tk_status = 0; +- if (task->tk_rqstp != NULL) ++ if (task->tk_rqstp != NULL) { ++ xprt_request_init(task); + return; ++ } + + task->tk_timeout = 0; + task->tk_status = -EAGAIN; +@@ -1362,32 +1385,35 @@ void xprt_release(struct rpc_task *task) + } + + xprt = req->rq_xprt; +- if (task->tk_ops->rpc_count_stats != NULL) +- task->tk_ops->rpc_count_stats(task, task->tk_calldata); +- else if (task->tk_client) +- rpc_count_iostats(task, task->tk_client->cl_metrics); +- spin_lock(&xprt->recv_lock); +- if (!list_empty(&req->rq_list)) { +- list_del_init(&req->rq_list); +- xprt_wait_on_pinned_rqst(req); +- } +- spin_unlock(&xprt->recv_lock); +- spin_lock_bh(&xprt->transport_lock); +- xprt->ops->release_xprt(xprt, task); +- if (xprt->ops->release_request) +- xprt->ops->release_request(task); +- xprt->last_used = jiffies; +- xprt_schedule_autodisconnect(xprt); +- spin_unlock_bh(&xprt->transport_lock); +- if (req->rq_buffer) +- xprt->ops->buf_free(task); +- xprt_inject_disconnect(xprt); +- if (req->rq_cred != NULL) +- put_rpccred(req->rq_cred); +- task->tk_rqstp = NULL; +- if (req->rq_release_snd_buf) +- req->rq_release_snd_buf(req); ++ if (xprt) { ++ if (task->tk_ops->rpc_count_stats != NULL) ++ task->tk_ops->rpc_count_stats(task, task->tk_calldata); ++ else if (task->tk_client) ++ rpc_count_iostats(task, task->tk_client->cl_metrics); ++ spin_lock(&xprt->recv_lock); ++ if (!list_empty(&req->rq_list)) { ++ list_del_init(&req->rq_list); ++ xprt_wait_on_pinned_rqst(req); ++ } ++ spin_unlock(&xprt->recv_lock); ++ spin_lock_bh(&xprt->transport_lock); ++ xprt->ops->release_xprt(xprt, task); ++ if (xprt->ops->release_request) ++ xprt->ops->release_request(task); ++ xprt->last_used = jiffies; ++ xprt_schedule_autodisconnect(xprt); ++ spin_unlock_bh(&xprt->transport_lock); ++ if (req->rq_buffer) ++ xprt->ops->buf_free(task); ++ xprt_inject_disconnect(xprt); ++ if (req->rq_cred != NULL) ++ put_rpccred(req->rq_cred); ++ if (req->rq_release_snd_buf) ++ req->rq_release_snd_buf(req); ++ } else ++ xprt = task->tk_xprt; + ++ task->tk_rqstp = NULL; + dprintk("RPC: %5u release request %p\n", task->tk_pid, req); + if (likely(!bc_prealloc(req))) + xprt->ops->free_slot(xprt, req); diff --git a/patches.suse/USB-Add-LPM-quirk-for-Lenovo-ThinkPad-USB-C-Dock-Gen.patch b/patches.suse/USB-Add-LPM-quirk-for-Lenovo-ThinkPad-USB-C-Dock-Gen.patch new file mode 100644 index 0000000..93b7574 --- /dev/null +++ b/patches.suse/USB-Add-LPM-quirk-for-Lenovo-ThinkPad-USB-C-Dock-Gen.patch @@ -0,0 +1,37 @@ +From 8f23fe35ff1e5491b4d279323a8209a31f03ae65 Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Mon, 12 Apr 2021 21:54:53 +0800 +Subject: [PATCH] USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet +Git-commit: 8f23fe35ff1e5491b4d279323a8209a31f03ae65 +Patch-mainline: v5.13-rc1 +References: git-fixes + +This is another branded 8153 device that doesn't work well with LPM +Enabled: +[ 400.597506] r8152 5-1.1:1.0 enx482ae3a2a6f0: Tx status -71 + +So disable LPM to resolve the issue. + +Signed-off-by: Kai-Heng Feng +Buglink: https://bugs.launchpad.net/bugs/1922651 +Link: https://lore.kernel.org/r/20210412135455.791971-1-kai.heng.feng@canonical.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -272,6 +272,9 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x1532, 0x0116), .driver_info = + USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, + ++ /* Lenovo ThinkPad USB-C Dock Gen2 Ethernet (RTL8153 GigE) */ ++ { USB_DEVICE(0x17ef, 0xa387), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* BUILDWIN Photo Frame */ + { USB_DEVICE(0x1908, 0x1315), .driver_info = + USB_QUIRK_HONOR_BNUMINTERFACES }, diff --git a/patches.suse/USB-Add-reset-resume-quirk-for-WD19-s-Realtek-Hub.patch b/patches.suse/USB-Add-reset-resume-quirk-for-WD19-s-Realtek-Hub.patch new file mode 100644 index 0000000..d8ee188 --- /dev/null +++ b/patches.suse/USB-Add-reset-resume-quirk-for-WD19-s-Realtek-Hub.patch @@ -0,0 +1,60 @@ +From ca91fd8c7643d93bfc18a6fec1a0d3972a46a18a Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Wed, 21 Apr 2021 01:46:51 +0800 +Subject: [PATCH] USB: Add reset-resume quirk for WD19's Realtek Hub +Git-commit: ca91fd8c7643d93bfc18a6fec1a0d3972a46a18a +Patch-mainline: v5.13-rc1 +References: git-fixes + +Realtek Hub (0bda:5487) in Dell Dock WD19 sometimes fails to work +after the system resumes from suspend with remote wakeup enabled +device connected: +[ 1947.640907] hub 5-2.3:1.0: hub_ext_port_status failed (err = -71) +[ 1947.641208] usb 5-2.3-port5: cannot disable (err = -71) +[ 1947.641401] hub 5-2.3:1.0: hub_ext_port_status failed (err = -71) +[ 1947.641450] usb 5-2.3-port4: cannot reset (err = -71) + +Information of this hub: +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 5 +D: Ver= 2.10 Cls=09(hub ) Sub=00 Prot=02 MxPS=64 #Cfgs= 1 +P: Vendor=0bda ProdID=5487 Rev= 1.47 +S: Manufacturer=Dell Inc. +S: Product=Dell dock +C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr= 0mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=01 Driver=hub +E: Ad=81(I) Atr=03(Int.) MxPS= 1 Ivl=256ms +I:* If#= 0 Alt= 1 #EPs= 1 Cls=09(hub ) Sub=00 Prot=02 Driver=hub + +The failure results from the ETIMEDOUT by chance when turning on +the suspend feature for the specified port of the hub. The port +seems to be in an unknown state so the hub_activate during resume +fails the hub_port_status, then the hub will fail to work. + +The quirky hub needs the reset-resume quirk to function correctly. + +Acked-by: Alan Stern +Signed-off-by: Chris Chiu +Cc: stable +Link: https://lore.kernel.org/r/20210420174651.6202-1-chris.chiu@canonical.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/core/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 6114cf83bb44..21e7522655ac 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -406,6 +406,7 @@ static const struct usb_device_id usb_quirk_list[] = { + + /* Realtek hub in Dell WD19 (Type-C) */ + { USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM }, ++ { USB_DEVICE(0x0bda, 0x5487), .driver_info = USB_QUIRK_RESET_RESUME }, + + /* Generic RTL8153 based ethernet adapters */ + { USB_DEVICE(0x0bda, 0x8153), .driver_info = USB_QUIRK_NO_LPM }, +-- +2.26.2 + diff --git a/patches.suse/USB-trancevibrator-fix-control-request-direction.patch b/patches.suse/USB-trancevibrator-fix-control-request-direction.patch new file mode 100644 index 0000000..2f15d90 --- /dev/null +++ b/patches.suse/USB-trancevibrator-fix-control-request-direction.patch @@ -0,0 +1,45 @@ +From 746e4acf87bcacf1406e05ef24a0b7139147c63e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 21 May 2021 15:31:09 +0200 +Subject: [PATCH] USB: trancevibrator: fix control-request direction +Git-commit: 746e4acf87bcacf1406e05ef24a0b7139147c63e +Patch-mainline: v5.13-rc4 +References: git-fixes + +The direction of the pipe argument must match the request-type direction +bit or control requests may fail depending on the host-controller-driver +implementation. + +Fix the set-speed request which erroneously used USB_DIR_IN and update +the default timeout argument to match (same value). + +Fixes: 5638e4d92e77 ("USB: add PlayStation 2 Trance Vibrator driver") +Cc: stable@vger.kernel.org # 2.6.19 +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210521133109.17396-1-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/misc/trancevibrator.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/misc/trancevibrator.c b/drivers/usb/misc/trancevibrator.c +index a3dfc77578ea..26baba3ab7d7 100644 +--- a/drivers/usb/misc/trancevibrator.c ++++ b/drivers/usb/misc/trancevibrator.c +@@ -61,9 +61,9 @@ static ssize_t speed_store(struct device *dev, struct device_attribute *attr, + /* Set speed */ + retval = usb_control_msg(tv->udev, usb_sndctrlpipe(tv->udev, 0), + 0x01, /* vendor request: set speed */ +- USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_OTHER, ++ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER, + tv->speed, /* speed value */ +- 0, NULL, 0, USB_CTRL_GET_TIMEOUT); ++ 0, NULL, 0, USB_CTRL_SET_TIMEOUT); + if (retval) { + tv->speed = old; + dev_dbg(&tv->udev->dev, "retval = %d\n", retval); +-- +2.26.2 + diff --git a/patches.suse/bnxt_en-Fix-PCI-AER-error-recovery-flow.patch b/patches.suse/bnxt_en-Fix-PCI-AER-error-recovery-flow.patch new file mode 100644 index 0000000..5dae68e --- /dev/null +++ b/patches.suse/bnxt_en-Fix-PCI-AER-error-recovery-flow.patch @@ -0,0 +1,45 @@ +From 1ea831d08fd7962079c6d1d7a93eee139737a85c Mon Sep 17 00:00:00 2001 +From: Vasundhara Volam +Date: Wed, 26 Aug 2020 01:08:35 -0400 +Subject: [PATCH 1/3] bnxt_en: Fix PCI AER error recovery flow +Git-commit: df3875ec550396974b1d8a518bd120d034738236 +Patch-mainline: v5.9-rc4 +References: git-fixes + +When a PCI error is detected the PCI state could be corrupt, save +the PCI state after initialization and restore it after the slot +reset. + +Fixes: 6316ea6db93d ("bnxt_en: Enable AER support.") +Signed-off-by: Vasundhara Volam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 872beaf5f9c4..124b70cd92bc 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -10716,6 +10716,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + (long)pci_resource_start(pdev, 0), dev->dev_addr); + pcie_print_link_status(pdev); + ++ pci_save_state(pdev); + return 0; + + init_err_cleanup_tc: +@@ -10884,6 +10885,8 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev) + "Cannot re-enable PCI device after reset.\n"); + } else { + pci_set_master(pdev); ++ pci_restore_state(pdev); ++ pci_save_state(pdev); + + err = bnxt_hwrm_func_reset(bp); + if (!err) +-- +2.16.4 + diff --git a/patches.suse/cfg80211-scan-drop-entry-from-hidden_list-on-overflo.patch b/patches.suse/cfg80211-scan-drop-entry-from-hidden_list-on-overflo.patch new file mode 100644 index 0000000..b8db975 --- /dev/null +++ b/patches.suse/cfg80211-scan-drop-entry-from-hidden_list-on-overflo.patch @@ -0,0 +1,38 @@ +From 010bfbe768f7ecc876ffba92db30432de4997e2a Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Fri, 16 Apr 2021 09:42:14 +0200 +Subject: [PATCH] cfg80211: scan: drop entry from hidden_list on overflow +Git-commit: 010bfbe768f7ecc876ffba92db30432de4997e2a +Patch-mainline: v5.13-rc1 +References: git-fixes + +If we overflow the maximum number of BSS entries and free the +new entry, drop it from any hidden_list that it may have been +added to in the code above or in cfg80211_combine_bsses(). + +Reported-by: Dan Carpenter +Link: https://lore.kernel.org/r/20210416094212.5de7d1676ad7.Ied283b0bc5f504845e7d6ab90626bdfa68bb3dc0@changeid +Cc: stable@vger.kernel.org +Signed-off-by: Johannes Berg +Acked-by: Takashi Iwai + +--- + net/wireless/scan.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index c3b51efff5c6..b21058698a9f 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -1751,6 +1751,8 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev, + + if (rdev->bss_entries >= bss_entries_limit && + !cfg80211_bss_expire_oldest(rdev)) { ++ if (!list_empty(&new->hidden_list)) ++ list_del(&new->hidden_list); + kfree(new); + goto drop; + } +-- +2.26.2 + diff --git a/patches.suse/cpufreq-Add-NULL-checks-to-show-and-store-methods-of.patch b/patches.suse/cpufreq-Add-NULL-checks-to-show-and-store-methods-of.patch new file mode 100644 index 0000000..2de5075 --- /dev/null +++ b/patches.suse/cpufreq-Add-NULL-checks-to-show-and-store-methods-of.patch @@ -0,0 +1,56 @@ +From e6e8df07268c1f75dd9215536e2ce4587b70f977 Mon Sep 17 00:00:00 2001 +From: Kai Shen +Date: Thu, 7 Nov 2019 05:08:17 +0000 +Subject: [PATCH] cpufreq: Add NULL checks to show() and store() methods of cpufreq +Git-commit: e6e8df07268c1f75dd9215536e2ce4587b70f977 +Patch-mainline: v5.5-rc1 +References: bsc#1184040 + +Add NULL checks to show() and store() in cpufreq.c to avoid attempts +to invoke a NULL callback. + +Though some interfaces of cpufreq are set as read-only, users can +still get write permission using chmod which can lead to a kernel +crash, as follows: + +chmod +w /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq +echo 1 > /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq + +This bug was found in linux 4.19. + +Signed-off-by: Kai Shen +Reported-by: Feilong Lin +Reviewed-by: Feilong Lin +Acked-by: Viresh Kumar +[ rjw: Subject & changelog ] + +Cc: All applicable +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/cpufreq/cpufreq.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -948,6 +948,9 @@ static ssize_t show(struct kobject *kobj + struct freq_attr *fattr = to_attr(attr); + ssize_t ret; + ++ if (!fattr->show) ++ return -EIO; ++ + down_read(&policy->rwsem); + ret = fattr->show(policy, buf); + up_read(&policy->rwsem); +@@ -962,6 +965,9 @@ static ssize_t store(struct kobject *kob + struct freq_attr *fattr = to_attr(attr); + ssize_t ret = -EINVAL; + ++ if (!fattr->store) ++ return -EIO; ++ + get_online_cpus(); + + if (cpu_online(policy->cpu)) { diff --git a/patches.suse/cpufreq-Avoid-cpufreq_suspend-deadlock-on-system-shu.patch b/patches.suse/cpufreq-Avoid-cpufreq_suspend-deadlock-on-system-shu.patch new file mode 100644 index 0000000..61869d7 --- /dev/null +++ b/patches.suse/cpufreq-Avoid-cpufreq_suspend-deadlock-on-system-shu.patch @@ -0,0 +1,87 @@ +From 65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 9 Oct 2019 01:29:10 +0200 +Subject: [PATCH] cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 +Patch-mainline: v5.4-rc4 +References: bsc#1184040 + +It is incorrect to set the cpufreq syscore shutdown callback pointer +to cpufreq_suspend(), because that function cannot be run in the +syscore stage of system shutdown for two reasons: (a) it may attempt +to carry out actions depending on devices that have already been shut +down at that point and (b) the RCU synchronization carried out by it +may not be able to make progress then. + +The latter issue has been present since commit 45975c7d21a1 ("rcu: +Define RCU-sched API in terms of RCU for Tree RCU PREEMPT builds"), +but the former one has been there since commit 90de2a4aa9f3 ("cpufreq: +suspend cpufreq governors on shutdown") regardless. + +Fix that by dropping cpufreq_syscore_ops altogether and making +device_shutdown() call cpufreq_suspend() directly before shutting +down devices, which is along the lines of what system-wide power +management does. + +Fixes: 45975c7d21a1 ("rcu: Define RCU-sched API in terms of RCU for Tree RCU PREEMPT builds") +Fixes: 90de2a4aa9f3 ("cpufreq: suspend cpufreq governors on shutdown") +Reported-by: Ville Syrjälä +Tested-by: Ville Syrjälä +Signed-off-by: Rafael J. Wysocki +Acked-by: Viresh Kumar +Cc: 4.0+ # 4.0+ +Acked-by: Takashi Iwai + +--- + drivers/base/core.c | 3 +++ + drivers/cpufreq/cpufreq.c | 10 ---------- + 2 files changed, 3 insertions(+), 10 deletions(-) + +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -10,6 +10,7 @@ + * + */ + ++#include + #include + #include + #include +@@ -2743,6 +2744,8 @@ void device_shutdown(void) + wait_for_device_probe(); + device_block_probing(); + ++ cpufreq_suspend(); ++ + spin_lock(&devices_kset->list_lock); + /* + * Walk the devices list backward, shutting down each in turn. +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -2623,14 +2623,6 @@ int cpufreq_unregister_driver(struct cpu + } + EXPORT_SYMBOL_GPL(cpufreq_unregister_driver); + +-/* +- * Stop cpufreq at shutdown to make sure it isn't holding any locks +- * or mutexes when secondary CPUs are halted. +- */ +-static struct syscore_ops cpufreq_syscore_ops = { +- .shutdown = cpufreq_suspend, +-}; +- + struct kobject *cpufreq_global_kobject; + EXPORT_SYMBOL(cpufreq_global_kobject); + +@@ -2642,8 +2634,6 @@ static int __init cpufreq_core_init(void + cpufreq_global_kobject = kobject_create_and_add("cpufreq", &cpu_subsys.dev_root->kobj); + BUG_ON(!cpufreq_global_kobject); + +- register_syscore_ops(&cpufreq_syscore_ops); +- + return 0; + } + module_param(off, int, 0444); diff --git a/patches.suse/drm-amdgpu-Fix-asic-reset-regression-issue-introduce.patch b/patches.suse/drm-amdgpu-Fix-asic-reset-regression-issue-introduce.patch new file mode 100644 index 0000000..51f7276 --- /dev/null +++ b/patches.suse/drm-amdgpu-Fix-asic-reset-regression-issue-introduce.patch @@ -0,0 +1,36 @@ +From c8941550aa66b2a90f4b32c45d59e8571e33336e Mon Sep 17 00:00:00 2001 +From: shaoyunl +Date: Tue, 9 Mar 2021 10:30:15 -0500 +Subject: [PATCH] drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f +Git-commit: c8941550aa66b2a90f4b32c45d59e8571e33336e +Patch-mainline: v5.13-rc1 +References: git-fixes + +This recent change introduce SDMA interrupt info printing with irq->process function. +These functions do not require a set function to enable/disable the irq + +Signed-off-by: shaoyunl +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c +index 9ab8d7db19f9..af026109421a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c +@@ -570,7 +570,7 @@ void amdgpu_irq_gpu_reset_resume_helper(struct amdgpu_device *adev) + for (j = 0; j < AMDGPU_MAX_IRQ_SRC_ID; ++j) { + struct amdgpu_irq_src *src = adev->irq.client[i].sources[j]; + +- if (!src) ++ if (!src || !src->funcs || !src->funcs->set) + continue; + for (k = 0; k < src->num_types; k++) + amdgpu_irq_update(adev, src, k); +-- +2.26.2 + diff --git a/patches.suse/drm-amdgpu-fix-NULL-pointer-dereference.patch b/patches.suse/drm-amdgpu-fix-NULL-pointer-dereference.patch new file mode 100644 index 0000000..f77f624 --- /dev/null +++ b/patches.suse/drm-amdgpu-fix-NULL-pointer-dereference.patch @@ -0,0 +1,60 @@ +From 3c3dc654333f6389803cdcaf03912e94173ae510 Mon Sep 17 00:00:00 2001 +From: Guchun Chen +Date: Tue, 30 Mar 2021 17:52:18 +0800 +Subject: [PATCH] drm/amdgpu: fix NULL pointer dereference +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 3c3dc654333f6389803cdcaf03912e94173ae510 +Patch-mainline: v5.13-rc1 +References: git-fixes + +ttm->sg needs to be checked before accessing its child member. + +Call Trace: + amdgpu_ttm_backend_destroy+0x12/0x70 [amdgpu] + ttm_bo_cleanup_memtype_use+0x3a/0x60 [ttm] + ttm_bo_release+0x17d/0x300 [ttm] + amdgpu_bo_unref+0x1a/0x30 [amdgpu] + amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x78b/0x8b0 [amdgpu] + kfd_ioctl_alloc_memory_of_gpu+0x118/0x220 [amdgpu] + kfd_ioctl+0x222/0x400 [amdgpu] + ? kfd_dev_is_large_bar+0x90/0x90 [amdgpu] + __x64_sys_ioctl+0x8e/0xd0 + ? __context_tracking_exit+0x52/0x90 + do_syscall_64+0x33/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 +Rip: 0033:0x7f97f264d317 +Code: b3 66 90 48 8b 05 71 4b 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 41 4b 2d 00 f7 d8 64 89 01 48 +Rsp: 002b:00007ffdb402c338 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 +Rax: ffffffffffffffda RBX: 00007f97f3cc63a0 RCX: 00007f97f264d317 +Rdx: 00007ffdb402c380 RSI: 00000000c0284b16 RDI: 0000000000000003 +Rbp: 00007ffdb402c380 R08: 00007ffdb402c428 R09: 00000000c4000004 +R10: 00000000c4000004 R11: 0000000000000246 R12: 00000000c0284b16 +R13: 0000000000000003 R14: 00007f97f3cc63a0 R15: 00007f8836200000 + +Signed-off-by: Guchun Chen +Acked-by: Christian König +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index 07e72d84e142..80071f54f2aa 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -867,7 +867,7 @@ static void amdgpu_ttm_tt_unpin_userptr(struct ttm_device *bdev, + DMA_BIDIRECTIONAL : DMA_TO_DEVICE; + + /* double check that we don't free the table twice */ +- if (!ttm->sg->sgl) ++ if (!ttm->sg || !ttm->sg->sgl) + return; + + /* unmap the pages mapped to the device */ +-- +2.26.2 + diff --git a/patches.suse/drm-meson-fix-shutdown-crash-when-component-not-prob.patch b/patches.suse/drm-meson-fix-shutdown-crash-when-component-not-prob.patch new file mode 100644 index 0000000..472e909 --- /dev/null +++ b/patches.suse/drm-meson-fix-shutdown-crash-when-component-not-prob.patch @@ -0,0 +1,64 @@ +From 7cfc4ea78fc103ea51ecbacd9236abb5b1c490d2 Mon Sep 17 00:00:00 2001 +From: Neil Armstrong +Date: Fri, 30 Apr 2021 10:27:44 +0200 +Subject: [PATCH] drm/meson: fix shutdown crash when component not probed +Git-commit: 7cfc4ea78fc103ea51ecbacd9236abb5b1c490d2 +Patch-mainline: v5.13-rc4 +References: git-fixes + +When main component is not probed, by example when the dw-hdmi module is +not loaded yet or in probe defer, the following crash appears on shutdown: + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 +... +pc : meson_drv_shutdown+0x24/0x50 +lr : platform_drv_shutdown+0x20/0x30 +... +Call trace: +meson_drv_shutdown+0x24/0x50 +platform_drv_shutdown+0x20/0x30 +device_shutdown+0x158/0x360 +kernel_restart_prepare+0x38/0x48 +kernel_restart+0x18/0x68 +__do_sys_reboot+0x224/0x250 +__arm64_sys_reboot+0x24/0x30 +... + +Simply check if the priv struct has been allocated before using it. + +Fixes: fa0c16caf3d7 ("drm: meson_drv add shutdown function") +Reported-by: Stefan Agner +Signed-off-by: Neil Armstrong +Tested-by: Martin Blumenstingl +Reviewed-by: Martin Blumenstingl +Link: https://patchwork.freedesktop.org/patch/msgid/20210430082744.3638743-1-narmstrong@baylibre.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/meson/meson_drv.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index 453d8b4c5763..07fcd12dca16 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -485,11 +485,12 @@ static int meson_probe_remote(struct platform_device *pdev, + static void meson_drv_shutdown(struct platform_device *pdev) + { + struct meson_drm *priv = dev_get_drvdata(&pdev->dev); +- struct drm_device *drm = priv->drm; + +- DRM_DEBUG_DRIVER("\n"); +- drm_kms_helper_poll_fini(drm); +- drm_atomic_helper_shutdown(drm); ++ if (!priv) ++ return; ++ ++ drm_kms_helper_poll_fini(priv->drm); ++ drm_atomic_helper_shutdown(priv->drm); + } + + static int meson_drv_probe(struct platform_device *pdev) +-- +2.26.2 + diff --git a/patches.suse/drm-msm-mdp5-Configure-PP_SYNC_HEIGHT-to-double-the-.patch b/patches.suse/drm-msm-mdp5-Configure-PP_SYNC_HEIGHT-to-double-the-.patch new file mode 100644 index 0000000..9b8034f --- /dev/null +++ b/patches.suse/drm-msm-mdp5-Configure-PP_SYNC_HEIGHT-to-double-the-.patch @@ -0,0 +1,57 @@ +From 2ad52bdb220de5ab348098e3482b01235d15a842 Mon Sep 17 00:00:00 2001 +From: Marijn Suijten +Date: Tue, 6 Apr 2021 23:47:24 +0200 +Subject: [PATCH] drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal +Git-commit: 2ad52bdb220de5ab348098e3482b01235d15a842 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Leaving this at a close-to-maximum register value 0xFFF0 means it takes +very long for the MDSS to generate a software vsync interrupt when the +hardware TE interrupt doesn't arrive. Configuring this to double the +vtotal (like some downstream kernels) leads to a frame to take at most +twice before the vsync signal, until hardware TE comes up. + +In this case the hardware interrupt responsible for providing this +signal - "disp-te" gpio - is not hooked up to the mdp5 vsync/pp logic at +all. This solves severe panel update issues observed on at least the +Xperia Loire and Tone series, until said gpio is properly hooked up to +an irq. + +Suggested-by: AngeloGioacchino Del Regno +Signed-off-by: Marijn Suijten +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20210406214726.131534-2-marijn.suijten@somainline.org +Signed-off-by: Rob Clark +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c +index ff2c1d583c79..f6df4d3b1406 100644 +--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c ++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c +@@ -49,9 +49,17 @@ static int pingpong_tearcheck_setup(struct drm_encoder *encoder, + | MDP5_PP_SYNC_CONFIG_VSYNC_IN_EN; + cfg |= MDP5_PP_SYNC_CONFIG_VSYNC_COUNT(vclks_line); + ++ /* ++ * Tearcheck emits a blanking signal every vclks_line * vtotal * 2 ticks on ++ * the vsync_clk equating to roughly half the desired panel refresh rate. ++ * This is only necessary as stability fallback if interrupts from the ++ * panel arrive too late or not at all, but is currently used by default ++ * because these panel interrupts are not wired up yet. ++ */ + mdp5_write(mdp5_kms, REG_MDP5_PP_SYNC_CONFIG_VSYNC(pp_id), cfg); + mdp5_write(mdp5_kms, +- REG_MDP5_PP_SYNC_CONFIG_HEIGHT(pp_id), 0xfff0); ++ REG_MDP5_PP_SYNC_CONFIG_HEIGHT(pp_id), (2 * mode->vtotal)); ++ + mdp5_write(mdp5_kms, + REG_MDP5_PP_VSYNC_INIT_VAL(pp_id), mode->vdisplay); + mdp5_write(mdp5_kms, REG_MDP5_PP_RD_PTR_IRQ(pp_id), mode->vdisplay + 1); +-- +2.26.2 + diff --git a/patches.suse/drm-radeon-Fix-off-by-one-power_state-index-heap-ove.patch b/patches.suse/drm-radeon-Fix-off-by-one-power_state-index-heap-ove.patch new file mode 100644 index 0000000..5a0d7ad --- /dev/null +++ b/patches.suse/drm-radeon-Fix-off-by-one-power_state-index-heap-ove.patch @@ -0,0 +1,119 @@ +From 5bbf219328849e83878bddb7c226d8d42e84affc Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Sun, 2 May 2021 22:06:07 -0700 +Subject: [PATCH] drm/radeon: Fix off-by-one power_state index heap overwrite +Git-commit: 5bbf219328849e83878bddb7c226d8d42e84affc +Patch-mainline: v5.13-rc1 +References: git-fixes + +An out of bounds write happens when setting the default power state. +KASAN sees this as: + +[drm] radeon: 512M of GTT memory ready. +[drm] GART: num cpu pages 131072, num gpu pages 131072 +================================================================== +Bug: KASAN: slab-out-of-bounds in +radeon_atombios_parse_power_table_1_3+0x1837/0x1998 [radeon] +Write of size 4 at addr ffff88810178d858 by task systemd-udevd/157 + +Cpu: 0 PID: 157 Comm: systemd-udevd Not tainted 5.12.0-E620 #50 +Hardware name: eMachines eMachines E620 /Nile , BIOS V1.03 09/30/2008 +Call Trace: + dump_stack+0xa5/0xe6 + print_address_description.constprop.0+0x18/0x239 + kasan_report+0x170/0x1a8 + radeon_atombios_parse_power_table_1_3+0x1837/0x1998 [radeon] + radeon_atombios_get_power_modes+0x144/0x1888 [radeon] + radeon_pm_init+0x1019/0x1904 [radeon] + rs690_init+0x76e/0x84a [radeon] + radeon_device_init+0x1c1a/0x21e5 [radeon] + radeon_driver_load_kms+0xf5/0x30b [radeon] + drm_dev_register+0x255/0x4a0 [drm] + radeon_pci_probe+0x246/0x2f6 [radeon] + pci_device_probe+0x1aa/0x294 + really_probe+0x30e/0x850 + driver_probe_device+0xe6/0x135 + device_driver_attach+0xc1/0xf8 + __driver_attach+0x13f/0x146 + bus_for_each_dev+0xfa/0x146 + bus_add_driver+0x2b3/0x447 + driver_register+0x242/0x2c1 + do_one_initcall+0x149/0x2fd + do_init_module+0x1ae/0x573 + load_module+0x4dee/0x5cca + __do_sys_finit_module+0xf1/0x140 + do_syscall_64+0x33/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Without KASAN, this will manifest later when the kernel attempts to +allocate memory that was stomped, since it collides with the inline slab +freelist pointer: + +invalid opcode: 0000 [#1] SMP NOPTI +Cpu: 0 PID: 781 Comm: openrc-run.sh Tainted: G W 5.10.12-gentoo-E620 #2 +Hardware name: eMachines eMachines E620 /Nile , BIOS V1.03 09/30/2008 +Rip: 0010:kfree+0x115/0x230 +Code: 89 c5 e8 75 ea ff ff 48 8b 00 0f ba e0 09 72 63 e8 1f f4 ff ff 41 89 c4 48 8b 45 00 0f ba e0 10 72 0a 48 8b 45 08 a8 01 75 02 <0f> 0b 44 89 e1 48 c7 c2 00 f0 ff ff be 06 00 00 00 48 d3 e2 48 c7 +Rsp: 0018:ffffb42f40267e10 EFLAGS: 00010246 +Rax: ffffd61280ee8d88 RBX: 0000000000000004 RCX: 000000008010000d +Rdx: 4000000000000000 RSI: ffffffffba1360b0 RDI: ffffd61280ee8d80 +Rbp: ffffd61280ee8d80 R08: ffffffffb91bebdf R09: 0000000000000000 +R10: ffff8fe2c1047ac8 R11: 0000000000000000 R12: 0000000000000000 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000100 +Fs: 00007fe80eff6b68(0000) GS:ffff8fe339c00000(0000) knlGS:0000000000000000 +Cs: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +Cr2: 00007fe80eec7bc0 CR3: 0000000038012000 CR4: 00000000000006f0 +Call Trace: + __free_fdtable+0x16/0x1f + put_files_struct+0x81/0x9b + do_exit+0x433/0x94d + do_group_exit+0xa6/0xa6 + __x64_sys_exit_group+0xf/0xf + do_syscall_64+0x33/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 +Rip: 0033:0x7fe80ef64bea +Code: Unable to access opcode bytes at RIP 0x7fe80ef64bc0. +Rsp: 002b:00007ffdb1c47528 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 +Rax: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fe80ef64bea +Rdx: 00007fe80ef64f60 RSI: 0000000000000000 RDI: 0000000000000000 +Rbp: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 +R10: 00007fe80ee2c620 R11: 0000000000000246 R12: 00007fe80eff41e0 +R13: 00000000ffffffff R14: 0000000000000024 R15: 00007fe80edf9cd0 +Modules linked in: radeon(+) ath5k(+) snd_hda_codec_realtek ... + +Use a valid power_state index when initializing the "flags" and "misc" +and "misc2" fields. + +Bug: https://bugzilla.kernel.org/show_bug.cgi?id=211537 +Reported-by: Erhard F. +Fixes: a48b9b4edb8b ("drm/radeon/kms/pm: add asic specific callbacks for getting power state (v2)") +Fixes: 79daedc94281 ("drm/radeon/kms: minor pm cleanups") +Signed-off-by: Kees Cook +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/radeon/radeon_atombios.