6.5.2-rc1 review

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lang Yu <[email protected]>

commit 6f38bdb86a056707b9ecb09e3b44adedc8e8d8a0 upstream.

Align with new vmhub definition.

v2: use client_id == VMC to decide vmhub(Hawking)

---
 drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c |    4 +++-
 drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c |    4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

@@ -109,9 +109,11 @@ static int gmc_v10_0_process_interrupt(s
 				       struct amdgpu_irq_src *source,
 				       struct amdgpu_iv_entry *entry)
 {
+	uint32_t vmhub_index = entry->client_id == SOC15_IH_CLIENTID_VMC ?
+			       AMDGPU_MMHUB0(0) : AMDGPU_GFXHUB(0);
+	struct amdgpu_vmhub *hub = &adev->vmhub[vmhub_index];
 	bool retry_fault = !!(entry->src_data[1] & 0x80);
 	bool write_fault = !!(entry->src_data[1] & 0x20);
-	struct amdgpu_vmhub *hub = &adev->vmhub[entry->vmid_src];
 	struct amdgpu_task_info task_info;
 	uint32_t status = 0;
 	u64 addr;

@@ -97,7 +97,9 @@ static int gmc_v11_0_process_interrupt(s
 				       struct amdgpu_irq_src *source,
 				       struct amdgpu_iv_entry *entry)
 {
-	struct amdgpu_vmhub *hub = &adev->vmhub[entry->vmid_src];
+	uint32_t vmhub_index = entry->client_id == SOC21_IH_CLIENTID_VMC ?
+			       AMDGPU_MMHUB0(0) : AMDGPU_GFXHUB(0);
+	struct amdgpu_vmhub *hub = &adev->vmhub[vmhub_index];
 	uint32_t status = 0;
 	u64 addr;
 

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christoph Hellwig <[email protected]>

commit 95e7ebc6823170256a8ce19fad87912805bfa001 upstream.

ds1685_rtc_poweroff is only used externally via symbol_get, which was only ever intended for very internal symbols like this one. Use EXPORT_SYMBOL_GPL for it so that symbol_get can enforce only being used on EXPORT_SYMBOL_GPL symbols.

---
 drivers/rtc/rtc-ds1685.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -1432,7 +1432,7 @@ ds1685_rtc_poweroff(struct platform_devi
 		unreachable();
 	}
 }
-EXPORT_SYMBOL(ds1685_rtc_poweroff);
+EXPORT_SYMBOL_GPL(ds1685_rtc_poweroff);
 /* ----------------------------------------------------------------------- */
 
 

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christoph Hellwig <[email protected]>

commit 9011e49d54dcc7653ebb8a1e05b5badb5ecfa9f9 upstream.

It has recently come to my attention that nvidia is circumventing the protection added in 262e6ae7081d ("modules: inherit TAINT_PROPRIETARY_MODULE") by importing exports from their proprietary modules into an allegedly GPL licensed module and then rexporting them.

Given that symbol_get was only ever intended for tightly cooperating modules using very internal symbols it is logical to restrict it to being used on EXPORT_SYMBOL_GPL and prevent nvidia from costly DMCA Circumvention of Access Controls law suites.

All symbols except for four used through symbol_get were already exported as EXPORT_SYMBOL_GPL, and the remaining four ones were switched over in the preparation patches.

---
 kernel/module/main.c |   14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

@@ -1295,12 +1295,20 @@ void *__symbol_get(const char *symbol)
 	};
 
 	preempt_disable();
-	if (!find_symbol(&fsa) || strong_try_module_get(fsa.owner)) {
-		preempt_enable();
-		return NULL;
+	if (!find_symbol(&fsa))
+		goto fail;
+	if (fsa.license != GPL_ONLY) {
+		pr_warn("failing symbol_get of non-GPLONLY symbol %s.\n",
+			symbol);
+		goto fail;
 	}
+	if (strong_try_module_get(fsa.owner))
+		goto fail;
 	preempt_enable();
 	return (void *)kernel_symbol_value(fsa.sym);
+fail:
+	preempt_enable();
+	return NULL;
 }
 EXPORT_SYMBOL_GPL(__symbol_get);
 

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Martin Kohn <[email protected]>

commit 873854c02364ebb991fc06f7148c14dfb5419e1b upstream.

Add Quectel EM05G with product ID 0x030e.
Interface 4 is used for qmi.

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=2c7c ProdID=030e Rev= 3.18
S:  Manufacturer=Quectel
S:  Product=Quectel EM05-G
C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=85(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=87(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E:  Ad=89(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
E:  Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

---
 drivers/usb/serial/option.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -259,6 +259,7 @@ static void option_instat_callback(struc
 #define QUECTEL_PRODUCT_EM05G			0x030a
 #define QUECTEL_PRODUCT_EM060K			0x030b
 #define QUECTEL_PRODUCT_EM05G_CS		0x030c
+#define QUECTEL_PRODUCT_EM05GV2			0x030e
 #define QUECTEL_PRODUCT_EM05CN_SG		0x0310
 #define QUECTEL_PRODUCT_EM05G_SG		0x0311
 #define QUECTEL_PRODUCT_EM05CN			0x0312

@@ -1188,6 +1189,8 @@ static const struct usb_device_id option
 	  .driver_info = RSVD(6) | ZLP },
 	{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff),
 	  .driver_info = RSVD(6) | ZLP },
+	{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05GV2, 0xff),
+	  .driver_info = RSVD(4) | ZLP },
 	{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_CS, 0xff),
 	  .driver_info = RSVD(6) | ZLP },
 	{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_GR, 0xff),

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Slark Xiao <[email protected]>

commit 4d9488b294e1f8353bbcadc4c7172a7f7490199b upstream.

The difference of T99W368 and T99W373 is the chip solution. T99W368 is designed based on Qualcomm SDX65 and T99W373 is SDX62.

Test evidence as below:

T:  Bus=01 Lev=02 Prnt=05 Port=00 Cnt=01 Dev#=  7 Spd=480 MxCh= 0
D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0489 ProdID=e0f0 Rev=05.04
S:  Manufacturer=FII
S:  Product=OLYMPIC USB WWAN Adapter
S:  SerialNumber=78ada8c4
C:  #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
I:  If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
I:  If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
I:  If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
I:  If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option

T:  Bus=01 Lev=02 Prnt=05 Port=00 Cnt=01 Dev#=  8 Spd=480 MxCh= 0
D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0489 ProdID=e0ee Rev=05.04
S:  Manufacturer=FII
S:  Product=OLYMPIC USB WWAN Adapter
S:  SerialNumber=78ada8d5
C:  #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
I:  If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
I:  If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
I:  If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
I:  If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option

Both of them share the same port configuration:
0&1: MBIM, 2: Modem, 3:GNSS, 4:NMEA, 5:Diag
GNSS port don't use serial driver.

---
 drivers/usb/serial/option.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -2235,6 +2235,10 @@ static const struct usb_device_id option
 	  .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff),			/* Foxconn T99W265 MBIM */
 	  .driver_info = RSVD(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0ee, 0xff),			/* Foxconn T99W368 MBIM */
+	  .driver_info = RSVD(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff),			/* Foxconn T99W373 MBIM */
+	  .driver_info = RSVD(3) },
 	{ USB_DEVICE(0x1508, 0x1001),						/* Fibocom NL668 (IOT version) */
 	  .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
 	{ USB_DEVICE(0x1782, 0x4d10) },						/* Fibocom L610 (AT mode) */

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email protected]>

commit 5fadc941d07530d681f3b7ec91e56d8445bc3825 upstream.

There have been reports of USB-audio driver spewing errors at the probe time on a few devices like Jabra and Logitech. The suggested fix there couldn't be applied as is, unfortunately, because it'll likely break other devices.

But, the patch suggested an interesting point: looking at the current init code in stream.c, one may notice that it does initialize differently from the device setup in endpoint.c. Namely, for UAC1, we should call snd_usb_init_pitch() and snd_usb_init_sample_rate() after setting the interface, while the init sequence at parsing calls them before setting the interface blindly.

This patch changes the init sequence at parsing for UAC1 (and other devices that need a similar behavior) to be aligned with the rest of the code, setting the interface at first. And, this fixes the long-standing problems on a few UAC1 devices like Jabra / Logitech, as reported, too.

---
 sound/usb/stream.c |   11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

@@ -1093,6 +1093,7 @@ static int __snd_usb_parse_audio_interfa
 	int i, altno, err, stream;
 	struct audioformat *fp = NULL;
 	struct snd_usb_power_domain *pd = NULL;
+	bool set_iface_first;
 	int num, protocol;
 
 	dev = chip->dev;

@@ -1223,11 +1224,19 @@ static int __snd_usb_parse_audio_interfa
 				return err;
 		}
 
+		set_iface_first = false;
+		if (protocol == UAC_VERSION_1 ||
+		    (chip->quirk_flags & QUIRK_FLAG_SET_IFACE_FIRST))
+			set_iface_first = true;
+
 		/* try to set the interface... */
 		usb_set_interface(chip->dev, iface_no, 0);
+		if (set_iface_first)
+			usb_set_interface(chip->dev, iface_no, altno);
 		snd_usb_init_pitch(chip, fp);
 		snd_usb_init_sample_rate(chip, fp, fp->rate_max);
-		usb_set_interface(chip->dev, iface_no, altno);
+		if (!set_iface_first)
+			usb_set_interface(chip->dev, iface_no, altno);
 	}
 	return 0;
 }

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Luke Lu <[email protected]>

commit 1fa206bb764f37d2ab4bf671e483153ef0659b34 upstream.

Device connected to usb otg port of GXL-based boards can not be recognised after resumption, doesn't recover even if disconnect and reconnect the device. dmesg shows it disconnects during resumption.

[   41.492911] usb 1-2: USB disconnect, device number 3
[   41.499346] usb 1-2: unregistering device
[   41.511939] usb 1-2: unregistering interface 1-2:1.0

Calling usb_post_init() will fix this issue, and it's tested and verified on libretech's aml-s905x-cc board.

---
 drivers/usb/dwc3/dwc3-meson-g12a.c |    6 ++++++
 1 file changed, 6 insertions(+)

@@ -926,6 +926,12 @@ static int __maybe_unused dwc3_meson_g12
 			return ret;
 	}
 
+	if (priv->drvdata->usb_post_init) {
+		ret = priv->drvdata->usb_post_init(priv);
+		if (ret)
+			return ret;
+	}
+
 	return 0;
 }
 

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xu Yang <[email protected]>

commit 36668515d56bf73f06765c71e08c8f7465f1e5c4 upstream.

In current driver, the value of tuning parameter will not take effect if samsung,picophy-* is assigned as 0. Because 0 is also a valid value acccording to the description of USB_PHY_CFG1 register, this will improve the logic to let it work.

---
 drivers/usb/chipidea/ci_hdrc_imx.c |   10 ++++++----
 drivers/usb/chipidea/usbmisc_imx.c |    6 ++++--
 2 files changed, 10 insertions(+), 6 deletions(-)

@@ -175,10 +175,12 @@ static struct imx_usbmisc_data *usbmisc_
 	if (of_usb_get_phy_mode(np) == USBPHY_INTERFACE_MODE_ULPI)
 		data->ulpi = 1;
 
-	of_property_read_u32(np, "samsung,picophy-pre-emp-curr-control",
-			&data->emp_curr_control);
-	of_property_read_u32(np, "samsung,picophy-dc-vol-level-adjust",
-			&data->dc_vol_level_adjust);
+	if (of_property_read_u32(np, "samsung,picophy-pre-emp-curr-control",
+			&data->emp_curr_control))
+		data->emp_curr_control = -1;
+	if (of_property_read_u32(np, "samsung,picophy-dc-vol-level-adjust",
+			&data->dc_vol_level_adjust))
+		data->dc_vol_level_adjust = -1;
 
 	return data;
 }

@@ -659,13 +659,15 @@ static int usbmisc_imx7d_init(struct imx
 			usbmisc->base + MX7D_USBNC_USB_CTRL2);
 		/* PHY tuning for signal quality */
 		reg = readl(usbmisc->base + MX7D_USB_OTG_PHY_CFG1);
-		if (data->emp_curr_control && data->emp_curr_control <=
+		if (data->emp_curr_control >= 0 &&
+			data->emp_curr_control <=
 			(TXPREEMPAMPTUNE0_MASK >> TXPREEMPAMPTUNE0_BIT)) {
 			reg &= ~TXPREEMPAMPTUNE0_MASK;
 			reg |= (data->emp_curr_control << TXPREEMPAMPTUNE0_BIT);
 		}
 
-		if (data->dc_vol_level_adjust && data->dc_vol_level_adjust <=
+		if (data->dc_vol_level_adjust >= 0 &&
+			data->dc_vol_level_adjust <=
 			(TXVREFTUNE0_MASK >> TXVREFTUNE0_BIT)) {
 			reg &= ~TXVREFTUNE0_MASK;
 			reg |= (data->dc_vol_level_adjust << TXVREFTUNE0_BIT);

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gao Xiang <[email protected]>

commit e4c1cf523d820730a86cae2c6d55924833b6f7ac upstream.