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c +index 42301b4e56f5..f9f4efa1738c 100644 +--- a/drivers/gpu/drm/radeon/radeon_atombios.c ++++ b/drivers/gpu/drm/radeon/radeon_atombios.c +@@ -2250,10 +2250,10 @@ static int radeon_atombios_parse_power_table_1_3(struct radeon_device *rdev) + rdev->pm.default_power_state_index = state_index - 1; + rdev->pm.power_state[state_index - 1].default_clock_mode = + &rdev->pm.power_state[state_index - 1].clock_info[0]; +- rdev->pm.power_state[state_index].flags &= ++ rdev->pm.power_state[state_index - 1].flags &= + ~RADEON_PM_STATE_SINGLE_DISPLAY_ONLY; +- rdev->pm.power_state[state_index].misc = 0; +- rdev->pm.power_state[state_index].misc2 = 0; ++ rdev->pm.power_state[state_index - 1].misc = 0; ++ rdev->pm.power_state[state_index - 1].misc2 = 0; + } + return state_index; + } +-- +2.26.2 + diff --git a/patches.suse/drm-radeon-dpm-Disable-sclk-switching-on-Oland-when-.patch b/patches.suse/drm-radeon-dpm-Disable-sclk-switching-on-Oland-when-.patch new file mode 100644 index 0000000..7ead9de --- /dev/null +++ b/patches.suse/drm-radeon-dpm-Disable-sclk-switching-on-Oland-when-.patch @@ -0,0 +1,93 @@ +From 227545b9a08c68778ddd89428f99c351fc9315ac Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Fri, 30 Apr 2021 12:56:56 +0800 +Subject: [PATCH] drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are connected +Git-commit: 227545b9a08c68778ddd89428f99c351fc9315ac +Patch-mainline: v5.13-rc2 +References: git-fixes + +Screen flickers rapidly when two 4K 60Hz monitors are in use. This issue +doesn't happen when one monitor is 4K 60Hz (pixelclock 594MHz) and +another one is 4K 30Hz (pixelclock 297MHz). + +The issue is gone after setting "power_dpm_force_performance_level" to +"high". Following the indication, we found that the issue occurs when +sclk is too low. + +So resolve the issue by disabling sclk switching when there are two +monitors requires high pixelclock (> 297MHz). + +V2: - Only apply the fix to Oland. +Signed-off-by: Kai-Heng Feng +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/radeon/radeon.h | 1 + + drivers/gpu/drm/radeon/radeon_pm.c | 8 ++++++++ + drivers/gpu/drm/radeon/si_dpm.c | 3 +++ + 3 files changed, 12 insertions(+) + +diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h +index 42281fce552e..56ed5634cebe 100644 +--- a/drivers/gpu/drm/radeon/radeon.h ++++ b/drivers/gpu/drm/radeon/radeon.h +@@ -1549,6 +1549,7 @@ struct radeon_dpm { + void *priv; + u32 new_active_crtcs; + int new_active_crtc_count; ++ int high_pixelclock_count; + u32 current_active_crtcs; + int current_active_crtc_count; + bool single_display; +diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c +index 0c1950f4e146..3861c0b98fcf 100644 +--- a/drivers/gpu/drm/radeon/radeon_pm.c ++++ b/drivers/gpu/drm/radeon/radeon_pm.c +@@ -1767,6 +1767,7 @@ static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev) + struct drm_device *ddev = rdev->ddev; + struct drm_crtc *crtc; + struct radeon_crtc *radeon_crtc; ++ struct radeon_connector *radeon_connector; + + if (!rdev->pm.dpm_enabled) + return; +@@ -1776,6 +1777,7 @@ static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev) + /* update active crtc counts */ + rdev->pm.dpm.new_active_crtcs = 0; + rdev->pm.dpm.new_active_crtc_count = 0; ++ rdev->pm.dpm.high_pixelclock_count = 0; + if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) { + list_for_each_entry(crtc, + &ddev->mode_config.crtc_list, head) { +@@ -1783,6 +1785,12 @@ static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev) + if (crtc->enabled) { + rdev->pm.dpm.new_active_crtcs |= (1 << radeon_crtc->crtc_id); + rdev->pm.dpm.new_active_crtc_count++; ++ if (!radeon_crtc->connector) ++ continue; ++ ++ radeon_connector = to_radeon_connector(radeon_crtc->connector); ++ if (radeon_connector->pixelclock_for_modeset > 297000) ++ rdev->pm.dpm.high_pixelclock_count++; + } + } + } +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index 2c54c0d7ca5b..3add39c1a689 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2979,6 +2979,9 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, + (rdev->pdev->device == 0x6605)) { + max_sclk = 75000; + } ++ ++ if (rdev->pm.dpm.high_pixelclock_count > 1) ++ disable_sclk_switching = true; + } + + if (rps->vce_active) { +-- +2.26.2 + diff --git a/patches.suse/extcon-arizona-Fix-some-issues-when-HPDET-IRQ-fires-.patch b/patches.suse/extcon-arizona-Fix-some-issues-when-HPDET-IRQ-fires-.patch new file mode 100644 index 0000000..11b18e0 --- /dev/null +++ b/patches.suse/extcon-arizona-Fix-some-issues-when-HPDET-IRQ-fires-.patch @@ -0,0 +1,90 @@ +From c309a3e8793f7e01c4a4ec7960658380572cb576 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sun, 7 Mar 2021 16:17:56 +0100 +Subject: [PATCH] extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplugged +Git-commit: c309a3e8793f7e01c4a4ec7960658380572cb576 +Patch-mainline: v5.13-rc1 +References: git-fixes + +When the jack is partially inserted and then removed again it may be +removed while the hpdet code is running. In this case the following +may happen: + +1. The "JACKDET rise" or ""JACKDET fall" IRQ triggers +2. arizona_jackdet runs and takes info->lock +3. The "HPDET" IRQ triggers +4. arizona_hpdet_irq runs, blocks on info->lock +5. arizona_jackdet calls arizona_stop_mic() and clears info->hpdet_done +6. arizona_jackdet releases info->lock +7. arizona_hpdet_irq now can continue running and: +7.1 Calls arizona_start_mic() (if a mic was detected) +7.2 sets info->hpdet_done + +Step 7 is undesirable / a bug: +7.1 causes the device to stay in a high power-state (with MICVDD enabled) +7.2 causes hpdet to not run on the next jack insertion, which in turn + causes the EXTCON_JACK_HEADPHONE state to never get set + +This fixes both issues by skipping these 2 steps when arizona_hpdet_irq +runs after the jack has been unplugged. + +Signed-off-by: Hans de Goede +Reviewed-by: Andy Shevchenko +Acked-by: Charles Keepax +Tested-by: Charles Keepax +Acked-by: Chanwoo Choi +Signed-off-by: Lee Jones +Acked-by: Takashi Iwai + +--- + drivers/extcon/extcon-arizona.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +--- a/drivers/extcon/extcon-arizona.c ++++ b/drivers/extcon/extcon-arizona.c +@@ -602,7 +602,7 @@ static irqreturn_t arizona_hpdet_irq(int + struct arizona *arizona = info->arizona; + int id_gpio = arizona->pdata.hpdet_id_gpio; + unsigned int report = EXTCON_JACK_HEADPHONE; +- int ret, reading; ++ int ret, reading, state; + bool mic = false; + + mutex_lock(&info->lock); +@@ -615,12 +615,11 @@ static irqreturn_t arizona_hpdet_irq(int + } + + /* If the cable was removed while measuring ignore the result */ +- ret = extcon_get_state(info->edev, EXTCON_MECHANICAL); +- if (ret < 0) { +- dev_err(arizona->dev, "Failed to check cable state: %d\n", +- ret); ++ state = extcon_get_state(info->edev, EXTCON_MECHANICAL); ++ if (state < 0) { ++ dev_err(arizona->dev, "Failed to check cable state: %d\n", state); + goto out; +- } else if (!ret) { ++ } else if (!state) { + dev_dbg(arizona->dev, "Ignoring HPDET for removed cable\n"); + goto done; + } +@@ -673,7 +672,7 @@ done: + ARIZONA_ACCDET_MODE_MASK, ARIZONA_ACCDET_MODE_MIC); + + /* If we have a mic then reenable MICDET */ +- if (mic || info->mic) ++ if (state && (mic || info->mic)) + arizona_start_mic(info); + + if (info->hpdet_active) { +@@ -681,7 +680,9 @@ done: + info->hpdet_active = false; + } + +- info->hpdet_done = true; ++ /* Do not set hp_det done when the cable has been unplugged */ ++ if (state) ++ info->hpdet_done = true; + + out: + mutex_unlock(&info->lock); diff --git a/patches.suse/fbdev-zero-fill-colormap-in-fbcmap.c.patch b/patches.suse/fbdev-zero-fill-colormap-in-fbcmap.c.patch new file mode 100644 index 0000000..b067ac6 --- /dev/null +++ b/patches.suse/fbdev-zero-fill-colormap-in-fbcmap.c.patch @@ -0,0 +1,56 @@ +From 19ab233989d0f7ab1de19a036e247afa4a0a1e9c Mon Sep 17 00:00:00 2001 +From: Phillip Potter +Date: Wed, 31 Mar 2021 23:07:19 +0100 +Subject: [PATCH] fbdev: zero-fill colormap in fbcmap.c +Git-commit: 19ab233989d0f7ab1de19a036e247afa4a0a1e9c +Patch-mainline: v5.13-rc1 +References: git-fixes + +Use kzalloc() rather than kmalloc() for the dynamically allocated parts +of the colormap in fb_alloc_cmap_gfp, to prevent a leak of random kernel +data to userspace under certain circumstances. + +Fixes a KMSAN-found infoleak bug reported by syzbot at: +https://syzkaller.appspot.com/bug?id=741578659feabd108ad9e06696f0c1f2e69c4b6e + +Reported-by: syzbot+47fa9c9c648b765305b9@syzkaller.appspotmail.com +Cc: stable +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Phillip Potter +Link: https://lore.kernel.org/r/20210331220719.1499743-1-phil@philpotter.co.uk +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/video/fbdev/core/fbcmap.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/video/fbdev/core/fbcmap.c b/drivers/video/fbdev/core/fbcmap.c +index 757d5c3f620b..ff09e57f3c38 100644 +--- a/drivers/video/fbdev/core/fbcmap.c ++++ b/drivers/video/fbdev/core/fbcmap.c +@@ -101,17 +101,17 @@ int fb_alloc_cmap_gfp(struct fb_cmap *cmap, int len, int transp, gfp_t flags) + if (!len) + return 0; + +- cmap->red = kmalloc(size, flags); ++ cmap->red = kzalloc(size, flags); + if (!cmap->red) + goto fail; +- cmap->green = kmalloc(size, flags); ++ cmap->green = kzalloc(size, flags); + if (!cmap->green) + goto fail; +- cmap->blue = kmalloc(size, flags); ++ cmap->blue = kzalloc(size, flags); + if (!cmap->blue) + goto fail; + if (transp) { +- cmap->transp = kmalloc(size, flags); ++ cmap->transp = kzalloc(size, flags); + if (!cmap->transp) + goto fail; + } else { +-- +2.26.2 + diff --git a/patches.suse/gpio-xilinx-Correct-kernel-doc-for-xgpio_probe.patch b/patches.suse/gpio-xilinx-Correct-kernel-doc-for-xgpio_probe.patch new file mode 100644 index 0000000..a32ecbb --- /dev/null +++ b/patches.suse/gpio-xilinx-Correct-kernel-doc-for-xgpio_probe.patch @@ -0,0 +1,41 @@ +From a0579474effff6a139768b300d8439c2327b3848 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Mon, 10 May 2021 22:46:30 +0300 +Subject: [PATCH] gpio: xilinx: Correct kernel doc for xgpio_probe() +Git-commit: a0579474effff6a139768b300d8439c2327b3848 +Patch-mainline: v5.13-rc3 +References: git-fixes + +Kernel doc validator complains: + +.../gpio-xilinx.c:556: warning: expecting prototype for xgpio_of_probe(). Prototype was for xgpio_probe() instead + +Correct as suggested by changing the name of the function in the doc.. + +Fixes: 749564ffd52d ("gpio/xilinx: Convert the driver to platform device interface") +Signed-off-by: Andy Shevchenko +Tested-by: Neeli Srinivas +Reviewed-by: Michal Simek +Signed-off-by: Bartosz Golaszewski +Acked-by: Takashi Iwai + +--- + drivers/gpio/gpio-xilinx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-xilinx.c b/drivers/gpio/gpio-xilinx.c +index b411d3156e0b..136557e7dd3c 100644 +--- a/drivers/gpio/gpio-xilinx.c ++++ b/drivers/gpio/gpio-xilinx.c +@@ -542,7 +542,7 @@ static void xgpio_irqhandler(struct irq_desc *desc) + } + + /** +- * xgpio_of_probe - Probe method for the GPIO device. ++ * xgpio_probe - Probe method for the GPIO device. + * @pdev: pointer to the platform device + * + * Return: +-- +2.26.2 + diff --git a/patches.suse/gpiolib-acpi-Add-quirk-to-ignore-EC-wakeups-on-Dell-.patch b/patches.suse/gpiolib-acpi-Add-quirk-to-ignore-EC-wakeups-on-Dell-.patch new file mode 100644 index 0000000..90508ff --- /dev/null +++ b/patches.suse/gpiolib-acpi-Add-quirk-to-ignore-EC-wakeups-on-Dell-.patch @@ -0,0 +1,56 @@ +From da91ece226729c76f60708efc275ebd4716ad089 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 1 Apr 2021 18:27:40 +0200 +Subject: [PATCH] gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055 +Git-commit: da91ece226729c76f60708efc275ebd4716ad089 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Like some other Bay and Cherry Trail SoC based devices the Dell Venue +10 Pro 5055 has an embedded-controller which uses ACPI GPIO events to +report events instead of using the standard ACPI EC interface for this. + +The EC interrupt is only used to report battery-level changes and +it keeps doing this while the system is suspended, causing the system +to not stay suspended. + +Add an ignore-wake quirk for the GPIO pin used by the EC to fix the +spurious wakeups from suspend. + +Signed-off-by: Hans de Goede +Acked-by: Andy Shevchenko +Signed-off-by: Andy Shevchenko +Acked-by: Takashi Iwai + +--- + drivers/gpio/gpiolib-acpi.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index 21750be9c489..3ef22a3c104d 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -1445,6 +1445,20 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] __initconst = { + .no_edge_events_on_boot = true, + }, + }, ++ { ++ /* ++ * The Dell Venue 10 Pro 5055, with Bay Trail SoC + TI PMIC uses an ++ * external embedded-controller connected via I2C + an ACPI GPIO ++ * event handler on INT33FFC:02 pin 12, causing spurious wakeups. ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Venue 10 Pro 5055"), ++ }, ++ .driver_data = &(struct acpi_gpiolib_dmi_quirk) { ++ .ignore_wake = "INT33FC:02@12", ++ }, ++ }, + { + /* + * HP X2 10 models with Cherry Trail SoC + TI PMIC use an +-- +2.26.2 + diff --git a/patches.suse/i2c-i801-Don-t-generate-an-interrupt-on-bus-reset.patch b/patches.suse/i2c-i801-Don-t-generate-an-interrupt-on-bus-reset.patch new file mode 100644 index 0000000..79dea11 --- /dev/null +++ b/patches.suse/i2c-i801-Don-t-generate-an-interrupt-on-bus-reset.patch @@ -0,0 +1,61 @@ +From e4d8716c3dcec47f1557024add24e1f3c09eb24b Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Tue, 25 May 2021 17:03:36 +0200 +Subject: [PATCH] i2c: i801: Don't generate an interrupt on bus reset +Git-commit: e4d8716c3dcec47f1557024add24e1f3c09eb24b +Patch-mainline: v5.13-rc4 +References: git-fixes + +Now that the i2c-i801 driver supports interrupts, setting the KILL bit +in a attempt to recover from a timed out transaction triggers an +interrupt. Unfortunately, the interrupt handler (i801_isr) is not +prepared for this situation and will try to process the interrupt as +if it was signaling the end of a successful transaction. In the case +of a block transaction, this can result in an out-of-range memory +access. + +This condition was reproduced several times by syzbot: +https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e +https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e +https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e +https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb +https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a +https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79 + +So disable interrupts while trying to reset the bus. Interrupts will +be enabled again for the following transaction. + +Fixes: 636752bcb517 ("i2c-i801: Enable IRQ for SMBus transactions") +Reported-by: syzbot+b4d3fd1dfd53e90afd79@syzkaller.appspotmail.com +Signed-off-by: Jean Delvare +Acked-by: Andy Shevchenko +Cc: Jarkko Nikula +Tested-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Acked-by: Takashi Iwai + +--- + drivers/i2c/busses/i2c-i801.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c +index 99d446763530..f9e1c2ceaac0 100644 +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -395,11 +395,9 @@ static int i801_check_post(struct i801_priv *priv, int status) + dev_err(&priv->pci_dev->dev, "Transaction timeout\n"); + /* try to stop the current command */ + dev_dbg(&priv->pci_dev->dev, "Terminating the current operation\n"); +- outb_p(inb_p(SMBHSTCNT(priv)) | SMBHSTCNT_KILL, +- SMBHSTCNT(priv)); ++ outb_p(SMBHSTCNT_KILL, SMBHSTCNT(priv)); + usleep_range(1000, 2000); +- outb_p(inb_p(SMBHSTCNT(priv)) & (~SMBHSTCNT_KILL), +- SMBHSTCNT(priv)); ++ outb_p(0, SMBHSTCNT(priv)); + + /* Check if it worked */ + status = inb_p(SMBHSTSTS(priv)); +-- +2.26.2 + diff --git a/patches.suse/i2c-s3c2410-fix-possible-NULL-pointer-deref-on-read-.patch b/patches.suse/i2c-s3c2410-fix-possible-NULL-pointer-deref-on-read-.patch new file mode 100644 index 0000000..fc8428c --- /dev/null +++ b/patches.suse/i2c-s3c2410-fix-possible-NULL-pointer-deref-on-read-.patch @@ -0,0 +1,72 @@ +From 24990423267ec283b9d86f07f362b753eb9b0ed5 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 26 May 2021 08:39:37 -0400 +Subject: [PATCH] i2c: s3c2410: fix possible NULL pointer deref on read message after write +Git-commit: 24990423267ec283b9d86f07f362b753eb9b0ed5 +Patch-mainline: v5.13-rc4 +References: git-fixes + +Interrupt handler processes multiple message write requests one after +another, till the driver message queue is drained. However if driver +encounters a read message without preceding START, it stops the I2C +transfer as it is an invalid condition for the controller. At least the +comment describes a requirement "the controller forces us to send a new +START when we change direction". This stop results in clearing the +message queue (i2c->msg = NULL). + +The code however immediately jumped back to label "retry_write" which +dereferenced the "i2c->msg" making it a possible NULL pointer +dereference. + +The Coverity analysis: +1. Condition !is_msgend(i2c), taking false branch. + if (!is_msgend(i2c)) { + +2. Condition !is_lastmsg(i2c), taking true branch. + } else if (!is_lastmsg(i2c)) { + +3. Condition i2c->msg->flags & 1, taking true branch. + if (i2c->msg->flags & I2C_M_RD) { + +4. write_zero_model: Passing i2c to s3c24xx_i2c_stop, which sets i2c->msg to NULL. + s3c24xx_i2c_stop(i2c, -EINVAL); + +5. Jumping to label retry_write. + goto retry_write; + +6. var_deref_model: Passing i2c to is_msgend, which dereferences null i2c->msg. + if (!is_msgend(i2c)) {" + +All previous calls to s3c24xx_i2c_stop() in this interrupt service +routine are followed by jumping to end of function (acknowledging +the interrupt and returning). This seems a reasonable choice also here +since message buffer was entirely emptied. + +Addresses-coverity: Explicit null dereferenced +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Wolfram Sang +Acked-by: Takashi Iwai + +--- + drivers/i2c/busses/i2c-s3c2410.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c +index ab928613afba..4d82761e1585 100644 +--- a/drivers/i2c/busses/i2c-s3c2410.c ++++ b/drivers/i2c/busses/i2c-s3c2410.c +@@ -480,7 +480,10 @@ static int i2c_s3c_irq_nextbyte(struct s3c24xx_i2c *i2c, unsigned long iicstat) + * forces us to send a new START + * when we change direction + */ ++ dev_dbg(i2c->dev, ++ "missing START before write->read\n"); + s3c24xx_i2c_stop(i2c, -EINVAL); ++ break; + } + + goto retry_write; +-- +2.26.2 + diff --git a/patches.suse/i2c-sh7760-add-IRQ-check.patch b/patches.suse/i2c-sh7760-add-IRQ-check.patch new file mode 100644 index 0000000..3865278 --- /dev/null +++ b/patches.suse/i2c-sh7760-add-IRQ-check.patch @@ -0,0 +1,42 @@ +From e5b2e3e742015dd2aa6bc7bcef2cb59b2de1221c Mon Sep 17 00:00:00 2001 +From: Sergey Shtylyov +Date: Sat, 10 Apr 2021 23:25:10 +0300 +Subject: [PATCH] i2c: sh7760: add IRQ check +Git-commit: e5b2e3e742015dd2aa6bc7bcef2cb59b2de1221c +Patch-mainline: v5.13-rc1 +References: git-fixes + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_irq() (which +takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding +an original error code. Stop calling devm_request_irq() with invalid +IRQ #s. + +Fixes: a26c20b1fa6d ("i2c: Renesas SH7760 I2C master driver") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Acked-by: Takashi Iwai + +--- + drivers/i2c/busses/i2c-sh7760.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c +index c2005c789d2b..c79c9f542c5a 100644 +--- a/drivers/i2c/busses/i2c-sh7760.c ++++ b/drivers/i2c/busses/i2c-sh7760.c +@@ -471,7 +471,10 @@ static int sh7760_i2c_probe(struct platform_device *pdev) + goto out2; + } + +- id->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ return ret; ++ id->irq = ret; + + id->adap.nr = pdev->id; + id->adap.algo = &sh7760_i2c_algo; +-- +2.26.2 + diff --git a/patches.suse/i2c-sh7760-fix-IRQ-error-path.patch b/patches.suse/i2c-sh7760-fix-IRQ-error-path.patch new file mode 100644 index 0000000..6f50435 --- /dev/null +++ b/patches.suse/i2c-sh7760-fix-IRQ-error-path.patch @@ -0,0 +1,38 @@ +From 92dfb27240fea2776f61c5422472cb6defca7767 Mon Sep 17 00:00:00 2001 +From: Sergey Shtylyov +Date: Sat, 17 Apr 2021 22:05:05 +0300 +Subject: [PATCH] i2c: sh7760: fix IRQ error path +Git-commit: 92dfb27240fea2776f61c5422472cb6defca7767 +Patch-mainline: v5.13-rc1 +References: git-fixes + +While adding the invalid IRQ check after calling platform_get_irq(), +I managed to overlook that the driver has a complex error path in its +probe() method, thus a simple *return* couldn't be used. Use a proper +*goto* instead! + +Fixes: e5b2e3e74201 ("i2c: sh7760: add IRQ check") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Acked-by: Takashi Iwai + +--- + drivers/i2c/busses/i2c-sh7760.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c +index c79c9f542c5a..319d1fa617c8 100644 +--- a/drivers/i2c/busses/i2c-sh7760.c ++++ b/drivers/i2c/busses/i2c-sh7760.c +@@ -473,7 +473,7 @@ static int sh7760_i2c_probe(struct platform_device *pdev) + + ret = platform_get_irq(pdev, 0); + if (ret < 0) +- return ret; ++ goto out3; + id->irq = ret; + + id->adap.nr = pdev->id; +-- +2.26.2 + diff --git a/patches.suse/iio-adc-ad7793-Add-missing-error-code-in-ad7793_setu.patch b/patches.suse/iio-adc-ad7793-Add-missing-error-code-in-ad7793_setu.patch new file mode 100644 index 0000000..8191d90 --- /dev/null +++ b/patches.suse/iio-adc-ad7793-Add-missing-error-code-in-ad7793_setu.patch @@ -0,0 +1,35 @@ +From 4ed243b1da169bcbc1ec5507867e56250c5f1ff9 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Fri, 14 May 2021 16:02:54 +0800 +Subject: [PATCH] iio: adc: ad7793: Add missing error code in ad7793_setup() +Git-commit: 4ed243b1da169bcbc1ec5507867e56250c5f1ff9 +Patch-mainline: v5.13-rc4 +References: git-fixes + +Set error code while device ID query failed. + +Fixes: 88bc30548aae ("IIO: ADC: New driver for AD7792/AD7793 3 Channel SPI ADC") +Signed-off-by: YueHaibing +Cc: +Signed-off-by: Jonathan Cameron +Acked-by: Takashi Iwai + +--- + drivers/iio/adc/ad7793.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c +index 5e980a06258e..440ef4c7be07 100644 +--- a/drivers/iio/adc/ad7793.c ++++ b/drivers/iio/adc/ad7793.c +@@ -279,6 +279,7 @@ static int ad7793_setup(struct iio_dev *indio_dev, + id &= AD7793_ID_MASK; + + if (id != st->chip_info->id) { ++ ret = -ENODEV; + dev_err(&st->sd.spi->dev, "device ID query failed\n"); + goto out; + } +-- +2.26.2 + diff --git a/patches.suse/iio-gyro-mpu3050-Fix-reported-temperature-value.patch b/patches.suse/iio-gyro-mpu3050-Fix-reported-temperature-value.patch new file mode 100644 index 0000000..52f7d03 --- /dev/null +++ b/patches.suse/iio-gyro-mpu3050-Fix-reported-temperature-value.patch @@ -0,0 +1,64 @@ +From f73c730774d88a14d7b60feee6d0e13570f99499 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Fri, 23 Apr 2021 05:09:59 +0300 +Subject: [PATCH] iio: gyro: mpu3050: Fix reported temperature value +Git-commit: f73c730774d88a14d7b60feee6d0e13570f99499 +Patch-mainline: v5.13-rc2 +References: git-fixes + +The raw temperature value is a 16-bit signed integer. The sign casting +is missing in the code, which results in a wrong temperature reported +by userspace tools, fix it. + +Cc: stable@vger.kernel.org +Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope") +Datasheet: https://www.cdiweb.com/datasheets/invensense/mpu-3000a.pdf +Tested-by: Maxim Schwalm # Asus TF700T +Tested-by: Svyatoslav Ryhel # Asus TF201 +Reported-by: Svyatoslav Ryhel +Reviewed-by: Andy Shevchenko +Reviewed-by: Linus Walleij +Signed-off-by: Dmitry Osipenko +Acked-by: Jean-Baptiste Maneyrol +Link: https://lore.kernel.org/r/20210423020959.5023-1-digetx@gmail.com +Signed-off-by: Jonathan Cameron +Acked-by: Takashi Iwai + +--- + drivers/iio/gyro/mpu3050-core.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c +index ac90be03332a..f17a93519535 100644 +--- a/drivers/iio/gyro/mpu3050-core.c ++++ b/drivers/iio/gyro/mpu3050-core.c +@@ -272,7 +272,16 @@ static int mpu3050_read_raw(struct iio_dev *indio_dev, + case IIO_CHAN_INFO_OFFSET: + switch (chan->type) { + case IIO_TEMP: +- /* The temperature scaling is (x+23000)/280 Celsius */ ++ /* ++ * The temperature scaling is (x+23000)/280 Celsius ++ * for the "best fit straight line" temperature range ++ * of -30C..85C. The 23000 includes room temperature ++ * offset of +35C, 280 is the precision scale and x is ++ * the 16-bit signed integer reported by hardware. ++ * ++ * Temperature value itself represents temperature of ++ * the sensor die. ++ */ + *val = 23000; + return IIO_VAL_INT; + default: +@@ -329,7 +338,7 @@ static int mpu3050_read_raw(struct iio_dev *indio_dev, + goto out_read_raw_unlock; + } + +- *val = be16_to_cpu(raw_val); ++ *val = (s16)be16_to_cpu(raw_val); + ret = IIO_VAL_INT; + + goto out_read_raw_unlock; +-- +2.26.2 + diff --git a/patches.suse/iio-proximity-pulsedlight-Fix-rumtime-PM-imbalance-o.patch b/patches.suse/iio-proximity-pulsedlight-Fix-rumtime-PM-imbalance-o.patch new file mode 100644 index 0000000..ee213ce --- /dev/null +++ b/patches.suse/iio-proximity-pulsedlight-Fix-rumtime-PM-imbalance-o.patch @@ -0,0 +1,37 @@ +From a2fa9242e89f27696515699fe0f0296bf1ac1815 Mon Sep 17 00:00:00 2001 +From: Dinghao Liu +Date: Mon, 12 Apr 2021 13:32:02 +0800 +Subject: [PATCH] iio: proximity: pulsedlight: Fix rumtime PM imbalance on error +Git-commit: a2fa9242e89f27696515699fe0f0296bf1ac1815 +Patch-mainline: v5.13-rc2 +References: git-fixes + +When lidar_write_control() fails, a pairing PM usage counter +decrement is needed to keep the counter balanced. + +Fixes: 4ac4e086fd8c5 ("iio: pulsedlight-lidar-lite: add runtime PM") +Signed-off-by: Dinghao Liu +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210412053204.4889-1-dinghao.liu@zju.edu.cn +Signed-off-by: Jonathan Cameron +Acked-by: Takashi Iwai + +--- + drivers/iio/proximity/pulsedlight-lidar-lite-v2.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c +index c685f10b5ae4..cc206bfa09c7 100644 +--- a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c ++++ b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c +@@ -160,6 +160,7 @@ static int lidar_get_measurement(struct lidar_data *data, u16 *reg) + ret = lidar_write_control(data, LIDAR_REG_CONTROL_ACQUIRE); + if (ret < 0) { + dev_err(&client->dev, "cannot send start measurement command"); ++ pm_runtime_put_noidle(&client->dev); + return ret; + } + +-- +2.26.2 + diff --git a/patches.suse/iio-tsl2583-Fix-division-by-a-zero-lux_val.patch b/patches.suse/iio-tsl2583-Fix-division-by-a-zero-lux_val.patch new file mode 100644 index 0000000..f929b21 --- /dev/null +++ b/patches.suse/iio-tsl2583-Fix-division-by-a-zero-lux_val.patch @@ -0,0 +1,50 @@ +From af0e1871d79cfbb91f732d2c6fa7558e45c31038 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Fri, 7 May 2021 19:30:41 +0100 +Subject: [PATCH] iio: tsl2583: Fix division by a zero lux_val +Git-commit: af0e1871d79cfbb91f732d2c6fa7558e45c31038 +Patch-mainline: v5.13-rc2 +References: git-fixes + +The lux_val returned from tsl2583_get_lux can potentially be zero, +so check for this to avoid a division by zero and an overflowed +gain_trim_val. + +Fixes clang scan-build warning: + +drivers/iio/light/tsl2583.c:345:40: warning: Either the +condition 'lux_val<0' is redundant or there is division +by zero at line 345. [zerodivcond] + +Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver") +Signed-off-by: Colin Ian King +Cc: +Signed-off-by: Jonathan Cameron +Acked-by: Takashi Iwai + +--- + drivers/iio/light/tsl2583.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c +index 0f787bfc88fc..c9d8f07a6fcd 100644 +--- a/drivers/iio/light/tsl2583.c ++++ b/drivers/iio/light/tsl2583.c +@@ -341,6 +341,14 @@ static int tsl2583_als_calibrate(struct iio_dev *indio_dev) + return lux_val; + } + ++ /* Avoid division by zero of lux_value later on */ ++ if (lux_val == 0) { ++ dev_err(&chip->client->dev, ++ "%s: lux_val of 0 will produce out of range trim_value\n", ++ __func__); ++ return -ENODATA; ++ } ++ + gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target) + * chip->als_settings.als_gain_trim) / lux_val); + if ((gain_trim_val < 250) || (gain_trim_val > 4000)) { +-- +2.26.2 + diff --git a/patches.suse/intel_th-Consistency-and-off-by-one-fix.patch b/patches.suse/intel_th-Consistency-and-off-by-one-fix.patch new file mode 100644 index 0000000..e915c7c --- /dev/null +++ b/patches.suse/intel_th-Consistency-and-off-by-one-fix.patch @@ -0,0 +1,49 @@ +From 18ffbc47d45a1489b664dd68fb3a7610a6e1dea3 Mon Sep 17 00:00:00 2001 +From: Pavel Machek +Date: Wed, 14 Apr 2021 20:12:49 +0300 +Subject: [PATCH] intel_th: Consistency and off-by-one fix +Git-commit: 18ffbc47d45a1489b664dd68fb3a7610a6e1dea3 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Consistently use "< ... +1" in for loops. + +Fix of-by-one in for_each_set_bit(). + +Signed-off-by: Pavel Machek +Signed-off-by: Alexander Shishkin +Link: https://lore.kernel.org/lkml/20190724095841.GA6952@amd/ +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210414171251.14672-6-alexander.shishkin@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/hwtracing/intel_th/gth.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c +index f72803a02391..28509b02a0b5 100644 +--- a/drivers/hwtracing/intel_th/gth.c ++++ b/drivers/hwtracing/intel_th/gth.c +@@ -543,7 +543,7 @@ static void intel_th_gth_disable(struct intel_th_device *thdev, + output->active = false; + + for_each_set_bit(master, gth->output[output->port].master, +- TH_CONFIGURABLE_MASTERS) { ++ TH_CONFIGURABLE_MASTERS + 1) { + gth_master_set(gth, master, -1); + } + spin_unlock(>h->gth_lock); +@@ -697,7 +697,7 @@ static void intel_th_gth_unassign(struct intel_th_device *thdev, + othdev->output.port = -1; + othdev->output.active = false; + gth->output[port].output = NULL; +- for (master = 0; master <= TH_CONFIGURABLE_MASTERS; master++) ++ for (master = 0; master < TH_CONFIGURABLE_MASTERS + 1; master++) + if (gth->master[master] == port) + gth->master[master] = -1; + spin_unlock(>h->gth_lock); +-- +2.26.2 + diff --git a/patches.suse/ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch b/patches.suse/ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch new file mode 100644 index 0000000..0d40a55 --- /dev/null +++ b/patches.suse/ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch @@ -0,0 +1,76 @@ +From 2253042d86f57d90a621ac2513a7a7a13afcf809 Mon Sep 17 00:00:00 2001 +From: Petr Pavlu +Date: Thu, 13 May 2021 14:26:36 +0200 +Subject: [PATCH] ipmi/watchdog: Stop watchdog timer when the current action is + 'none' +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://github.com/cminyard/linux-ipmi.git +Git-commit: 2253042d86f57d90a621ac2513a7a7a13afcf809 +References: bsc#1184855 + +When an IPMI watchdog timer is being stopped in ipmi_close() or +ipmi_ioctl(WDIOS_DISABLECARD), the current watchdog action is updated to +WDOG_TIMEOUT_NONE and _ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB) is called +to install this action. The latter function ends up invoking +__ipmi_set_timeout() which makes the actual 'Set Watchdog Timer' IPMI +request. + +For IPMI 1.0, this operation results in fully stopping the watchdog timer. +For IPMI >= 1.5, function __ipmi_set_timeout() always specifies the "don't +stop" flag in the prepared 'Set Watchdog Timer' IPMI request. This causes +that the watchdog timer has its action correctly updated to 'none' but the +timer continues to run. A problem is that IPMI firmware can then still log +an expiration event when the configured timeout is reached, which is +unexpected because the watchdog timer was requested to be stopped. + +The patch fixes this problem by not setting the "don't stop" flag in +__ipmi_set_timeout() when the current action is WDOG_TIMEOUT_NONE which +results in stopping the watchdog timer. This makes the behaviour for +IPMI >= 1.5 consistent with IPMI 1.0. It also matches the logic in +__ipmi_heartbeat() which does not allow to reset the watchdog if the +current action is WDOG_TIMEOUT_NONE as that would start the timer. + +Signed-off-by: Petr Pavlu +Message-Id: <10a41bdc-9c99-089c-8d89-fa98ce5ea080@suse.com> +Cc: stable@vger.kernel.org +Signed-off-by: Corey Minyard +--- + drivers/char/ipmi/ipmi_watchdog.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c +index 32c334e34d55..e4ff3b50de7f 100644 +--- a/drivers/char/ipmi/ipmi_watchdog.c ++++ b/drivers/char/ipmi/ipmi_watchdog.c +@@ -371,16 +371,18 @@ static int __ipmi_set_timeout(struct ipmi_smi_msg *smi_msg, + data[0] = 0; + WDOG_SET_TIMER_USE(data[0], WDOG_TIMER_USE_SMS_OS); + +- if ((ipmi_version_major > 1) +- || ((ipmi_version_major == 1) && (ipmi_version_minor >= 5))) { +- /* This is an IPMI 1.5-only feature. */ +- data[0] |= WDOG_DONT_STOP_ON_SET; +- } else if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) { +- /* +- * In ipmi 1.0, setting the timer stops the watchdog, we +- * need to start it back up again. +- */ +- hbnow = 1; ++ if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) { ++ if ((ipmi_version_major > 1) || ++ ((ipmi_version_major == 1) && (ipmi_version_minor >= 5))) { ++ /* This is an IPMI 1.5-only feature. */ ++ data[0] |= WDOG_DONT_STOP_ON_SET; ++ } else { ++ /* ++ * In ipmi 1.0, setting the timer stops the watchdog, we ++ * need to start it back up again. ++ */ ++ hbnow = 1; ++ } + } + + data[1] = 0; +-- +2.26.2 + diff --git a/patches.suse/leds-lp5523-check-return-value-of-lp5xx_read-and-jum.patch b/patches.suse/leds-lp5523-check-return-value-of-lp5xx_read-and-jum.patch new file mode 100644 index 0000000..ffd2890 --- /dev/null +++ b/patches.suse/leds-lp5523-check-return-value-of-lp5xx_read-and-jum.patch @@ -0,0 +1,43 @@ +From 6647f7a06eb030a2384ec71f0bb2e78854afabfe Mon Sep 17 00:00:00 2001 +From: Phillip Potter +Date: Mon, 3 May 2021 13:56:36 +0200 +Subject: [PATCH] leds: lp5523: check return value of lp5xx_read and jump to cleanup code +Git-commit: 6647f7a06eb030a2384ec71f0bb2e78854afabfe +Patch-mainline: v5.13-rc3 +References: git-fixes + +Check return value of lp5xx_read and if non-zero, jump to code at end of +the function, causing lp5523_stop_all_engines to be executed before +returning the error value up the call chain. This fixes the original +commit (248b57015f35) which was reverted due to the University of Minnesota +problems. + +Cc: stable +Acked-by: Jacek Anaszewski +Signed-off-by: Phillip Potter +Link: https://lore.kernel.org/r/20210503115736.2104747-10-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/leds/leds-lp5523.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c +index 5036d7d5f3d4..b1590cb4a188 100644 +--- a/drivers/leds/leds-lp5523.c ++++ b/drivers/leds/leds-lp5523.c +@@ -305,7 +305,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip) + + /* Let the programs run for couple of ms and check the engine status */ + usleep_range(3000, 6000); +- lp55xx_read(chip, LP5523_REG_STATUS, &status); ++ ret = lp55xx_read(chip, LP5523_REG_STATUS, &status); ++ if (ret) ++ goto out; + status &= LP5523_ENG_STATUS_MASK; + + if (status != LP5523_ENG_STATUS_MASK) { +-- +2.26.2 + diff --git a/patches.suse/mac80211-clear-the-beacon-s-CRC-after-channel-switch.patch b/patches.suse/mac80211-clear-the-beacon-s-CRC-after-channel-switch.patch new file mode 100644 index 0000000..aa604d8 --- /dev/null +++ b/patches.suse/mac80211-clear-the-beacon-s-CRC-after-channel-switch.patch @@ -0,0 +1,52 @@ +From d6843d1ee283137723b4a8c76244607ce6db1951 Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Thu, 8 Apr 2021 14:31:25 +0200 +Subject: [PATCH] mac80211: clear the beacon's CRC after channel switch +Git-commit: d6843d1ee283137723b4a8c76244607ce6db1951 +Patch-mainline: v5.13-rc1 +References: git-fixes + +After channel switch, we should consider any beacon with a +CSA IE as a new switch. If the CSA IE is a leftover from +before the switch that the AP forgot to remove, we'll get +a CSA-to-Self. + +This caused issues in iwlwifi where the firmware saw a beacon +with a CSA-to-Self with mode = 1 on the new channel after a +switch. The firmware considered this a new switch and closed +its queues. Since the beacon didn't change between before and +after the switch, we wouldn't handle it (the CRC is the same) +and we wouldn't let the firmware open its queues again or +disconnect if the CSA IE stays for too long. + +Clear the CRC valid state after we switch to make sure that +we handle the beacon and handle the CSA IE as required. + +Signed-off-by: Emmanuel Grumbach +Link: https://lore.kernel.org/r/20210408143124.b9e68aa98304.I465afb55ca2c7d59f7bf610c6046a1fd732b4c28@changeid +Signed-off-by: Johannes Berg +Acked-by: Takashi Iwai + +--- + net/mac80211/mlme.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index ce4e3855fec1..5f89aae9ea23 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -1295,6 +1295,11 @@ static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata) + + sdata->vif.csa_active = false; + ifmgd->csa_waiting_bcn = false; ++ /* ++ * If the CSA IE is still present on the beacon after the switch, ++ * we need to consider it as a new CSA (possibly to self). ++ */ ++ ifmgd->beacon_crc_valid = false; + + ret = drv_post_channel_switch(sdata); + if (ret) { +-- +2.26.2 + diff --git a/patches.suse/media-adv7604-fix-possible-use-after-free-in-adv76xx.patch b/patches.suse/media-adv7604-fix-possible-use-after-free-in-adv76xx.patch new file mode 100644 index 0000000..eace57f --- /dev/null +++ b/patches.suse/media-adv7604-fix-possible-use-after-free-in-adv76xx.patch @@ -0,0 +1,43 @@ +From fa56f5f1fe31c2050675fa63b84963ebd504a5b3 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Tue, 6 Apr 2021 15:42:46 +0200 +Subject: [PATCH] media: adv7604: fix possible use-after-free in adv76xx_remove() +Git-commit: fa56f5f1fe31c2050675fa63b84963ebd504a5b3 +Patch-mainline: v5.13-rc1 +References: git-fixes + +This driver's remove path calls cancel_delayed_work(). However, that +function does not wait until the work function finishes. This means +that the callback function may still be running after the driver's +remove function has finished, which would result in a use-after-free. + +Fix by calling cancel_delayed_work_sync(), which ensures that +the work is properly cancelled, no longer running, and unable +to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/i2c/adv7604.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c +index 10418574a89c..3049aa2fd0f0 100644 +--- a/drivers/media/i2c/adv7604.c ++++ b/drivers/media/i2c/adv7604.c +@@ -3670,7 +3670,7 @@ static int adv76xx_remove(struct i2c_client *client) + io_write(sd, 0x6e, 0); + io_write(sd, 0x73, 0); + +- cancel_delayed_work(&state->delayed_work_enable_hotplug); ++ cancel_delayed_work_sync(&state->delayed_work_enable_hotplug); + v4l2_async_unregister_subdev(sd); + media_entity_cleanup(&sd->entity); + adv76xx_unregister_clients(to_state(sd)); +-- +2.26.2 + diff --git a/patches.suse/media-dvb-usb-fix-memory-leak-in-dvb_usb_adapter_ini.patch b/patches.suse/media-dvb-usb-fix-memory-leak-in-dvb_usb_adapter_ini.patch new file mode 100644 index 0000000..c617549 --- /dev/null +++ b/patches.suse/media-dvb-usb-fix-memory-leak-in-dvb_usb_adapter_ini.patch @@ -0,0 +1,83 @@ +From b7cd0da982e3043f2eec7235ac5530cb18d6af1d Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Sun, 28 Mar 2021 21:32:19 +0200 +Subject: [PATCH] media: dvb-usb: fix memory leak in dvb_usb_adapter_init +Git-commit: b7cd0da982e3043f2eec7235ac5530cb18d6af1d +Patch-mainline: v5.13-rc1 +References: git-fixes + +syzbot reported memory leak in dvb-usb. The problem was +in invalid error handling in dvb_usb_adapter_init(). + +for (n = 0; n < d->props.num_adapters; n++) { +.... + if ((ret = dvb_usb_adapter_stream_init(adap)) || + (ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs)) || + (ret = dvb_usb_adapter_frontend_init(adap))) { + return ret; + } +... + d->num_adapters_initialized++; +... +} + +In case of error in dvb_usb_adapter_dvb_init() or +dvb_usb_adapter_dvb_init() d->num_adapters_initialized won't be +incremented, but dvb_usb_adapter_exit() relies on it: + + for (n = 0; n < d->num_adapters_initialized; n++) + +So, allocated objects won't be freed. + +Signed-off-by: Pavel Skripkin +Reported-by: syzbot+3c2be7424cea3b932b0e@syzkaller.appspotmail.com +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/usb/dvb-usb/dvb-usb-init.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c +index 6c9e3290af56..28e1fd64dd3c 100644 +--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c ++++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c +@@ -79,11 +79,17 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) + } + } + +- if ((ret = dvb_usb_adapter_stream_init(adap)) || +- (ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs)) || +- (ret = dvb_usb_adapter_frontend_init(adap))) { ++ ret = dvb_usb_adapter_stream_init(adap); ++ if (ret) + return ret; +- } ++ ++ ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs); ++ if (ret) ++ goto dvb_init_err; ++ ++ ret = dvb_usb_adapter_frontend_init(adap); ++ if (ret) ++ goto frontend_init_err; + + /* use exclusive FE lock if there is multiple shared FEs */ + if (adap->fe_adap[1].fe) +@@ -103,6 +109,12 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) + } + + return 0; ++ ++frontend_init_err: ++ dvb_usb_adapter_dvb_exit(adap); ++dvb_init_err: ++ dvb_usb_adapter_stream_exit(adap); ++ return ret; + } + + static int dvb_usb_adapter_exit(struct dvb_usb_device *d) +-- +2.26.2 + diff --git a/patches.suse/media-em28xx-fix-memory-leak.patch b/patches.suse/media-em28xx-fix-memory-leak.patch new file mode 100644 index 0000000..181a16f --- /dev/null +++ b/patches.suse/media-em28xx-fix-memory-leak.patch @@ -0,0 +1,41 @@ +From 0ae10a7dc8992ee682ff0b1752ff7c83d472eef1 Mon Sep 17 00:00:00 2001 +From: Muhammad Usama Anjum +Date: Wed, 24 Mar 2021 19:07:53 +0100 +Subject: [PATCH] media: em28xx: fix memory leak +Git-commit: 0ae10a7dc8992ee682ff0b1752ff7c83d472eef1 +Patch-mainline: v5.13-rc1 +References: git-fixes + +If some error occurs, URB buffers should also be freed. If they aren't +freed with the dvb here, the em28xx_dvb_fini call doesn't frees the URB +buffers as dvb is set to NULL. The function in which error occurs should +do all the cleanup for the allocations it had done. + +Tested the patch with the reproducer provided by syzbot. This patch +fixes the memleak. + +Reported-by: syzbot+889397c820fa56adf25d@syzkaller.appspotmail.com +Signed-off-by: Muhammad Usama Anjum +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/usb/em28xx/em28xx-dvb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c +index 526424279637..471bd74667e3 100644 +--- a/drivers/media/usb/em28xx/em28xx-dvb.c ++++ b/drivers/media/usb/em28xx/em28xx-dvb.c +@@ -2010,6 +2010,7 @@ static int em28xx_dvb_init(struct em28xx *dev) + return result; + + out_free: ++ em28xx_uninit_usb_xfer(dev, EM28XX_DIGITAL_MODE); + kfree(dvb); + dev->dvb = NULL; + goto ret; +-- +2.26.2 + diff --git a/patches.suse/media-gspca-sq905.c-fix-uninitialized-variable.patch b/patches.suse/media-gspca-sq905.c-fix-uninitialized-variable.patch new file mode 100644 index 0000000..c36ea75 --- /dev/null +++ b/patches.suse/media-gspca-sq905.c-fix-uninitialized-variable.patch @@ -0,0 +1,36 @@ +From eaaea4681984c79d2b2b160387b297477f0c1aab Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Thu, 11 Mar 2021 15:46:40 +0100 +Subject: [PATCH] media: gspca/sq905.c: fix uninitialized variable +Git-commit: eaaea4681984c79d2b2b160387b297477f0c1aab +Patch-mainline: v5.13-rc1 +References: git-fixes + +act_len can be uninitialized if usb_bulk_msg() returns an error. +Set it to 0 to avoid a KMSAN error. + +Signed-off-by: Hans Verkuil +Reported-by: syzbot+a4e309017a5f3a24c7b3@syzkaller.appspotmail.com +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/usb/gspca/sq905.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/usb/gspca/sq905.c b/drivers/media/usb/gspca/sq905.c +index 97799cfb832e..949111070971 100644 +--- a/drivers/media/usb/gspca/sq905.c ++++ b/drivers/media/usb/gspca/sq905.c +@@ -158,7 +158,7 @@ static int + sq905_read_data(struct gspca_dev *gspca_dev, u8 *data, int size, int need_lock) + { + int ret; +- int act_len; ++ int act_len = 0; + + gspca_dev->usb_buf[0] = '\0'; + if (need_lock) +-- +2.26.2 + diff --git a/patches.suse/media-i2c-adv7842-fix-possible-use-after-free-in-adv.patch b/patches.suse/media-i2c-adv7842-fix-possible-use-after-free-in-adv.patch new file mode 100644 index 0000000..0ffe36e --- /dev/null +++ b/patches.suse/media-i2c-adv7842-fix-possible-use-after-free-in-adv.patch @@ -0,0 +1,43 @@ +From 4a15275b6a18597079f18241c87511406575179a Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Tue, 6 Apr 2021 15:50:53 +0200 +Subject: [PATCH] media: i2c: adv7842: fix possible use-after-free in adv7842_remove() +Git-commit: 4a15275b6a18597079f18241c87511406575179a +Patch-mainline: v5.13-rc1 +References: git-fixes + +This driver's remove path calls cancel_delayed_work(). However, that +function does not wait until the work function finishes. This means +that the callback function may still be running after the driver's +remove function has finished, which would result in a use-after-free. + +Fix by calling cancel_delayed_work_sync(), which ensures that +the work is properly cancelled, no longer running, and unable +to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/i2c/adv7842.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c +index 21dbb7a594fb..8bd58ce07926 100644 +--- a/drivers/media/i2c/adv7842.c ++++ b/drivers/media/i2c/adv7842.c +@@ -3573,7 +3573,7 @@ static int adv7842_remove(struct i2c_client *client) + struct adv7842_state *state = to_state(sd); + + adv7842_irq_enable(sd, false); +- cancel_delayed_work(&state->delayed_work_enable_hotplug); ++ cancel_delayed_work_sync(&state->delayed_work_enable_hotplug); + v4l2_device_unregister_subdev(sd); + media_entity_cleanup(&sd->entity); + adv7842_unregister_clients(sd); +-- +2.26.2 + diff --git a/patches.suse/media-ite-cir-check-for-receive-overflow.patch b/patches.suse/media-ite-cir-check-for-receive-overflow.patch new file mode 100644 index 0000000..de4283d --- /dev/null +++ b/patches.suse/media-ite-cir-check-for-receive-overflow.patch @@ -0,0 +1,36 @@ +From 28c7afb07ccfc0a939bb06ac1e7afe669901c65a Mon Sep 17 00:00:00 2001 +From: Sean Young +Date: Mon, 22 Feb 2021 09:08:35 +0100 +Subject: [PATCH] media: ite-cir: check for receive overflow +Git-commit: 28c7afb07ccfc0a939bb06ac1e7afe669901c65a +Patch-mainline: v5.13-rc1 +References: git-fixes + +It's best if this condition is reported. + +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/rc/ite-cir.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/media/rc/ite-cir.c ++++ b/drivers/media/rc/ite-cir.c +@@ -285,8 +285,14 @@ static irqreturn_t ite_cir_isr(int irq, + /* read the interrupt flags */ + iflags = dev->params.get_irq_causes(dev); + ++ /* Check for RX overflow */ ++ if (iflags & ITE_IRQ_RX_FIFO_OVERRUN) { ++ dev_warn(&dev->rdev->dev, "receive overflow\n"); ++ ir_raw_event_reset(dev->rdev); ++ } ++ + /* check for the receive interrupt */ +- if (iflags & (ITE_IRQ_RX_FIFO | ITE_IRQ_RX_FIFO_OVERRUN)) { ++ if (iflags & ITE_IRQ_RX_FIFO) { + /* read the FIFO bytes */ + rx_bytes = + dev->params.get_rx_bytes(dev, rx_buf, diff --git a/patches.suse/media-media-saa7164-fix-saa7164_encoder_register-mem.patch b/patches.suse/media-media-saa7164-fix-saa7164_encoder_register-mem.patch new file mode 100644 index 0000000..5194f8a --- /dev/null +++ b/patches.suse/media-media-saa7164-fix-saa7164_encoder_register-mem.patch @@ -0,0 +1,87 @@ +From c759b2970c561e3b56aa030deb13db104262adfe Mon Sep 17 00:00:00 2001 +From: Daniel Niv +Date: Thu, 11 Mar 2021 03:53:00 +0100 +Subject: [PATCH] media: media/saa7164: fix saa7164_encoder_register() memory leak bugs +Git-commit: c759b2970c561e3b56aa030deb13db104262adfe +Patch-mainline: v5.13-rc1 +References: git-fixes + +Add a fix for the memory leak bugs that can occur when the +saa7164_encoder_register() function fails. +The function allocates memory without explicitly freeing +it when errors occur. +Add a better error handling that deallocate the unused buffers before the +function exits during a fail. + +Signed-off-by: Daniel Niv +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/pci/saa7164/saa7164-encoder.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/media/pci/saa7164/saa7164-encoder.c b/drivers/media/pci/saa7164/saa7164-encoder.c +index 11e1eb6a6809..1d1d32e043f1 100644 +--- a/drivers/media/pci/saa7164/saa7164-encoder.c ++++ b/drivers/media/pci/saa7164/saa7164-encoder.c +@@ -1008,7 +1008,7 @@ int saa7164_encoder_register(struct saa7164_port *port) + printk(KERN_ERR "%s() failed (errno = %d), NO PCI configuration\n", + __func__, result); + result = -ENOMEM; +- goto failed; ++ goto fail_pci; + } + + /* Establish encoder defaults here */ +@@ -1062,7 +1062,7 @@ int saa7164_encoder_register(struct saa7164_port *port) + 100000, ENCODER_DEF_BITRATE); + if (hdl->error) { + result = hdl->error; +- goto failed; ++ goto fail_hdl; + } + + port->std = V4L2_STD_NTSC_M; +@@ -1080,7 +1080,7 @@ int saa7164_encoder_register(struct saa7164_port *port) + printk(KERN_INFO "%s: can't allocate mpeg device\n", + dev->name); + result = -ENOMEM; +- goto failed; ++ goto fail_hdl; + } + + port->v4l_device->ctrl_handler = hdl; +@@ -1091,10 +1091,7 @@ int saa7164_encoder_register(struct saa7164_port *port) + if (result < 0) { + printk(KERN_INFO "%s: can't register mpeg device\n", + dev->name); +- /* TODO: We're going to leak here if we don't dealloc +- The buffers above. The unreg function can't deal wit it. +- */ +- goto failed; ++ goto fail_reg; + } + + printk(KERN_INFO "%s: registered device video%d [mpeg]\n", +@@ -1116,9 +1113,14 @@ int saa7164_encoder_register(struct saa7164_port *port) + + saa7164_api_set_encoder(port); + saa7164_api_get_encoder(port); ++ return 0; + +- result = 0; +-failed: ++fail_reg: ++ video_device_release(port->v4l_device); ++ port->v4l_device = NULL; ++fail_hdl: ++ v4l2_ctrl_handler_free(hdl); ++fail_pci: + return result; + } + +-- +2.26.2 + diff --git a/patches.suse/misc-uss720-fix-memory-leak-in-uss720_probe.patch b/patches.suse/misc-uss720-fix-memory-leak-in-uss720_probe.patch new file mode 100644 index 0000000..54e7d8c --- /dev/null +++ b/patches.suse/misc-uss720-fix-memory-leak-in-uss720_probe.patch @@ -0,0 +1,57 @@ +From dcb4b8ad6a448532d8b681b5d1a7036210b622de Mon Sep 17 00:00:00 2001 +From: Dongliang Mu +Date: Fri, 14 May 2021 20:43:48 +0800 +Subject: [PATCH] misc/uss720: fix memory leak in uss720_probe +Git-commit: dcb4b8ad6a448532d8b681b5d1a7036210b622de +Patch-mainline: v5.13-rc4 +References: git-fixes + +uss720_probe forgets to decrease the refcount of usbdev in uss720_probe. +Fix this by decreasing the refcount of usbdev by usb_put_dev. + +Bug: memory leak +unreferenced object 0xffff888101113800 (size 2048): + comm "kworker/0:1", pid 7, jiffies 4294956777 (age 28.870s) + hex dump (first 32 bytes): + ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1........... + 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................ + backtrace: + [] kmalloc include/linux/slab.h:554 [inline] + [] kzalloc include/linux/slab.h:684 [inline] + [] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582 + [] hub_port_connect drivers/usb/core/hub.c:5129 [inline] + [] hub_port_connect_change drivers/usb/core/hub.c:5363 [inline] + [] port_event drivers/usb/core/hub.c:5509 [inline] + [] hub_event+0x1171/0x20c0 drivers/usb/core/hub.c:5591 + [] process_one_work+0x2c9/0x600 kernel/workqueue.c:2275 + [] worker_thread+0x59/0x5d0 kernel/workqueue.c:2421 + [] kthread+0x178/0x1b0 kernel/kthread.c:292 + [] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 + +Fixes: 0f36163d3abe ("[PATCH] usb: fix uss720 schedule with interrupts off") +Cc: stable +Reported-by: syzbot+636c58f40a86b4a879e7@syzkaller.appspotmail.com +Signed-off-by: Dongliang Mu +Link: https://lore.kernel.org/r/20210514124348.6587-1-mudongliangabcd@gmail.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/misc/uss720.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c +index b5d661644263..748139d26263 100644 +--- a/drivers/usb/misc/uss720.c ++++ b/drivers/usb/misc/uss720.c +@@ -736,6 +736,7 @@ static int uss720_probe(struct usb_interface *intf, + parport_announce_port(pp); + + usb_set_intfdata(intf, pp); ++ usb_put_dev(usbdev); + return 0; + + probe_abort: +-- +2.26.2 + diff --git a/patches.suse/mmc-block-Update-ext_csd.cache_ctrl-if-it-was-writte.patch b/patches.suse/mmc-block-Update-ext_csd.cache_ctrl-if-it-was-writte.patch new file mode 100644 index 0000000..7cee437 --- /dev/null +++ b/patches.suse/mmc-block-Update-ext_csd.cache_ctrl-if-it-was-writte.patch @@ -0,0 +1,51 @@ +From aea0440ad023ab0662299326f941214b0d7480bd Mon Sep 17 00:00:00 2001 +From: Avri Altman +Date: Tue, 20 Apr 2021 16:46:41 +0300 +Subject: [PATCH] mmc: block: Update ext_csd.cache_ctrl if it was written +Git-commit: aea0440ad023ab0662299326f941214b0d7480bd +Patch-mainline: v5.13-rc1 +References: git-fixes + +The cache function can be turned ON and OFF by writing to the CACHE_CTRL +byte (EXT_CSD byte [33]). However, card->ext_csd.cache_ctrl is only +set on init if cache size > 0. + +Fix that by explicitly setting ext_csd.cache_ctrl on ext-csd write. + +Signed-off-by: Avri Altman +Acked-by: Adrian Hunter +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20210420134641.57343-3-avri.altman@wdc.com +Signed-off-by: Ulf Hansson +Acked-by: Takashi Iwai + +--- + drivers/mmc/core/block.