This was accidentally fixed up in commit e4c1cf523d82 but we can't take the full change due to other dependancy issues, so here is just the actual bugfix that is needed.

[Background]

keltargw reported an issue [1] that with mmaped I/Os, sometimes the tail of the last page (after file ends) is not filled with zeroes.

The root cause is that such tail page could be wrongly selected for inplace I/Os so the zeroed part will then be filled with compressed data instead of zeroes.

A simple fix is to avoid doing inplace I/Os for such tail parts, actually that was already fixed upstream in commit e4c1cf523d82 ("erofs: tidy up z_erofs_do_read_page()") by accident.

[1] https://lore.kernel.org/r/[email protected]

---
 fs/erofs/zdata.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -1038,6 +1038,8 @@ hitted:
 	cur = end - min_t(erofs_off_t, offset + end - map->m_la, end);
 	if (!(map->m_flags & EROFS_MAP_MAPPED)) {
 		zero_user_segment(page, cur, end);
+		++spiltted;
+		tight = false;
 		goto next_part;
 	}
 	if (map->m_flags & EROFS_MAP_FRAGMENT) {

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Namjae Jeon <[email protected]>

commit 17d5b135bb720832364e8f55f6a887a3c7ec8fdb upstream.

If ->DataOffset of create context is 0, DataBuffer size is not correctly validated. This patch change wrong validation code and consider tag length in request.

---
 fs/smb/server/oplock.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -1492,7 +1492,7 @@ struct create_context *smb2_find_context
 		    name_len < 4 ||
 		    name_off + name_len > cc_len ||
 		    (value_off & 0x7) != 0 ||
-		    (value_off && (value_off < name_off + name_len)) ||
+		    (value_len && value_off < name_off + (name_len < 8 ? 8 : name_len)) ||
 		    ((u64)value_off + value_len > cc_len))
 			return ERR_PTR(-EINVAL);
 

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Namjae Jeon <[email protected]>

commit 4b081ce0d830b684fdf967abc3696d1261387254 upstream.

If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy to session key array from SessionKey from client.

---
 fs/smb/server/auth.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -355,6 +355,9 @@ int ksmbd_decode_ntlmssp_auth_blob(struc
 		if (blob_len < (u64)sess_key_off + sess_key_len)
 			return -EINVAL;
 
+		if (sess_key_len > CIFS_KEY_SIZE)
+			return -EINVAL;
+
 		ctx_arc4 = kmalloc(sizeof(*ctx_arc4), GFP_KERNEL);
 		if (!ctx_arc4)
 			return -ENOMEM;

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Namjae Jeon <[email protected]>

commit 0ba5439d9afa2722e7728df56f272c89987540a4 upstream.

UBSAN complains about out-of-bounds array indexes on 1-element arrays in struct smb2_ea_info.

UBSAN: array-index-out-of-bounds in fs/smb/server/smb2pdu.c:4335:15
index 1 is out of range for type 'char [1]'
CPU: 1 PID: 354 Comm: kworker/1:4 Not tainted 6.5.0-rc4 #1
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop
Reference Platform, BIOS 6.00 07/22/2020
Workqueue: ksmbd-io handle_ksmbd_work [ksmbd]
Call Trace:
 <TASK>
 __dump_stack linux/lib/dump_stack.c:88
 dump_stack_lvl+0x48/0x70 linux/lib/dump_stack.c:106
 dump_stack+0x10/0x20 linux/lib/dump_stack.c:113
 ubsan_epilogue linux/lib/ubsan.c:217
 __ubsan_handle_out_of_bounds+0xc6/0x110 linux/lib/ubsan.c:348
 smb2_get_ea linux/fs/smb/server/smb2pdu.c:4335
 smb2_get_info_file linux/fs/smb/server/smb2pdu.c:4900
 smb2_query_info+0x63ae/0x6b20 linux/fs/smb/server/smb2pdu.c:5275
 __process_request linux/fs/smb/server/server.c:145
 __handle_ksmbd_work linux/fs/smb/server/server.c:213
 handle_ksmbd_work+0x348/0x10b0 linux/fs/smb/server/server.c:266
 process_one_work+0x85a/0x1500 linux/kernel/workqueue.c:2597
 worker_thread+0xf3/0x13a0 linux/kernel/workqueue.c:2748
 kthread+0x2b7/0x390 linux/kernel/kthread.c:389
 ret_from_fork+0x44/0x90 linux/arch/x86/kernel/process.c:145
 ret_from_fork_asm+0x1b/0x30 linux/arch/x86/entry/entry_64.S:304
 </TASK>

---
 fs/smb/server/smb2pdu.c |    2 +-
 fs/smb/server/smb2pdu.h |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

@@ -4308,7 +4308,7 @@ static int smb2_get_ea(struct ksmbd_work
 		if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
 			name_len -= XATTR_USER_PREFIX_LEN;
 
-		ptr = (char *)(&eainfo->name + name_len + 1);
+		ptr = eainfo->name + name_len + 1;
 		buf_free_len -= (offsetof(struct smb2_ea_info, name) +
 				name_len + 1);
 		/* bailout if xattr can't fit in buf_free_len */

@@ -361,7 +361,7 @@ struct smb2_ea_info {
 	__u8   Flags;
 	__u8   EaNameLength;
 	__le16 EaValueLength;
-	char name[1];
+	char name[];
 	/* optionally followed by value */
 } __packed; /* level 15 Query */
 

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Namjae Jeon <[email protected]>

commit e628bf939aafb61fbc56e9bdac8795cea5127e25 upstream.

Create 3 kinds of files to reproduce this problem.

dd if=/dev/urandom of=127k.bin bs=1024 count=127
dd if=/dev/urandom of=128k.bin bs=1024 count=128
dd if=/dev/urandom of=129k.bin bs=1024 count=129

When copying files from ksmbd share to windows or cifs.ko, The following error message happen from windows client.

"The file '129k.bin' is too large for the destination filesystem."

We can see the error logs from ksmbd debug prints

[48394.611537] ksmbd: RDMA r/w request 0x0: token 0x669d, length 0x20000
[48394.612054] ksmbd: smb_direct: RDMA write, len 0x20000, needed credits 0x1
[48394.612572] ksmbd: filename 129k.bin, offset 131072, len 131072
[48394.614189] ksmbd: nbytes 1024, offset 132096 mincount 0
[48394.614585] ksmbd: Failed to process 8 [-22]

And we can reproduce it with cifs.ko,
e.g. dd if=129k.bin of=/dev/null bs=128KB count=2

This problem is that ksmbd rdma return error if remaining bytes is less than Length of Buffer Descriptor V1 Structure.

smb_direct_rdma_xmit()
...

     if (desc_buf_len == 0 || total_length > buf_len ||
           total_length > t->max_rdma_rw_size)
               return -EINVAL;

This patch reduce descriptor size with remaining bytes and remove the check for total_length and buf_len.

---
 fs/smb/server/transport_rdma.c |   25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

@@ -1366,24 +1366,35 @@ static int smb_direct_rdma_xmit(struct s
 	LIST_HEAD(msg_list);
 	char *desc_buf;
 	int credits_needed;
-	unsigned int desc_buf_len;
-	size_t total_length = 0;
+	unsigned int desc_buf_len, desc_num = 0;
 
 	if (t->status != SMB_DIRECT_CS_CONNECTED)
 		return -ENOTCONN;
 
+	if (buf_len > t->max_rdma_rw_size)
+		return -EINVAL;
+
 	/* calculate needed credits */
 	credits_needed = 0;
 	desc_buf = buf;
 	for (i = 0; i < desc_len / sizeof(*desc); i++) {
+		if (!buf_len)
+			break;
+
 		desc_buf_len = le32_to_cpu(desc[i].length);
+		if (!desc_buf_len)
+			return -EINVAL;
+
+		if (desc_buf_len > buf_len) {
+			desc_buf_len = buf_len;
+			desc[i].length = cpu_to_le32(desc_buf_len);
+			buf_len = 0;
+		}
 
 		credits_needed += calc_rw_credits(t, desc_buf, desc_buf_len);
 		desc_buf += desc_buf_len;
-		total_length += desc_buf_len;
-		if (desc_buf_len == 0 || total_length > buf_len ||
-		    total_length > t->max_rdma_rw_size)
-			return -EINVAL;
+		buf_len -= desc_buf_len;
+		desc_num++;
 	}
 
 	ksmbd_debug(RDMA, "RDMA %s, len %#x, needed credits %#x\n",

@@ -1395,7 +1406,7 @@ static int smb_direct_rdma_xmit(struct s
 
 	/* build rdma_rw_ctx for each descriptor */
 	desc_buf = buf;
-	for (i = 0; i < desc_len / sizeof(*desc); i++) {
+	for (i = 0; i < desc_num; i++) {
 		msg = kzalloc(offsetof(struct smb_direct_rdma_rw_msg, sg_list) +
 			      sizeof(struct scatterlist) * SG_CHUNK_SIZE, GFP_KERNEL);
 		if (!msg) {

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email protected]>

commit 0faa29c4207e6e29cfc81b427df60e326c37083a upstream.

The spitz board file uses the obscure symbol_get() function to optionally call a function from sharpsl_pm.c if that is built. However, the two files are always built together these days, and have been for a long time, so this can be changed to a normal function call.

---
 arch/arm/mach-pxa/sharpsl_pm.c |    2 --
 arch/arm/mach-pxa/spitz.c      |   14 +-------------
 2 files changed, 1 insertion(+), 15 deletions(-)

@@ -216,8 +216,6 @@ void sharpsl_battery_kick(void)
 {
 	schedule_delayed_work(&sharpsl_bat, msecs_to_jiffies(125));
 }
-EXPORT_SYMBOL(sharpsl_battery_kick);
-
 
 static void sharpsl_battery_thread(struct work_struct *private_)
 {

@@ -9,7 +9,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/module.h>	/* symbol_get ; symbol_put */
 #include <linux/platform_device.h>
 #include <linux/delay.h>
 #include <linux/gpio_keys.h>

@@ -518,17 +517,6 @@ static struct gpiod_lookup_table spitz_a
 	},
 };
 
-static void spitz_bl_kick_battery(void)
-{
-	void (*kick_batt)(void);
-
-	kick_batt = symbol_get(sharpsl_battery_kick);
-	if (kick_batt) {
-		kick_batt();
-		symbol_put(sharpsl_battery_kick);
-	}
-}
-
 static struct gpiod_lookup_table spitz_lcdcon_gpio_table = {
 	.dev_id = "spi2.1",
 	.table = {

@@ -556,7 +544,7 @@ static struct corgi_lcd_platform_data sp
 	.max_intensity		= 0x2f,
 	.default_intensity	= 0x1f,
 	.limit_mask		= 0x0b,
-	.kick_battery		= spitz_bl_kick_battery,
+	.kick_battery		= sharpsl_battery_kick,
 };
 
 static struct spi_board_info spitz_spi_devices[] = {

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christoph Hellwig <[email protected]>

commit d4a5c59a955bba96b273ec1a5885bada24c56979 upstream.

au1xmmc is split somewhat awkwardly into the main mmc subsystem driver, and callbacks in platform_data that sit under arch/mips/ and are always built in. The latter than call mmc_detect_change through symbol_get. Remove the use of symbol_get by requiring the driver to be built in. In the future the interrupt handlers for card insert/eject detection should probably be moved into the main driver, and which point it can be built modular again.