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index 8bfd4d95b386..6cd5d03bcc64 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -572,6 +572,18 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, + main_md->part_curr = value & EXT_CSD_PART_CONFIG_ACC_MASK; + } + ++ /* ++ * Make sure to update CACHE_CTRL in case it was changed. The cache ++ * will get turned back on if the card is re-initialized, e.g. ++ * suspend/resume or hw reset in recovery. ++ */ ++ if ((MMC_EXTRACT_INDEX_FROM_ARG(cmd.arg) == EXT_CSD_CACHE_CTRL) && ++ (cmd.opcode == MMC_SWITCH)) { ++ u8 value = MMC_EXTRACT_VALUE_FROM_ARG(cmd.arg) & 1; ++ ++ card->ext_csd.cache_ctrl = value; ++ } ++ + /* + * According to the SD specs, some commands require a delay after + * issuing the command. +-- +2.26.2 + diff --git a/patches.suse/mmc-core-Do-a-power-cycle-when-the-CMD11-fails.patch b/patches.suse/mmc-core-Do-a-power-cycle-when-the-CMD11-fails.patch new file mode 100644 index 0000000..0f78f53 --- /dev/null +++ b/patches.suse/mmc-core-Do-a-power-cycle-when-the-CMD11-fails.patch @@ -0,0 +1,44 @@ +From 147186f531ae49c18b7a9091a2c40e83b3d95649 Mon Sep 17 00:00:00 2001 +From: DooHyun Hwang +Date: Wed, 10 Feb 2021 13:59:36 +0900 +Subject: [PATCH] mmc: core: Do a power cycle when the CMD11 fails +Git-commit: 147186f531ae49c18b7a9091a2c40e83b3d95649 +Patch-mainline: v5.13-rc1 +References: git-fixes + +A CMD11 is sent to the SD/SDIO card to start the voltage switch procedure +into 1.8V I/O. According to the SD spec a power cycle is needed of the +card, if it turns out that the CMD11 fails. Let's fix this, to allow a +retry of the initialization without the voltage switch, to succeed. + +Note that, whether it makes sense to also retry with the voltage switch +after the power cycle is a bit more difficult to know. At this point, we +treat it like the CMD11 isn't supported and therefore we skip it when +retrying. + +Signed-off-by: DooHyun Hwang +Link: https://lore.kernel.org/r/20210210045936.7809-1-dh0421.hwang@samsung.com +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Acked-by: Takashi Iwai + +--- + drivers/mmc/core/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index 1136b859ddd8..a6674df2a7bb 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -1207,7 +1207,7 @@ int mmc_set_uhs_voltage(struct mmc_host *host, u32 ocr) + + err = mmc_wait_for_cmd(host, &cmd, 0); + if (err) +- return err; ++ goto power_cycle; + + if (!mmc_host_is_spi(host) && (cmd.resp[0] & R1_ERROR)) + return -EIO; +-- +2.26.2 + diff --git a/patches.suse/mmc-core-Set-read-only-for-SD-cards-with-permanent-w.patch b/patches.suse/mmc-core-Set-read-only-for-SD-cards-with-permanent-w.patch new file mode 100644 index 0000000..71bc34b --- /dev/null +++ b/patches.suse/mmc-core-Set-read-only-for-SD-cards-with-permanent-w.patch @@ -0,0 +1,50 @@ +From 917a5336f2c27928be270226ab374ed0cbf3805d Mon Sep 17 00:00:00 2001 +From: Seunghui Lee +Date: Mon, 22 Feb 2021 17:31:56 +0900 +Subject: [PATCH] mmc: core: Set read only for SD cards with permanent write protect bit +Git-commit: 917a5336f2c27928be270226ab374ed0cbf3805d +Patch-mainline: v5.13-rc1 +References: git-fixes + +Some of SD cards sets permanent write protection bit in their CSD register, +due to lifespan or internal problem. To avoid unnecessary I/O write +operations, let's parse the bits in the CSD during initialization and mark +the card as read only for this case. + +Signed-off-by: Seunghui Lee +Link: https://lore.kernel.org/r/20210222083156.19158-1-sh043.lee@samsung.com +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Acked-by: Takashi Iwai + +--- + drivers/mmc/core/sd.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c +index 6fa51a6ed058..2c48d6504101 100644 +--- a/drivers/mmc/core/sd.c ++++ b/drivers/mmc/core/sd.c +@@ -135,6 +135,9 @@ static int mmc_decode_csd(struct mmc_card *card) + csd->erase_size = UNSTUFF_BITS(resp, 39, 7) + 1; + csd->erase_size <<= csd->write_blkbits - 9; + } ++ ++ if (UNSTUFF_BITS(resp, 13, 1)) ++ mmc_card_set_readonly(card); + break; + case 1: + /* +@@ -169,6 +172,9 @@ static int mmc_decode_csd(struct mmc_card *card) + csd->write_blkbits = 9; + csd->write_partial = 0; + csd->erase_size = 1; ++ ++ if (UNSTUFF_BITS(resp, 13, 1)) ++ mmc_card_set_readonly(card); + break; + default: + pr_err("%s: unrecognised CSD structure version %d\n", +-- +2.26.2 + diff --git a/patches.suse/msft-hv-2080-uio_hv_generic-add-missed-sysfs_remove_bin_file.patch b/patches.suse/msft-hv-2080-uio_hv_generic-add-missed-sysfs_remove_bin_file.patch new file mode 100644 index 0000000..231aa2f --- /dev/null +++ b/patches.suse/msft-hv-2080-uio_hv_generic-add-missed-sysfs_remove_bin_file.patch @@ -0,0 +1,30 @@ +From: Chuhong Yuan +Date: Thu, 7 May 2020 23:13:43 +0800 +Patch-mainline: v5.8-rc1 +References: git-fixes +Subject: uio_hv_generic: add missed sysfs_remove_bin_file +Git-commit: 7066c2f61ce49b131026fec68ed1c9b0d0d9a05a + +This driver calls sysfs_create_bin_file() in probe, but forgets to +call sysfs_remove_bin_file() in remove. +Add the missed call to fix it. + +Signed-off-by: Chuhong Yuan +Link: https://lore.kernel.org/r/20200507151343.792816-1-hslester96@gmail.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Olaf Hering +--- + drivers/uio/uio_hv_generic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -361,6 +361,7 @@ hv_uio_remove(struct hv_device *dev) + if (!pdata) + return 0; + ++ sysfs_remove_bin_file(&dev->channel->kobj, &ring_buffer_bin_attr); + uio_unregister_device(&pdata->info); + hv_uio_cleanup(dev, pdata); + hv_set_drvdata(dev, NULL); diff --git a/patches.suse/msft-hv-2197-uio-uio_hv_generic-use-devm_kzalloc-for-private-data.patch b/patches.suse/msft-hv-2197-uio-uio_hv_generic-use-devm_kzalloc-for-private-data.patch new file mode 100644 index 0000000..ba470ea --- /dev/null +++ b/patches.suse/msft-hv-2197-uio-uio_hv_generic-use-devm_kzalloc-for-private-data.patch @@ -0,0 +1,61 @@ +From: Alexandru Ardelean +Date: Thu, 19 Nov 2020 17:49:03 +0200 +Patch-mainline: v5.11-rc1 +References: git-fixes +Subject: uio: uio_hv_generic: use devm_kzalloc() for private data alloc +Git-commit: 74e71964b1a9ffd34fa4b6ec8f2fa13e7cf0ac7a + +This is a minor cleanup for the management of the private object of this +driver. The allocation can be tied to the life-time of the hv_device +object. +This cleans up a bit the exit & error paths, since the object doesn't need +to be explicitly free'd anymore. + +Signed-off-by: Alexandru Ardelean +Link: https://lore.kernel.org/r/20201119154903.82099-4-alexandru.ardelean@analog.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Olaf Hering +--- + drivers/uio/uio_hv_generic.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -247,14 +247,14 @@ hv_uio_probe(struct hv_device *dev, + return -ENOTSUPP; + } + +- pdata = kzalloc(sizeof(*pdata), GFP_KERNEL); ++ pdata = devm_kzalloc(&dev->device, sizeof(*pdata), GFP_KERNEL); + if (!pdata) + return -ENOMEM; + + ret = vmbus_alloc_ring(channel, HV_RING_SIZE * PAGE_SIZE, + HV_RING_SIZE * PAGE_SIZE); + if (ret) +- goto fail; ++ return ret; + + set_channel_read_mode(channel, HV_CALL_ISR); + +@@ -347,8 +347,6 @@ hv_uio_probe(struct hv_device *dev, + + fail_close: + hv_uio_cleanup(dev, pdata); +-fail: +- kfree(pdata); + + return ret; + } +@@ -364,10 +362,8 @@ hv_uio_remove(struct hv_device *dev) + sysfs_remove_bin_file(&dev->channel->kobj, &ring_buffer_bin_attr); + uio_unregister_device(&pdata->info); + hv_uio_cleanup(dev, pdata); +- hv_set_drvdata(dev, NULL); + + vmbus_free_ring(dev->channel); +- kfree(pdata); + return 0; + } + diff --git a/patches.suse/msft-hv-2305-Drivers-hv-vmbus-Use-after-free-in-__vmbus_open.patch b/patches.suse/msft-hv-2305-Drivers-hv-vmbus-Use-after-free-in-__vmbus_open.patch new file mode 100644 index 0000000..90dfcd6 --- /dev/null +++ b/patches.suse/msft-hv-2305-Drivers-hv-vmbus-Use-after-free-in-__vmbus_open.patch @@ -0,0 +1,34 @@ +From: Dan Carpenter +Date: Tue, 13 Apr 2021 13:50:04 +0300 +Patch-mainline: v5.13-rc1 +Subject: Drivers: hv: vmbus: Use after free in __vmbus_open() +Git-commit: 3e9bf43f7f7a46f21ec071cb47be92d0874c48da +References: git-fixes + +The "open_info" variable is added to the &vmbus_connection.chn_msg_list, +but the error handling frees "open_info" without removing it from the +list. This will result in a use after free. First remove it from the +list, and then free it. + +Fixes: 6f3d791f3006 ("Drivers: hv: vmbus: Fix rescind handling issues") +Signed-off-by: Dan Carpenter +Reviewed-by: Andrea Parri +Link: https://lore.kernel.org/r/YHV3XLCot6xBS44r@mwanda +Signed-off-by: Wei Liu +Acked-by: Olaf Hering +--- + drivers/hv/channel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -653,7 +653,7 @@ static int __vmbus_open(struct vmbus_channel *newchannel, + + if (newchannel->rescind) { + err = -ENODEV; +- goto error_free_info; ++ goto error_clean_msglist; + } + + err = vmbus_post_msg(open_msg, diff --git a/patches.suse/msft-hv-2310-Drivers-hv-vmbus-Initialize-unload_event-statically.patch b/patches.suse/msft-hv-2310-Drivers-hv-vmbus-Initialize-unload_event-statically.patch new file mode 100644 index 0000000..9f9e13b --- /dev/null +++ b/patches.suse/msft-hv-2310-Drivers-hv-vmbus-Initialize-unload_event-statically.patch @@ -0,0 +1,58 @@ +From: "Andrea Parri (Microsoft)" +Date: Tue, 20 Apr 2021 03:43:50 +0200 +Patch-mainline: v5.13-rc1 +Subject: Drivers: hv: vmbus: Initialize unload_event statically +Git-commit: 8c2d5e0640e53c14b6240e9bf1e32a2226e6e6ca +References: bsc#1185724 + +If a malicious or compromised Hyper-V sends a spurious message of type +CHANNELMSG_UNLOAD_RESPONSE, the function vmbus_unload_response() will +call complete() on an uninitialized event, and cause an oops. + +Reported-by: Michael Kelley +Signed-off-by: Andrea Parri (Microsoft) +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/20210420014350.2002-1-parri.andrea@gmail.com +Signed-off-by: Wei Liu +Acked-by: Olaf Hering +--- + drivers/hv/channel_mgmt.c | 7 ++++++- + drivers/hv/connection.c | 2 ++ + 2 files changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -826,6 +826,11 @@ static void vmbus_unload_response(struct vmbus_channel_message_header *hdr) + /* + * This is a global event; just wakeup the waiting thread. + * Once we successfully unload, we can cleanup the monitor state. ++ * ++ * NB. A malicious or compromised Hyper-V could send a spurious ++ * message of type CHANNELMSG_UNLOAD_RESPONSE, and trigger a call ++ * of the complete() below. Make sure that unload_event has been ++ * initialized by the time this complete() is executed. + */ + complete(&vmbus_connection.unload_event); + } +@@ -841,7 +846,7 @@ void vmbus_initiate_unload(bool crash) + if (vmbus_proto_version < VERSION_WIN8_1) + return; + +- init_completion(&vmbus_connection.unload_event); ++ reinit_completion(&vmbus_connection.unload_event); + memset(&hdr, 0, sizeof(struct vmbus_channel_message_header)); + hdr.msgtype = CHANNELMSG_UNLOAD; + vmbus_post_msg(&hdr, sizeof(struct vmbus_channel_message_header), +diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c +--- a/drivers/hv/connection.c ++++ b/drivers/hv/connection.c +@@ -26,6 +26,8 @@ + + struct vmbus_connection vmbus_connection = { + .conn_state = DISCONNECTED, ++ .unload_event = COMPLETION_INITIALIZER( ++ vmbus_connection.unload_event), + .next_gpadl_handle = ATOMIC_INIT(0xE1E10), + }; + EXPORT_SYMBOL_GPL(vmbus_connection); diff --git a/patches.suse/msft-hv-2311-Drivers-hv-vmbus-Increase-wait-time-for-VMbus-unload.patch b/patches.suse/msft-hv-2311-Drivers-hv-vmbus-Increase-wait-time-for-VMbus-unload.patch new file mode 100644 index 0000000..5c21de3 --- /dev/null +++ b/patches.suse/msft-hv-2311-Drivers-hv-vmbus-Increase-wait-time-for-VMbus-unload.patch @@ -0,0 +1,92 @@ +From: Michael Kelley +Date: Mon, 19 Apr 2021 21:48:09 -0700 +Patch-mainline: v5.13-rc1 +Subject: Drivers: hv: vmbus: Increase wait time for VMbus unload +Git-commit: 77db0ec8b7764cb9b09b78066ebfd47b2c0c1909 +References: bsc#1185724 + +When running in Azure, disks may be connected to a Linux VM with +read/write caching enabled. If a VM panics and issues a VMbus +UNLOAD request to Hyper-V, the response is delayed until all dirty +data in the disk cache is flushed. In extreme cases, this flushing +can take 10's of seconds, depending on the disk speed and the amount +of dirty data. If kdump is configured for the VM, the current 10 second +timeout in vmbus_wait_for_unload() may be exceeded, and the UNLOAD +complete message may arrive well after the kdump kernel is already +running, causing problems. Note that no problem occurs if kdump is +not enabled because Hyper-V waits for the cache flush before doing +a reboot through the BIOS/UEFI code. + +Fix this problem by increasing the timeout in vmbus_wait_for_unload() +to 100 seconds. Also output periodic messages so that if anyone is +watching the serial console, they won't think the VM is completely +hung. + +Fixes: 911e1987efc8 ("Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload") +Signed-off-by: Michael Kelley +Reviewed-by: Vitaly Kuznetsov +Link: https://lore.kernel.org/r/1618894089-126662-1-git-send-email-mikelley@microsoft.com +Signed-off-by: Wei Liu +Acked-by: Olaf Hering +--- + drivers/hv/channel_mgmt.c | 30 +++++++++++++++++++++++++----- + 1 file changed, 25 insertions(+), 5 deletions(-) + +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -755,6 +755,12 @@ static void init_vp_index(struct vmbus_channel *channel) + free_cpumask_var(available_mask); + } + ++#define UNLOAD_DELAY_UNIT_MS 10 /* 10 milliseconds */ ++#define UNLOAD_WAIT_MS (100*1000) /* 100 seconds */ ++#define UNLOAD_WAIT_LOOPS (UNLOAD_WAIT_MS/UNLOAD_DELAY_UNIT_MS) ++#define UNLOAD_MSG_MS (5*1000) /* Every 5 seconds */ ++#define UNLOAD_MSG_LOOPS (UNLOAD_MSG_MS/UNLOAD_DELAY_UNIT_MS) ++ + static void vmbus_wait_for_unload(void) + { + int cpu; +@@ -772,12 +778,17 @@ static void vmbus_wait_for_unload(void) + * vmbus_connection.unload_event. If not, the last thing we can do is + * read message pages for all CPUs directly. + * +- * Wait no more than 10 seconds so that the panic path can't get +- * hung forever in case the response message isn't seen. ++ * Wait up to 100 seconds since an Azure host must writeback any dirty ++ * data in its disk cache before the VMbus UNLOAD request will ++ * complete. This flushing has been empirically observed to take up ++ * to 50 seconds in cases with a lot of dirty data, so allow additional ++ * leeway and for inaccuracies in mdelay(). But eventually time out so ++ * that the panic path can't get hung forever in case the response ++ * message isn't seen. + */ +- for (i = 0; i < 1000; i++) { ++ for (i = 1; i <= UNLOAD_WAIT_LOOPS; i++) { + if (completion_done(&vmbus_connection.unload_event)) +- break; ++ goto completed; + + for_each_online_cpu(cpu) { + struct hv_per_cpu_context *hv_cpu +@@ -800,9 +811,18 @@ static void vmbus_wait_for_unload(void) + vmbus_signal_eom(msg, message_type); + } + +- mdelay(10); ++ /* ++ * Give a notice periodically so someone watching the ++ * serial output won't think it is completely hung. ++ */ ++ if (!(i % UNLOAD_MSG_LOOPS)) ++ pr_notice("Waiting for VMBus UNLOAD to complete\n"); ++ ++ mdelay(UNLOAD_DELAY_UNIT_MS); + } ++ pr_err("Continuing even though VMBus UNLOAD did not complete\n"); + ++completed: + /* + * We're crashing and already got the UNLOAD_RESPONSE, cleanup all + * maybe-pending messages on all CPUs to be able to receive new diff --git a/patches.suse/msft-hv-2312-video-hyperv_fb-Add-ratelimit-on-error-message.patch b/patches.suse/msft-hv-2312-video-hyperv_fb-Add-ratelimit-on-error-message.patch new file mode 100644 index 0000000..ff4e9f2 --- /dev/null +++ b/patches.suse/msft-hv-2312-video-hyperv_fb-Add-ratelimit-on-error-message.patch @@ -0,0 +1,36 @@ +From: Michael Kelley +Date: Tue, 20 Apr 2021 08:44:19 -0700 +Patch-mainline: v5.13-rc1 +Subject: video: hyperv_fb: Add ratelimit on error message +Git-commit: aa5b7d11c7cb87c266d705b237368985e7171958 +References: bsc#1185724 + +Due to a full ring buffer, the driver may be unable to send updates to +the Hyper-V host. But outputing the error message can make the problem +worse because console output is also typically written to the frame +buffer. As a result, in some circumstances the error message is output +continuously. + +Break the cycle by rate limiting the error message. Also output +the error code for additional diagnosability. + +Signed-off-by: Michael Kelley +Link: https://lore.kernel.org/r/1618933459-10585-1-git-send-email-mikelley@microsoft.com +Signed-off-by: Wei Liu +Acked-by: Olaf Hering +--- + drivers/video/fbdev/hyperv_fb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c +--- a/drivers/video/fbdev/hyperv_fb.c ++++ b/drivers/video/fbdev/hyperv_fb.c +@@ -308,7 +308,7 @@ static inline int synthvid_send(struct hv_device *hdev, + VM_PKT_DATA_INBAND, 0); + + if (ret) +- pr_err("Unable to send packet via vmbus\n"); ++ pr_err_ratelimited("Unable to send packet via vmbus; error %d\n", ret); + + return ret; + } diff --git a/patches.suse/msft-hv-2316-uio_hv_generic-Fix-a-memory-leak-in-error-handling-p.patch b/patches.suse/msft-hv-2316-uio_hv_generic-Fix-a-memory-leak-in-error-handling-p.patch new file mode 100644 index 0000000..76ee174 --- /dev/null +++ b/patches.suse/msft-hv-2316-uio_hv_generic-Fix-a-memory-leak-in-error-handling-p.patch @@ -0,0 +1,50 @@ +From: Christophe JAILLET +Date: Sun, 9 May 2021 09:13:03 +0200 +Patch-mainline: v5.13-rc3 +References: git-fixes +Subject: uio_hv_generic: Fix a memory leak in error handling paths +Git-commit: 3ee098f96b8b6c1a98f7f97915f8873164e6af9d + +If 'vmbus_establish_gpadl()' fails, the (recv|send)_gpadl will not be +updated and 'hv_uio_cleanup()' in the error handling path will not be +able to free the corresponding buffer. + +In such a case, we need to free the buffer explicitly. + +Fixes: cdfa835c6e5e ("uio_hv_generic: defer opening vmbus until first use") +Cc: stable +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/4fdaff557deef6f0475d02ba7922ddbaa1ab08a6.1620544055.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Acked-by: Olaf Hering +--- + drivers/uio/uio_hv_generic.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -296,8 +296,10 @@ hv_uio_probe(struct hv_device *dev, + + ret = vmbus_establish_gpadl(channel, pdata->recv_buf, + RECV_BUFFER_SIZE, &pdata->recv_gpadl); +- if (ret) ++ if (ret) { ++ vfree(pdata->recv_buf); + goto fail_close; ++ } + + /* put Global Physical Address Label in name */ + snprintf(pdata->recv_name, sizeof(pdata->recv_name), +@@ -316,8 +318,10 @@ hv_uio_probe(struct hv_device *dev, + + ret = vmbus_establish_gpadl(channel, pdata->send_buf, + SEND_BUFFER_SIZE, &pdata->send_gpadl); +- if (ret) ++ if (ret) { ++ vfree(pdata->send_buf); + goto fail_close; ++ } + + snprintf(pdata->send_name, sizeof(pdata->send_name), + "send:%u", pdata->send_gpadl); diff --git a/patches.suse/msft-hv-2317-uio_hv_generic-Fix-another-memory-leak-in-error-hand.patch b/patches.suse/msft-hv-2317-uio_hv_generic-Fix-another-memory-leak-in-error-hand.patch new file mode 100644 index 0000000..e141e38 --- /dev/null +++ b/patches.suse/msft-hv-2317-uio_hv_generic-Fix-another-memory-leak-in-error-hand.patch @@ -0,0 +1,45 @@ +From: Christophe JAILLET +Date: Sun, 9 May 2021 09:13:12 +0200 +Patch-mainline: v5.13-rc3 +References: git-fixes +Subject: uio_hv_generic: Fix another memory leak in error handling paths +Git-commit: 0b0226be3a52dadd965644bc52a807961c2c26df + +Memory allocated by 'vmbus_alloc_ring()' at the beginning of the probe +function is never freed in the error handling path. + +Add the missing 'vmbus_free_ring()' call. + +Note that it is already freed in the .remove function. + +Fixes: cdfa835c6e5e ("uio_hv_generic: defer opening vmbus until first use") +Cc: stable +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/0d86027b8eeed8e6360bc3d52bcdb328ff9bdca1.1620544055.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Acked-by: Olaf Hering +--- + drivers/uio/uio_hv_generic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -291,7 +291,7 @@ hv_uio_probe(struct hv_device *dev, + pdata->recv_buf = vzalloc(RECV_BUFFER_SIZE); + if (pdata->recv_buf == NULL) { + ret = -ENOMEM; +- goto fail_close; ++ goto fail_free_ring; + } + + ret = vmbus_establish_gpadl(channel, pdata->recv_buf, +@@ -351,6 +351,8 @@ hv_uio_probe(struct hv_device *dev, + + fail_close: + hv_uio_cleanup(dev, pdata); ++fail_free_ring: ++ vmbus_free_ring(dev->channel); + + return ret; + } diff --git a/patches.suse/net-enic-Cure-the-enic-api-locking-trainwreck.patch b/patches.suse/net-enic-Cure-the-enic-api-locking-trainwreck.patch new file mode 100644 index 0000000..6a70b6b --- /dev/null +++ b/patches.suse/net-enic-Cure-the-enic-api-locking-trainwreck.patch @@ -0,0 +1,156 @@ +From 7b738036bcfd3a84eca7e2587dd36ae0b6d12afa Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Tue, 29 Sep 2020 22:25:10 +0200 +Subject: [PATCH 3/3] net: enic: Cure the enic api locking trainwreck +Git-commit: a53b59ece86c86d16d12ccdaa1ad0c78250a9d96 +Patch-mainline: v5.10-rc1 +References: git-fixes + +enic_dev_wait() has a BUG_ON(in_interrupt()). + +Chasing the callers of enic_dev_wait() revealed the gems of enic_reset() +and enic_tx_hang_reset() which are both invoked through work queues in +order to be able to call rtnl_lock(). So far so good. + +After locking rtnl both functions acquire enic::enic_api_lock which +serializes against the (ab)use from infiniband. This is where the +trainwreck starts. + +enic::enic_api_lock is a spin_lock() which implicitly disables preemption, +but both functions invoke a ton of functions under that lock which can +sleep. The BUG_ON(in_interrupt()) does not trigger in that case because it +can't detect the preempt disabled condition. + +This clearly has never been tested with any of the mandatory debug options +for 7+ years, which would have caught that for sure. + +Cure it by adding a enic_api_busy member to struct enic, which is modified +and evaluated with enic::enic_api_lock held. + +If enic_api_devcmd_proxy_by_index() observes enic::enic_api_busy as true, +it drops enic::enic_api_lock and busy waits for enic::enic_api_busy to +become false. + +It would be smarter to wait for a completion of that busy period, but +enic_api_devcmd_proxy_by_index() is called with other spin locks held which +obviously can't sleep. + +Remove the BUG_ON(in_interrupt()) check as well because it's incomplete and +with proper debugging enabled the problem would have been caught from the +debug checks in schedule_timeout(). + +Fixes: 0b038566c0ea ("drivers/net: enic: Add an interface for USNIC to interact with firmware") +Signed-off-by: Thomas Gleixner +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/cisco/enic/enic.h | 1 + + drivers/net/ethernet/cisco/enic/enic_api.c | 6 ++++++ + drivers/net/ethernet/cisco/enic/enic_main.c | 27 +++++++++++++++++++++------ + 3 files changed, 28 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h +index 0dd64acd2a3f..08cac1bfacaf 100644 +--- a/drivers/net/ethernet/cisco/enic/enic.h ++++ b/drivers/net/ethernet/cisco/enic/enic.h +@@ -171,6 +171,7 @@ struct enic { + u16 num_vfs; + #endif + spinlock_t enic_api_lock; ++ bool enic_api_busy; + struct enic_port_profile *pp; + + /* work queue cache line section */ +diff --git a/drivers/net/ethernet/cisco/enic/enic_api.c b/drivers/net/ethernet/cisco/enic/enic_api.c +index b161f24522b8..b028ea2dec2b 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_api.c ++++ b/drivers/net/ethernet/cisco/enic/enic_api.c +@@ -34,6 +34,12 @@ int enic_api_devcmd_proxy_by_index(struct net_device *netdev, int vf, + struct vnic_dev *vdev = enic->vdev; + + spin_lock(&enic->enic_api_lock); ++ while (enic->enic_api_busy) { ++ spin_unlock(&enic->enic_api_lock); ++ cpu_relax(); ++ spin_lock(&enic->enic_api_lock); ++ } ++ + spin_lock_bh(&enic->devcmd_lock); + + vnic_dev_cmd_proxy_by_index_start(vdev, vf); +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c +index 212c9b6756a8..7f7f183b981e 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -2145,8 +2145,6 @@ static int enic_dev_wait(struct vnic_dev *vdev, + int done; + int err; + +- BUG_ON(in_interrupt()); +- + err = start(vdev, arg); + if (err) + return err; +@@ -2334,6 +2332,13 @@ static int enic_set_rss_nic_cfg(struct enic *enic) + rss_hash_bits, rss_base_cpu, rss_enable); + } + ++static void enic_set_api_busy(struct enic *enic, bool busy) ++{ ++ spin_lock(&enic->enic_api_lock); ++ enic->enic_api_busy = busy; ++ spin_unlock(&enic->enic_api_lock); ++} ++ + static void enic_reset(struct work_struct *work) + { + struct enic *enic = container_of(work, struct enic, reset); +@@ -2343,7 +2348,9 @@ static void enic_reset(struct work_struct *work) + + rtnl_lock(); + +- spin_lock(&enic->enic_api_lock); ++ /* Stop any activity from infiniband */ ++ enic_set_api_busy(enic, true); ++ + enic_stop(enic->netdev); + enic_dev_soft_reset(enic); + enic_reset_addr_lists(enic); +@@ -2351,7 +2358,10 @@ static void enic_reset(struct work_struct *work) + enic_set_rss_nic_cfg(enic); + enic_dev_set_ig_vlan_rewrite_mode(enic); + enic_open(enic->netdev); +- spin_unlock(&enic->enic_api_lock); ++ ++ /* Allow infiniband to fiddle with the device again */ ++ enic_set_api_busy(enic, false); ++ + call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev); + + rtnl_unlock(); +@@ -2363,7 +2373,9 @@ static void enic_tx_hang_reset(struct work_struct *work) + + rtnl_lock(); + +- spin_lock(&enic->enic_api_lock); ++ /* Stop any activity from infiniband */ ++ enic_set_api_busy(enic, true); ++ + enic_dev_hang_notify(enic); + enic_stop(enic->netdev); + enic_dev_hang_reset(enic); +@@ -2372,7 +2384,10 @@ static void enic_tx_hang_reset(struct work_struct *work) + enic_set_rss_nic_cfg(enic); + enic_dev_set_ig_vlan_rewrite_mode(enic); + enic_open(enic->netdev); +- spin_unlock(&enic->enic_api_lock); ++ ++ /* Allow infiniband to fiddle with the device again */ ++ enic_set_api_busy(enic, false); ++ + call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev); + + rtnl_unlock(); +-- +2.16.4 + diff --git a/patches.suse/net-phy-intel-xway-enable-integrated-led-functions.patch b/patches.suse/net-phy-intel-xway-enable-integrated-led-functions.patch new file mode 100644 index 0000000..9d785a1 --- /dev/null +++ b/patches.suse/net-phy-intel-xway-enable-integrated-led-functions.patch @@ -0,0 +1,71 @@ +From 357a07c26697a770d39d28b6b111f978deb4017d Mon Sep 17 00:00:00 2001 +From: Martin Schiller +Date: Wed, 21 Apr 2021 07:50:47 +0200 +Subject: [PATCH] net: phy: intel-xway: enable integrated led functions +Git-commit: 357a07c26697a770d39d28b6b111f978deb4017d +Patch-mainline: v5.13-rc1 +References: git-fixes + +The Intel xway phys offer the possibility to deactivate the integrated +LED function and to control the LEDs manually. +If this was set by the bootloader, it must be ensured that the +integrated LED function is enabled for all LEDs when loading the driver. + +Before commit 6e2d85ec0559 ("net: phy: Stop with excessive soft reset") +the LEDs were enabled by a soft-reset of the PHY (using +genphy_soft_reset). Initialize the XWAY_MDIO_LED with it's default +value (which is applied during a soft reset) instead of adding back +the soft reset. This brings back the default LED configuration while +still preventing an excessive amount of soft resets. + +Fixes: 6e2d85ec0559 ("net: phy: Stop with excessive soft reset") +Signed-off-by: Martin Schiller +Signed-off-by: David S. Miller +Acked-by: Takashi Iwai + +--- + drivers/net/phy/intel-xway.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/drivers/net/phy/intel-xway.c b/drivers/net/phy/intel-xway.c +index 6eac50d4b42f..d453ec016168 100644 +--- a/drivers/net/phy/intel-xway.c ++++ b/drivers/net/phy/intel-xway.c +@@ -11,6 +11,18 @@ + + #define XWAY_MDIO_IMASK 0x19 /* interrupt mask */ + #define XWAY_MDIO_ISTAT 0x1A /* interrupt status */ ++#define XWAY_MDIO_LED 0x1B /* led control */ ++ ++/* bit 15:12 are reserved */ ++#define XWAY_MDIO_LED_LED3_EN BIT(11) /* Enable the integrated function of LED3 */ ++#define XWAY_MDIO_LED_LED2_EN BIT(10) /* Enable the integrated function of LED2 */ ++#define XWAY_MDIO_LED_LED1_EN BIT(9) /* Enable the integrated function of LED1 */ ++#define XWAY_MDIO_LED_LED0_EN BIT(8) /* Enable the integrated function of LED0 */ ++/* bit 7:4 are reserved */ ++#define XWAY_MDIO_LED_LED3_DA BIT(3) /* Direct Access to LED3 */ ++#define XWAY_MDIO_LED_LED2_DA BIT(2) /* Direct Access to LED2 */ ++#define XWAY_MDIO_LED_LED1_DA BIT(1) /* Direct Access to LED1 */ ++#define XWAY_MDIO_LED_LED0_DA BIT(0) /* Direct Access to LED0 */ + + #define XWAY_MDIO_INIT_WOL BIT(15) /* Wake-On-LAN */ + #define XWAY_MDIO_INIT_MSRE BIT(14) +@@ -159,6 +171,15 @@ static int xway_gphy_config_init(struct phy_device *phydev) + /* Clear all pending interrupts */ + phy_read(phydev, XWAY_MDIO_ISTAT); + ++ /* Ensure that integrated led function is enabled for all leds */ ++ err = phy_write(phydev, XWAY_MDIO_LED, ++ XWAY_MDIO_LED_LED0_EN | ++ XWAY_MDIO_LED_LED1_EN | ++ XWAY_MDIO_LED_LED2_EN | ++ XWAY_MDIO_LED_LED3_EN); ++ if (err) ++ return err; ++ + phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LEDCH, + XWAY_MMD_LEDCH_NACS_NONE | + XWAY_MMD_LEDCH_SBF_F02HZ | +-- +2.26.2 + diff --git a/patches.suse/net-qed-RDMA-personality-shouldn-t-fail-VF-load.patch b/patches.suse/net-qed-RDMA-personality-shouldn-t-fail-VF-load.patch new file mode 100644 index 0000000..d746fc6 --- /dev/null +++ b/patches.suse/net-qed-RDMA-personality-shouldn-t-fail-VF-load.patch @@ -0,0 +1,35 @@ +From 0d4346963cc191b010840b19b431f8676ebe61e0 Mon Sep 17 00:00:00 2001 +From: Dmitry Bogdanov +Date: Wed, 9 Sep 2020 20:43:10 +0300 +Subject: [PATCH 2/3] net: qed: RDMA personality shouldn't fail VF load +Git-commit: ce1cf9e5025f4e2d2198728391f1847b3e168bc6 +Patch-mainline: v5.9-rc7 +References: git-fixes + +Fix the assert during VF driver installation when the personality is iWARP + +Fixes: 1fe614d10f45 ("qed: Relax VF firmware requirements") +Signed-off-by: Igor Russkikh +Signed-off-by: Michal Kalderon +Signed-off-by: Dmitry Bogdanov +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/qlogic/qed/qed_sriov.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +index 78f77b712b10..7411e23481f2 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +@@ -96,6 +96,7 @@ static int qed_sp_vf_start(struct qed_hwfn *p_hwfn, struct qed_vf_info *p_vf) + p_ramrod->personality = PERSONALITY_ETH; + break; + case QED_PCI_ETH_ROCE: ++ case QED_PCI_ETH_IWARP: + p_ramrod->personality = PERSONALITY_RDMA_AND_ETH; + break; + default: +-- +2.16.4 + diff --git a/patches.suse/net-usb-fix-memory-leak-in-smsc75xx_bind.patch b/patches.suse/net-usb-fix-memory-leak-in-smsc75xx_bind.patch new file mode 100644 index 0000000..5a28f26 --- /dev/null +++ b/patches.suse/net-usb-fix-memory-leak-in-smsc75xx_bind.patch @@ -0,0 +1,61 @@ +From 46a8b29c6306d8bbfd92b614ef65a47c900d8e70 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Mon, 24 May 2021 23:02:08 +0300 +Subject: [PATCH] net: usb: fix memory leak in smsc75xx_bind +Git-commit: 46a8b29c6306d8bbfd92b614ef65a47c900d8e70 +Patch-mainline: v5.13-rc4 +References: git-fixes + +Syzbot reported memory leak in smsc75xx_bind(). +The problem was is non-freed memory in case of +errors after memory allocation. + +Backtrace: [] kmalloc include/linux/slab.h:556 [inline] [] kzalloc include/linux/slab.h:686 [inline] [] smsc75xx_bind+0x7a/0x334 drivers/net/usb/smsc75xx.c:1460 [] usbnet_probe+0x3b6/0xc30 drivers/net/usb/usbnet.c:1728 + +Fixes: d0cad871703b ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver") +Cc: stable@kernel.vger.org +Reported-and-tested-by: syzbot+b558506ba8165425fee2@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Acked-by: Takashi Iwai + +--- + drivers/net/usb/smsc75xx.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c +index f8cdabb9ef5a..b286993da67c 100644 +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -1483,7 +1483,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf) + ret = smsc75xx_wait_ready(dev, 0); + if (ret < 0) { + netdev_warn(dev->net, "device not ready in smsc75xx_bind\n"); +- return ret; ++ goto err; + } + + smsc75xx_init_mac_address(dev); +@@ -1492,7 +1492,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf) + ret = smsc75xx_reset(dev); + if (ret < 0) { + netdev_warn(dev->net, "smsc75xx_reset error %d\n", ret); +- return ret; ++ goto err; + } + + dev->net->netdev_ops = &smsc75xx_netdev_ops; +@@ -1502,6 +1502,10 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf) + dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len; + dev->net->max_mtu = MAX_SINGLE_PACKET_SIZE; + return 0; ++ ++err: ++ kfree(pdata); ++ return ret; + } + + static void smsc75xx_unbind(struct usbnet *dev, struct usb_interface *intf) +-- +2.26.2 + diff --git a/patches.suse/phy-phy-twl4030-usb-Fix-possible-use-after-free-in-t.patch b/patches.suse/phy-phy-twl4030-usb-Fix-possible-use-after-free-in-t.patch new file mode 100644 index 0000000..9852a46 --- /dev/null +++ b/patches.suse/phy-phy-twl4030-usb-Fix-possible-use-after-free-in-t.patch @@ -0,0 +1,44 @@ +From e1723d8b87b73ab363256e7ca3af3ddb75855680 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Wed, 7 Apr 2021 17:27:16 +0800 +Subject: [PATCH] phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() +Git-commit: e1723d8b87b73ab363256e7ca3af3ddb75855680 +Patch-mainline: v5.13-rc1 +References: git-fixes + +This driver's remove path calls cancel_delayed_work(). However, that +function does not wait until the work function finishes. This means +that the callback function may still be running after the driver's +remove function has finished, which would result in a use-after-free. + +Fix by calling cancel_delayed_work_sync(), which ensures that +the work is properly cancelled, no longer running, and unable +to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210407092716.3270248-1-yangyingliang@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/phy/ti/phy-twl4030-usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/ti/phy-twl4030-usb.c b/drivers/phy/ti/phy-twl4030-usb.c +index 9887f908f540..812e5409d359 100644 +--- a/drivers/phy/ti/phy-twl4030-usb.c ++++ b/drivers/phy/ti/phy-twl4030-usb.c +@@ -779,7 +779,7 @@ static int twl4030_usb_remove(struct platform_device *pdev) + + usb_remove_phy(&twl->phy); + pm_runtime_get_sync(twl->dev); +- cancel_delayed_work(&twl->id_workaround_work); ++ cancel_delayed_work_sync(&twl->id_workaround_work); + device_remove_file(twl->dev, &dev_attr_vbus); + + /* set transceiver mode to power on defaults */ +-- +2.26.2 + diff --git a/patches.suse/pinctrl-samsung-use-int-for-register-masks-in-Exynos.patch b/patches.suse/pinctrl-samsung-use-int-for-register-masks-in-Exynos.patch new file mode 100644 index 0000000..25bed2d --- /dev/null +++ b/patches.suse/pinctrl-samsung-use-int-for-register-masks-in-Exynos.patch @@ -0,0 +1,67 @@ +From fa0c10a5f3a49130dd11281aa27e7e1c8654abc7 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 8 Apr 2021 21:50:29 +0200 +Subject: [PATCH] pinctrl: samsung: use 'int' for register masks in Exynos +Git-commit: fa0c10a5f3a49130dd11281aa27e7e1c8654abc7 +Patch-mainline: v5.13-rc1 +References: git-fixes + +The Special Function Registers on all Exynos SoC, including ARM64, are +32-bit wide, so entire driver uses matching functions like readl() or +writel(). On 64-bit ARM using unsigned long for register masks: +1. makes little sense as immediately after bitwise operation it will be + cast to 32-bit value when calling writel(), +2. is actually error-prone because it might promote other operands to + 64-bit. + +Addresses-coverity: Unintentional integer overflow +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Sylwester Nawrocki +Link: https://lore.kernel.org/r/20210408195029.69974-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Linus Walleij +Acked-by: Takashi Iwai + +--- + drivers/pinctrl/samsung/pinctrl-exynos.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/pinctrl/samsung/pinctrl-exynos.c ++++ b/drivers/pinctrl/samsung/pinctrl-exynos.c +@@ -77,7 +77,7 @@ static void exynos_irq_mask(struct irq_d + struct exynos_irq_chip *our_chip = to_exynos_irq_chip(chip); + struct samsung_pin_bank *bank = irq_data_get_irq_chip_data(irqd); + unsigned long reg_mask = our_chip->eint_mask + bank->eint_offset; +- unsigned long mask; ++ unsigned int mask; + unsigned long flags; + + spin_lock_irqsave(&bank->slock, flags); +@@ -105,7 +105,7 @@ static void exynos_irq_unmask(struct irq + struct exynos_irq_chip *our_chip = to_exynos_irq_chip(chip); + struct samsung_pin_bank *bank = irq_data_get_irq_chip_data(irqd); + unsigned long reg_mask = our_chip->eint_mask + bank->eint_offset; +- unsigned long mask; ++ unsigned int mask; + unsigned long flags; + + /* +@@ -441,7 +441,7 @@ static void exynos_irq_eint0_15(struct i + chained_irq_exit(chip, desc); + } + +-static inline void exynos_irq_demux_eint(unsigned long pend, ++static inline void exynos_irq_demux_eint(unsigned int pend, + struct irq_domain *domain) + { + unsigned int irq; +@@ -458,8 +458,8 @@ static void exynos_irq_demux_eint16_31(s + { + struct irq_chip *chip = irq_desc_get_chip(desc); + struct exynos_muxed_weint_data *eintd = irq_desc_get_handler_data(desc); +- unsigned long pend; +- unsigned long mask; ++ unsigned int pend; ++ unsigned int mask; + int i; + + chained_irq_enter(chip, desc); diff --git a/patches.suse/platform-mellanox-mlxbf-tmfifo-Fix-a-memory-barrier-.patch b/patches.suse/platform-mellanox-mlxbf-tmfifo-Fix-a-memory-barrier-.patch new file mode 100644 index 0000000..8d44d9c --- /dev/null +++ b/patches.suse/platform-mellanox-mlxbf-tmfifo-Fix-a-memory-barrier-.patch @@ -0,0 +1,66 @@ +From 1c0e5701c5e792c090aef0e5b9b8923c334d9324 Mon Sep 17 00:00:00 2001 +From: Liming Sun +Date: Fri, 7 May 2021 20:30:12 -0400 +Subject: [PATCH] platform/mellanox: mlxbf-tmfifo: Fix a memory barrier issue +Git-commit: 1c0e5701c5e792c090aef0e5b9b8923c334d9324 +Patch-mainline: v5.13-rc3 +References: git-fixes + +The virtio framework uses wmb() when updating avail->idx. It +guarantees the write order, but not necessarily loading order +for the code accessing the memory. This commit adds a load barrier +after reading the avail->idx to make sure all the data in the +descriptor is visible. It also adds a barrier when returning the +packet to virtio framework to make sure read/writes are visible to +the virtio code. + +Fixes: 1357dfd7261f ("platform/mellanox: Add TmFifo driver for Mellanox BlueField Soc") +Signed-off-by: Liming Sun +Reviewed-by: Vadim Pasternak +Link: https://lore.kernel.org/r/1620433812-17911-1-git-send-email-limings@nvidia.com +Signed-off-by: Hans de Goede +Acked-by: Takashi Iwai + +--- + drivers/platform/mellanox/mlxbf-tmfifo.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c +index bbc4e71a16ff..38800e86ed8a 100644 +--- a/drivers/platform/mellanox/mlxbf-tmfifo.c ++++ b/drivers/platform/mellanox/mlxbf-tmfifo.c +@@ -294,6 +294,9 @@ mlxbf_tmfifo_get_next_desc(struct mlxbf_tmfifo_vring *vring) + if (vring->next_avail == virtio16_to_cpu(vdev, vr->avail->idx)) + return NULL; + ++ /* Make sure 'avail->idx' is visible already. */ ++ virtio_rmb(false); ++ + idx = vring->next_avail % vr->num; + head = virtio16_to_cpu(vdev, vr->avail->ring[idx]); + if (WARN_ON(head >= vr->num)) +@@ -322,7 +325,7 @@ static void mlxbf_tmfifo_release_desc(struct mlxbf_tmfifo_vring *vring, + * done or not. Add a memory barrier here to make sure the update above + * completes before updating the idx. + */ +- mb(); ++ virtio_mb(false); + vr->used->idx = cpu_to_virtio16(vdev, vr_idx + 1); + } + +@@ -733,6 +736,12 @@ static bool mlxbf_tmfifo_rxtx_one_desc(struct mlxbf_tmfifo_vring *vring, + desc = NULL; + fifo->vring[is_rx] = NULL; + ++ /* ++ * Make sure the load/store are in order before ++ * returning back to virtio. ++ */ ++ virtio_mb(false); ++ + /* Notify upper layer that packet is done. */ + spin_lock_irqsave(&fifo->spin_lock[is_rx], flags); + vring_interrupt(0, vring->vq); +-- +2.26.2 + diff --git a/patches.suse/platform-x86-thinkpad_acpi-Correct-thermal-sensor-al.patch b/patches.suse/platform-x86-thinkpad_acpi-Correct-thermal-sensor-al.patch new file mode 100644 index 0000000..3a4987d --- /dev/null +++ b/patches.suse/platform-x86-thinkpad_acpi-Correct-thermal-sensor-al.patch @@ -0,0 +1,107 @@ +From 6759e18e5cd8745a5dfc5726e4a3db5281ec1639 Mon Sep 17 00:00:00 2001 +From: Mark Pearson +Date: Wed, 7 Apr 2021 17:20:15 -0400 +Subject: [PATCH] platform/x86: thinkpad_acpi: Correct thermal sensor allocation +Git-commit: 6759e18e5cd8745a5dfc5726e4a3db5281ec1639 +Patch-mainline: v5.13-rc1 +References: git-fixes + +On recent Thinkpad platforms it was reported that temp sensor 11 was +always incorrectly displaying 66C. It turns out the reason for this is +that this location in EC RAM is not a temperature sensor but is the +power supply ID (offset 0xC2). + +Based on feedback from the Lenovo firmware team the EC RAM version can +be determined and for the current version (3) only the 0x78 to 0x7F +range is used for temp sensors. I don't have any details for earlier +versions so I have left the implementation unaltered there. + +Note - in this block only 0x78 and 0x79 are officially designated (CPU & +GPU sensors). The use of the other locations in the block will vary from +platform to platform; but the existing logic to detect a sensor presence +holds. + +Signed-off-by: Mark Pearson +Link: https://lore.kernel.org/r/20210407212015.298222-1-markpearson@lenovo.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Acked-by: Takashi Iwai + +--- + drivers/platform/x86/thinkpad_acpi.c | 31 ++++++++++++++++++++-------- + 1 file changed, 22 insertions(+), 9 deletions(-) + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index 968e0e6b3fa4..ec98089d98c9 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -6283,6 +6283,7 @@ enum thermal_access_mode { + enum { /* TPACPI_THERMAL_TPEC_* */ + TP_EC_THERMAL_TMP0 = 0x78, /* ACPI EC regs TMP 0..7 */ + TP_EC_THERMAL_TMP8 = 0xC0, /* ACPI EC regs TMP 8..15 */ ++ TP_EC_FUNCREV = 0xEF, /* ACPI EC Functional revision */ + TP_EC_THERMAL_TMP_NA = -128, /* ACPI EC sensor not available */ + + TPACPI_THERMAL_SENSOR_NA = -128000, /* Sensor not available */ +@@ -6481,7 +6482,7 @@ static const struct attribute_group thermal_temp_input8_group = { + + static int __init thermal_init(struct ibm_init_struct *iibm) + { +- u8 t, ta1, ta2; ++ u8 t, ta1, ta2, ver = 0; + int i; + int acpi_tmp7; + int res; +@@ -6496,7 +6497,14 @@ static int __init thermal_init(struct ibm_init_struct *iibm) + * 0x78-0x7F, 0xC0-0xC7. Registers return 0x00 for + * non-implemented, thermal sensors return 0x80 when + * not available ++ * The above rule is unfortunately flawed. This has been seen with ++ * 0xC2 (power supply ID) causing thermal control problems. ++ * The EC version can be determined by offset 0xEF and at least for ++ * version 3 the Lenovo firmware team confirmed that registers 0xC0-0xC7 ++ * are not thermal registers. + */ ++ if (!acpi_ec_read(TP_EC_FUNCREV, &ver)) ++ pr_warn("Thinkpad ACPI EC unable to access EC version\n"); + + ta1 = ta2 = 0; + for (i = 0; i < 8; i++) { +@@ -6506,11 +6514,13 @@ static int __init thermal_init(struct ibm_init_struct *iibm) + ta1 = 0; + break; + } +- if (acpi_ec_read(TP_EC_THERMAL_TMP8 + i, &t)) { +- ta2 |= t; +- } else { +- ta1 = 0; +- break; ++ if (ver < 3) { ++ if (acpi_ec_read(TP_EC_THERMAL_TMP8 + i, &t)) { ++ ta2 |= t; ++ } else { ++ ta1 = 0; ++ break; ++ } + } + } + if (ta1 == 0) { +@@ -6523,9 +6533,12 @@ static int __init thermal_init(struct ibm_init_struct *iibm) + thermal_read_mode = TPACPI_THERMAL_NONE; + } + } else { +- thermal_read_mode = +- (ta2 != 0) ? +- TPACPI_THERMAL_TPEC_16 : TPACPI_THERMAL_TPEC_8; ++ if (ver >= 3) ++ thermal_read_mode = TPACPI_THERMAL_TPEC_8; ++ else ++ thermal_read_mode = ++ (ta2 != 0) ? ++ TPACPI_THERMAL_TPEC_16 : TPACPI_THERMAL_TPEC_8; + } + } else if (acpi_tmp7) { + if (tpacpi_is_ibm() && +-- +2.26.2 + diff --git a/patches.suse/power-supply-Use-IRQF_ONESHOT.patch b/patches.suse/power-supply-Use-IRQF_ONESHOT.patch new file mode 100644 index 0000000..b29acc5 --- /dev/null +++ b/patches.suse/power-supply-Use-IRQF_ONESHOT.patch @@ -0,0 +1,83 @@ +From 2469b836fa835c67648acad17d62bc805236a6ea Mon Sep 17 00:00:00 2001 +From: dongjian +Date: Mon, 22 Mar 2021 19:21:33 +0800 +Subject: [PATCH] power: supply: Use IRQF_ONESHOT +Git-commit: 2469b836fa835c67648acad17d62bc805236a6ea +Patch-mainline: v5.13-rc1 +References: git-fixes + +Fixes coccicheck error: + +drivers/power/supply/pm2301_charger.c:1089:7-27: ERROR: +drivers/power/supply/lp8788-charger.c:502:8-28: ERROR: +drivers/power/supply/tps65217_charger.c:239:8-33: ERROR: +drivers/power/supply/tps65090-charger.c:303:8-33: ERROR: + +Threaded IRQ with no primary handler requested without IRQF_ONESHOT + +Signed-off-by: dongjian +Signed-off-by: Sebastian Reichel +Acked-by: Takashi Iwai + +--- + drivers/power/supply/lp8788-charger.c | 2 +- + drivers/power/supply/pm2301_charger.c | 2 +- + drivers/power/supply/tps65090-charger.c | 2 +- + drivers/power/supply/tps65217_charger.c | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/power/supply/lp8788-charger.c b/drivers/power/supply/lp8788-charger.c +index e7931ffb7151..397e5a03b7d9 100644 +--- a/drivers/power/supply/lp8788-charger.c ++++ b/drivers/power/supply/lp8788-charger.c +@@ -501,7 +501,7 @@ static int lp8788_set_irqs(struct platform_device *pdev, + + ret = request_threaded_irq(virq, NULL, + lp8788_charger_irq_thread, +- 0, name, pchg); ++ IRQF_ONESHOT, name, pchg); + if (ret) + break; + } +diff --git a/drivers/power/supply/pm2301_charger.c b/drivers/power/supply/pm2301_charger.c +index ac06ecf7fc9c..a3bfb9612b17 100644 +--- a/drivers/power/supply/pm2301_charger.c ++++ b/drivers/power/supply/pm2301_charger.c +@@ -1089,7 +1089,7 @@ static int pm2xxx_wall_charger_probe(struct i2c_client *i2c_client, + ret = request_threaded_irq(gpio_to_irq(pm2->pdata->gpio_irq_number), + NULL, + pm2xxx_charger_irq[0].isr, +- pm2->pdata->irq_type, ++ pm2->pdata->irq_type | IRQF_ONESHOT, + pm2xxx_charger_irq[0].name, pm2); + + if (ret != 0) { +diff --git a/drivers/power/supply/tps65090-charger.c b/drivers/power/supply/tps65090-charger.c +index 6b0098e5a88b..0990b2fa6cd8 100644 +--- a/drivers/power/supply/tps65090-charger.c ++++ b/drivers/power/supply/tps65090-charger.c +@@ -301,7 +301,7 @@ static int tps65090_charger_probe(struct platform_device *pdev) + + if (irq != -ENXIO) { + ret = devm_request_threaded_irq(&pdev->dev, irq, NULL, +- tps65090_charger_isr, 0, "tps65090-charger", cdata); ++ tps65090_charger_isr, IRQF_ONESHOT, "tps65090-charger", cdata); + if (ret) { + dev_err(cdata->dev, + "Unable to register irq %d err %d\n", irq, +diff --git a/drivers/power/supply/tps65217_charger.c b/drivers/power/supply/tps65217_charger.c +index 814c2b81fdfe..ba33d1617e0b 100644 +--- a/drivers/power/supply/tps65217_charger.c ++++ b/drivers/power/supply/tps65217_charger.c +@@ -238,7 +238,7 @@ static int tps65217_charger_probe(struct platform_device *pdev) + for (i = 0; i < NUM_CHARGER_IRQS; i++) { + ret = devm_request_threaded_irq(&pdev->dev, irq[i], NULL, + tps65217_charger_irq, +- 0, "tps65217-charger", ++ IRQF_ONESHOT, "tps65217-charger", + charger); + if (ret) { + dev_err(charger->dev, +-- +2.26.2 + diff --git a/patches.suse/power-supply-generic-adc-battery-fix-possible-use-af.patch b/patches.suse/power-supply-generic-adc-battery-fix-possible-use-af.patch new file mode 100644 index 0000000..84e8491 --- /dev/null +++ b/patches.suse/power-supply-generic-adc-battery-fix-possible-use-af.patch @@ -0,0 +1,42 @@ +From b6cfa007b3b229771d9588970adb4ab3e0487f49 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Wed, 7 Apr 2021 17:17:06 +0800 +Subject: [PATCH] power: supply: generic-adc-battery: fix possible use-after-free in gab_remove() +Git-commit: b6cfa007b3b229771d9588970adb4ab3e0487f49 +Patch-mainline: v5.13-rc1 +References: git-fixes + +This driver's remove path calls cancel_delayed_work(). However, that +function does not wait until the work function finishes. This means +that the callback function may still be running after the driver's +remove function has finished, which would result in a use-after-free. + +Fix by calling cancel_delayed_work_sync(), which ensures that +the work is properly cancelled, no longer running, and unable +to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Sebastian Reichel +Acked-by: Takashi Iwai + +--- + drivers/power/supply/generic-adc-battery.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c +index 0032069fbc2b..66039c665dd1 100644 +--- a/drivers/power/supply/generic-adc-battery.c ++++ b/drivers/power/supply/generic-adc-battery.c +@@ -373,7 +373,7 @@ static int gab_remove(struct platform_device *pdev) + } + + kfree(adc_bat->psy_desc.properties); +- cancel_delayed_work(&adc_bat->bat_work); ++ cancel_delayed_work_sync(&adc_bat->bat_work); + return 0; + } + +-- +2.26.2 + diff --git a/patches.suse/power-supply-s3c_adc_battery-fix-possible-use-after-.patch b/patches.suse/power-supply-s3c_adc_battery-fix-possible-use-after-.patch new file mode 100644 index 0000000..8df18e2 --- /dev/null +++ b/patches.suse/power-supply-s3c_adc_battery-fix-possible-use-after-.patch @@ -0,0 +1,38 @@ +From 68ae256945d2abe9036a7b68af4cc65aff79d5b7 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Wed, 7 Apr 2021 17:19:03 +0800 +Subject: [PATCH] power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove() +Git-commit: 68ae256945d2abe9036a7b68af4cc65aff79d5b7 +Patch-mainline: v5.13-rc1 +References: git-fixes + +This driver's remove path calls cancel_delayed_work(). However, that +function does not wait until the work function finishes. This means +that the callback function may still be running after the driver's +remove function has finished, which would result in a use-after-free. + +Fix by calling cancel_delayed_work_sync(), which ensures that +the work is properly cancelled, no longer running, and unable +to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Sebastian Reichel +Acked-by: Takashi Iwai + +--- + drivers/power/supply/s3c_adc_battery.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/power/supply/s3c_adc_battery.c ++++ b/drivers/power/supply/s3c_adc_battery.c +@@ -392,7 +392,7 @@ static int s3c_adc_bat_remove(struct pla + gpio_free(pdata->gpio_charge_finished); + } + +- cancel_delayed_work(&bat_work); ++ cancel_delayed_work_sync(&bat_work); + + if (pdata->exit) + pdata->exit(); diff --git a/patches.suse/powerpc-64-remove-start_tb-and-accum_tb-from-thread_.patch b/patches.suse/powerpc-64-remove-start_tb-and-accum_tb-from-thread_.patch new file mode 100644 index 0000000..9479a00 --- /dev/null +++ b/patches.suse/powerpc-64-remove-start_tb-and-accum_tb-from-thread_.patch @@ -0,0 +1,54 @@ +From 36d632ea831fd2fa3cb62599a465825f59076f64 Mon Sep 17 00:00:00 2001 +From: Nicholas Piggin +Date: Sat, 5 May 2018 03:19:29 +1000 +Subject: [PATCH] powerpc/64: remove start_tb and accum_tb from thread_struct + +References: bsc#1186487 ltc#177613 +Patch-mainline: v4.18-rc1 +Git-commit: 36d632ea831fd2fa3cb62599a465825f59076f64 + +These fields are only written to. + +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Acked-by: Michal Suchanek +--- + arch/powerpc/include/asm/processor.h | 4 ---- + arch/powerpc/kernel/process.c | 6 +----- + 2 files changed, 1 insertion(+), 9 deletions(-) + +diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h +index c4b36a494a63..eff269adfa71 100644 +--- a/arch/powerpc/include/asm/processor.h ++++ b/arch/powerpc/include/asm/processor.h +@@ -264,10 +264,6 @@ struct thread_struct { + struct thread_fp_state *fp_save_area; + int fpexc_mode; /* floating-point exception mode */ + unsigned int align_ctl; /* alignment handling control */ +-#ifdef CONFIG_PPC64 +- unsigned long start_tb; /* Start purr when proc switched in */ +- unsigned long accum_tb; /* Total accumulated purr for process */ +-#endif + #ifdef CONFIG_HAVE_HW_BREAKPOINT + struct perf_event *ptrace_bps[HBP_NUM]; + /* +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c +index 25db000fa5b3..f4e5291584c5 100644 +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -1188,11 +1188,7 @@ struct task_struct *__switch_to(struct task_struct *prev, + */ + if (firmware_has_feature(FW_FEATURE_SPLPAR)) { + struct cpu_usage *cu = this_cpu_ptr(&cpu_usage_array); +- long unsigned start_tb, current_tb; +- start_tb = old_thread->start_tb; +- cu->current_tb = current_tb = mfspr(SPRN_PURR); +- old_thread->accum_tb += (current_tb - start_tb); +- new_thread->start_tb = current_tb; ++ cu->current_tb = mfspr(SPRN_PURR); + } + #endif /* CONFIG_PPC64 */ + +-- +2.26.2 + diff --git a/patches.suse/powerpc-64s-Fix-crashes-when-toggling-entry-flush-ba.patch b/patches.suse/powerpc-64s-Fix-crashes-when-toggling-entry-flush-ba.patch index 2ee9bb1..f253b1c 100644 --- a/patches.suse/powerpc-64s-Fix-crashes-when-toggling-entry-flush-ba.patch +++ b/patches.suse/powerpc-64s-Fix-crashes-when-toggling-entry-flush-ba.patch @@ -3,7 +3,7 @@ From: Michael Ellerman Date: Thu, 6 May 2021 14:49:59 +1000 Subject: [PATCH] powerpc/64s: Fix crashes when toggling entry flush barrier -References: bsc#1177666 git-fixes +References: bsc#1177666 git-fixes bsc#1186460 ltc#192531 Patch-mainline: v5.13-rc2 Git-commit: aec86b052df6541cc97c5fca44e5934cbea4963b diff --git a/patches.suse/powerpc-64s-Fix-crashes-when-toggling-stf-barrier.patch b/patches.suse/powerpc-64s-Fix-crashes-when-toggling-stf-barrier.patch index cd43529..a327523 100644 --- a/patches.suse/powerpc-64s-Fix-crashes-when-toggling-stf-barrier.patch +++ b/patches.suse/powerpc-64s-Fix-crashes-when-toggling-stf-barrier.patch @@ -3,7 +3,7 @@ From: Michael Ellerman Date: Thu, 6 May 2021 14:49:58 +1000 Subject: [PATCH] powerpc/64s: Fix crashes when toggling stf barrier -References: bsc#1087082 git-fixes +References: bsc#1087082 git-fixes bsc#1186460 ltc#192531 Patch-mainline: v5.13-rc2 Git-commit: 8ec7791bae1327b1c279c5cd6e929c3b12daaf0a diff --git a/patches.suse/powerpc-pseries-lparcfg-calculate-PURR-on-demand.patch b/patches.suse/powerpc-pseries-lparcfg-calculate-PURR-on-demand.patch new file mode 100644 index 0000000..56fc71e --- /dev/null +++ b/patches.suse/powerpc-pseries-lparcfg-calculate-PURR-on-demand.patch @@ -0,0 +1,137 @@ +From 3d3a6021ddcbe9c31520e4e7b65e5ce5dc58274d Mon Sep 17 00:00:00 2001 +From: Nicholas Piggin +Date: Sat, 5 May 2018 03:19:30 +1000 +Subject: [PATCH] powerpc/pseries: lparcfg calculate PURR on demand + +References: bsc#1186487 ltc#177613 +Patch-mainline: v4.18-rc1 +Git-commit: 3d3a6021ddcbe9c31520e4e7b65e5ce5dc58274d + +For SPLPAR, lparcfg provides a sum of PURR registers for all CPUs. +Currently this is done by reading PURR in context switch and timer +interrupt, and storing that into a per-CPU variable. These are summed +to provide the value. + +This does not work with all timer schemes (e.g., NO_HZ_FULL), and it +is sub-optimal for performance because it reads the PURR register on +every context switch, although that's been difficult to distinguish +from noise in the contxt_switch microbenchmark. + +This patch implements the sum by calling a function on each CPU, to +read and add PURR values of each CPU. + +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Acked-by: Michal Suchanek +--- + arch/powerpc/include/asm/time.h | 8 -------- + arch/powerpc/kernel/process.c | 14 -------------- + arch/powerpc/kernel/time.c | 8 -------- + arch/powerpc/platforms/pseries/lparcfg.c | 18 ++++++++++-------- + 4 files changed, 10 insertions(+), 38 deletions(-) + +diff --git a/arch/powerpc/include/asm/time.h b/arch/powerpc/include/asm/time.h +--- a/arch/powerpc/include/asm/time.h ++++ b/arch/powerpc/include/asm/time.h +@@ -196,14 +196,6 @@ extern u64 mulhdu(u64, u64); + extern void div128_by_32(u64 dividend_high, u64 dividend_low, + unsigned divisor, struct div_result *dr); + +-/* Used to store Processor Utilization register (purr) values */ +- +-struct cpu_usage { +- u64 current_tb; /* Holds the current purr register values */ +-}; +- +-DECLARE_PER_CPU(struct cpu_usage, cpu_usage_array); +- + extern void secondary_cpu_time_init(void); + + DECLARE_PER_CPU(u64, decrementers_next_tb); +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c +index f4e5291584c5..2a7fa5000cce 100644 +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -846,10 +846,6 @@ bool ppc_breakpoint_available(void) + } + EXPORT_SYMBOL_GPL(ppc_breakpoint_available); + +-#ifdef CONFIG_PPC64 +-DEFINE_PER_CPU(struct cpu_usage, cpu_usage_array); +-#endif +- + static inline bool hw_brk_match(struct arch_hw_breakpoint *a, + struct arch_hw_breakpoint *b) + { +@@ -1182,16 +1178,6 @@ struct task_struct *__switch_to(struct task_struct *prev, + + WARN_ON(!irqs_disabled()); + +-#ifdef