---
 arch/mips/alchemy/devboards/db1000.c |    8 +-------
 arch/mips/alchemy/devboards/db1200.c |   19 ++-----------------
 arch/mips/alchemy/devboards/db1300.c |   10 +---------
 drivers/mmc/host/Kconfig             |    5 +++--
 4 files changed, 7 insertions(+), 35 deletions(-)

@@ -14,7 +14,6 @@
 #include <linux/interrupt.h>
 #include <linux/leds.h>
 #include <linux/mmc/host.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/pm.h>
 #include <linux/spi/spi.h>

@@ -167,12 +166,7 @@ static struct platform_device db1x00_aud
 
 static irqreturn_t db1100_mmc_cd(int irq, void *ptr)
 {
-	void (*mmc_cd)(struct mmc_host *, unsigned long);
-	/* link against CONFIG_MMC=m */
-	mmc_cd = symbol_get(mmc_detect_change);
-	mmc_cd(ptr, msecs_to_jiffies(500));
-	symbol_put(mmc_detect_change);
-
+	mmc_detect_change(ptr, msecs_to_jiffies(500));
 	return IRQ_HANDLED;
 }
 

@@ -10,7 +10,6 @@
 #include <linux/gpio.h>
 #include <linux/i2c.h>
 #include <linux/init.h>
-#include <linux/module.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/leds.h>

@@ -340,14 +339,7 @@ static irqreturn_t db1200_mmc_cd(int irq
 
 static irqreturn_t db1200_mmc_cdfn(int irq, void *ptr)
 {
-	void (*mmc_cd)(struct mmc_host *, unsigned long);
-
-	/* link against CONFIG_MMC=m */
-	mmc_cd = symbol_get(mmc_detect_change);
-	if (mmc_cd) {
-		mmc_cd(ptr, msecs_to_jiffies(200));
-		symbol_put(mmc_detect_change);
-	}
+	mmc_detect_change(ptr, msecs_to_jiffies(200));
 
 	msleep(100);	/* debounce */
 	if (irq == DB1200_SD0_INSERT_INT)

@@ -431,14 +423,7 @@ static irqreturn_t pb1200_mmc1_cd(int ir
 
 static irqreturn_t pb1200_mmc1_cdfn(int irq, void *ptr)
 {
-	void (*mmc_cd)(struct mmc_host *, unsigned long);
-
-	/* link against CONFIG_MMC=m */
-	mmc_cd = symbol_get(mmc_detect_change);
-	if (mmc_cd) {
-		mmc_cd(ptr, msecs_to_jiffies(200));
-		symbol_put(mmc_detect_change);
-	}
+	mmc_detect_change(ptr, msecs_to_jiffies(200));
 
 	msleep(100);	/* debounce */
 	if (irq == PB1200_SD1_INSERT_INT)

@@ -17,7 +17,6 @@
 #include <linux/interrupt.h>
 #include <linux/ata_platform.h>
 #include <linux/mmc/host.h>
-#include <linux/module.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/platnand.h>
 #include <linux/platform_device.h>

@@ -459,14 +458,7 @@ static irqreturn_t db1300_mmc_cd(int irq
 
 static irqreturn_t db1300_mmc_cdfn(int irq, void *ptr)
 {
-	void (*mmc_cd)(struct mmc_host *, unsigned long);
-
-	/* link against CONFIG_MMC=m.  We can only be called once MMC core has
-	 * initialized the controller, so symbol_get() should always succeed.
-	 */
-	mmc_cd = symbol_get(mmc_detect_change);
-	mmc_cd(ptr, msecs_to_jiffies(200));
-	symbol_put(mmc_detect_change);
+	mmc_detect_change(ptr, msecs_to_jiffies(200));
 
 	msleep(100);	/* debounce */
 	if (irq == DB1300_SD1_INSERT_INT)

@@ -526,11 +526,12 @@ config MMC_ALCOR
 	  of Alcor Micro PCI-E card reader
 
 config MMC_AU1X
-	tristate "Alchemy AU1XX0 MMC Card Interface support"
+	bool "Alchemy AU1XX0 MMC Card Interface support"
 	depends on MIPS_ALCHEMY
+	depends on MMC=y
 	help
 	  This selects the AMD Alchemy(R) Multimedia card interface.
-	  If you have a Alchemy platform with a MMC slot, say Y or M here.
+	  If you have a Alchemy platform with a MMC slot, say Y here.
 
 	  If unsure, say N.
 

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christoph Hellwig <[email protected]>

commit 569820befb16ffc755ab7af71f4f08cc5f68f0fe upstream.

enetc_phc_index is only used via symbol_get, which was only ever intended for very internal symbols like this one. Use EXPORT_SYMBOL_GPL for it so that symbol_get can enforce only being used on EXPORT_SYMBOL_GPL symbols.

---
 drivers/net/ethernet/freescale/enetc/enetc_ptp.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -8,7 +8,7 @@
 #include "enetc.h"
 
 int enetc_phc_index = -1;
-EXPORT_SYMBOL(enetc_phc_index);
+EXPORT_SYMBOL_GPL(enetc_phc_index);
 
 static struct ptp_clock_info enetc_ptp_caps = {
 	.owner		= THIS_MODULE,

This is the start of the stable review cycle for the 6.5.2 release. There are 34 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Wed, 06 Sep 2023 18:29:29 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.5.2-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.5.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.5.2-rc1

Mario Limonciello <[email protected]>
pinctrl: amd: Don't show Invalid config param errors

Marco Felsch <[email protected]>
usb: typec: tcpci: clear the fault status bit

Ryusuke Konishi <[email protected]>
nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse

Brian Foster <[email protected]>
tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY

Hugo Villeneuve <[email protected]>
dt-bindings: sc16is7xx: Add property to change GPIO function

Badhri Jagan Sridharan <[email protected]>
tcpm: Avoid soft reset when partner does not support get_status

Juerg Haefliger <[email protected]>
fsi: master-ast-cf: Add MODULE_FIRMWARE macro

Wang Ming <[email protected]>
firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: fix bug when first setting GPIO direction

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: fix broken port 0 uart init

Johan Hovold <[email protected]>
serial: qcom-geni: fix opp vote on shutdown

Sven Eckelmann <[email protected]>
wifi: ath11k: Cleanup mac80211 references on failure during tx_complete

Sven Eckelmann <[email protected]>
wifi: ath11k: Don't drop tx_status when peer cannot be found

Sascha Hauer <[email protected]>
wifi: rtw88: usb: kill and free rx urbs on probe failure

Deren Wu <[email protected]>
wifi: mt76: mt7921: fix skb leak by txs missing in AMSDU

Deren Wu <[email protected]>
wifi: mt76: mt7921: do not support one stream on secondary antenna only

Nam Cao <[email protected]>
staging: rtl8712: fix race condition

Aaron Armstrong Skomra <[email protected]>
HID: wacom: remove the battery when the EKR is off

Xu Yang <[email protected]>
usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0

Luke Lu <[email protected]>
usb: dwc3: meson-g12a: do post init to fix broken usb after resumption

Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix init call orders for UAC1

Slark Xiao <[email protected]>
USB: serial: option: add FOXCONN T99W368/T99W373 product

Martin Kohn <[email protected]>

    USB: serial: option: add Quectel EM05G variant (0x030e)

Christoph Hellwig <[email protected]>
modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules

Christoph Hellwig <[email protected]>
rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff

Christoph Hellwig <[email protected]>
net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index

Christoph Hellwig <[email protected]>
mmc: au1xmmc: force non-modular build and remove symbol_get usage

Arnd Bergmann <[email protected]>
ARM: pxa: remove use of symbol_get()

Namjae Jeon <[email protected]>
ksmbd: reduce descriptor size if remaining bytes is less than request size

Namjae Jeon <[email protected]>
ksmbd: replace one-element array with flex-array member in struct smb2_ea_info

Namjae Jeon <[email protected]>
ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()

Namjae Jeon <[email protected]>
ksmbd: fix wrong DataOffset validation of create context

Gao Xiang <[email protected]>
erofs: ensure that the post-EOF tails are all zeroed

Lang Yu <[email protected]>
drm/amdgpu: correct vmhub index in GMC v10/11

-------------

Diffstat:

 .../devicetree/bindings/serial/nxp,sc16is7xx.txt   | 46 ++++++++++++++++++++++
 Makefile                                           |  4 +-
 arch/arm/mach-pxa/sharpsl_pm.c                     |  2 -
 arch/arm/mach-pxa/spitz.c                          | 14 +------
 arch/mips/alchemy/devboards/db1000.c               |  8 +---
 arch/mips/alchemy/devboards/db1200.c               | 19 +--------
 arch/mips/alchemy/devboards/db1300.c               | 10 +----
 drivers/firmware/stratix10-svc.c                   |  2 +-
 drivers/fsi/fsi-master-ast-cf.c                    |  1 +
 drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c             |  4 +-
 drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c             |  4 +-
 drivers/hid/wacom.h                                |  1 +
 drivers/hid/wacom_sys.c                            | 25 ++++++++++--
 drivers/hid/wacom_wac.c                            |  1 +
 drivers/hid/wacom_wac.h                            |  1 +
 drivers/mmc/host/Kconfig                           |  5 ++-
 drivers/net/ethernet/freescale/enetc/enetc_ptp.c   |  2 +-
 drivers/net/wireless/ath/ath11k/dp_tx.c            | 10 ++---
 .../net/wireless/mediatek/mt76/mt76_connac_mac.c   |  7 +++-
 drivers/net/wireless/mediatek/mt76/mt7921/main.c   |  2 +-
 drivers/net/wireless/realtek/rtw88/usb.c           |  5 ++-
 drivers/pinctrl/pinctrl-amd.c                      |  4 +-
 drivers/rtc/rtc-ds1685.c                           |  2 +-
 drivers/staging/rtl8712/os_intfs.c                 |  1 +
 drivers/staging/rtl8712/usb_intf.c                 |  1 -
 drivers/tty/serial/qcom_geni_serial.c              |  5 +++
 drivers/tty/serial/sc16is7xx.c                     | 17 +++++++-
 drivers/usb/chipidea/ci_hdrc_imx.c                 | 10 +++--
 drivers/usb/chipidea/usbmisc_imx.c                 |  6 ++-
 drivers/usb/dwc3/dwc3-meson-g12a.c                 |  6 +++
 drivers/usb/serial/option.c                        |  7 ++++
 drivers/usb/typec/tcpm/tcpci.c                     |  4 ++
 drivers/usb/typec/tcpm/tcpm.c                      |  7 ++++
 fs/erofs/zdata.c                                   |  2 +
 fs/nilfs2/alloc.c                                  |  3 +-
 fs/nilfs2/inode.c                                  |  7 +++-
 fs/smb/server/auth.c                               |  3 ++
 fs/smb/server/oplock.c                             |  2 +-
 fs/smb/server/smb2pdu.c                            |  2 +-
 fs/smb/server/smb2pdu.h                            |  2 +-
 fs/smb/server/transport_rdma.c                     | 25 ++++++++----
 include/linux/usb/tcpci.h                          |  1 +
 kernel/module/main.c                               | 14 +++++--
 kernel/trace/trace.c                               |  4 +-
 sound/usb/stream.c                                 | 11 +++++-
 45 files changed, 220 insertions(+), 99 deletions(-)

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nam Cao <[email protected]>

commit 1422b526fba994cf05fd288a152106563b875fce upstream.

In probe function, request_firmware_nowait() is called to load firmware asynchronously. At completion of firmware loading, register_netdev() is called. However, a mutex needed by netdev is initialized after the call to request_firmware_nowait(). Consequently, it can happen that register_netdev() is called before the driver is ready.

Move the mutex initialization into r8712_init_drv_sw(), which is called before request_firmware_nowait().

---
 drivers/staging/rtl8712/os_intfs.c |    1 +
 drivers/staging/rtl8712/usb_intf.c |    1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

@@ -327,6 +327,7 @@ int r8712_init_drv_sw(struct _adapter *p
 	mp871xinit(padapter);
 	init_default_value(padapter);
 	r8712_InitSwLeds(padapter);
+	mutex_init(&padapter->mutex_start);
 
 	return 0;
 

@@ -567,7 +567,6 @@ static int r871xu_drv_init(struct usb_in
 	if (rtl871x_load_fw(padapter))
 		goto deinit_drv_sw;
 	init_completion(&padapter->rx_filter_ready);
-	mutex_init(&padapter->mutex_start);
 	return 0;
 
 deinit_drv_sw:

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Wang Ming <[email protected]>

commit dd218433f2b635d97e8fda3eed047151fd528ce4 upstream.

The devm_memremap() function returns error pointers. It never returns NULL. Fix the check.

---
 drivers/firmware/stratix10-svc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -756,7 +756,7 @@ svc_create_memory_pool(struct platform_d
 	paddr = begin;
 	size = end - begin;
 	va = devm_memremap(dev, paddr, size, MEMREMAP_WC);
-	if (!va) {
+	if (IS_ERR(va)) {
 		dev_err(dev, "fail to remap shared memory\n");
 		return ERR_PTR(-EINVAL);
 	}

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Juerg Haefliger <[email protected]>

commit 3a1d7aff6e65ad6e285e28abe55abbfd484997ee upstream.

The module loads firmware so add a MODULE_FIRMWARE macro to provide that information via modinfo.

---
 drivers/fsi/fsi-master-ast-cf.c |    1 +
 1 file changed, 1 insertion(+)

@@ -1441,3 +1441,4 @@ static struct platform_driver fsi_master
 
 module_platform_driver(fsi_master_acf);
 MODULE_LICENSE("GPL");
+MODULE_FIRMWARE(FW_FILE_NAME);

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Badhri Jagan Sridharan <[email protected]>

commit 78e0ea4277546debf7e96797ac3b768539cc44f6 upstream.

When partner does not support get_status message, tcpm right now responds with soft reset message. This causes PD renegotiation to happen and resets PPS link. Avoid soft resetting the link when partner does not support get_status message to mitigate PPS resets.

[  208.926752] Setting voltage/current limit 9500 mV 2450 mA
[  208.930407] set_auto_vbus_discharge_threshold mode:3 pps_active:y vbus:9500 ret:0
[  208.930418] state change SNK_TRANSITION_SINK -> SNK_READY [rev3 POWER_NEGOTIATION]
[  208.930455] AMS POWER_NEGOTIATION finished

// ALERT message from the Source

[  213.948442] PD RX, header: 0x19a6 [1]
[  213.948451] state change SNK_READY -> GET_STATUS_SEND [rev3 GETTING_SOURCE_SINK_STATUS]
[  213.948457] PD TX, header: 0x492
[  213.950402] PD TX complete, status: 0
[  213.950427] pending state change GET_STATUS_SEND -> GET_STATUS_SEND_TIMEOUT @ 60 ms [rev3 GETTING_SOURCE_SINK_STATUS]

// NOT_SUPPORTED from the Source

[  213.959954] PD RX, header: 0xbb0 [1]

// sink sends SOFT_RESET

[  213.959958] state change GET_STATUS_SEND -> SNK_SOFT_RESET [rev3 GETTING_SOURCE_SINK_STATUS]
[  213.959962] AMS GETTING_SOURCE_SINK_STATUS finished
[  213.959964] AMS SOFT_RESET_AMS start
[  213.959966] state change SNK_SOFT_RESET -> AMS_START [rev3 SOFT_RESET_AMS]
[  213.959969] state change AMS_START -> SOFT_RESET_SEND [rev3 SOFT_RESET_AMS]

---
 drivers/usb/typec/tcpm/tcpm.c |    7 +++++++
 1 file changed, 7 insertions(+)

@@ -2753,6 +2753,13 @@ static void tcpm_pd_ctrl_request(struct
 			port->sink_cap_done = true;
 			tcpm_set_state(port, ready_state(port), 0);
 			break;
+		/*
+		 * Some port partners do not support GET_STATUS, avoid soft reset the link to
+		 * prevent redundant power re-negotiation
+		 */
+		case GET_STATUS_SEND:
+			tcpm_set_state(port, ready_state(port), 0);
+			break;
 		case SRC_READY:
 		case SNK_READY:
 			if (port->vdm_state > VDM_STATE_READY) {

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hugo Villeneuve <[email protected]>

commit 4cf478dc5d707e56aefa258c049872eff054a353 upstream.

Some variants in this series of UART controllers have GPIO pins that are shared between GPIO and modem control lines.

The pin mux mode (GPIO or modem control lines) can be set for each ports (channels) supported by the variant.

This adds a property to the device tree to set the GPIO pin mux to modem control lines on selected ports if needed.

---
 Documentation/devicetree/bindings/serial/nxp,sc16is7xx.txt |   46 +++++++++++++
 1 file changed, 46 insertions(+)

@@ -23,6 +23,9 @@ Optional properties:
     1 = active low.
 - irda-mode-ports: An array that lists the indices of the port that
 		   should operate in IrDA mode.
+- nxp,modem-control-line-ports: An array that lists the indices of the port that
+				should have shared GPIO lines configured as
+				modem control lines.
 
 Example:
         sc16is750: sc16is750@51 {

@@ -35,6 +38,26 @@ Example:
                 #gpio-cells = <2>;
         };
 
+	sc16is752: sc16is752@53 {
+		compatible = "nxp,sc16is752";
+		reg = <0x53>;
+		clocks = <&clk20m>;
+		interrupt-parent = <&gpio3>;
+		interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
+		nxp,modem-control-line-ports = <1>; /* Port 1 as modem control lines */
+		gpio-controller; /* Port 0 as GPIOs */
+		#gpio-cells = <2>;
+	};
+
+	sc16is752: sc16is752@54 {
+		compatible = "nxp,sc16is752";
+		reg = <0x54>;
+		clocks = <&clk20m>;
+		interrupt-parent = <&gpio3>;
+		interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
+		nxp,modem-control-line-ports = <0 1>; /* Ports 0 and 1 as modem control lines */
+	};
+
 * spi as bus
 
 Required properties:

@@ -59,6 +82,9 @@ Optional properties:
     1 = active low.
 - irda-mode-ports: An array that lists the indices of the port that
 		   should operate in IrDA mode.
+- nxp,modem-control-line-ports: An array that lists the indices of the port that
+				should have shared GPIO lines configured as
+				modem control lines.
 
 Example:
 	sc16is750: sc16is750@0 {

@@ -70,3 +96,23 @@ Example:
 		gpio-controller;
 		#gpio-cells = <2>;
 	};
+
+	sc16is752: sc16is752@1 {
+		compatible = "nxp,sc16is752";
+		reg = <1>;
+		clocks = <&clk20m>;
+		interrupt-parent = <&gpio3>;
+		interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
+		nxp,modem-control-line-ports = <1>; /* Port 1 as modem control lines */
+		gpio-controller; /* Port 0 as GPIOs */
+		#gpio-cells = <2>;
+	};
+
+	sc16is752: sc16is752@2 {
+		compatible = "nxp,sc16is752";
+		reg = <2>;
+		clocks = <&clk20m>;
+		interrupt-parent = <&gpio3>;
+		interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
+		nxp,modem-control-line-ports = <0 1>; /* Ports 0 and 1 as modem control lines */
+	};

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Brian Foster <[email protected]>

commit 3d07fa1dd19035eb0b13ae6697efd5caa9033e74 upstream.

The pipe cpumask used to serialize opens between the main and percpu trace pipes is not zeroed or initialized. This can result in spurious -EBUSY returns if underlying memory is not fully zeroed. This has been observed by immediate failure to read the main trace_pipe file on an otherwise newly booted and idle system:

 # cat /sys/kernel/debug/tracing/trace_pipe
 cat: /sys/kernel/debug/tracing/trace_pipe: Device or resource busy

Zero the allocation of pipe_cpumask to avoid the problem.

---
 kernel/trace/trace.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -9486,7 +9486,7 @@ static struct trace_array *trace_array_c
 	if (!alloc_cpumask_var(&tr->tracing_cpumask, GFP_KERNEL))
 		goto out_free_tr;
 
-	if (!alloc_cpumask_var(&tr->pipe_cpumask, GFP_KERNEL))
+	if (!zalloc_cpumask_var(&tr->pipe_cpumask, GFP_KERNEL))
 		goto out_free_tr;
 
 	tr->trace_flags = global_trace.trace_flags & ~ZEROED_TRACE_FLAGS;

@@ -10431,7 +10431,7 @@ __init static int tracer_alloc_buffers(v
 	if (trace_create_savedcmd() < 0)
 		goto out_free_temp_buffer;
 
-	if (!alloc_cpumask_var(&global_trace.pipe_cpumask, GFP_KERNEL))
+	if (!zalloc_cpumask_var(&global_trace.pipe_cpumask, GFP_KERNEL))
 		goto out_free_savedcmd;
 
 	/* TODO: make the number of buffers hot pluggable with CPUS */

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ryusuke Konishi <[email protected]>

commit cdaac8e7e5a059f9b5e816cda257f08d0abffacd upstream.

A syzbot stress test using a corrupted disk image reported that mark_buffer_dirty() called from __nilfs_mark_inode_dirty() or nilfs_palloc_commit_alloc_entry() may output a kernel warning, and can panic if the kernel is booted with panic_on_warn.

This is because nilfs2 keeps buffer pointers in local structures for some metadata and reuses them, but such buffers may be forcibly discarded by nilfs_clear_dirty_page() in some critical situations.

This issue is reported to appear after commit 28a65b49eb53 ("nilfs2: do not write dirty data after degenerating to read-only"), but the issue has potentially existed before.

Fix this issue by checking the uptodate flag when attempting to reuse an internally held buffer, and reloading the metadata instead of reusing the buffer if the flag was lost.

---
 fs/nilfs2/alloc.c |    3 ++-
 fs/nilfs2/inode.c |    7 +++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

@@ -205,7 +205,8 @@ static int nilfs_palloc_get_block(struct
 	int ret;
 
 	spin_lock(lock);
-	if (prev->bh && blkoff == prev->blkoff) {
+	if (prev->bh && blkoff == prev->blkoff &&
+	    likely(buffer_uptodate(prev->bh))) {
 		get_bh(prev->bh);
 		*bhp = prev->bh;
 		spin_unlock(lock);

@@ -1025,7 +1025,7 @@ int nilfs_load_inode_block(struct inode
 	int err;
 
 	spin_lock(&nilfs->ns_inode_lock);
-	if (ii->i_bh == NULL) {
+	if (ii->i_bh == NULL || unlikely(!buffer_uptodate(ii->i_bh))) {
 		spin_unlock(&nilfs->ns_inode_lock);
 		err = nilfs_ifile_get_inode_block(ii->i_root->ifile,
 						  inode->i_ino, pbh);

@@ -1034,7 +1034,10 @@ int nilfs_load_inode_block(struct inode
 		spin_lock(&nilfs->ns_inode_lock);
 		if (ii->i_bh == NULL)
 			ii->i_bh = *pbh;
-		else {
+		else if (unlikely(!buffer_uptodate(ii->i_bh))) {
+			__brelse(ii->i_bh);
+			ii->i_bh = *pbh;
+		} else {
 			brelse(*pbh);
 			*pbh = ii->i_bh;
 		}

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marco Felsch <[email protected]>

commit 23e60c8daf5ec2ab1b731310761b668745fcf6ed upstream.

According the "USB Type-C Port Controller Interface Specification v2.0" the TCPC sets the fault status register bit-7 (AllRegistersResetToDefault) once the registers have been reset to their default values.

This triggers an alert(-irq) on PTN5110 devices albeit we do mask the fault-irq, which may cause a kernel hang. Fix this generically by writing a one to the corresponding bit-7.

---
 drivers/usb/typec/tcpm/tcpci.c |    4 ++++
 include/linux/usb/tcpci.h      |    1 +
 2 files changed, 5 insertions(+)

@@ -602,6 +602,10 @@ static int tcpci_init(struct tcpc_dev *t
 	if (time_after(jiffies, timeout))
 		return -ETIMEDOUT;
 
+	ret = tcpci_write16(tcpci, TCPC_FAULT_STATUS, TCPC_FAULT_STATUS_ALL_REG_RST_TO_DEFAULT);
+	if (ret < 0)
+		return ret;
+
 	/* Handle vendor init */
 	if (tcpci->data->init) {
 		ret = tcpci->data->init(tcpci, tcpci->data);

@@ -103,6 +103,7 @@
 #define TCPC_POWER_STATUS_SINKING_VBUS	BIT(0)
 
 #define TCPC_FAULT_STATUS		0x1f
+#define TCPC_FAULT_STATUS_ALL_REG_RST_TO_DEFAULT BIT(7)
 
 #define TCPC_ALERT_EXTENDED		0x21
 

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mario Limonciello <[email protected]>

commit 87b549efcb0f7934b0916d2a00607a878b6f1e0f upstream.

On some systems amd_pinconf_set() is called with parameters 0x8 (PIN_CONFIG_DRIVE_PUSH_PULL) or 0x14 (PIN_CONFIG_PERSIST_STATE) which are not supported by pinctrl-amd.