CONFIG_PPC64 +- /* +- * Collect processor utilization data per process +- */ +- if (firmware_has_feature(FW_FEATURE_SPLPAR)) { +- struct cpu_usage *cu = this_cpu_ptr(&cpu_usage_array); +- cu->current_tb = mfspr(SPRN_PURR); +- } +-#endif /* CONFIG_PPC64 */ +- + #ifdef CONFIG_PPC_BOOK3S_64 + batch = this_cpu_ptr(&ppc64_tlb_batch); + if (batch->active) { +diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c +index e7e8611e8863..1fe6a24357e7 100644 +--- a/arch/powerpc/kernel/time.c ++++ b/arch/powerpc/kernel/time.c +@@ -597,14 +597,6 @@ static void __timer_interrupt(void) + __this_cpu_inc(irq_stat.timer_irqs_others); + } + +-#ifdef CONFIG_PPC64 +- /* collect purr register values often, for accurate calculations */ +- if (firmware_has_feature(FW_FEATURE_SPLPAR)) { +- struct cpu_usage *cu = this_cpu_ptr(&cpu_usage_array); +- cu->current_tb = mfspr(SPRN_PURR); +- } +-#endif +- + trace_timer_interrupt_exit(regs); + } + +diff --git a/arch/powerpc/platforms/pseries/lparcfg.c b/arch/powerpc/platforms/pseries/lparcfg.c +index c508c938dc71..7c872dc01bdb 100644 +--- a/arch/powerpc/platforms/pseries/lparcfg.c ++++ b/arch/powerpc/platforms/pseries/lparcfg.c +@@ -52,18 +52,20 @@ + * Track sum of all purrs across all processors. This is used to further + * calculate usage values by different applications + */ ++static void cpu_get_purr(void *arg) ++{ ++ atomic64_t *sum = arg; ++ ++ atomic64_add(mfspr(SPRN_PURR), sum); ++} ++ + static unsigned long get_purr(void) + { +- unsigned long sum_purr = 0; +- int cpu; ++ atomic64_t purr = ATOMIC64_INIT(0); + +- for_each_possible_cpu(cpu) { +- struct cpu_usage *cu; ++ on_each_cpu(cpu_get_purr, &purr, 1); + +- cu = &per_cpu(cpu_usage_array, cpu); +- sum_purr += cu->current_tb; +- } +- return sum_purr; ++ return atomic64_read(&purr); + } + + /* +-- +2.26.2 + diff --git a/patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch b/patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch new file mode 100644 index 0000000..b53a622 --- /dev/null +++ b/patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch @@ -0,0 +1,105 @@ +From 5114975eb2de4e70d9d43b57912e1aee12ec090b Mon Sep 17 00:00:00 2001 +From: Brian King +Date: Tue, 11 May 2021 13:12:19 -0500 +Subject: [PATCH] scsi: ibmvfc: Avoid move login if fast fail is enabled + +References: bsc#1185938 ltc#192043 +Patch-mainline: queued +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: 5114975eb2de4e70d9d43b57912e1aee12ec090b + +If fast fail is enabled and we encounter a WWPN moving from one port id to +another port id with I/O outstanding, if we use the move login MAD, +although it will work, it will leave any outstanding I/O still outstanding +to the old port id. Eventually, the SCSI command timers will fire and we +will abort these commands, however, this is generally much longer than the +fast fail timeout, which can lead to I/O operations being outstanding for a +long time. This patch changes the behavior to avoid the move login if fast +fail is enabled. Once terminate_rport_io cleans up the rport, then we force +the target back through the delete process, which re-drives the implicit +logout, then kicks us back into discovery where we will discover the WWPN +at the new location and do a PLOGI to it. + +Link: https://lore.kernel.org/r/1620756740-7045-3-git-send-email-brking@linux.vnet.ibm.com +Signed-off-by: Brian King +Signed-off-by: Martin K. Petersen +Acked-by: Michal Suchanek +--- + drivers/scsi/ibmvscsi/ibmvfc.c | 39 ++++++++++++++++++++++++---------- + drivers/scsi/ibmvscsi/ibmvfc.h | 1 + + 2 files changed, 29 insertions(+), 11 deletions(-) + +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c +index 4ac5bff69305..c8d3fdf65a7f 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.c ++++ b/drivers/scsi/ibmvscsi/ibmvfc.c +@@ -4728,19 +4728,24 @@ static int ibmvfc_alloc_target(struct ibmvfc_host *vhost, + * and it failed for some reason, such as there being I/O + * pending to the target. In this case, we will have already + * deleted the rport from the FC transport so we do a move +- * login, which works even with I/O pending, as it will cancel +- * any active commands. ++ * login, which works even with I/O pending, however, if ++ * there is still I/O pending, it will stay outstanding, so ++ * we only do this if fast fail is disabled for the rport, ++ * otherwise we let terminate_rport_io clean up the port ++ * before we login at the new location. + */ + if (wtgt->action == IBMVFC_TGT_ACTION_LOGOUT_DELETED_RPORT) { +- /* +- * Do a move login here. The old target is no longer +- * known to the transport layer We don't use the +- * normal ibmvfc_set_tgt_action to set this, as we +- * don't normally want to allow this state change. +- */ +- wtgt->new_scsi_id = scsi_id; +- wtgt->action = IBMVFC_TGT_ACTION_INIT; +- ibmvfc_init_tgt(wtgt, ibmvfc_tgt_move_login); ++ if (wtgt->move_login) { ++ /* ++ * Do a move login here. The old target is no longer ++ * known to the transport layer We don't use the ++ * normal ibmvfc_set_tgt_action to set this, as we ++ * don't normally want to allow this state change. ++ */ ++ wtgt->new_scsi_id = scsi_id; ++ wtgt->action = IBMVFC_TGT_ACTION_INIT; ++ ibmvfc_init_tgt(wtgt, ibmvfc_tgt_move_login); ++ } + goto unlock_out; + } else { + tgt_err(wtgt, "Unexpected target state: %d, %p\n", +@@ -5486,6 +5491,18 @@ static void ibmvfc_do_work(struct ibmvfc_host *vhost) + rport = tgt->rport; + tgt->rport = NULL; + ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_LOGOUT_DELETED_RPORT); ++ ++ /* ++ * If fast fail is enabled, we wait for it to fire and then clean up ++ * the old port, since we expect the fast fail timer to clean up the ++ * outstanding I/O faster than waiting for normal command timeouts. ++ * However, if fast fail is disabled, any I/O outstanding to the ++ * rport LUNs will stay outstanding indefinitely, since the EH handlers ++ * won't get invoked for I/O's timing out. If this is a NPIV failover ++ * scenario, the better alternative is to use the move login. ++ */ ++ if (rport && rport->fast_io_fail_tmo == -1) ++ tgt->move_login = 1; + spin_unlock_irqrestore(vhost->host->host_lock, flags); + if (rport) + fc_remote_port_delete(rport); +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h +index 4601bd21372d..4f0f3baefae4 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.h ++++ b/drivers/scsi/ibmvscsi/ibmvfc.h +@@ -726,6 +726,7 @@ struct ibmvfc_target { + int add_rport; + int init_retries; + int logo_rcvd; ++ int move_login; + u32 cancel_key; + struct ibmvfc_service_parms service_parms; + struct ibmvfc_service_parms service_parms_change; +-- +2.26.2 + diff --git a/patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch b/patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch new file mode 100644 index 0000000..3122558 --- /dev/null +++ b/patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch @@ -0,0 +1,109 @@ +From d5b45dd5ba6c944b17118530843e67bf9c096e49 Mon Sep 17 00:00:00 2001 +From: Brian King +Date: Tue, 11 May 2021 13:12:18 -0500 +Subject: [PATCH] scsi: ibmvfc: Handle move login failure + +References: bsc#1185938 ltc#192043 +Patch-mainline: queued +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: d5b45dd5ba6c944b17118530843e67bf9c096e49 + +When service is being performed on an SVC with NPIV enabled, the WWPN of +the canister / node being serviced fails over to the another canister / +node. This looks to the ibmvfc driver as a WWPN moving from one SCSI ID to +another. The driver will first attempt to do an implicit logout of the old +SCSI ID. If this works, we simply delete the rport at the old location and +add an rport at the new location and the FC transport class handles +everything. However, if there is I/O outstanding, this implicit logout will +fail, in which case we will send a "move login" request to the VIOS. This +will cancel any outstanding I/O to that port, logout the port, and PLOGI +the new port. Recently we've encountered a scenario where the move login +fails. This was resulting in an attempted plogi to the new scsi id, without +the old scsi id getting logged out, which is a VIOS protocol violation. To +solve this, we want to keep tracking the old scsi id as the current scsi +id. That way, once terminate_rport_io cancels the outstanding i/o, it will +send us back through to do an implicit logout of the old scsi id, rather +than the new scsi id, and then we can plogi the new scsi id. + +Link: https://lore.kernel.org/r/1620756740-7045-2-git-send-email-brking@linux.vnet.ibm.com +Signed-off-by: Brian King +Signed-off-by: Martin K. Petersen +Acked-by: Michal Suchanek +--- + drivers/scsi/ibmvscsi/ibmvfc.c | 16 ++++++++-------- + drivers/scsi/ibmvscsi/ibmvfc.h | 2 +- + 2 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c +index 6540d48eb0e8..4ac5bff69305 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.c ++++ b/drivers/scsi/ibmvscsi/ibmvfc.c +@@ -4299,9 +4299,10 @@ static void ibmvfc_tgt_move_login_done(struct ibmvfc_event *evt) + ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_NONE); + switch (status) { + case IBMVFC_MAD_SUCCESS: +- tgt_dbg(tgt, "Move Login succeeded for old scsi_id: %llX\n", tgt->old_scsi_id); ++ tgt_dbg(tgt, "Move Login succeeded for new scsi_id: %llX\n", tgt->new_scsi_id); + tgt->ids.node_name = wwn_to_u64(rsp->service_parms.node_name); + tgt->ids.port_name = wwn_to_u64(rsp->service_parms.port_name); ++ tgt->scsi_id = tgt->new_scsi_id; + tgt->ids.port_id = tgt->scsi_id; + memcpy(&tgt->service_parms, &rsp->service_parms, + sizeof(tgt->service_parms)); +@@ -4319,8 +4320,8 @@ static void ibmvfc_tgt_move_login_done(struct ibmvfc_event *evt) + level += ibmvfc_retry_tgt_init(tgt, ibmvfc_tgt_move_login); + + tgt_log(tgt, level, +- "Move Login failed: old scsi_id: %llX, flags:%x, vios_flags:%x, rc=0x%02X\n", +- tgt->old_scsi_id, be32_to_cpu(rsp->flags), be16_to_cpu(rsp->vios_flags), ++ "Move Login failed: new scsi_id: %llX, flags:%x, vios_flags:%x, rc=0x%02X\n", ++ tgt->new_scsi_id, be32_to_cpu(rsp->flags), be16_to_cpu(rsp->vios_flags), + status); + break; + } +@@ -4357,8 +4358,8 @@ static void ibmvfc_tgt_move_login(struct ibmvfc_target *tgt) + move->common.opcode = cpu_to_be32(IBMVFC_MOVE_LOGIN); + move->common.length = cpu_to_be16(sizeof(*move)); + +- move->old_scsi_id = cpu_to_be64(tgt->old_scsi_id); +- move->new_scsi_id = cpu_to_be64(tgt->scsi_id); ++ move->old_scsi_id = cpu_to_be64(tgt->scsi_id); ++ move->new_scsi_id = cpu_to_be64(tgt->new_scsi_id); + move->wwpn = cpu_to_be64(tgt->wwpn); + move->node_name = cpu_to_be64(tgt->ids.node_name); + +@@ -4367,7 +4368,7 @@ static void ibmvfc_tgt_move_login(struct ibmvfc_target *tgt) + ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_DEL_RPORT); + kref_put(&tgt->kref, ibmvfc_release_tgt); + } else +- tgt_dbg(tgt, "Sent Move Login for old scsi_id: %llX\n", tgt->old_scsi_id); ++ tgt_dbg(tgt, "Sent Move Login for new scsi_id: %llX\n", tgt->new_scsi_id); + } + + /** +@@ -4737,8 +4738,7 @@ static int ibmvfc_alloc_target(struct ibmvfc_host *vhost, + * normal ibmvfc_set_tgt_action to set this, as we + * don't normally want to allow this state change. + */ +- wtgt->old_scsi_id = wtgt->scsi_id; +- wtgt->scsi_id = scsi_id; ++ wtgt->new_scsi_id = scsi_id; + wtgt->action = IBMVFC_TGT_ACTION_INIT; + ibmvfc_init_tgt(wtgt, ibmvfc_tgt_move_login); + goto unlock_out; +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h +index 19dcec3ae9ba..4601bd21372d 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.h ++++ b/drivers/scsi/ibmvscsi/ibmvfc.h +@@ -718,7 +718,7 @@ struct ibmvfc_target { + struct ibmvfc_host *vhost; + u64 scsi_id; + u64 wwpn; +- u64 old_scsi_id; ++ u64 new_scsi_id; + struct fc_rport *rport; + int target_id; + enum ibmvfc_target_action action; +-- +2.26.2 + diff --git a/patches.suse/scsi-ibmvfc-Reinit-target-retries.patch b/patches.suse/scsi-ibmvfc-Reinit-target-retries.patch new file mode 100644 index 0000000..7b975c2 --- /dev/null +++ b/patches.suse/scsi-ibmvfc-Reinit-target-retries.patch @@ -0,0 +1,68 @@ +From 2e51f78b5d8717bba243f5e857031b1d104a3577 Mon Sep 17 00:00:00 2001 +From: Brian King +Date: Tue, 11 May 2021 13:12:20 -0500 +Subject: [PATCH] scsi: ibmvfc: Reinit target retries + +References: bsc#1185938 ltc#192043 +Patch-mainline: queued +Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git +Git-commit: 2e51f78b5d8717bba243f5e857031b1d104a3577 + +If rport target discovery commands fail for some reason, they get retried +up to a set number of retries. Once the retry limit is exceeded, the target +is deleted. In order to delete the target, we either need to do an implicit +logout or a move login. In the move login case, if the move login fails, we +want to retry it. This ensures the retry counter gets reinitialized so the +move login will get retried. + +Link: https://lore.kernel.org/r/1620756740-7045-4-git-send-email-brking@linux.vnet.ibm.com +Signed-off-by: Brian King +Signed-off-by: Martin K. Petersen +Acked-by: Michal Suchanek +--- + drivers/scsi/ibmvscsi/ibmvfc.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c +index c8d3fdf65a7f..a251dbf630cc 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.c ++++ b/drivers/scsi/ibmvscsi/ibmvfc.c +@@ -654,8 +654,10 @@ static void ibmvfc_reinit_host(struct ibmvfc_host *vhost) + **/ + static void ibmvfc_del_tgt(struct ibmvfc_target *tgt) + { +- if (!ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_LOGOUT_RPORT)) ++ if (!ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_LOGOUT_RPORT)) { + tgt->job_step = ibmvfc_tgt_implicit_logout_and_del; ++ tgt->init_retries = 0; ++ } + wake_up(&tgt->vhost->work_wait_q); + } + +@@ -4744,6 +4746,7 @@ static int ibmvfc_alloc_target(struct ibmvfc_host *vhost, + */ + wtgt->new_scsi_id = scsi_id; + wtgt->action = IBMVFC_TGT_ACTION_INIT; ++ wtgt->init_retries = 0; + ibmvfc_init_tgt(wtgt, ibmvfc_tgt_move_login); + } + goto unlock_out; +@@ -5336,6 +5339,7 @@ static void ibmvfc_tgt_add_rport(struct ibmvfc_target *tgt) + tgt_dbg(tgt, "Deleting rport with outstanding I/O\n"); + ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_LOGOUT_DELETED_RPORT); + tgt->rport = NULL; ++ tgt->init_retries = 0; + spin_unlock_irqrestore(vhost->host->host_lock, flags); + fc_remote_port_delete(rport); + return; +@@ -5490,6 +5494,7 @@ static void ibmvfc_do_work(struct ibmvfc_host *vhost) + tgt_dbg(tgt, "Deleting rport with I/O outstanding\n"); + rport = tgt->rport; + tgt->rport = NULL; ++ tgt->init_retries = 0; + ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_LOGOUT_DELETED_RPORT); + + /* +-- +2.26.2 + diff --git a/patches.suse/serial-sh-sci-Fix-off-by-one-error-in-FIFO-threshold.patch b/patches.suse/serial-sh-sci-Fix-off-by-one-error-in-FIFO-threshold.patch new file mode 100644 index 0000000..d52df0f --- /dev/null +++ b/patches.suse/serial-sh-sci-Fix-off-by-one-error-in-FIFO-threshold.patch @@ -0,0 +1,55 @@ +From 2ea2e019c190ee3973ef7bcaf829d8762e56e635 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Mon, 10 May 2021 14:07:55 +0200 +Subject: [PATCH] serial: sh-sci: Fix off-by-one error in FIFO threshold register setting +Git-commit: 2ea2e019c190ee3973ef7bcaf829d8762e56e635 +Patch-mainline: v5.13-rc4 +References: git-fixes + +The Receive FIFO Data Count Trigger field (RTRG[6:0]) in the Receive +FIFO Data Count Trigger Register (HSRTRGR) of HSCIF can only hold values +ranging from 0-127. As the FIFO size is equal to 128 on HSCIF, the user +can write an out-of-range value, touching reserved bits. + +Fix this by limiting the trigger value to the FIFO size minus one. +Reverse the order of the checks, to avoid rx_trig becoming zero if the +FIFO size is one. + +Note that this change has no impact on other SCIF variants, as their +maximum supported trigger value is lower than the FIFO size anyway, and +the code below takes care of enforcing these limits. + +Fixes: a380ed461f66d1b8 ("serial: sh-sci: implement FIFO threshold register setting") +Reported-by: Linh Phung +Reviewed-by: Wolfram Sang +Reviewed-by: Ulrich Hecht +Signed-off-by: Geert Uytterhoeven +Cc: stable +Link: https://lore.kernel.org/r/5eff320aef92ffb33d00e57979fd3603bbb4a70f.1620648218.git.geert+renesas@glider.be +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/sh-sci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index ef37fdf37612..4baf1316ea72 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -1023,10 +1023,10 @@ static int scif_set_rtrg(struct uart_port *port, int rx_trig) + { + unsigned int bits; + ++ if (rx_trig >= port->fifosize) ++ rx_trig = port->fifosize - 1; + if (rx_trig < 1) + rx_trig = 1; +- if (rx_trig >= port->fifosize) +- rx_trig = port->fifosize; + + /* HSCIF can be set to an arbitrary level. */ + if (sci_getreg(port, HSRTRGR)->size) { +-- +2.26.2 + diff --git a/patches.suse/serial-stm32-fix-incorrect-characters-on-console.patch b/patches.suse/serial-stm32-fix-incorrect-characters-on-console.patch new file mode 100644 index 0000000..8a1a4e5 --- /dev/null +++ b/patches.suse/serial-stm32-fix-incorrect-characters-on-console.patch @@ -0,0 +1,54 @@ +From f264c6f6aece81a9f8fbdf912b20bd3feb476a7a Mon Sep 17 00:00:00 2001 +From: Erwan Le Ray +Date: Thu, 4 Mar 2021 17:22:58 +0100 +Subject: [PATCH] serial: stm32: fix incorrect characters on console +Git-commit: f264c6f6aece81a9f8fbdf912b20bd3feb476a7a +Patch-mainline: v5.13-rc1 +References: git-fixes + +Incorrect characters are observed on console during boot. This issue occurs +when init/main.c is modifying termios settings to open /dev/console on the +rootfs. + +This patch adds a waiting loop in set_termios to wait for TX shift register +empty (and TX FIFO if any) before stopping serial port. + +Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver") +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20210304162308.8984-4-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/stm32-usart.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -476,8 +476,9 @@ static void stm32_set_termios(struct uar + unsigned int baud; + u32 usartdiv, mantissa, fraction, oversampling; + tcflag_t cflag = termios->c_cflag; +- u32 cr1, cr2, cr3; ++ u32 cr1, cr2, cr3, isr; + unsigned long flags; ++ int ret; + + if (!stm32_port->hw_flow_control) + cflag &= ~CRTSCTS; +@@ -486,6 +487,15 @@ static void stm32_set_termios(struct uar + + spin_lock_irqsave(&port->lock, flags); + ++ ret = readl_relaxed_poll_timeout_atomic(port->membase + ofs->isr, ++ isr, ++ (isr & USART_SR_TC), ++ 10, 100000); ++ ++ /* Send the TC error message only when ISR_TC is not set. */ ++ if (ret) ++ dev_err(port->dev, "Transmission is not complete\n"); ++ + /* Stop serial port and reset value */ + writel_relaxed(0, port->membase + ofs->cr1); + diff --git a/patches.suse/spi-dln2-Fix-reference-leak-to-master.patch b/patches.suse/spi-dln2-Fix-reference-leak-to-master.patch new file mode 100644 index 0000000..b314452 --- /dev/null +++ b/patches.suse/spi-dln2-Fix-reference-leak-to-master.patch @@ -0,0 +1,40 @@ +From 9b844b087124c1538d05f40fda8a4fec75af55be Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Fri, 9 Apr 2021 08:29:55 +0000 +Subject: [PATCH] spi: dln2: Fix reference leak to master +Git-commit: 9b844b087124c1538d05f40fda8a4fec75af55be +Patch-mainline: v5.13-rc1 +References: git-fixes + +Call spi_master_get() holds the reference count to master device, thus +we need an additional spi_master_put() call to reduce the reference +count, otherwise we will leak a reference to master. + +This commit fix it by removing the unnecessary spi_master_get(). + +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Link: https://lore.kernel.org/r/20210409082955.2907950-1-weiyongjun1@huawei.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/spi/spi-dln2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-dln2.c b/drivers/spi/spi-dln2.c +index 3902eadb892f..3ff63ab82f4f 100644 +--- a/drivers/spi/spi-dln2.c ++++ b/drivers/spi/spi-dln2.c +@@ -781,7 +781,7 @@ static int dln2_spi_probe(struct platform_device *pdev) + + static int dln2_spi_remove(struct platform_device *pdev) + { +- struct spi_master *master = spi_master_get(platform_get_drvdata(pdev)); ++ struct spi_master *master = platform_get_drvdata(pdev); + struct dln2_spi *dln2 = spi_master_get_devdata(master); + + pm_runtime_disable(&pdev->dev); +-- +2.26.2 + diff --git a/patches.suse/spi-omap-100k-Fix-reference-leak-to-master.patch b/patches.suse/spi-omap-100k-Fix-reference-leak-to-master.patch new file mode 100644 index 0000000..f11057b --- /dev/null +++ b/patches.suse/spi-omap-100k-Fix-reference-leak-to-master.patch @@ -0,0 +1,58 @@ +From a23faea76d4cf5f75decb574491e66f9ecd707e7 Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Fri, 9 Apr 2021 08:29:54 +0000 +Subject: [PATCH] spi: omap-100k: Fix reference leak to master +Git-commit: a23faea76d4cf5f75decb574491e66f9ecd707e7 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Call spi_master_get() holds the reference count to master device, thus +we need an additional spi_master_put() call to reduce the reference +count, otherwise we will leak a reference to master. + +This commit fix it by removing the unnecessary spi_master_get(). + +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Link: https://lore.kernel.org/r/20210409082954.2906933-1-weiyongjun1@huawei.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/spi/spi-omap-100k.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-omap-100k.c b/drivers/spi/spi-omap-100k.c +index 189fd2dda37b..7062f2902253 100644 +--- a/drivers/spi/spi-omap-100k.c ++++ b/drivers/spi/spi-omap-100k.c +@@ -424,7 +424,7 @@ static int omap1_spi100k_probe(struct platform_device *pdev) + + static int omap1_spi100k_remove(struct platform_device *pdev) + { +- struct spi_master *master = spi_master_get(platform_get_drvdata(pdev)); ++ struct spi_master *master = platform_get_drvdata(pdev); + struct omap1_spi100k *spi100k = spi_master_get_devdata(master); + + pm_runtime_disable(&pdev->dev); +@@ -438,7 +438,7 @@ static int omap1_spi100k_remove(struct platform_device *pdev) + #ifdef CONFIG_PM + static int omap1_spi100k_runtime_suspend(struct device *dev) + { +- struct spi_master *master = spi_master_get(dev_get_drvdata(dev)); ++ struct spi_master *master = dev_get_drvdata(dev); + struct omap1_spi100k *spi100k = spi_master_get_devdata(master); + + clk_disable_unprepare(spi100k->ick); +@@ -449,7 +449,7 @@ static int omap1_spi100k_runtime_suspend(struct device *dev) + + static int omap1_spi100k_runtime_resume(struct device *dev) + { +- struct spi_master *master = spi_master_get(dev_get_drvdata(dev)); ++ struct spi_master *master = dev_get_drvdata(dev); + struct omap1_spi100k *spi100k = spi_master_get_devdata(master); + int ret; + +-- +2.26.2 + diff --git a/patches.suse/staging-emxx_udc-fix-loop-in-_nbu2ss_nuke.patch b/patches.suse/staging-emxx_udc-fix-loop-in-_nbu2ss_nuke.patch new file mode 100644 index 0000000..8a1e8b4 --- /dev/null +++ b/patches.suse/staging-emxx_udc-fix-loop-in-_nbu2ss_nuke.patch @@ -0,0 +1,49 @@ +From e0112a7c9e847ada15a631b88e279d547e8f26a7 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 19 May 2021 17:16:50 +0300 +Subject: [PATCH] staging: emxx_udc: fix loop in _nbu2ss_nuke() +Git-commit: e0112a7c9e847ada15a631b88e279d547e8f26a7 +Patch-mainline: v5.13-rc4 +References: git-fixes + +The _nbu2ss_ep_done() function calls: + + list_del_init(&req->queue); + +which means that the loop will never exit. + +Fixes: ca3d253eb967 ("Staging: emxx_udc: Iterate list using list_for_each_entry") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/YKUd0sDyjm/lkJfJ@mwanda +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/staging/emxx_udc/emxx_udc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/emxx_udc/emxx_udc.c b/drivers/staging/emxx_udc/emxx_udc.c +index 741147a4f0fe..ecc5c9da9027 100644 +--- a/drivers/staging/emxx_udc/emxx_udc.c ++++ b/drivers/staging/emxx_udc/emxx_udc.c +@@ -2064,7 +2064,7 @@ static int _nbu2ss_nuke(struct nbu2ss_udc *udc, + struct nbu2ss_ep *ep, + int status) + { +- struct nbu2ss_req *req; ++ struct nbu2ss_req *req, *n; + + /* Endpoint Disable */ + _nbu2ss_epn_exit(udc, ep); +@@ -2076,7 +2076,7 @@ static int _nbu2ss_nuke(struct nbu2ss_udc *udc, + return 0; + + /* called with irqs blocked */ +- list_for_each_entry(req, &ep->queue, queue) { ++ list_for_each_entry_safe(req, n, &ep->queue, queue) { + _nbu2ss_ep_done(ep, req, status); + } + +-- +2.26.2 + diff --git a/patches.suse/staging-iio-cdc-ad7746-avoid-overwrite-of-num_channe.patch b/patches.suse/staging-iio-cdc-ad7746-avoid-overwrite-of-num_channe.patch new file mode 100644 index 0000000..a07e487 --- /dev/null +++ b/patches.suse/staging-iio-cdc-ad7746-avoid-overwrite-of-num_channe.patch @@ -0,0 +1,38 @@ +From 04f5b9f539ce314f758d919a14dc7a669f3b7838 Mon Sep 17 00:00:00 2001 +From: Lucas Stankus +Date: Tue, 11 May 2021 17:54:18 -0300 +Subject: [PATCH] staging: iio: cdc: ad7746: avoid overwrite of num_channels +Git-commit: 04f5b9f539ce314f758d919a14dc7a669f3b7838 +Patch-mainline: v5.13-rc4 +References: git-fixes + +AD7745 devices don't have the CIN2 pins and therefore can't handle related +channels. Forcing the number of AD7746 channels may lead to enabling more +channels than what the hardware actually supports. +Avoid num_channels being overwritten after first assignment. + +Signed-off-by: Lucas Stankus +Fixes: 83e416f458d53 ("staging: iio: adc: Replace, rewrite ad7745 from scratch.") +Signed-off-by: Jonathan Cameron +Cc: +Acked-by: Takashi Iwai + +--- + drivers/staging/iio/cdc/ad7746.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/staging/iio/cdc/ad7746.c b/drivers/staging/iio/cdc/ad7746.c +index dfd71e99e872..eab534dc4bcc 100644 +--- a/drivers/staging/iio/cdc/ad7746.c ++++ b/drivers/staging/iio/cdc/ad7746.c +@@ -700,7 +700,6 @@ static int ad7746_probe(struct i2c_client *client, + indio_dev->num_channels = ARRAY_SIZE(ad7746_channels); + else + indio_dev->num_channels = ARRAY_SIZE(ad7746_channels) - 2; +- indio_dev->num_channels = ARRAY_SIZE(ad7746_channels); + indio_dev->modes = INDIO_DIRECT_MODE; + + if (pdata) { +-- +2.26.2 + diff --git a/patches.suse/thunderbolt-dma_port-Fix-NVM-read-buffer-bounds-and-.patch b/patches.suse/thunderbolt-dma_port-Fix-NVM-read-buffer-bounds-and-.patch new file mode 100644 index 0000000..1adc53a --- /dev/null +++ b/patches.suse/thunderbolt-dma_port-Fix-NVM-read-buffer-bounds-and-.patch @@ -0,0 +1,68 @@ +From b106776080a1cf953a1b2fd50cb2a995db4732be Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 27 Apr 2021 15:48:29 +0300 +Subject: [PATCH] thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue +Git-commit: b106776080a1cf953a1b2fd50cb2a995db4732be +Patch-mainline: v5.13-rc4 +References: git-fixes + +Up to 64 bytes of data can be read from NVM in one go. Read address +must be dword aligned. Data is read into a local buffer. + +If caller asks to read data starting at an unaligned address then full +dword is anyway read from NVM into a local buffer. Data is then copied +from the local buffer starting at the unaligned offset to the caller +buffer. + +In cases where asked data length + unaligned offset is over 64 bytes +we need to make sure we don't read past the 64 bytes in the local +buffer when copying to caller buffer, and make sure that we don't +skip copying unaligned offset bytes from local buffer anymore after +the first round of 64 byte NVM data read. + +Fixes: 3e13676862f9 ("thunderbolt: Add support for DMA configuration based mailbox") +Cc: stable@vger.kernel.org +Signed-off-by: Mathias Nyman +Signed-off-by: Mika Westerberg +Acked-by: Takashi Iwai + +--- + drivers/thunderbolt/dma_port.