Don't show an err message when called with an invalid parameter, downgrade this to debug instead.

---
 drivers/pinctrl/pinctrl-amd.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -748,7 +748,7 @@ static int amd_pinconf_get(struct pinctr
 		break;
 
 	default:
-		dev_err(&gpio_dev->pdev->dev, "Invalid config param %04x\n",
+		dev_dbg(&gpio_dev->pdev->dev, "Invalid config param %04x\n",
 			param);
 		return -ENOTSUPP;
 	}

@@ -798,7 +798,7 @@ static int amd_pinconf_set(struct pinctr
 			break;
 
 		default:
-			dev_err(&gpio_dev->pdev->dev,
+			dev_dbg(&gpio_dev->pdev->dev,
 				"Invalid config param %04x\n", param);
 			ret = -ENOTSUPP;
 		}

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Deren Wu <[email protected]>

commit d616d3680264beb9a9d2c4fc681064b06f447eeb upstream.

mt7921 support following antenna combiantions only.
* primary + secondary (2x2)
* primary only (1x1)

Since we cannot work on secondary antenna only, return error if the antenna bitmap is 0x2 in .set_antenna().

For example:
iw phy0 set antenna 3 3 /* valid */
iw phy0 set antenna 1 1 /* valid */
iw phy0 set antenna 2 2 /* invalid */

---
 drivers/net/wireless/mediatek/mt76/mt7921/main.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -1363,7 +1363,7 @@ mt7921_set_antenna(struct ieee80211_hw *
 		return -EINVAL;
 
 	if ((BIT(hweight8(tx_ant)) - 1) != tx_ant)
-		tx_ant = BIT(ffs(tx_ant) - 1) - 1;
+		return -EINVAL;
 
 	mt7921_mutex_acquire(dev);
 

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Deren Wu <[email protected]>

commit b642f4c5f3de0a8f47808d32b1ebd9c427a42a66 upstream.

txs may be dropped if the frame is aggregated in AMSDU. When the problem shows up, some SKBs would be hold in driver to cause network stopped temporarily. Even if the problem can be recovered by txs timeout handling, mt7921 still need to disable txs in AMSDU to avoid this issue.

---
 drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

@@ -495,6 +495,7 @@ void mt76_connac2_mac_write_txwi(struct
 				    BSS_CHANGED_BEACON_ENABLED));
 	bool inband_disc = !!(changed & (BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
 					 BSS_CHANGED_FILS_DISCOVERY));
+	bool amsdu_en = wcid->amsdu;
 
 	if (vif) {
 		struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;

@@ -554,12 +555,14 @@ void mt76_connac2_mac_write_txwi(struct
 	txwi[4] = 0;
 
 	val = FIELD_PREP(MT_TXD5_PID, pid);
-	if (pid >= MT_PACKET_ID_FIRST)
+	if (pid >= MT_PACKET_ID_FIRST) {
 		val |= MT_TXD5_TX_STATUS_HOST;
+		amsdu_en = amsdu_en && !is_mt7921(dev);
+	}
 
 	txwi[5] = cpu_to_le32(val);
 	txwi[6] = 0;
-	txwi[7] = wcid->amsdu ? cpu_to_le32(MT_TXD7_HW_AMSDU) : 0;
+	txwi[7] = amsdu_en ? cpu_to_le32(MT_TXD7_HW_AMSDU) : 0;
 
 	if (is_8023)
 		mt76_connac2_mac_write_txwi_8023(txwi, skb, wcid);

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sascha Hauer <[email protected]>

commit 290564367ab7fa7e2048bdc00d9c0ad016b41eea upstream.

After rtw_usb_alloc_rx_bufs() has been called rx urbs have been allocated and must be freed in the error path. After rtw_usb_init_rx() has been called they are submitted, so they also must be killed.

Add these forgotten steps to the probe error path.

Besides the lost memory this also fixes a problem when the driver fails to download the firmware in rtw_chip_info_setup(). In this case it can happen that the completion of the rx urbs handler runs at a time when we already freed our data structures resulting in a kernel crash.

---
 drivers/net/wireless/realtek/rtw88/usb.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

@@ -844,7 +844,7 @@ int rtw_usb_probe(struct usb_interface *
 
 	ret = rtw_core_init(rtwdev);
 	if (ret)
-		goto err_release_hw;
+		goto err_free_rx_bufs;
 
 	ret = rtw_usb_intf_init(rtwdev, intf);
 	if (ret) {

@@ -890,6 +890,9 @@ err_destroy_usb:
 err_deinit_core:
 	rtw_core_deinit(rtwdev);
 
+err_free_rx_bufs:
+	rtw_usb_free_rx_bufs(rtwusb);
+
 err_release_hw:
 	ieee80211_free_hw(hw);
 

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <[email protected]>

commit 400ece6c7f346b0a30867bd00b03b5b2563d4357 upstream.

When a station idles for a long time, hostapd will try to send a QoS Null frame to the station as "poll". NL80211_CMD_PROBE_CLIENT is used for this purpose. And the skb will be added to ack_status_frame - waiting for a completion via ieee80211_report_ack_skb().

But when the peer was already removed before the tx_complete arrives, the peer will be missing. And when using dev_kfree_skb_any (instead of going through mac80211), the entry will stay inside ack_status_frames. This IDR will therefore run full after 8K request were generated for such clients. At this point, the access point will then just stall and not allow any new clients because idr_alloc() for ack_status_frame will fail.

ieee80211_free_txskb() on the other hand will (when required) call ieee80211_report_ack_skb() and make sure that (when required) remove the entry from the ack_status_frame.

Tested-on: IPQ6018 hw1.0 WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1

---
 drivers/net/wireless/ath/ath11k/dp_tx.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -369,7 +369,7 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
 			   "dp_tx: failed to find the peer with peer_id %d\n",
 			    ts->peer_id);
 		spin_unlock_bh(&ab->base_lock);
-		dev_kfree_skb_any(msdu);
+		ieee80211_free_txskb(ar->hw, msdu);
 		return;
 	}
 	spin_unlock_bh(&ab->base_lock);

@@ -624,7 +624,7 @@ static void ath11k_dp_tx_complete_msdu(s
 			   "dp_tx: failed to find the peer with peer_id %d\n",
 			    ts->peer_id);
 		spin_unlock_bh(&ab->base_lock);
-		dev_kfree_skb_any(msdu);
+		ieee80211_free_txskb(ar->hw, msdu);
 		return;
 	}
 	arsta = (struct ath11k_sta *)peer->sta->drv_priv;

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <[email protected]>

commit 29d15589f084d71a4ea8c544039c5839db0236e2 upstream.

When a function is using functions from mac80211 to free an skb then it should do it consistently and not switch to the generic dev_kfree_skb_any (or similar functions). Otherwise (like in the error handlers), mac80211 will will not be aware of the freed skb and thus not clean up related information in its internal data structures.

Not doing so lead in the past to filled up structure which then prevented new clients to connect.

---
 drivers/net/wireless/ath/ath11k/dp_tx.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

@@ -344,7 +344,7 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
 	dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
 
 	if (!skb_cb->vif) {
-		dev_kfree_skb_any(msdu);
+		ieee80211_free_txskb(ar->hw, msdu);
 		return;
 	}
 

@@ -566,12 +566,12 @@ static void ath11k_dp_tx_complete_msdu(s
 	dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
 
 	if (unlikely(!rcu_access_pointer(ab->pdevs_active[ar->pdev_idx]))) {
-		dev_kfree_skb_any(msdu);
+		ieee80211_free_txskb(ar->hw, msdu);
 		return;
 	}
 
 	if (unlikely(!skb_cb->vif)) {
-		dev_kfree_skb_any(msdu);
+		ieee80211_free_txskb(ar->hw, msdu);
 		return;
 	}
 

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

commit 8ece7b754bc34ffd7fcc8269ccb9128e72ca76d8 upstream.

The operating-performance-point vote needs to be dropped when shutting down the port to avoid wasting power by keeping resources like power domains in an unnecessarily high performance state (e.g. when a UART connected Bluetooth controller is not in use).

---
 drivers/tty/serial/qcom_geni_serial.c |    5 +++++
 1 file changed, 5 insertions(+)

@@ -126,6 +126,7 @@ struct qcom_geni_serial_port {
 	dma_addr_t rx_dma_addr;
 	bool setup;
 	unsigned int baud;
+	unsigned long clk_rate;
 	void *rx_buf;
 	u32 loopback;
 	bool brk;

@@ -1249,6 +1250,7 @@ static void qcom_geni_serial_set_termios
 			baud * sampling_rate, clk_rate, clk_div);
 
 	uport->uartclk = clk_rate;
+	port->clk_rate = clk_rate;
 	dev_pm_opp_set_rate(uport->dev, clk_rate);
 	ser_clk_cfg = SER_CLK_EN;
 	ser_clk_cfg |= clk_div << CLK_DIV_SHFT;

@@ -1513,10 +1515,13 @@ static void qcom_geni_serial_pm(struct u
 
 	if (new_state == UART_PM_STATE_ON && old_state == UART_PM_STATE_OFF) {
 		geni_icc_enable(&port->se);
+		if (port->clk_rate)
+			dev_pm_opp_set_rate(uport->dev, port->clk_rate);
 		geni_se_resources_on(&port->se);
 	} else if (new_state == UART_PM_STATE_OFF &&
 			old_state == UART_PM_STATE_ON) {
 		geni_se_resources_off(&port->se);
+		dev_pm_opp_set_rate(uport->dev, 0);
 		geni_icc_disable(&port->se);
 	}
 }

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hugo Villeneuve <[email protected]>

commit 2861ed4d6e6d1a2c9de9bf5b0abd996c2dc673d0 upstream.

The sc16is7xx_config_rs485() function is called only for the second port (index 1, channel B), causing initialization problems for the first port.

For the sc16is7xx driver, port->membase and port->mapbase are not set, and their default values are 0. And we set port->iobase to the device index. This means that when the first device is registered using the uart_add_one_port() function, the following values will be in the port structure:

    port->membase = 0
    port->mapbase = 0
    port->iobase  = 0

Therefore, the function uart_configure_port() in serial_core.c will exit early because of the following check:

	/*
	 * If there isn't a port here, don't do anything further.
	 */
	if (!port->iobase && !port->mapbase && !port->membase)
		return;

Typically, I2C and SPI drivers do not set port->membase and port->mapbase.

The max310x driver sets port->membase to ~0 (all ones). By implementing the same change in this driver, uart_configure_port() is now correctly executed for all ports.

---
 drivers/tty/serial/sc16is7xx.c |    6 ++++++
 1 file changed, 6 insertions(+)

@@ -1436,6 +1436,12 @@ static int sc16is7xx_probe(struct device
 		s->p[i].port.fifosize	= SC16IS7XX_FIFO_SIZE;
 		s->p[i].port.flags	= UPF_FIXED_TYPE | UPF_LOW_LATENCY;
 		s->p[i].port.iobase	= i;
+		/*
+		 * Use all ones as membase to make sure uart_configure_port() in
+		 * serial_core.c does not abort for SPI/I2C devices where the
+		 * membase address is not applicable.
+		 */
+		s->p[i].port.membase	= (void __iomem *)~0;
 		s->p[i].port.iotype	= UPIO_PORT;
 		s->p[i].port.uartclk	= freq;
 		s->p[i].port.rs485_config = sc16is7xx_config_rs485;

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hugo Villeneuve <[email protected]>

commit 9baeea723c0fb9c3ba9a336369f758ed9bc6831d upstream.

When configuring a pin as an output pin with a value of logic 0, we end up as having a value of logic 1 on the output pin. Setting a logic 0 a second time (or more) after that will correctly output a logic 0 on the output pin.

By default, all GPIO pins are configured as inputs. When we enter sc16is7xx_gpio_direction_output() for the first time, we first set the desired value in IOSTATE, and then we configure the pin as an output. The datasheet states that writing to IOSTATE register will trigger a transfer of the value to the I/O pin configured as output, so if the pin is configured as an input, nothing will be transferred.

Therefore, set the direction first in IODIR, and then set the desired value in IOSTATE.

This is what is done in NXP application note AN10587.

---
 drivers/tty/serial/sc16is7xx.c |   11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

@@ -1342,9 +1342,18 @@ static int sc16is7xx_gpio_direction_outp
 		state |= BIT(offset);
 	else
 		state &= ~BIT(offset);
-	sc16is7xx_port_write(port, SC16IS7XX_IOSTATE_REG, state);
+
+	/*
+	 * If we write IOSTATE first, and then IODIR, the output value is not
+	 * transferred to the corresponding I/O pin.
+	 * The datasheet states that each register bit will be transferred to
+	 * the corresponding I/O pin programmed as output when writing to
+	 * IOSTATE. Therefore, configure direction first with IODIR, and then
+	 * set value after with IOSTATE.
+	 */
 	sc16is7xx_port_update(port, SC16IS7XX_IODIR_REG, BIT(offset),
 			      BIT(offset));
+	sc16is7xx_port_write(port, SC16IS7XX_IOSTATE_REG, state);
 
 	return 0;
 }

6.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Aaron Armstrong Skomra <[email protected]>

commit 9ac6678b95b0dd9458a7a6869f46e51cd55a1d84 upstream.

Currently the EKR battery remains even after we stop getting information from the device. This can lead to a stale battery persisting indefinitely in userspace.

The remote sends a heartbeat every 10 seconds. Delete the battery if we miss two heartbeats (after 21 seconds). Restore the battery once we see a heartbeat again.

---
 drivers/hid/wacom.h     |    1 +
 drivers/hid/wacom_sys.c |   25 +++++++++++++++++++++----
 drivers/hid/wacom_wac.c |    1 +
 drivers/hid/wacom_wac.h |    1 +
 4 files changed, 24 insertions(+), 4 deletions(-)

@@ -150,6 +150,7 @@ struct wacom_remote {
 		struct input_dev *input;
 		bool registered;
 		struct wacom_battery battery;
+		ktime_t active_time;
 	} remotes[WACOM_MAX_REMOTES];
 };
 

@@ -2523,6 +2523,18 @@ fail:
 	return;
 }
 
+static void wacom_remote_destroy_battery(struct wacom *wacom, int index)
+{
+	struct wacom_remote *remote = wacom->remote;
+
+	if (remote->remotes[index].battery.battery) {
+		devres_release_group(&wacom->hdev->dev,
+				     &remote->remotes[index].battery.bat_desc);
+		remote->remotes[index].battery.battery = NULL;
+		remote->remotes[index].active_time = 0;
+	}
+}
+
 static void wacom_remote_destroy_one(struct wacom *wacom, unsigned int index)
 {
 	struct wacom_remote *remote = wacom->remote;

@@ -2537,9 +2549,7 @@ static void wacom_remote_destroy_one(str
 			remote->remotes[i].registered = false;
 			spin_unlock_irqrestore(&remote->remote_lock, flags);
 
-			if (remote->remotes[i].battery.battery)
-				devres_release_group(&wacom->hdev->dev,
-						     &remote->remotes[i].battery.bat_desc);
+			wacom_remote_destroy_battery(wacom, i);
 
 			if (remote->remotes[i].group.name)
 				devres_release_group(&wacom->hdev->dev,

@@ -2547,7 +2557,6 @@ static void wacom_remote_destroy_one(str
 
 			remote->remotes[i].serial = 0;
 			remote->remotes[i].group.name = NULL;
-			remote->remotes[i].battery.battery = NULL;
 			wacom->led.groups[i].select = WACOM_STATUS_UNKNOWN;
 		}
 	}

@@ -2632,6 +2641,9 @@ static int wacom_remote_attach_battery(s
 	if (remote->remotes[index].battery.battery)
 		return 0;
 
+	if (!remote->remotes[index].active_time)
+		return 0;
+
 	if (wacom->led.groups[index].select == WACOM_STATUS_UNKNOWN)
 		return 0;
 

@@ -2647,6 +2659,7 @@ static void wacom_remote_work(struct wor
 {
 	struct wacom *wacom = container_of(work, struct wacom, remote_work);
 	struct wacom_remote *remote = wacom->remote;
+	ktime_t kt = ktime_get();
 	struct wacom_remote_data data;
 	unsigned long flags;
 	unsigned int count;

@@ -2673,6 +2686,10 @@ static void wacom_remote_work(struct wor
 		serial = data.remote[i].serial;
 		if (data.remote[i].connected) {
 
+			if (kt - remote->remotes[i].active_time > WACOM_REMOTE_BATTERY_TIMEOUT
+			    && remote->remotes[i].active_time != 0)
+				wacom_remote_destroy_battery(wacom, i);
+
 			if (remote->remotes[i].serial == serial) {
 				wacom_remote_attach_battery(wacom, i);
 				continue;

@@ -1134,6 +1134,7 @@ static int wacom_remote_irq(struct wacom
 	if (index < 0 || !remote->remotes[index].registered)
 		goto out;
 
+	remote->remotes[i].active_time = ktime_get();
 	input = remote->remotes[index].input;
 
 	input_report_key(input, BTN_0, (data[9] & 0x01));

@@ -13,6 +13,7 @@
 #define WACOM_NAME_MAX		64
 #define WACOM_MAX_REMOTES	5
 #define WACOM_STATUS_UNKNOWN	255
+#define WACOM_REMOTE_BATTERY_TIMEOUT	21000000000ll
 
 /* packet length for individual models */
 #define WACOM_PKGLEN_BBFUN	 9

For RCU,

thanks,

- Joel

Successfully compiled and installed bindeb-pkgs on my computer (Acer Aspire E15, Intel Core i3 Haswell). No noticeable regressions.

An old man doll... just what I always wanted! - Clara

Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.

## Build
* kernel: 6.5.2-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-6.5.y
* git commit: 3b1345379dfa8756bebb7a0a5dcb41cf9e0ba98e
* git describe: v6.5.1-35-g3b1345379dfa
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.5.y/build/v6.5.1-35-g3b1345379dfa

## Test Regressions (compared to v6.5.1)

## Metric Regressions (compared to v6.5.1)

## Test Fixes (compared to v6.5.1)

## Metric Fixes (compared to v6.5.1)

## Test result summary
total: 142284, pass: 122577, fail: 2113, skip: 17398, xfail: 196

## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 142 total, 140 passed, 2 failed
* arm64: 53 total, 50 passed, 3 failed
* i386: 41 total, 39 passed, 2 failed
* mips: 30 total, 28 passed, 2 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 37 total, 35 passed, 2 failed
* riscv: 25 total, 22 passed, 3 failed
* s390: 16 total, 13 passed, 3 failed
* sh: 14 total, 12 passed, 2 failed
* sparc: 8 total, 8 passed, 0 failed
* x86_64: 46 total, 42 passed, 4 failed

## Test suites summary
* boot
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-net-mptcp
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-user_events
* kselftest-vDSO
* kselftest-vm
* kselftest-watchdog
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* perf
* rcutorture

--
Linaro LKFT
https://lkft.linaro.org

Hi Greg,

Build test (gcc version 12.3.1 20230829):
mips: 52 configs -> no failure
arm: 70 configs -> no failure
arm64: 3 configs -> no failure
x86_64: 4 configs -> no failure
alpha allmodconfig -> no failure
csky allmodconfig -> no failure
powerpc allmodconfig -> no failure
riscv allmodconfig -> no failure
s390 allmodconfig -> no failure
xtensa allmodconfig -> no failure

Boot test:
x86_64: Booted on my test laptop. No regression.
x86_64: Booted on qemu. No regression. [1]
arm64: Booted on rpi4b (4GB model). No regression. [2]
mips: Booted on ci20 board. No regression. [3]

[1]. https://openqa.qa.codethink.co.uk/tests/4947
[2]. https://openqa.qa.codethink.co.uk/tests/4955
[3]. https://openqa.qa.codethink.co.uk/tests/4956

Regards
Sudip

All tests passing for Tegra ...

Test results for stable-v6.5:

    11 builds:	11 pass, 0 fail
    28 boots:	28 pass, 0 fail
    130 tests:	130 pass, 0 fail

Linux version: 6.5.2-rc1-g3b1345379dfa
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,

                tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
                tegra20-ventana, tegra210-p2371-2180,
                tegra210-p3450-0000, tegra30-cardhu-a04

Jon

Tested rc1 against the Fedora build system (aarch64, ppc64le, s390x, x86_64), and boot tested x86_64. No regressions noted.

Compiled and booted on my test system. No dmesg regressions.

thanks,
-- Shuah

Built and booted successfully on RISC-V RV64 (HiFive Unmatched).

Hello,

This rc kernel passes DAMON functionality test[1] on my test machine. Attaching the test results summary below. Please note that I retrieved the kernel from linux-stable-rc tree[2].

[1] https://github.com/awslabs/damon-tests/tree/next/corr
[2] 3b1345379dfa ("Linux 6.5.2-rc1")

Thanks,
SJ

[...]

---

ok 1 selftests: damon: debugfs_attrs.sh
ok 2 selftests: damon: debugfs_schemes.sh
ok 3 selftests: damon: debugfs_target_ids.sh
ok 4 selftests: damon: debugfs_empty_targets.sh
ok 5 selftests: damon: debugfs_huge_count_read_write.sh
ok 6 selftests: damon: debugfs_duplicate_context_creation.sh
ok 7 selftests: damon: debugfs_rm_non_contexts.sh
ok 8 selftests: damon: sysfs.sh
ok 9 selftests: damon: sysfs_update_removed_scheme_dir.sh
ok 10 selftests: damon: reclaim.sh
ok 11 selftests: damon: lru_sort.sh
ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_m68k.sh
ok 12 selftests: damon-tests: build_arm64.sh
ok 13 selftests: damon-tests: build_i386_idle_flag.sh
ok 14 selftests: damon-tests: build_i386_highpte.sh
ok 15 selftests: damon-tests: build_nomemcg.sh

PASS

Hi Greg,

6.5.2-rc1 tested.

Run tested on:
- Allwinner H6 (Tanix TX6)
- Intel Alder Lake x86_64 (nuc12 i7-1260P)

In addition - build tested for:
- Allwinner A64
- Allwinner H3
- Allwinner H5
- NXP iMX6
- NXP iMX8
- Qualcomm Dragonboard
- Rockchip RK3288
- Rockchip RK3328
- Rockchip RK3399pro
- Samsung Exynos

--
Rudi

Build results:

	total: 157 pass: 157 fail: 0
Qemu test results:
	total: 524 pass: 524 fail: 0

Guenter

Hi

This patch, as part of v6.5.2, breaks the in-kernel ds3000 module (for a TeVii s480 v2 DVB-S2 card, which is a PCIe card attaching two onboard TeVii s660 cards via an onboard USB2 controller (MCS9990),
https://www.linuxtv.org/wiki/index.php/TeVii_S480) from loading.

[    2.896589] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[    2.901085] failing symbol_get of non-GPLONLY symbol ds3000_attach.
[    2.901089] DVB: Unable to find symbol ds3000_attach()
[    2.901091] dvb-usb: no frontend was attached by 'TeVii S480.2 USB'