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/thunderbolt/dma_port.c b/drivers/thunderbolt/dma_port.c +index 7288aaf01ae6..5631319f7b20 100644 +--- a/drivers/thunderbolt/dma_port.c ++++ b/drivers/thunderbolt/dma_port.c +@@ -366,15 +366,15 @@ int dma_port_flash_read(struct tb_dma_port *dma, unsigned int address, + void *buf, size_t size) + { + unsigned int retries = DMA_PORT_RETRIES; +- unsigned int offset; +- +- offset = address & 3; +- address = address & ~3; + + do { +- u32 nbytes = min_t(u32, size, MAIL_DATA_DWORDS * 4); ++ unsigned int offset; ++ size_t nbytes; + int ret; + ++ offset = address & 3; ++ nbytes = min_t(size_t, size + offset, MAIL_DATA_DWORDS * 4); ++ + ret = dma_port_flash_read_block(dma, address, dma->buf, + ALIGN(nbytes, 4)); + if (ret) { +@@ -386,6 +386,7 @@ int dma_port_flash_read(struct tb_dma_port *dma, unsigned int address, + return ret; + } + ++ nbytes -= offset; + memcpy(buf, dma->buf + offset, nbytes); + + size -= nbytes; +-- +2.26.2 + diff --git a/patches.suse/tpm-fix-error-return-code-in-tpm2_get_cc_attrs_tbl.patch b/patches.suse/tpm-fix-error-return-code-in-tpm2_get_cc_attrs_tbl.patch new file mode 100644 index 0000000..6d5c536 --- /dev/null +++ b/patches.suse/tpm-fix-error-return-code-in-tpm2_get_cc_attrs_tbl.patch @@ -0,0 +1,41 @@ +From 1df83992d977355177810c2b711afc30546c81ce Mon Sep 17 00:00:00 2001 +From: Zhen Lei +Date: Wed, 12 May 2021 21:39:26 +0800 +Subject: [PATCH] tpm: fix error return code in tpm2_get_cc_attrs_tbl() +Git-commit: 1df83992d977355177810c2b711afc30546c81ce +Patch-mainline: v5.13-rc2 +References: git-fixes + +If the total number of commands queried through TPM2_CAP_COMMANDS is +different from that queried through TPM2_CC_GET_CAPABILITY, it indicates +an unknown error. In this case, an appropriate error code -EFAULT should +be returned. However, we currently do not explicitly assign this error +code to 'rc'. As a result, 0 was incorrectly returned. + +Cc: stable@vger.kernel.org +Fixes: 58472f5cd4f6("tpm: validate TPM 2.0 commands") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Acked-by: Takashi Iwai + +--- + drivers/char/tpm/tpm2-cmd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c +index eff1f12d981a..c84d23951219 100644 +--- a/drivers/char/tpm/tpm2-cmd.c ++++ b/drivers/char/tpm/tpm2-cmd.c +@@ -656,6 +656,7 @@ int tpm2_get_cc_attrs_tbl(struct tpm_chip *chip) + + if (nr_commands != + be32_to_cpup((__be32 *)&buf.data[TPM_HEADER_SIZE + 5])) { ++ rc = -EFAULT; + tpm_buf_destroy(&buf); + goto out; + } +-- +2.26.2 + diff --git a/patches.suse/usb-core-hub-fix-race-condition-about-TRSMRCY-of-res.patch b/patches.suse/usb-core-hub-fix-race-condition-about-TRSMRCY-of-res.patch new file mode 100644 index 0000000..4c21413 --- /dev/null +++ b/patches.suse/usb-core-hub-fix-race-condition-about-TRSMRCY-of-res.patch @@ -0,0 +1,50 @@ +From 975f94c7d6c306b833628baa9aec3f79db1eb3a1 Mon Sep 17 00:00:00 2001 +From: Chunfeng Yun +Date: Wed, 12 May 2021 10:07:38 +0800 +Subject: [PATCH] usb: core: hub: fix race condition about TRSMRCY of resume +Git-commit: 975f94c7d6c306b833628baa9aec3f79db1eb3a1 +References: git-fixes +Patch-mainline: v5.13-rc2 + +This may happen if the port becomes resume status exactly +when usb_port_resume() gets port status, it still need provide +a TRSMCRY time before access the device. + +CC: +Reported-by: Tianping Fang +Acked-by: Alan Stern +Signed-off-by: Chunfeng Yun +Link: https://lore.kernel.org/r/20210512020738.52961-1-chunfeng.yun@mediatek.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/core/hub.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index b2bc4b7c4289..fc7d6cdacf16 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -3642,9 +3642,6 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg) + * sequence. + */ + status = hub_port_status(hub, port1, &portstatus, &portchange); +- +- /* TRSMRCY = 10 msec */ +- msleep(10); + } + + SuspendCleared: +@@ -3659,6 +3656,9 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg) + usb_clear_port_feature(hub->hdev, port1, + USB_PORT_FEAT_C_SUSPEND); + } ++ ++ /* TRSMRCY = 10 msec */ ++ msleep(10); + } + + if (udev->persist_enabled) +-- +2.26.2 + diff --git a/patches.suse/usb-dwc3-omap-improve-extcon-initialization.patch b/patches.suse/usb-dwc3-omap-improve-extcon-initialization.patch new file mode 100644 index 0000000..f84bd63 --- /dev/null +++ b/patches.suse/usb-dwc3-omap-improve-extcon-initialization.patch @@ -0,0 +1,50 @@ +From e17b02d4970913233d543c79c9c66e72cac05bdd Mon Sep 17 00:00:00 2001 +From: Marcel Hamer +Date: Tue, 27 Apr 2021 14:21:18 +0200 +Subject: [PATCH] usb: dwc3: omap: improve extcon initialization +Git-commit: e17b02d4970913233d543c79c9c66e72cac05bdd +Patch-mainline: v5.13-rc2 +References: git-fixes + +When extcon is used in combination with dwc3, it is assumed that the dwc3 +registers are untouched and as such are only configured if VBUS is valid +or ID is tied to ground. + +In case VBUS is not valid or ID is floating, the registers are not +configured as such during driver initialization, causing a wrong +default state during boot. + +If the registers are not in a default state, because they are for +instance touched by a boot loader, this can cause for a kernel error. + +Signed-off-by: Marcel Hamer +Link: https://lore.kernel.org/r/20210427122118.1948340-1-marcel@solidxs.se +Cc: stable +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/dwc3/dwc3-omap.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c +index 3db17806e92e..e196673f5c64 100644 +--- a/drivers/usb/dwc3/dwc3-omap.c ++++ b/drivers/usb/dwc3/dwc3-omap.c +@@ -437,8 +437,13 @@ static int dwc3_omap_extcon_register(struct dwc3_omap *omap) + + if (extcon_get_state(edev, EXTCON_USB) == true) + dwc3_omap_set_mailbox(omap, OMAP_DWC3_VBUS_VALID); ++ else ++ dwc3_omap_set_mailbox(omap, OMAP_DWC3_VBUS_OFF); ++ + if (extcon_get_state(edev, EXTCON_USB_HOST) == true) + dwc3_omap_set_mailbox(omap, OMAP_DWC3_ID_GROUND); ++ else ++ dwc3_omap_set_mailbox(omap, OMAP_DWC3_ID_FLOAT); + + omap->edev = edev; + } +-- +2.26.2 + diff --git a/patches.suse/usb-fotg210-hcd-Fix-an-error-message.patch b/patches.suse/usb-fotg210-hcd-Fix-an-error-message.patch new file mode 100644 index 0000000..398f121 --- /dev/null +++ b/patches.suse/usb-fotg210-hcd-Fix-an-error-message.patch @@ -0,0 +1,53 @@ +From a60a34366e0d09ca002c966dd7c43a68c28b1f82 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Thu, 6 May 2021 22:39:10 +0200 +Subject: [PATCH] usb: fotg210-hcd: Fix an error message +Git-commit: a60a34366e0d09ca002c966dd7c43a68c28b1f82 +Patch-mainline: v5.13-rc2 +References: git-fixes + +'retval' is known to be -ENODEV here. +This is a hard-coded default error code which is not useful in the error +message. Moreover, another error message is printed at the end of the +error handling path. The corresponding error code (-ENOMEM) is more +informative. + +So remove simplify the first error message. + +While at it, also remove the useless initialization of 'retval'. + +Fixes: 7d50195f6c50 ("usb: host: Faraday fotg210-hcd driver") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/94531bcff98e46d4f9c20183a90b7f47f699126c.1620333419.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/fotg210-hcd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c +index 6cac642520fc..9c2eda0918e1 100644 +--- a/drivers/usb/host/fotg210-hcd.c ++++ b/drivers/usb/host/fotg210-hcd.c +@@ -5568,7 +5568,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev) + struct usb_hcd *hcd; + struct resource *res; + int irq; +- int retval = -ENODEV; ++ int retval; + struct fotg210_hcd *fotg210; + + if (usb_disabled()) +@@ -5588,7 +5588,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev) + hcd = usb_create_hcd(&fotg210_fotg210_hc_driver, dev, + dev_name(dev)); + if (!hcd) { +- dev_err(dev, "failed to create hcd with err %d\n", retval); ++ dev_err(dev, "failed to create hcd\n"); + retval = -ENOMEM; + goto fail_create_hcd; + } +-- +2.26.2 + diff --git a/patches.suse/usb-sl811-hcd-improve-misleading-indentation.patch b/patches.suse/usb-sl811-hcd-improve-misleading-indentation.patch new file mode 100644 index 0000000..7cdfdca --- /dev/null +++ b/patches.suse/usb-sl811-hcd-improve-misleading-indentation.patch @@ -0,0 +1,54 @@ +From 8460f6003a1d2633737b89c4f69d6f4c0c7c65a3 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 22 Mar 2021 17:42:26 +0100 +Subject: [PATCH] usb: sl811-hcd: improve misleading indentation +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 8460f6003a1d2633737b89c4f69d6f4c0c7c65a3 +Patch-mainline: v5.13-rc1 +References: git-fixes + +gcc-11 now warns about a confusingly indented code block: + +Drivers/usb/host/sl811-hcd.c: In function ‘sl811h_hub_control’: +drivers/usb/host/sl811-hcd.c:1291:9: error: this ‘if’ clause does not guard... [-Werror=misleading-indentation] + 1291 | if (*(u16*)(buf+2)) /* only if wPortChange is interesting */ + | ^~ +drivers/usb/host/sl811-hcd.c:1295:17: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the ‘if’ + 1295 | break; + +Rewrite this to use a single if() block with the __is_defined() macro. + +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20210322164244.827589-1-arnd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/sl811-hcd.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c +index d49fb656d34b..85623731a516 100644 +--- a/drivers/usb/host/sl811-hcd.c ++++ b/drivers/usb/host/sl811-hcd.c +@@ -1287,11 +1287,10 @@ sl811h_hub_control( + goto error; + put_unaligned_le32(sl811->port1, buf); + +-#ifndef VERBOSE +- if (*(u16*)(buf+2)) /* only if wPortChange is interesting */ +-#endif +- dev_dbg(hcd->self.controller, "GetPortStatus %08x\n", +- sl811->port1); ++ if (__is_defined(VERBOSE) || ++ *(u16*)(buf+2)) /* only if wPortChange is interesting */ ++ dev_dbg(hcd->self.controller, "GetPortStatus %08x\n", ++ sl811->port1); + break; + case SetPortFeature: + if (wIndex != 1 || wLength != 0) +-- +2.26.2 + diff --git a/patches.suse/usb-xhci-Fix-port-minor-revision.patch b/patches.suse/usb-xhci-Fix-port-minor-revision.patch new file mode 100644 index 0000000..5c4dc5a --- /dev/null +++ b/patches.suse/usb-xhci-Fix-port-minor-revision.patch @@ -0,0 +1,51 @@ +From 64364bc912c01b33bba6c22e3ccb849bfca96398 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Wed, 10 Mar 2021 19:43:21 -0800 +Subject: [PATCH] usb: xhci: Fix port minor revision +Git-commit: 64364bc912c01b33bba6c22e3ccb849bfca96398 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Some hosts incorrectly use sub-minor version for minor version (i.e. +0x02 instead of 0x20 for bcdUSB 0x320 and 0x01 for bcdUSB 0x310). +Currently the xHCI driver works around this by just checking for minor +revision > 0x01 for USB 3.1 everywhere. With the addition of USB 3.2, +checking this gets a bit cumbersome. Since there is no USB release with +bcdUSB 0x301 to 0x309, we can assume that sub-minor version 01 to 09 is +incorrect. Let's try to fix this and use the minor revision that matches +with the USB/xHCI spec to help with the version checking within the +driver. + +Acked-by: Mathias Nyman +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/ed330e95a19dc367819c5b4d78bf7a541c35aa0a.1615432770.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/xhci-mem.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 7eb8c07c8418..34d95c006751 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -2129,6 +2129,15 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports, + + if (major_revision == 0x03) { + rhub = &xhci->usb3_rhub; ++ /* ++ * Some hosts incorrectly use sub-minor version for minor ++ * version (i.e. 0x02 instead of 0x20 for bcdUSB 0x320 and 0x01 ++ * for bcdUSB 0x310). Since there is no USB release with sub ++ * minor version 0x301 to 0x309, we can assume that they are ++ * incorrect and fix it here. ++ */ ++ if (minor_revision > 0x00 && minor_revision < 0x10) ++ minor_revision <<= 4; + } else if (major_revision <= 0x02) { + rhub = &xhci->usb2_rhub; + } else { +-- +2.26.2 + diff --git a/patches.suse/usb-xhci-Increase-timeout-for-HC-halt.patch b/patches.suse/usb-xhci-Increase-timeout-for-HC-halt.patch new file mode 100644 index 0000000..0cfa8ae --- /dev/null +++ b/patches.suse/usb-xhci-Increase-timeout-for-HC-halt.patch @@ -0,0 +1,38 @@ +From ca09b1bea63ab83f4cca3a2ae8bc4f597ec28851 Mon Sep 17 00:00:00 2001 +From: Maximilian Luz +Date: Wed, 12 May 2021 11:08:15 +0300 +Subject: [PATCH] usb: xhci: Increase timeout for HC halt +Git-commit: ca09b1bea63ab83f4cca3a2ae8bc4f597ec28851 +References: git-fixes +Patch-mainline: v5.13-rc2 + +On some devices (specifically the SC8180x based Surface Pro X with +QCOM04A6) HC halt / xhci_halt() times out during boot. Manually binding +the xhci-hcd driver at some point later does not exhibit this behavior. +To work around this, double XHCI_MAX_HALT_USEC, which also resolves this +issue. + +Cc: +Signed-off-by: Maximilian Luz +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20210512080816.866037-5-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/host/xhci-ext-caps.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-ext-caps.h ++++ b/drivers/usb/host/xhci-ext-caps.h +@@ -19,8 +19,9 @@ + * along with this program; if not, write to the Free Software Foundation, + * Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ +-/* Up to 16 ms to halt an HC */ +-#define XHCI_MAX_HALT_USEC (16*1000) ++ ++/* HC should halt within 16 ms, but use 32 ms as some hosts take longer */ ++#define XHCI_MAX_HALT_USEC (32 * 1000) + /* HC not running - set to 1 when run/stop bit is cleared. */ + #define XHCI_STS_HALT (1<<0) + diff --git a/patches.suse/vgacon-Record-video-mode-changes-with-VT_RESIZEX.patch b/patches.suse/vgacon-Record-video-mode-changes-with-VT_RESIZEX.patch new file mode 100644 index 0000000..689931d --- /dev/null +++ b/patches.suse/vgacon-Record-video-mode-changes-with-VT_RESIZEX.patch @@ -0,0 +1,70 @@ +From d4d0ad57b3865795c4cde2fb5094c594c2e8f469 Mon Sep 17 00:00:00 2001 +From: "Maciej W. Rozycki" +Date: Thu, 13 May 2021 11:51:41 +0200 +Subject: [PATCH] vgacon: Record video mode changes with VT_RESIZEX +Git-commit: d4d0ad57b3865795c4cde2fb5094c594c2e8f469 +Patch-mainline: v5.13-rc2 +References: git-fixes + +Fix an issue with VGA console font size changes made after the initial +video text mode has been changed with a user tool like `svgatextmode' +calling the VT_RESIZEX ioctl. As it stands in that case the original +screen geometry continues being used to validate further VT resizing. + +Consequently when the video adapter is firstly reprogrammed from the +original say 80x25 text mode using a 9x16 character cell (720x400 pixel +resolution) to say 80x37 text mode and the same character cell (720x592 +pixel resolution), and secondly the CRTC character cell updated to 9x8 +(by loading a suitable font with the KD_FONT_OP_SET request of the +KDFONTOP ioctl), the VT geometry does not get further updated from 80x37 +and only upper half of the screen is used for the VT, with the lower +half showing rubbish corresponding to whatever happens to be there in +the video memory that maps to that part of the screen. Of course the +proportions change according to text mode geometries and font sizes +chosen. + +Address the problem then, by updating the text mode geometry defaults +rather than checking against them whenever the VT is resized via a user +ioctl. + +Signed-off-by: Maciej W. Rozycki +Fixes: e400b6ec4ede ("vt/vgacon: Check if screen resize request comes from userspace") +Cc: stable@vger.kernel.org # v2.6.24+ +Signed-off-by: Linus Torvalds +Acked-by: Takashi Iwai + +--- + drivers/video/console/vgacon.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c +index 962c12be9774..511e7d06b148 100644 +--- a/drivers/video/console/vgacon.c ++++ b/drivers/video/console/vgacon.c +@@ -1089,12 +1089,20 @@ static int vgacon_resize(struct vc_data *c, unsigned int width, + if ((width << 1) * height > vga_vram_size) + return -EINVAL; + ++ if (user) { ++ /* ++ * Ho ho! Someone (svgatextmode, eh?) may have reprogrammed ++ * the video mode! Set the new defaults then and go away. ++ */ ++ screen_info.orig_video_cols = width; ++ screen_info.orig_video_lines = height; ++ vga_default_font_height = c->vc_font.height; ++ return 0; ++ } + if (width % 2 || width > screen_info.orig_video_cols || + height > (screen_info.orig_video_lines * vga_default_font_height)/ + c->vc_font.height) +- /* let svgatextmode tinker with video timings and +- return success */ +- return (user) ? 0 : -EINVAL; ++ return -EINVAL; + + if (con_is_visible(c) && !vga_is_gfx) /* who knows */ + vgacon_doresize(c, width, height); +-- +2.26.2 + diff --git a/patches.suse/vsock-vmci-log-once-the-failed-queue-pair-allocation.patch b/patches.suse/vsock-vmci-log-once-the-failed-queue-pair-allocation.patch new file mode 100644 index 0000000..14ee658 --- /dev/null +++ b/patches.suse/vsock-vmci-log-once-the-failed-queue-pair-allocation.patch @@ -0,0 +1,50 @@ +From e16edc99d658cd41c60a44cc14d170697aa3271f Mon Sep 17 00:00:00 2001 +From: Stefano Garzarella +Date: Fri, 16 Apr 2021 12:44:16 +0200 +Subject: [PATCH] vsock/vmci: log once the failed queue pair allocation +Git-commit: e16edc99d658cd41c60a44cc14d170697aa3271f +Patch-mainline: v5.13-rc1 +References: git-fixes + +VMCI feature is not supported in conjunction with the vSphere Fault +Tolerance (FT) feature. + +VMware Tools can repeatedly try to create a vsock connection. If FT is +enabled the kernel logs is flooded with the following messages: + + qp_alloc_hypercall result = -20 + Could not attach to queue pair with -20 + +"qp_alloc_hypercall result = -20" was hidden by commit e8266c4c3307 +("vmci: Stop log spew when qp allocation isn't possible"), but "Could +not attach to queue pair with -20" is still there flooding the log. + +Since the error message can be useful in some cases, print it only once. + +Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") +Signed-off-by: Stefano Garzarella +Reviewed-by: Jorgen Hansen +Signed-off-by: David S. Miller +Acked-by: Takashi Iwai + +--- + net/vmw_vsock/vmci_transport.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index 8b65323207db..1c9ecb18b8e6 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -568,8 +568,7 @@ vmci_transport_queue_pair_alloc(struct vmci_qp **qpair, + peer, flags, VMCI_NO_PRIVILEGE_FLAGS); + out: + if (err < 0) { +- pr_err("Could not attach to queue pair with %d\n", +- err); ++ pr_err_once("Could not attach to queue pair with %d\n", err); + err = vmci_transport_error_to_vsock_error(err); + } + +-- +2.26.2 + diff --git a/patches.suse/wl3501_cs-Fix-out-of-bounds-warnings-in-wl3501_mgmt_.patch b/patches.suse/wl3501_cs-Fix-out-of-bounds-warnings-in-wl3501_mgmt_.patch new file mode 100644 index 0000000..de036d8 --- /dev/null +++ b/patches.suse/wl3501_cs-Fix-out-of-bounds-warnings-in-wl3501_mgmt_.patch @@ -0,0 +1,286 @@ +From bb43e5718d8f1b46e7a77e7b39be3c691f293050 Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Wed, 14 Apr 2021 18:45:15 -0500 +Subject: [PATCH] wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join +Git-commit: bb43e5718d8f1b46e7a77e7b39be3c691f293050 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Fix the following out-of-bounds warnings by adding a new structure +wl3501_req instead of duplicating the same members in structure +wl3501_join_req and wl3501_scan_confirm: + +arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [39, 108] from the object at 'sig' is out of the bounds of referenced subobject 'beacon_period' with type 'short unsigned int' at offset 36 [-Warray-bounds] +arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [25, 95] from the object at 'sig' is out of the bounds of referenced subobject 'beacon_period' with type 'short unsigned int' at offset 22 [-Warray-bounds] + +Refactor the code, accordingly: + +$ pahole -C wl3501_req drivers/net/wireless/wl3501_cs.o +struct wl3501_req { + u16 beacon_period; /* 0 2 */ + u16 dtim_period; /* 2 2 */ + u16 cap_info; /* 4 2 */ + u8 bss_type; /* 6 1 */ + u8 bssid[6]; /* 7 6 */ + struct iw_mgmt_essid_pset ssid; /* 13 34 */ + struct iw_mgmt_ds_pset ds_pset; /* 47 3 */ + struct iw_mgmt_cf_pset cf_pset; /* 50 8 */ + struct iw_mgmt_ibss_pset ibss_pset; /* 58 4 */ + struct iw_mgmt_data_rset bss_basic_rset; /* 62 10 */ + + /* size: 72, cachelines: 2, members: 10 */ + /* last cacheline: 8 bytes */ +}; + +$ pahole -C wl3501_join_req drivers/net/wireless/wl3501_cs.o +struct wl3501_join_req { + u16 next_blk; /* 0 2 */ + u8 sig_id; /* 2 1 */ + u8 reserved; /* 3 1 */ + struct iw_mgmt_data_rset operational_rset; /* 4 10 */ + u16 reserved2; /* 14 2 */ + u16 timeout; /* 16 2 */ + u16 probe_delay; /* 18 2 */ + u8 timestamp[8]; /* 20 8 */ + u8 local_time[8]; /* 28 8 */ + struct wl3501_req req; /* 36 72 */ + + /* size: 108, cachelines: 2, members: 10 */ + /* last cacheline: 44 bytes */ +}; + +$ pahole -C wl3501_scan_confirm drivers/net/wireless/wl3501_cs.o +struct wl3501_scan_confirm { + u16 next_blk; /* 0 2 */ + u8 sig_id; /* 2 1 */ + u8 reserved; /* 3 1 */ + u16 status; /* 4 2 */ + char timestamp[8]; /* 6 8 */ + char localtime[8]; /* 14 8 */ + struct wl3501_req req; /* 22 72 */ + /* --- cacheline 1 boundary (64 bytes) was 30 bytes ago --- */ + u8 rssi; /* 94 1 */ + + /* size: 96, cachelines: 2, members: 8 */ + /* padding: 1 */ + /* last cacheline: 32 bytes */ +}; + +The problem is that the original code is trying to copy data into a +bunch of struct members adjacent to each other in a single call to +memcpy(). Now that a new struct wl3501_req enclosing all those adjacent +members is introduced, memcpy() doesn't overrun the length of +&sig.beacon_period and &this->bss_set[i].beacon_period, because the +address of the new struct object _req_ is used as the destination, +instead. + +This helps with the ongoing efforts to globally enable -Warray-bounds +and get us closer to being able to tighten the FORTIFY_SOURCE routines +on memcpy(). + +Link: https://github.com/KSPP/linux/issues/109 +Reported-by: kernel test robot +Signed-off-by: Gustavo A. R. Silva +Reviewed-by: Kees Cook +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1fbaf516da763b50edac47d792a9145aa4482e29.1618442265.git.gustavoars@kernel.org +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/wl3501.h | 35 +++++++++++-------------- + drivers/net/wireless/wl3501_cs.c | 44 +++++++++++++++++--------------- + 2 files changed, 38 insertions(+), 41 deletions(-) + +diff --git a/drivers/net/wireless/wl3501.h b/drivers/net/wireless/wl3501.h +index 8c5480bec104..91f276dd22a1 100644 +--- a/drivers/net/wireless/wl3501.h ++++ b/drivers/net/wireless/wl3501.h +@@ -379,16 +379,7 @@ struct wl3501_get_confirm { + u8 mib_value[100]; + }; + +-struct wl3501_join_req { +- u16 next_blk; +- u8 sig_id; +- u8 reserved; +- struct iw_mgmt_data_rset operational_rset; +- u16 reserved2; +- u16 timeout; +- u16 probe_delay; +- u8 timestamp[8]; +- u8 local_time[8]; ++struct wl3501_req { + u16 beacon_period; + u16 dtim_period; + u16 cap_info; +@@ -401,6 +392,19 @@ struct wl3501_join_req { + struct iw_mgmt_data_rset bss_basic_rset; + }; + ++struct wl3501_join_req { ++ u16 next_blk; ++ u8 sig_id; ++ u8 reserved; ++ struct iw_mgmt_data_rset operational_rset; ++ u16 reserved2; ++ u16 timeout; ++ u16 probe_delay; ++ u8 timestamp[8]; ++ u8 local_time[8]; ++ struct wl3501_req req; ++}; ++ + struct wl3501_join_confirm { + u16 next_blk; + u8 sig_id; +@@ -443,16 +447,7 @@ struct wl3501_scan_confirm { + u16 status; + char timestamp[8]; + char localtime[8]; +- u16 beacon_period; +- u16 dtim_period; +- u16 cap_info; +- u8 bss_type; +- u8 bssid[ETH_ALEN]; +- struct iw_mgmt_essid_pset ssid; +- struct iw_mgmt_ds_pset ds_pset; +- struct iw_mgmt_cf_pset cf_pset; +- struct iw_mgmt_ibss_pset ibss_pset; +- struct iw_mgmt_data_rset bss_basic_rset; ++ struct wl3501_req req; + u8 rssi; + }; + +diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c +index 70307308635f..672f5d5f3f2c 100644 +--- a/drivers/net/wireless/wl3501_cs.c ++++ b/drivers/net/wireless/wl3501_cs.c +@@ -590,7 +590,7 @@ static int wl3501_mgmt_join(struct wl3501_card *this, u16 stas) + struct wl3501_join_req sig = { + .sig_id = WL3501_SIG_JOIN_REQ, + .timeout = 10, +- .ds_pset = { ++ .req.ds_pset = { + .el = { + .id = IW_MGMT_INFO_ELEMENT_DS_PARAMETER_SET, + .len = 1, +@@ -599,7 +599,7 @@ static int wl3501_mgmt_join(struct wl3501_card *this, u16 stas) + }, + }; + +- memcpy(&sig.beacon_period, &this->bss_set[stas].beacon_period, 72); ++ memcpy(&sig.req, &this->bss_set[stas].req, sizeof(sig.req)); + return wl3501_esbq_exec(this, &sig, sizeof(sig)); + } + +@@ -667,35 +667,37 @@ static void wl3501_mgmt_scan_confirm(struct wl3501_card *this, u16 addr) + if (sig.status == WL3501_STATUS_SUCCESS) { + pr_debug("success"); + if ((this->net_type == IW_MODE_INFRA && +- (sig.cap_info & WL3501_MGMT_CAPABILITY_ESS)) || ++ (sig.req.cap_info & WL3501_MGMT_CAPABILITY_ESS)) || + (this->net_type == IW_MODE_ADHOC && +- (sig.cap_info & WL3501_MGMT_CAPABILITY_IBSS)) || ++ (sig.req.cap_info & WL3501_MGMT_CAPABILITY_IBSS)) || + this->net_type == IW_MODE_AUTO) { + if (!this->essid.el.len) + matchflag = 1; + else if (this->essid.el.len == 3 && + !memcmp(this->essid.essid, "ANY", 3)) + matchflag = 1; +- else if (this->essid.el.len != sig.ssid.el.len) ++ else if (this->essid.el.len != sig.req.ssid.el.len) + matchflag = 0; +- else if (memcmp(this->essid.essid, sig.ssid.essid, ++ else if (memcmp(this->essid.essid, sig.req.ssid.essid, + this->essid.el.len)) + matchflag = 0; + else + matchflag = 1; + if (matchflag) { + for (i = 0; i < this->bss_cnt; i++) { +- if (ether_addr_equal_unaligned(this->bss_set[i].bssid, sig.bssid)) { ++ if (ether_addr_equal_unaligned(this->bss_set[i].req.bssid, ++ sig.req.bssid)) { + matchflag = 0; + break; + } + } + } + if (matchflag && (i < 20)) { +- memcpy(&this->bss_set[i].beacon_period, +- &sig.beacon_period, 73); ++ memcpy(&this->bss_set[i].req, ++ &sig.req, sizeof(sig.req)); + this->bss_cnt++; + this->rssi = sig.rssi; ++ this->bss_set[i].rssi = sig.rssi; + } + } + } else if (sig.status == WL3501_STATUS_TIMEOUT) { +@@ -887,19 +889,19 @@ static void wl3501_mgmt_join_confirm(struct net_device *dev, u16 addr) + if (this->join_sta_bss < this->bss_cnt) { + const int i = this->join_sta_bss; + memcpy(this->bssid, +- this->bss_set[i].bssid, ETH_ALEN); +- this->chan = this->bss_set[i].ds_pset.chan; ++ this->bss_set[i].req.bssid, ETH_ALEN); ++ this->chan = this->bss_set[i].req.ds_pset.chan; + iw_copy_mgmt_info_element(&this->keep_essid.el, +- &this->bss_set[i].ssid.el); ++ &this->bss_set[i].req.ssid.el); + wl3501_mgmt_auth(this); + } + } else { + const int i = this->join_sta_bss; + +- memcpy(&this->bssid, &this->bss_set[i].bssid, ETH_ALEN); +- this->chan = this->bss_set[i].ds_pset.chan; ++ memcpy(&this->bssid, &this->bss_set[i].req.bssid, ETH_ALEN); ++ this->chan = this->bss_set[i].req.ds_pset.chan; + iw_copy_mgmt_info_element(&this->keep_essid.el, +- &this->bss_set[i].ssid.el); ++ &this->bss_set[i].req.ssid.el); + wl3501_online(dev); + } + } else { +@@ -1573,30 +1575,30 @@ static int wl3501_get_scan(struct net_device *dev, struct iw_request_info *info, + for (i = 0; i < this->bss_cnt; ++i) { + iwe.cmd = SIOCGIWAP; + iwe.u.ap_addr.sa_family = ARPHRD_ETHER; +- memcpy(iwe.u.ap_addr.sa_data, this->bss_set[i].bssid, ETH_ALEN); ++ memcpy(iwe.u.ap_addr.sa_data, this->bss_set[i].req.bssid, ETH_ALEN); + current_ev = iwe_stream_add_event(info, current_ev, + extra + IW_SCAN_MAX_DATA, + &iwe, IW_EV_ADDR_LEN); + iwe.cmd = SIOCGIWESSID; + iwe.u.data.flags = 1; +- iwe.u.data.length = this->bss_set[i].ssid.el.len; ++ iwe.u.data.length = this->bss_set[i].req.ssid.el.len; + current_ev = iwe_stream_add_point(info, current_ev, + extra + IW_SCAN_MAX_DATA, + &iwe, +- this->bss_set[i].ssid.essid); ++ this->bss_set[i].req.ssid.essid); + iwe.cmd = SIOCGIWMODE; +- iwe.u.mode = this->bss_set[i].bss_type; ++ iwe.u.mode = this->bss_set[i].req.bss_type; + current_ev = iwe_stream_add_event(info, current_ev, + extra + IW_SCAN_MAX_DATA, + &iwe, IW_EV_UINT_LEN); + iwe.cmd = SIOCGIWFREQ; +- iwe.u.freq.m = this->bss_set[i].ds_pset.chan; ++ iwe.u.freq.m = this->bss_set[i].req.ds_pset.chan; + iwe.u.freq.e = 0; + current_ev = iwe_stream_add_event(info, current_ev, + extra + IW_SCAN_MAX_DATA, + &iwe, IW_EV_FREQ_LEN); + iwe.cmd = SIOCGIWENCODE; +- if (this->bss_set[i].cap_info & WL3501_MGMT_CAPABILITY_PRIVACY) ++ if (this->bss_set[i].req.cap_info & WL3501_MGMT_CAPABILITY_PRIVACY) + iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY; + else + iwe.u.data.flags = IW_ENCODE_DISABLED; +-- +2.26.2 + diff --git a/patches.suse/wl3501_cs-Fix-out-of-bounds-warnings-in-wl3501_send_.patch b/patches.suse/wl3501_cs-Fix-out-of-bounds-warnings-in-wl3501_send_.patch new file mode 100644 index 0000000..a172e30 --- /dev/null +++ b/patches.suse/wl3501_cs-Fix-out-of-bounds-warnings-in-wl3501_send_.patch @@ -0,0 +1,147 @@ +From 820aa37638a252b57967bdf4038a514b1ab85d45 Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Wed, 14 Apr 2021 18:43:19 -0500 +Subject: [PATCH] wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt +Git-commit: 820aa37638a252b57967bdf4038a514b1ab85d45 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Fix the following out-of-bounds warnings by enclosing structure members +daddr and saddr into new struct addr, in structures wl3501_md_req and +Wl3501_md_ind: + +arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [18, 23] from the object at 'sig' is out of the bounds of referenced subobject 'daddr' with type 'u8[6]' {aka 'unsigned char[6]'} at offset 11 [-Warray-bounds] +arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [18, 23] from the object at 'sig' is out of the bounds of referenced subobject 'daddr' with type 'u8[6]' {aka 'unsigned char[6]'} at offset 11 [-Warray-bounds] + +Refactor the code, accordingly: + +$ pahole -C wl3501_md_req drivers/net/wireless/wl3501_cs.o +struct wl3501_md_req { + u16 next_blk; /* 0 2 */ + u8 sig_id; /* 2 1 */ + u8 routing; /* 3 1 */ + u16 data; /* 4 2 */ + u16 size; /* 6 2 */ + u8 pri; /* 8 1 */ + u8 service_class; /* 9 1 */ + struct { + u8 daddr[6]; /* 10 6 */ + u8 saddr[6]; /* 16 6 */ + } addr; /* 10 12 */ + + /* size: 22, cachelines: 1, members: 8 */ + /* last cacheline: 22 bytes */ +}; + +$ pahole -C wl3501_md_ind drivers/net/wireless/wl3501_cs.o +struct wl3501_md_ind { + u16 next_blk; /* 0 2 */ + u8 sig_id; /* 2 1 */ + u8 routing; /* 3 1 */ + u16 data; /* 4 2 */ + u16 size; /* 6 2 */ + u8 reception; /* 8 1 */ + u8 pri; /* 9 1 */ + u8 service_class; /* 10 1 */ + struct { + u8 daddr[6]; /* 11 6 */ + u8 saddr[6]; /* 17 6 */ + } addr; /* 11 12 */ + + /* size: 24, cachelines: 1, members: 9 */ + /* padding: 1 */ + /* last cacheline: 24 bytes */ +}; + +The problem is that the original code is trying to copy data into a +couple of arrays adjacent to each other in a single call to memcpy(). +Now that a new struct _addr_ enclosing those two adjacent arrays +is introduced, memcpy() doesn't overrun the length of &sig.daddr[0] +and &sig.daddr, because the address of the new struct object _addr_ +is used, instead. + +This helps with the ongoing efforts to globally enable -Warray-bounds +and get us closer to being able to tighten the FORTIFY_SOURCE routines +on memcpy(). + +Link: https://github.com/KSPP/linux/issues/109 +Reported-by: kernel test robot +Reviewed-by: Kees Cook +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/d260fe56aed7112bff2be5b4d152d03ad7b78e78.1618442265.git.gustavoars@kernel.org +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/wl3501.h | 12 ++++++++---- + drivers/net/wireless/wl3501_cs.c | 10 ++++++---- + 2 files changed, 14 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/wl3501.h b/drivers/net/wireless/wl3501.h +index 5779ffbe5d0f..8c5480bec104 100644 +--- a/drivers/net/wireless/wl3501.h ++++ b/drivers/net/wireless/wl3501.h +@@ -471,8 +471,10 @@ struct wl3501_md_req { + u16 size; + u8 pri; + u8 service_class; +- u8 daddr[ETH_ALEN]; +- u8 saddr[ETH_ALEN]; ++ struct { ++ u8 daddr[ETH_ALEN]; ++ u8 saddr[ETH_ALEN]; ++ } addr; + }; + + struct wl3501_md_ind { +@@ -484,8 +486,10 @@ struct wl3501_md_ind { + u8 reception; + u8 pri; + u8 service_class; +- u8 daddr[ETH_ALEN]; +- u8 saddr[ETH_ALEN]; ++ struct { ++ u8 daddr[ETH_ALEN]; ++ u8 saddr[ETH_ALEN]; ++ } addr; + }; + + struct wl3501_md_confirm { +diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c +index 8ca5789c7b37..70307308635f 100644 +--- a/drivers/net/wireless/wl3501_cs.c ++++ b/drivers/net/wireless/wl3501_cs.c +@@ -469,6 +469,7 @@ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len) + struct wl3501_md_req sig = { + .sig_id = WL3501_SIG_MD_REQ, + }; ++ size_t sig_addr_len = sizeof(sig.addr); + u8 *pdata = (char *)data; + int rc = -EIO; + +@@ -484,9 +485,9 @@ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len) + goto out; + } + rc = 0; +- memcpy(&sig.daddr[0], pdata, 12); +- pktlen = len - 12; +- pdata += 12; ++ memcpy(&sig.addr, pdata, sig_addr_len); ++ pktlen = len - sig_addr_len; ++ pdata += sig_addr_len; + sig.data = bf; + if (((*pdata) * 256 + (*(pdata + 1))) > 1500) { + u8 addr4[ETH_ALEN] = { +@@ -980,7 +981,8 @@ static inline void wl3501_md_ind_interrupt(struct net_device *dev, + } else { + skb->dev = dev; + skb_reserve(skb, 2); /* IP headers on 16 bytes boundaries */ +- skb_copy_to_linear_data(skb, (unsigned char *)&sig.daddr, 12); ++ skb_copy_to_linear_data(skb, (unsigned char *)&sig.addr, ++ sizeof(sig.addr)); + wl3501_receive(this, skb->data, pkt_len); + skb_put(skb, pkt_len); + skb->protocol = eth_type_trans(skb, dev); +-- +2.26.2 + diff --git a/patches.suse/xhci-Do-not-use-GFP_KERNEL-in-potentially-atomic-con.patch b/patches.suse/xhci-Do-not-use-GFP_KERNEL-in-potentially-atomic-con.patch new file mode 100644 index 0000000..cc83122 --- /dev/null +++ b/patches.suse/xhci-Do-not-use-GFP_KERNEL-in-potentially-atomic-con.patch @@ -0,0 +1,58 @@ +From dda32c00c9a0fa103b5d54ef72c477b7aa993679 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Wed, 12 May 2021 11:08:14 +0300 +Subject: [PATCH] xhci: Do not use GFP_KERNEL in (potentially) atomic context +Git-commit: dda32c00c9a0fa103b5d54ef72c477b7aa993679 +References: git-fixes +Patch-mainline: v5.13-rc2 + +'xhci_urb_enqueue()' is passed a 'mem_flags' argument, because "URBs may be +submitted in interrupt context" (see comment related to 'usb_submit_urb()' +in 'drivers/usb/core/urb.c') + +So this flag should be used in all the calling chain. +Up to now, 'xhci_check_maxpacket()' which is only called from +'xhci_urb_enqueue()', uses GFP_KERNEL. + +Be safe and pass the mem_flags to this function as well. + +Fixes: ddba5cd0aeff ("xhci: Use command structures when queuing commands on the command ring") +Cc: +Signed-off-by: Christophe JAILLET +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20210512080816.866037-4-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/host/xhci.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1386,7 +1386,7 @@ static int xhci_configure_endpoint(struc + * we need to issue an evaluate context command and wait on it. + */ + static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id, +- unsigned int ep_index, struct urb *urb) ++ unsigned int ep_index, struct urb *urb, gfp_t mem_flags) + { + struct xhci_container_ctx *out_ctx; + struct xhci_input_control_ctx *ctrl_ctx; +@@ -1417,7 +1417,7 @@ static int xhci_check_maxpacket(struct x + * changes max packet sizes. + */ + +- command = xhci_alloc_command(xhci, false, true, GFP_KERNEL); ++ command = xhci_alloc_command(xhci, false, true, mem_flags); + if (!command) + return -ENOMEM; + +@@ -1508,7 +1508,7 @@ static int xhci_urb_enqueue(struct usb_h + */ + if (urb->dev->speed == USB_SPEED_FULL) { + ret = xhci_check_maxpacket(xhci, slot_id, +- ep_index, urb); ++ ep_index, urb, mem_flags); + if (ret < 0) { + xhci_urb_free_priv(urb_priv); + urb->hcpriv = NULL; diff --git a/series.conf b/series.conf index cbc8dcc..2d6a5fc 100644 --- a/series.conf +++ b/series.conf @@ -33966,6 +33966,8 @@ patches.suse/mm-pkeys-x86-powerpc-Display-pkey-in-smaps-if-arch-s.patch patches.suse/powerpc-pkeys-Drop-private-VM_PKEY-definitions.patch patches.suse/powerpc-powernv-ioda2-Remove-redundant-free-of-TCE-p.patch + patches.suse/powerpc-64-remove-start_tb-and-accum_tb-from-thread_.patch + patches.suse/powerpc-pseries-lparcfg-calculate-PURR-on-demand.patch patches.suse/powerpc-mm-hugetlb-Update-huge_ptep_set_access_flags.patch patches.suse/powerpc-mm-radix-Move-function-from-radix.h-to-pgtab.patch patches.suse/powerpc-mm-Change-function-prototype.patch @@ -52619,6 +52621,7 @@ patches.suse/drm-edid-Add-6-bpc-quirk-for-SDC-panel-in-Lenovo-G50.patch patches.suse/0001-drm-msm-dsi-Implement-reset-correctly.patch patches.suse/PCI-PM-Fix-pci_power_up.patch + patches.suse/cpufreq-Avoid-cpufreq_suspend-deadlock-on-system-shu.patch patches.suse/ACPI-CPPC-Set-pcc_data-pcc_ss_id-to-NULL-in-acpi_cpp.patch patches.suse/ALSA-hda-realtek-Reduce-the-Headphone-static-noise-o.patch patches.suse/ALSA-usb-audio-Disable-quirks-for-BOSS-Katana-amplif.patch @@ -53160,6 +53163,7 @@ patches.suse/futex-Prevent-robust-futex-exit-race.patch patches.suse/cpuidle-Do-not-unset-the-driver-if-it-is-there-alrea.patch patches.suse/cpufreq-powernv-fix-stack-bloat-and-hard-limit-on-nu.patch + patches.suse/cpufreq-Add-NULL-checks-to-show-and-store-methods-of.patch patches.suse/cpufreq-s3c64xx-Remove-pointless-NULL-check-in-s3c64.patch patches.suse/cpufreq-Register-drivers-only-after-CPU-devices-have.patch patches.suse/PM-devfreq-Check-NULL-governor-in-available_governor.patch @@ -55986,6 +55990,7 @@ patches.suse/staging-rtl8712-Fix-IEEE80211_ADDBA_PARAM_BUF_SIZE_M.patch patches.suse/drivers-base-Fix-NULL-pointer-exception-in-__platfor.patch patches.suse/drivers-char-tlclk.c-Avoid-data-race-between-init-an.patch + patches.suse/msft-hv-2080-uio_hv_generic-add-missed-sysfs_remove_bin_file.patch patches.suse/fpga-dfl-afu-Corrected-error-handling-levels.patch patches.suse/dev-mem-Revoke-mappings-when-a-driver-claims-the-reg.patch patches.suse/w1-omap-hdq-cleanup-to-add-missing-newline-for-some-.patch @@ -56923,6 +56928,7 @@ patches.suse/ibmvnic-fix-NULL-tx_pools-and-rx_tools-issue-at-do_r.patch patches.suse/bnxt_en-Don-t-query-FW-when-netif_running-is-false.patch patches.suse/bnxt_en-Check-for-zero-dir-entries-in-NVRAM.patch + patches.suse/bnxt_en-Fix-PCI-AER-error-recovery-flow.patch patches.suse/bnxt_en-fix-HWRM-error-when-querying-VF-temperature.patch patches.suse/net-hns3-Fix-for-geneve-tx-checksum-bug.patch patches.suse/net-disable-netpoll-on-fresh-napis.patch @@ -57044,6 +57050,7 @@ patches.suse/ieee802154-adf7242-check-status-of-adf7242_read_reg.patch patches.suse/mac802154-tx-fix-use-after-free.patch patches.suse/ip-fix-tos-reflection-in-ack-and-reset-packets.patch + patches.suse/net-qed-RDMA-personality-shouldn-t-fail-VF-load.patch patches.suse/tipc-fix-shutdown-of-connection-oriented-socket.patch patches.suse/hdlc_ppp-add-range-checks-in-ppp_cp_parse_cr.patch patches.suse/s390-qeth-delay-draining-the-tx-buffers @@ -57377,6 +57384,7 @@ patches.suse/Bluetooth-A2MP-Fix-not-initializing-all-members.patch patches.suse/Bluetooth-L2CAP-Fix-calling-sk_filter-on-non-socket-.patch patches.suse/Bluetooth-MGMT-Fix-not-checking-if-BT_HS-is-enabled.patch + patches.suse/net-enic-Cure-the-enic-api-locking-trainwreck.patch patches.suse/nl80211-fix-non-split-wiphy-information.patch patches.suse/iwlwifi-mvm-split-a-print-to-avoid-a-WARNING-in-ROC.patch patches.suse/can-softing-softing_card_shutdown-add-braces-around-.patch @@ -57882,6 +57890,7 @@ patches.suse/serial-8250_omap-Avoid-FIFO-corruption-caused-by-MDR.patch patches.suse/misc-vmw_vmci-fix-kernel-info-leak-by-initializing-d.patch patches.suse/bus-fsl-mc-fix-error-return-code-in-fsl_mc_object_al.patch + patches.suse/msft-hv-2197-uio-uio_hv_generic-use-devm_kzalloc-for-private-data.patch patches.suse/extcon-max77693-Fix-modalias-string.patch patches.suse/iio-buffer-Fix-demux-update.patch patches.suse/iio-imu-bmi160-Fix-too-large-a-buffer.patch @@ -58192,6 +58201,8 @@ patches.suse/futex_Use_pi_state_update_owner__in_put_pi_state_.patch patches.suse/futex_Simplify_fixup_pi_state_owner_.patch patches.suse/futex-Handle-faults-correctly-for-PI-futexes.patch + patches.suse/NFC-fix-possible-resource-leak.patch + patches.suse/NFC-fix-resource-leak-when-target-index-is-invalid.patch patches.suse/igc-fix-link-speed-advertising.patch patches.suse/can-dev-prevent-potential-information-leak-in-can_fi.patch patches.suse/ibmvnic-Ensure-that-CRQ-entry-read-are-correctly-ord.patch @@ -58595,6 +58606,7 @@ patches.suse/bpf-Refactor-and-streamline-bounds-check-into-helper.patch patches.suse/bpf-Move-sanitize_val_alu-out-of-op-switch.patch patches.suse/bpf-Tighten-speculative-pointer-arithmetic-mask.patch + patches.suse/ARM-footbridge-fix-PCI-interrupt-mapping.patch patches.suse/pinctrl-lewisburg-Update-number-of-pins-in-community.patch patches.suse/x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch patches.suse/locking-qrwlock-Fix-ordering-in-queued_write_lock_sl.patch @@ -58604,15 +58616,28 @@ patches.suse/crypto-qat-Fix-a-double-free-in-adf_create_ring.patch patches.suse/x86-microcode-check-for-offline-cpus-before-requesting-new-microcode.patch patches.suse/genirq-Reduce-irqdebug-cacheline-bouncing.patch + patches.suse/msft-hv-2305-Drivers-hv-vmbus-Use-after-free-in-__vmbus_open.patch + patches.suse/msft-hv-2310-Drivers-hv-vmbus-Initialize-unload_event-statically.patch + patches.suse/msft-hv-2311-Drivers-hv-vmbus-Increase-wait-time-for-VMbus-unload.patch + patches.suse/msft-hv-2312-video-hyperv_fb-Add-ratelimit-on-error-message.patch + patches.suse/platform-x86-thinkpad_acpi-Correct-thermal-sensor-al.patch patches.suse/platform-x86-pmc_atom-Match-all-Beckhoff-Automation-.patch patches.suse/misc-lis3lv02d-Fix-false-positive-WARN-on-various-HP.patch patches.suse/misc-vmw_vmci-explicitly-initialize-vmci_notify_bm_s.patch patches.suse/misc-vmw_vmci-explicitly-initialize-vmci_datagram-pa.patch patches.suse/phy-marvell-ARMADA375_USBCLUSTER_PHY-should-not-defa.patch + patches.suse/fbdev-zero-fill-colormap-in-fbcmap.c.patch + patches.suse/intel_th-Consistency-and-off-by-one-fix.patch + patches.suse/phy-phy-twl4030-usb-Fix-possible-use-after-free-in-t.patch patches.suse/bluetooth-eliminate-the-potential-race-condition-whe.patch patches.suse/staging-rtl8192u-Fix-potential-infinite-loop.patch + patches.suse/serial-stm32-fix-incorrect-characters-on-console.patch patches.suse/usb-typec-tcpci-Check-ROLE_CONTROL-while-interpretin.patch + patches.suse/usb-sl811-hcd-improve-misleading-indentation.patch + patches.suse/usb-xhci-Fix-port-minor-revision.patch + patches.suse/USB-Add-LPM-quirk-for-Lenovo-ThinkPad-USB-C-Dock-Gen.patch patches.suse/usb-dwc3-gadget-Fix-START_TRANSFER-link-state-check.patch + patches.suse/USB-Add-reset-resume-quirk-for-WD19-s-Realtek-Hub.patch patches.suse/USB-CDC-ACM-fix-poison-unpoison-imbalance.patch patches.suse/USB-serial-usb_wwan-fix-unprivileged-TIOCCSERIAL.patch patches.suse/USB-serial-fix-return-value-for-unsupported-ioctls.patch @@ -58625,14 +58650,27 @@ patches.suse/clk-mvebu-armada-37xx-periph-Fix-switching-CPU-freq-.patch patches.suse/clk-mvebu-armada-37xx-periph-Fix-workaround-for-swit.patch patches.suse/cpufreq-Kconfig-fix-documentation-links.patch + patches.suse/PCI-PM-Do-not-read-power-state-in-pci_enable_device_.patch patches.suse/mtd-require-write-permissions-for-locking-and-badblo.patch patches.suse/spi-spi-ti-qspi-Free-DMA-resources.patch + patches.suse/spi-dln2-Fix-reference-leak-to-master.patch + patches.suse/spi-omap-100k-Fix-reference-leak-to-master.patch + patches.suse/media-ite-cir-check-for-receive-overflow.patch patches.suse/media-omap4iss-return-error-code-when-omap4iss_get-f.patch + patches.suse/media-media-saa7164-fix-saa7164_encoder_register-mem.patch + patches.suse/media-gspca-sq905.c-fix-uninitialized-variable.patch patches.suse/media-m88rs6000t-avoid-potential-out-of-bounds-reads.patch patches.suse/media-dvbdev-Fix-memory-leak-in-dvb_media_device_fre.patch + patches.suse/media-em28xx-fix-memory-leak.patch + patches.suse/media-adv7604-fix-possible-use-after-free-in-adv76xx.patch + patches.suse/media-i2c-adv7842-fix-possible-use-after-free-in-adv.patch + patches.suse/media-dvb-usb-fix-memory-leak-in-dvb_usb_adapter_ini.patch patches.suse/drm-radeon-fix-copy-of-uninitialized-variable-back-t.patch + patches.suse/drm-amdgpu-Fix-asic-reset-regression-issue-introduce.patch patches.suse/drm-amdkfd-fix-build-error-with-AMD_IOMMU_V2-m.patch patches.suse/drm-omap-fix-misleading-indentation-in-pixinc.patch + patches.suse/drm-amdgpu-fix-NULL-pointer-dereference.patch + patches.suse/drm-msm-mdp5-Configure-PP_SYNC_HEIGHT-to-double-the-.patch patches.suse/kernel-smp-add-boot-parameter-for-controlling-CSD.patch patches.suse/kernel-smp-prepare-more-CSD-lock-debugging.patch patches.suse/kernel-smp-add-more-data-to-CSD-lock-debugging.patch @@ -58646,8 +58684,15 @@ patches.suse/pata_ipx4xx_cf-fix-IRQ-check.patch patches.suse/sata_mv-add-IRQ-checks.patch patches.suse/ata-libahci_platform-fix-IRQ-check.patch + patches.suse/power-supply-Use-IRQF_ONESHOT.patch + patches.suse/power-supply-generic-adc-battery-fix-possible-use-af.patch + patches.suse/power-supply-s3c_adc_battery-fix-possible-use-after-.patch + patches.suse/mmc-core-Do-a-power-cycle-when-the-CMD11-fails.patch + patches.suse/mmc-core-Set-read-only-for-SD-cards-with-permanent-w.patch patches.suse/mmc-core-Correct-descriptions-in-mmc_of_parse.patch patches.suse/mmc-mmc_spi-Drop-unused-NO_IRQ-definition.patch + patches.suse/mmc-block-Update-ext_csd.cache_ctrl-if-it-was-writte.patch + patches.suse/extcon-arizona-Fix-some-issues-when-HPDET-IRQ-fires-.patch patches.suse/mfd-stm32-timers-Avoid-clearing-auto-reload-register.patch patches.suse/mfd-lpc_sch-Partially-revert-Add-support-for-Intel-Q.patch patches.suse/backlight-journada720-Fix-Wmisleading-indentation-wa.patch @@ -58735,7 +58780,10 @@ patches.suse/nfc-pn533-prevent-potential-memory-corruption.patch patches.suse/ibmvnic-Use-skb_frag_address-instead-of-hand-coding-.patch patches.suse/liquidio-Fix-unintented-sign-extension-of-a-left-shi.patch + patches.suse/Bluetooth-SMP-Fail-if-remote-and-local-public-keys-a.patch + patches.suse/Bluetooth-Set-CONF_NOT_COMPLETE-as-l2cap_chan-defaul.patch patches.suse/Bluetooth-verify-AMP-hci_chan-before-amp_destroy.patch + patches.suse/Bluetooth-initialize-skb_queue_head-at-l2cap_chan_cr.patch patches.suse/cxgb4-Fix-unintentional-sign-extension-issues.patch patches.suse/net-thunderx-Fix-unintentional-sign-extension-issue.patch patches.suse/ibmvnic-clean-up-the-remaining-debugfs-data-structur.patch @@ -58746,9 +58794,15 @@ patches.suse/ibmvnic-queue-reset-work-in-system_long_wq.patch patches.suse/rtlwifi-8821ae-upgrade-PHY-and-RF-parameters.patch patches.suse/ipw2x00-potential-buffer-overflow-in-libipw_wx_set_e.patch + patches.suse/mac80211-clear-the-beacon-s-CRC-after-channel-switch.patch patches.suse/mac80211-bail-out-if-cipher-schemes-are-invalid.patch + patches.suse/cfg80211-scan-drop-entry-from-hidden_list-on-overflo.patch patches.suse/ath9k-Fix-error-check-in-ath9k_hw_read_revisions-for.patch + patches.suse/wl3501_cs-Fix-out-of-bounds-warnings-in-wl3501_send_.patch + patches.suse/wl3501_cs-Fix-out-of-bounds-warnings-in-wl3501_mgmt_.patch patches.suse/net-xdp-Update-pkt_type-if-generic-XDP-changes-unica.patch + patches.suse/vsock-vmci-log-once-the-failed-queue-pair-allocation.patch + patches.suse/net-phy-intel-xway-enable-integrated-led-functions.patch patches.suse/bnxt_en-fix-ternary-sign-extension-bug-in-bnxt_show_.patch patches.suse/powerpc-fadump-Mark-fadump_calculate_reserve_size-as.patch patches.suse/powerpc-prom-Mark-identical_pvr_fixup-as-__init.patch @@ -58759,13 +58813,30 @@ patches.suse/powerpc-pseries-extract-host-bridge-from-pci_bus-pri.patch patches.suse/powerpc-pseries-Add-shutdown-to-vio_driver-and-vio_b.patch patches.suse/drm-i915-gvt-Fix-error-code-in-intel_gvt_init_device.patch + patches.suse/ALSA-hdsp-don-t-disable-if-not-enabled.patch + patches.suse/ALSA-hdspm-don-t-disable-if-not-enabled.patch + patches.suse/ALSA-rme9652-don-t-disable-if-not-enabled.patch patches.suse/ALSA-core-remove-redundant-spin_lock-pair-in-snd_car.patch patches.suse/ALSA-usb-audio-Add-error-checks-for-usb_driver_claim.patch + patches.suse/ALSA-usb-audio-Add-MIDI-quirk-for-Vox-ToneLab-EX.patch patches.suse/ALSA-usb-midi-don-t-return-ENOMEM-when-usb_urb_ep_ty.patch + patches.suse/ALSA-emu8000-Fix-a-use-after-free-in-snd_emu8000_cre.patch + patches.suse/ASoC-rt286-Make-RT286_SET_GPIO_-readable-and-writabl.patch + patches.suse/ASoC-rt286-Generalize-support-for-ALC3263-codec.patch + patches.suse/ALSA-sb-Fix-two-use-after-free-in-snd_sb_qsound_buil.patch + patches.suse/ALSA-hda-realtek-Re-order-ALC882-Acer-quirk-table-en.patch + patches.suse/ALSA-hda-realtek-Re-order-ALC882-Sony-quirk-table-en.patch + patches.suse/ALSA-hda-realtek-Re-order-ALC269-Sony-quirk-table-en.patch + patches.suse/ALSA-hda-realtek-Re-order-ALC269-Lenovo-quirk-table-.patch + patches.suse/ALSA-hda-realtek-Remove-redundant-entry-for-ALC861-H.patch + patches.suse/ALSA-hda-conexant-Re-order-CX5066-quirk-table-entrie.patch patches.suse/HID-plantronics-Workaround-for-double-volume-key-pre.patch patches.suse/i2c-cadence-add-IRQ-check.patch patches.suse/i2c-emev2-add-IRQ-check.patch patches.suse/i2c-jz4780-add-IRQ-check.patch + patches.suse/i2c-sh7760-add-IRQ-check.patch + patches.suse/i2c-sh7760-fix-IRQ-error-path.patch + patches.suse/pinctrl-samsung-use-int-for-register-masks-in-Exynos.patch patches.suse/pinctrl-core-Fix-kernel-doc-string-for-pin_get_name.patch patches.suse/RDMA-hns-Delete-redundant-condition-judgment-related.patch patches.suse/RDMA-srpt-Fix-error-return-code-in-srpt_cm_req_recv.patch @@ -58777,9 +58848,16 @@ patches.suse/rtc-ds1307-Fix-wday-settings-for-rx8130.patch patches.suse/docs-kernel-parameters-Move-gpio-mockup-for-alphabet.patch patches.suse/docs-kernel-parameters-Add-gpio_mockup_named_lines.patch + patches.suse/gpiolib-acpi-Add-quirk-to-ignore-EC-wakeups-on-Dell-.patch patches.suse/thermal-drivers-ti-soc-thermal-bandgap-Remove-unused.patch patches.suse/PCI-Release-OF-node-in-pci_scan_device-s-error-path.patch + patches.suse/ACPI-hotplug-PCI-Fix-reference-count-leak-in-enable_.patch + patches.suse/ACPI-custom_method-fix-potential-use-after-free-issu.patch + patches.suse/ACPI-custom_method-fix-a-possible-memory-leak.patch patches.suse/ftrace-handle-commands-when-closing-set_ftrace_filter-file.patch + patches.suse/Input-elants_i2c-do-not-bind-to-i2c-hid-compatible-A.patch + patches.suse/Input-silead-add-workaround-for-x86-BIOS-es-which-br.patch + patches.suse/ACPI-GTDT-Don-t-corrupt-interrupt-mappings-on-watchd.patch patches.suse/net-hns3-fix-incorrect-configuration-for-igu_egu_hw_.patch patches.suse/net-hns3-initialize-the-message-content-in-hclge_get.patch patches.suse/net-hns3-add-check-for-HNS3_NIC_STATE_INITED-in-hns3.patch @@ -58800,14 +58878,53 @@ patches.suse/scsi-lpfc-Fix-DMA-virtual-address-ptr-assignment-in-.patch patches.suse/scsi-lpfc-Fix-bad-memory-access-during-VPD-DUMP-mail.patch patches.suse/scsi-qla2xxx-Prevent-PRLI-in-target-mode.patch + patches.suse/drm-radeon-Fix-off-by-one-power_state-index-heap-ove.patch + patches.suse/tpm-fix-error-return-code-in-tpm2_get_cc_attrs_tbl.patch + patches.suse/vgacon-Record-video-mode-changes-with-VT_RESIZEX.patch + patches.suse/drm-radeon-dpm-Disable-sclk-switching-on-Oland-when-.patch patches.suse/powerpc-64s-Fix-crashes-when-toggling-stf-barrier.patch + patches.suse/usb-dwc3-omap-improve-extcon-initialization.patch + patches.suse/usb-fotg210-hcd-Fix-an-error-message.patch + patches.suse/xhci-Do-not-use-GFP_KERNEL-in-potentially-atomic-con.patch + patches.suse/usb-xhci-Increase-timeout-for-HC-halt.patch + patches.suse/usb-core-hub-fix-race-condition-about-TRSMRCY-of-res.patch + patches.suse/iio-proximity-pulsedlight-Fix-rumtime-PM-imbalance-o.patch + patches.suse/iio-gyro-mpu3050-Fix-reported-temperature-value.patch + patches.suse/iio-tsl2583-Fix-division-by-a-zero-lux_val.patch + patches.suse/Revert-leds-lp5523-fix-a-missing-check-of-return-val.patch + patches.suse/leds-lp5523-check-return-value-of-lp5xx_read-and-jum.patch + patches.suse/msft-hv-2316-uio_hv_generic-Fix-a-memory-leak-in-error-handling-p.patch + patches.suse/msft-hv-2317-uio_hv_generic-Fix-another-memory-leak-in-error-hand.patch + patches.suse/platform-mellanox-mlxbf-tmfifo-Fix-a-memory-barrier-.patch + patches.suse/ALSA-hda-realtek-reset-eapd-coeff-to-default-value-f.patch + patches.suse/ALSA-bebob-oxfw-fix-Kconfig-entry-for-Mackie-d.2-Pro.patch + patches.suse/ALSA-line6-Fix-racy-initialization-of-LINE6-MIDI.patch + patches.suse/gpio-xilinx-Correct-kernel-doc-for-xgpio_probe.patch patches.suse/nvme-fc-clear-q_live-at-beginning-of-association-tea.patch + patches.suse/NFC-nci-fix-memory-leak-in-nci_allocate_device.patch + patches.suse/net-usb-fix-memory-leak-in-smsc75xx_bind.patch patches.suse/bpf-Wrap-aux-data-inside-bpf_sanitize_info-container.patch patches.suse/bpf-Fix-mask-direction-swap-upon-off-reg-sign-change.patch + patches.suse/ASoC-cs42l42-Regmap-must-use_single_read-write.patch + patches.suse/ASoC-cs35l33-fix-an-error-code-in-probe.patch + patches.suse/drm-meson-fix-shutdown-crash-when-component-not-prob.patch + patches.suse/misc-uss720-fix-memory-leak-in-uss720_probe.patch + patches.suse/USB-trancevibrator-fix-control-request-direction.patch + patches.suse/thunderbolt-dma_port-Fix-NVM-read-buffer-bounds-and-.patch + patches.suse/serial-sh-sci-Fix-off-by-one-error-in-FIFO-threshold.patch + patches.suse/staging-emxx_udc-fix-loop-in-_nbu2ss_nuke.patch + patches.suse/staging-iio-cdc-ad7746-avoid-overwrite-of-num_channe.patch + patches.suse/iio-adc-ad7793-Add-missing-error-code-in-ad7793_setu.patch + patches.suse/i2c-i801-Don-t-generate-an-interrupt-on-bus-reset.patch + patches.suse/i2c-s3c2410-fix-possible-NULL-pointer-deref-on-read-.patch # netdev/net-next patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch + # jejb/scsi for-next + patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch + patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch + # dhowells/linux-fs keys-uefi patches.suse/0001-KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch patches.suse/0003-efi-Add-an-EFI-signature-blob-parser.patch @@ -58827,6 +58944,10 @@ patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch + patches.suse/scsi-ibmvfc-Reinit-target-retries.patch + + # git://github.com/cminyard/linux-ipmi.git for-next + patches.suse/ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch # out-of-tree patches patches.suse/net-mvpp2-fix-condition-for-setting-up-link-interrup.patch @@ -58859,6 +58980,7 @@ patches.suse/proc-Avoid-mixing-integer-types-in-mem_rw.patch patches.suse/netfilter-conntrack-improve-RST-handling-when-tuple-.patch patches.suse/netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch + patches.kabi/kABI-powerpc-64-add-back-start_tb-and-accum_tb-to-th.patch ######################################################## # end of sorted patches @@ -59245,6 +59367,9 @@ patches.suse/sunrpc-svcauth_gss_register_pseudoflavor-must-reject.patch patches.suse/sunrpc-clean-up-properly-in-gss_mech_unregister.patch patches.suse/NFS-only-invalidate-dentrys-that-are-clearly-invalid.patch + patches.suse/SUNRPC-in-case-of-backlog-hand-free-slots-directly-t.patch + patches.suse/SUNRPC-More-fixes-for-backlog-congestion.patch + patches.suse/NFSv4-Replace-closed-stateids-with-the-invalid-speci.patch ######################################################## # Overlayfs @@ -59863,5 +59988,4 @@ +bsc1094575 patches.suse/s390-qeth-use-Read-device-to-query-hypervisor-for-MA.patch patches.suse/v2-0004-xen-netback-fix-spurious-event-detection-for-comm.patch - patches.suse/NFSv4-Replace-closed-stateids-with-the-invalid-speci.patch patches.suse/ACPICA-Enable-sleep-button-on-ACPI-legacy-wake.patch