$ dmesg | grep -i -e dvb -e dw21 -e ds3000 -e symbol
[    2.739710] dvb-usb: found a 'TeVii S480.2 USB' in cold state, will try to load a firmware
[    2.740232] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw'
[    2.740233] dw2102: start downloading DW210X firmware
[    2.743090] dvb-usb: found a 'Microsoft Xbox One Digital TV Tuner' in cold state, will try to load a firmware
[    2.743217] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw'
[    2.896066] dvb-usb: found a 'TeVii S480.2 USB' in warm state.
[    2.896297] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[    2.896344] dvbdev: DVB: registering new adapter (TeVii S480.2 USB)
[    2.896450] dvb-usb: MAC address: 9f:9f:9f:9f:9f:9f
[    2.896589] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[    2.901085] failing symbol_get of non-GPLONLY symbol ds3000_attach.
[    2.901089] DVB: Unable to find symbol ds3000_attach()
[    2.901091] dvb-usb: no frontend was attached by 'TeVii S480.2 USB'
[    2.925255] rc rc0: lirc_dev: driver dw2102 registered at minor = 0, scancode receiver, no transmitter
[    2.925398] dvb-usb: schedule remote query interval to 150 msecs.
[    2.925401] dvb-usb: TeVii S480.2 USB successfully initialized and connected.
[    2.925458] dvb-usb: found a 'TeVii S480.1 USB' in cold state, will try to load a firmware
[    2.925488] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw'
[    2.925489] dw2102: start downloading DW210X firmware
[    2.959695] dvb-usb: TeVii S480.2 USB successfully deinitialized and disconnected.
[    3.079102] dvb-usb: found a 'TeVii S480.1 USB' in warm state.
[    3.079416] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[    3.079486] dvbdev: DVB: registering new adapter (TeVii S480.1 USB)
[    3.079777] dvb-usb: MAC address: 2f:2f:2f:2f:2f:2f
[    3.080123] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[    3.080622] failing symbol_get of non-GPLONLY symbol ds3000_attach.
[    3.083513] failing symbol_get of non-GPLONLY symbol ds3000_attach.
[    3.083516] DVB: Unable to find symbol ds3000_attach()
[    3.085420] dvb-usb: no frontend was attached by 'TeVii S480.1 USB'
[    3.087260] rc rc1: lirc_dev: driver dw2102 registered at minor = 0, scancode receiver, no transmitter
[    3.087362] dvb-usb: schedule remote query interval to 150 msecs.
[    3.087365] dvb-usb: TeVii S480.1 USB successfully initialized and connected.
[    3.087451] usbcore: registered new interface driver dw2102
[    3.115445] dvb-usb: TeVii S480.1 USB successfully deinitialized and disconnected.
[    3.319289] dvb-usb: found a 'Microsoft Xbox One Digital TV Tuner' in warm state.
[    3.319543] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[    3.320133] dvbdev: DVB: registering new adapter (Microsoft Xbox One Digital TV Tuner)
[    3.320350] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[    3.498941] usb 5-5: DVB: registering adapter 0 frontend 0 (Panasonic MN88472)...
[    3.498948] dvbdev: dvb_create_media_entity: media entity 'Panasonic MN88472' registered.
[    3.499264] dvb-usb: Microsoft Xbox One Digital TV Tuner successfully initialized and connected.
[    3.499437] usbcore: registered new interface driver dvb_usb_dib0700
[    4.667281] usb 1-1: Product: DVBS2BOX
[    4.667833] dvb-usb: found a 'TeVii S660 USB' in cold state, will try to load a firmware
[    4.667883] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw'
[    4.667885] dw2102: start downloading DW210X firmware
[    4.823196] dvb-usb: found a 'TeVii S660 USB' in warm state.
[    4.823520] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[    4.823950] dvbdev: DVB: registering new adapter (TeVii S660 USB)
[    4.851318] usb 4-1: Product: DVBS2BOX
[    4.851853] dvb-usb: found a 'TeVii S660 USB' in cold state, will try to load a firmware
[    4.851898] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw'
[    4.851900] dw2102: start downloading DW210X firmware
[    5.007159] dvb-usb: found a 'TeVii S660 USB' in warm state.
[    5.007469] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[    5.007837] dvbdev: DVB: registering new adapter (TeVii S660 USB)
[    5.067116] dvb-usb: MAC address: 00:18:XX:XX:XX:XX
[    5.067337] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[    5.067802] failing symbol_get of non-GPLONLY symbol ds3000_attach.
[    5.071091] failing symbol_get of non-GPLONLY symbol ds3000_attach.
[    5.071094] DVB: Unable to find symbol ds3000_attach()
[    5.072124] dvb-usb: no frontend was attached by 'TeVii S660 USB'
[    5.074041] rc rc1: lirc_dev: driver dw2102 registered at minor = 0, scancode receiver, no transmitter
[    5.074244] dvb-usb: schedule remote query interval to 150 msecs.
[    5.074254] dvb-usb: TeVii S660 USB successfully initialized and connected.
[    5.250767] dvb-usb: MAC address: 00:18:XX:XX:XX:XX
[    5.250985] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[    5.251599] failing symbol_get of non-GPLONLY symbol ds3000_attach.
[    5.254664] failing symbol_get of non-GPLONLY symbol ds3000_attach.
[    5.254666] DVB: Unable to find symbol ds3000_attach()
[    5.255871] dvb-usb: no frontend was attached by 'TeVii S660 USB'
[    5.257962] rc rc2: lirc_dev: driver dw2102 registered at minor = 2, scancode receiver, no transmitter
[    5.258132] dvb-usb: schedule remote query interval to 150 msecs.
[    5.258135] dvb-usb: TeVii S660 USB successfully initialized and connected.
[   13.070175] mn88472 12-0018: downloading firmware from file 'dvb-demod-mn88472-02.fw'

This is a self built version of v6.5.2, without any out-of-tree-, backports- or proprietary modules being loaded.

$ lspci -nn
00:00.0 Host bridge [0600]: Intel Corporation Device [8086:a703] (rev 01)
00:02.0 VGA compatible controller [0300]: Intel Corporation Raptor Lake-S GT1 [UHD Graphics 770] [8086:a780] (rev 04)
00:06.0 PCI bridge [0604]: Intel Corporation Raptor Lake PCIe 4.0 Graphics Port [8086:a74d] (rev 01)
00:08.0 System peripheral [0880]: Intel Corporation GNA Scoring Accelerator module [8086:a74f] (rev 01)
00:0a.0 Signal processing controller [1180]: Intel Corporation Raptor Lake Crashlog and Telemetry [8086:a77d] (rev 01)
00:0e.0 RAID bus controller [0104]: Intel Corporation Volume Management Device NVMe RAID Controller Intel Corporation [8086:a77f]
00:14.0 USB controller [0c03]: Intel Corporation Device [8086:7a60] (rev 11)
00:14.2 RAM memory [0500]: Intel Corporation Device [8086:7a27] (rev 11)
00:14.3 Network controller [0280]: Intel Corporation Device [8086:7a70] (rev 11)
00:15.0 Serial bus controller [0c80]: Intel Corporation Device [8086:7a4c] (rev 11)
00:16.0 Communication controller [0780]: Intel Corporation Device [8086:7a68] (rev 11)
00:17.0 SATA controller [0106]: Intel Corporation Device [8086:7a62] (rev 11)
00:1a.0 PCI bridge [0604]: Intel Corporation Device [8086:7a48] (rev 11)
00:1c.0 PCI bridge [0604]: Intel Corporation Device [8086:7a38] (rev 11)
00:1c.2 PCI bridge [0604]: Intel Corporation Device [8086:7a3a] (rev 11)
00:1c.4 PCI bridge [0604]: Intel Corporation Device [8086:7a3c] (rev 11)
00:1d.0 PCI bridge [0604]: Intel Corporation Device [8086:7a36] (rev 11)
00:1f.0 ISA bridge [0601]: Intel Corporation Device [8086:7a06] (rev 11)
00:1f.3 Audio device [0403]: Intel Corporation Device [8086:7a50] (rev 11)
00:1f.4 SMBus [0c05]: Intel Corporation Device [8086:7a23] (rev 11)
00:1f.5 Serial bus controller [0c80]: Intel Corporation Device [8086:7a24] (rev 11)
01:00.0 Non-Volatile memory controller [0108]: Micron/Crucial Technology P5 Plus NVMe PCIe SSD [c0a9:5407]
04:00.0 Ethernet controller [0200]: Realtek Semiconductor Co., Ltd. RTL8125 2.5GbE Controller [10ec:8125] (rev 05)
05:00.0 SATA controller [0106]: ASMedia Technology Inc. ASM1062 Serial ATA Controller [1b21:0612] (rev 02)
06:00.0 USB controller [0c03]: MosChip Semiconductor Technology Ltd. MCS9990 PCIe to 4-Port USB 2.0 Host Controller [9710:9990]
06:00.1 USB controller [0c03]: MosChip Semiconductor Technology Ltd. MCS9990 PCIe to 4-Port USB 2.0 Host Controller [9710:9990]
06:00.2 USB controller [0c03]: MosChip Semiconductor Technology Ltd. MCS9990 PCIe to 4-Port USB 2.0 Host Controller [9710:9990]
06:00.3 USB controller [0c03]: MosChip Semiconductor Technology Ltd. MCS9990 PCIe to 4-Port USB 2.0 Host Controller [9710:9990]
06:00.4 USB controller [0c03]: MosChip Semiconductor Technology Ltd. MCS9990 PCIe to 4-Port USB 2.0 Host Controller [9710:9990]
06:00.5 USB controller [0c03]: MosChip Semiconductor Technology Ltd. MCS9990 PCIe to 4-Port USB 2.0 Host Controller [9710:9990]
06:00.6 USB controller [0c03]: MosChip Semiconductor Technology Ltd. MCS9990 PCIe to 4-Port USB 2.0 Host Controller [9710:9990]
06:00.7 USB controller [0c03]: MosChip Semiconductor Technology Ltd. MCS9990 PCIe to 4-Port USB 2.0 Host Controller [9710:9990]

$ lsusb
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 010 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 009 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 001 Device 003: ID 9022:d660 TeVii Technology Ltd. DVB-S2 S660
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 008 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 004 Device 003: ID 9022:d660 TeVii Technology Ltd. DVB-S2 S660
Bus 004 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 007 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 006 Device 002: ID 174c:3074 ASMedia Technology Inc. ASM1074 SuperSpeed hub
Bus 006 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 005 Device 003: ID 174c:2074 ASMedia Technology Inc. ASM1074 High-Speed hub
Bus 005 Device 002: ID 045e:02d5 Microsoft Corp. Xbox One Digital TV Tuner
Bus 005 Device 007: ID 8087:0026 Intel Corp. AX201 Bluetooth
Bus 005 Device 005: ID 0b05:19af ASUSTek Computer, Inc. AURA LED Controller
Bus 005 Device 010: ID 0609:0334 SMK Manufacturing, Inc. eHome Infrared Receiver
Bus 005 Device 009: ID 04d9:1603 Holtek Semiconductor, Inc. Keyboard
Bus 005 Device 008: ID 046d:c069 Logitech, Inc. M-U0007 [Corded Mouse M500]
Bus 005 Device 006: ID 147e:2016 Upek Biometric Touchchip/Touchstrip Fingerprint Sensor
Bus 005 Device 004: ID 05e3:0608 Genesys Logic, Inc. Hub
Bus 005 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

$ ls -1 /sys/module/
8250
842_compress
842_decompress
ac97_bus
acpi
acpi_pad
acpiphp
acpi_tad
aesni_intel
af_alg
af_packet
ahci
algif_hash
algif_skcipher
asus_nb_wmi
asus_wmi
async_memcpy
async_pq
async_raid6_recov
async_tx
async_xor
autofs4
battery
binder
binder_alloc
binfmt_misc
blk_cgroup
blk_crypto
block
bluetooth
bnep
bridge
btbcm
btintel
btmtk
btrtl
btusb
button
ccp
cec
cfg80211
clocksource
cmac
configfs
coretemp
cpufreq
cpufreq_conservative
cpufreq_powersave
cpuid
cpuidle
cpuidle_haltpoll
crc16
crc32c_generic
crc32c_intel
crc32_pclmul
crc64_rocksoft
crc_t10dif
crct10dif_pclmul
cryptd
cryptomgr
crypto_simd
device_hmem
dib0070
dib0090
dib3000mc
dib7000m
dibx000_common
dm_mod
dns_resolver
drm
drm_buddy
drm_display_helper
drm_kms_helper
ds3000
dvb_core
dvb_usb
dvb_usb_dib0700
dvb_usb_dw2102
edac_core
ee1004
eeepc_wmi
efi_pstore
ehci_hcd
ehci_pci
evdev
ext4
fan
fat
fb
firmware_class
fscrypto
fuse
ghash_clmulni_intel
gpiolib_acpi
grant_table
haltpoll
hid
hid_generic
hwmon_vid
i2c_algo_bit
i2c_core
i2c_designware_core
i2c_designware_platform
i2c_dev
i2c_i801
i2c_smbus
i8042
i915
idma64
ima
intel_cstate
intel_gtt
intel_idle
intel_lpss
intel_lpss_pci
intel_pmc_bxt
intel_pmc_core
intel_powerclamp
intel_rapl_common
intel_rapl_msr
intel_tcc_cooling
intel_uncore_frequency
intel_uncore_frequency_common
intel_vsec
ip_tables
ipv6
irqbypass
ir_rc6_decoder
iTCO_vendor_support
iTCO_wdt
iwlmvm
iwlwifi
jbd2
kernel
keyboard
kfence
kvm
kvm_intel
ledtrig_audio
libahci
libarc4
libata
libcrc32c
linear
llc
loop
lp
mac80211
mbcache
mc
mceusb
md_mod
mei
mei_hdcp
mei_me
mei_pxp
memory_hotplug
mfd_core
mn88472
module
mousedev
msr
multipath
nct6775
nct6775_core
netpoll
nls_cp437
nls_utf8
nmi_backtrace
nvme
nvme_core
ohci_hcd
ohci_pci
page_alloc
page_reporting
parport
parport_pc
pcie_aspm
pciehp
pci_hotplug
pcspkr
pinctrl_alderlake
platform_profile
pmt_class
pmt_telemetry
polyval_clmulni
polyval_generic
ppdev
printk
processor
pstore
r8169
raid0
raid1
raid10
raid456
raid6_pq
random
rapl
rc_core
rc_rc6_mce
rc_tevii_nec
rcupdate
rcutree
realtek
regmap_i2c
rfcomm
rfkill
rng_core
rtc_cmos
scsi_common
scsi_mod
sd_mod
secretmem
sg
sha512_ssse3
snd
snd_compress
snd_hda_codec
snd_hda_codec_generic
snd_hda_codec_hdmi
snd_hda_codec_realtek
snd_hda_core
snd_hda_ext_core
snd_hda_intel
snd_hwdep
snd_intel_dspcfg
snd_intel_sdw_acpi
snd_pcm
snd_pcm_dmaengine
snd_soc_acpi
snd_soc_acpi_intel_match
snd_soc_core
snd_soc_hdac_hda
snd_sof
snd_sof_intel_hda
snd_sof_intel_hda_common
snd_sof_intel_hda_mlink
snd_sof_pci
snd_sof_pci_intel_tgl
snd_sof_utils
snd_sof_xtensa_dsp
snd_timer
soundcore
soundwire_cadence
soundwire_generic_allocation
soundwire_intel
sparse_keymap
spurious
srcutree
stp
sysrq
tcp_cubic
tda18250
thermal
tpm
tpm_crb
tpm_tis
tpm_tis_core
ttm
tun
udmabuf
usb_common
usbcore
usbhid
vfat
video
videobuf2_common
videobuf2_memops
videobuf2_vmalloc
vmd
vt
watchdog
wmi
wmi_bmof
workqueue
x86_pkg_temp_thermal
xen
xhci_hcd
xhci_pci
xhci_pci_renesas
xor
x_tables
xz_dec
zswap

Regards
Stefan Lippers-Hollmann

This is also broken in Linus's tree, right?

This is odd, where is that call coming from? I don't see any call to symbol_get in the dvb code, where is this happening?

Anyway, does the patch below fix this?

thanks,

greg k-h

----------------

index 20fcf31af165..515aa7c7baf2 100644
@@ -859,7 +859,7 @@ struct dvb_frontend *ds3000_attach(const struct ds3000_config *config,
 	ds3000_set_voltage(&state->frontend, SEC_VOLTAGE_OFF);
 	return &state->frontend;
 }
-EXPORT_SYMBOL(ds3000_attach);
+EXPORT_SYMBOL_GPL(ds3000_attach);
 
 static int ds3000_set_carrier_offset(struct dvb_frontend *fe,
 					s32 carrier_offset_khz)

Hi

Yes, HEAD as of 6.5.0-12145-g4a0fc73da97e is affected just as well.

That change alone only moves the issue down to ts2020_attach().

$ dmesg | grep -i -e dvb -e gpl -e symbol
[    1.464876] usb 3-1: Product: DVBS2BOX
[    1.482143] usb 5-1: Product: DVBS2BOX
[    3.692647] dvb-usb: found a 'TeVii S660 USB' in cold state, will try to load a firmware
[    3.692951] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw'
[    3.860571] dvb-usb: found a 'TeVii S660 USB' in warm state.
[    3.860615] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[    3.860944] dvbdev: DVB: registering new adapter (TeVii S660 USB)
[    4.097144] dvb-usb: MAC address: 00:18:XX:XX:XX:XX
[    4.097272] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[    4.111792] failing symbol_get of non-GPLONLY symbol ts2020_attach.
[    4.111795] DVB: Unable to find symbol ts2020_attach()
[    4.112759] usb 3-1: DVB: registering adapter 0 frontend 0 (Montage Technology DS3000)...
[    4.112764] dvbdev: dvb_create_media_entity: media entity 'Montage Technology DS3000' registered.
[    4.138938] dvb-usb: schedule remote query interval to 150 msecs.
[    4.138942] dvb-usb: TeVii S660 USB successfully initialized and connected.
[    4.138988] dvb-usb: found a 'TeVii S660 USB' in cold state, will try to load a firmware
[    4.139016] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw'
[    4.292614] dvb-usb: found a 'TeVii S660 USB' in warm state.
[    4.292679] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[    4.293075] dvbdev: DVB: registering new adapter (TeVii S660 USB)
[    4.538876] dvb-usb: MAC address: 00:18:XX:XX:XX:XX
[    4.539113] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[    4.543738] failing symbol_get of non-GPLONLY symbol ts2020_attach.
[    4.546349] failing symbol_get of non-GPLONLY symbol ts2020_attach.
[    4.546354] DVB: Unable to find symbol ts2020_attach()
[    4.548643] usb 5-1: DVB: registering adapter 1 frontend 0 (Montage Technology DS3000)...
[    4.548650] dvbdev: dvb_create_media_entity: media entity 'Montage Technology DS3000' registered.
[    4.549970] dvb-usb: schedule remote query interval to 150 msecs.
[    4.549973] dvb-usb: TeVii S660 USB successfully initialized and connected.
[    7.830408] ds3000_firmware_ondemand: Waiting for firmware upload (dvb-fe-ds3000.fw)...
[    8.367600] ds3000_firmware_ondemand: Waiting for firmware upload (dvb-fe-ds3000.fw)...

Extending this to approach to ts2020_attach() does fix the problem for me. Searching the web for "failing symbol_get of non-GPLONLY symbol" suggests that there might be further instances within the DVB subsystem https://syzkaller.appspot.com/x/log.txt?x=11faa1eda80000
(this was merely gathered by a passive web search, I have no contact to the poster or any further information about it).

[ now fully functional with EXPORT_SYMBOL_GPL(ds3000_attach) and
EXPORT_SYMBOL_GPL(ts2020_attach) ]

$ dmesg | grep -i -e dvb -e gpl -e symbol -e taint
[    1.499064] usb 3-1: Product: DVBS2BOX
[    1.505760] usb 4-1: Product: DVBS2BOX
[    3.915802] dvb-usb: found a 'TeVii S660 USB' in cold state, will try to load a firmware
[    3.917134] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw'
[    4.084566] dvb-usb: found a 'TeVii S660 USB' in warm state.
[    4.084602] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[    4.084984] dvbdev: DVB: registering new adapter (TeVii S660 USB)
[    4.320740] dvb-usb: MAC address: 00:18:XX:XX:XX:XX
[    4.320871] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[    4.390349] usb 3-1: DVB: registering adapter 0 frontend 0 (Montage Technology DS3000)...
[    4.390356] dvbdev: dvb_create_media_entity: media entity 'Montage Technology DS3000' registered.
[    4.416869] dvb-usb: schedule remote query interval to 150 msecs.
[    4.416872] dvb-usb: TeVii S660 USB successfully initialized and connected.
[    4.416905] dvb-usb: found a 'TeVii S660 USB' in cold state, will try to load a firmware
[    4.416927] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw'
[    4.572611] dvb-usb: found a 'TeVii S660 USB' in warm state.
[    4.572679] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[    4.573066] dvbdev: DVB: registering new adapter (TeVii S660 USB)
[    4.821631] dvb-usb: MAC address: 00:18:XX:XX:XX:XX
[    4.821757] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[    4.884845] usb 4-1: DVB: registering adapter 1 frontend 0 (Montage Technology DS3000)...
[    4.884856] dvbdev: dvb_create_media_entity: media entity 'Montage Technology DS3000' registered.
[    4.886511] dvb-usb: schedule remote query interval to 150 msecs.
[    4.886514] dvb-usb: TeVii S660 USB successfully initialized and connected.
[    7.312401] ds3000_firmware_ondemand: Waiting for firmware upload (dvb-fe-ds3000.fw)...
[    7.918355] ds3000_firmware_ondemand: Waiting for firmware upload (dvb-fe-ds3000.fw)...
[    7.919675] ds3000_firmware_ondemand: Waiting for firmware upload (dvb-fe-ds3000.fw)...

With these changes, my DVB-S2 and DVB-T2 cards are working:
- https://www.linuxtv.org/wiki/index.php/TeVii_S480
- https://www.linuxtv.org/wiki/index.php/Xbox_One_Digital_TV_Tuner

Thanks a lot
Stefan Lippers-Hollmann

---

@@ -525,7 +525,7 @@ struct dvb_frontend *ts2020_attach(struc
 
 	return fe;
 }
-EXPORT_SYMBOL(ts2020_attach);
+EXPORT_SYMBOL_GPL(ts2020_attach);
 
 /*
  * We implement own regmap locking due to legacy DVB attach which uses frontend

Ok, good, thanks for confirming.

Ugh, it looks like everyone that calls dvb_attach() is going to be affected. I can make up a patch for this later today, unless Christoph beats me to it :)

Also, in commit 8f569c0b4e6b ("media: dvb-core: add helper functions for I2C binding"), way back in 2018, it says no one should be using this function anymore, but given I see over 700 uses of it, that's obviously not changing any time soon :(

Thanks for testing this.

greg k-h

And it's over 130 symbols, attached, I'll figure out a way to script this...

as102_attach
ascot2e_attach
atbm8830_attach
au8522_attach
bcm3510_attach
cx22700_attach
cx22702_attach
cx24110_attach
cx24113_attach
cx24116_attach
cx24117_attach
cx24120_attach
cx24123_attach
cxd2820r_attach
cxd2841er_attach_s
cxd2841er_attach_t_c
cxd2880_attach
ddbridge_dummy_fe_qam_attach
dib0070_attach
dib0090_fw_register
dib0090_register
dib3000mb_attach
dib3000mc_attach
dib7000m_attach
dib7000p_attach
dib8000_attach
dib9000_attach
drx39xxj_attach
drxd_attach
drxk_attach
ds3000_attach
dst_attach
dst_ca_attach
dvb_pll_attach
ec100_attach
fc0011_attach
fc0012_attach
fc0013_attach
gp8psk_fe_attach
helene_attach
helene_attach_s
horus3a_attach
isl6405_attach
isl6421_attach
isl6423_attach
itd1000_attach
ix2505v_attach
l64781_attach
lg2160_attach
lgdt3305_attach
lgdt3306a_attach
lgdt330x_attach
lgs8gxx_attach
lnbh24_attach
lnbh25_attach
lnbp21_attach
lnbp22_attach
m88ds3103_attach
m88rs2000_attach
max2165_attach
mb86a16_attach
mb86a20s_attach
mc44s803_attach
microtune_attach
mt2060_attach
mt2063_attach
mt2131_attach
mt2266_attach
mt312_attach
mt352_attach
mxl111sf_demod_attach
mxl111sf_tuner_attach
mxl5005s_attach
mxl5007t_attach
mxl5xx_attach
nxt200x_attach
nxt6000_attach
or51132_attach
or51211_attach
qt1010_attach
r820t_attach
s5h1409_attach
s5h1411_attach
s5h1420_attach
s5h1432_attach
s921_attach
si21xx_attach
simple_tuner_attach
sp8870_attach
sp887x_attach
stb0899_attach
stb6000_attach
stb6100_attach
stv0288_attach
stv0297_attach
stv0299_attach
stv0367cab_attach
stv0367ddb_attach
stv0367ter_attach
stv0900_attach
stv090x_attach
stv0910_attach
stv6110_attach
stv6110x_attach
stv6111_attach
tda10021_attach
tda10023_attach
tda10045_attach
tda10046_attach
tda10048_attach
tda10086_attach
tda18218_attach
tda18271_attach
tda18271c2dd_attach
tda665x_attach
tda8083_attach
tda8261_attach
tda826x_attach
tda827x_attach
tda829x_attach
tda9887_attach
tea5761_attach
tea5767_attach
ts2020_attach
tua6100_attach
ves1820_attach
ves1x93_attach
xc2028_attach
xc4000_attach
xc5000_attach
zl10036_attach
zl10039_attach
zl10353_attach

Eww. Sorry for missing this, and I suspect it really should be entirely reworked in the future. But for now the scripting sounds right. Let me know if you'd done anything, otherwise I can look into it this afternoon Chilean time.

.. and it turns out dvb_attach has already been deprecated for 5 years time, it's just that it still has all these users around.

Yeah, apis never seem to go away. I'm scripting it now, almost done...

greg k-h