Linux 5.15.131

 
ALSA: usb-audio: Fix init call orders for UAC1 [+ + +]
Author: Takashi Iwai <[email protected]>
Date:   Mon Aug 21 13:18:57 2023 +0200

    ALSA: usb-audio: Fix init call orders for UAC1
    
    commit 5fadc941d07530d681f3b7ec91e56d8445bc3825 upstream.
    
    There have been reports of USB-audio driver spewing errors at the
    probe time on a few devices like Jabra and Logitech.  The suggested
    fix there couldn't be applied as is, unfortunately, because it'll
    likely break other devices.
    
    But, the patch suggested an interesting point: looking at the current
    init code in stream.c, one may notice that it does initialize
    differently from the device setup in endpoint.c.  Namely, for UAC1, we
    should call snd_usb_init_pitch() and snd_usb_init_sample_rate() after
    setting the interface, while the init sequence at parsing calls them
    before setting the interface blindly.
    
    This patch changes the init sequence at parsing for UAC1 (and other
    devices that need a similar behavior) to be aligned with the rest of
    the code, setting the interface at first.  And, this fixes the
    long-standing problems on a few UAC1 devices like Jabra / Logitech,
    as reported, too.
    
    Reported-and-tested-by: Joakim Tjernlund <[email protected]>
    Closes: https://lore.kernel.org/r/[email protected]
    Cc: <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
ARM: pxa: remove use of symbol_get() [+ + +]
Author: Arnd Bergmann <[email protected]>
Date:   Tue Aug 1 19:35:40 2023 +0200

    ARM: pxa: remove use of symbol_get()
    
    commit 0faa29c4207e6e29cfc81b427df60e326c37083a upstream.
    
    The spitz board file uses the obscure symbol_get() function
    to optionally call a function from sharpsl_pm.c if that is
    built. However, the two files are always built together
    these days, and have been for a long time, so this can
    be changed to a normal function call.
    
    Link: https://lore.kernel.org/lkml/[email protected]/
    Signed-off-by: Arnd Bergmann <[email protected]>
    Signed-off-by: Christoph Hellwig <[email protected]>
    Signed-off-by: Luis Chamberlain <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition [+ + +]
Author: Zheng Wang <[email protected]>
Date:   Thu Mar 9 00:45:01 2023 +0800

    Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
    
    commit 73f7b171b7c09139eb3c6a5677c200dc1be5f318 upstream.
    
    In btsdio_probe, the data->work is bound with btsdio_work. It will be
    started in btsdio_send_frame.
    
    If the btsdio_remove runs with a unfinished work, there may be a race
    condition that hdev is freed but used in btsdio_work. Fix it by
    canceling the work before do cleanup in btsdio_remove.
    
    Fixes: CVE-2023-1989
    Fixes: ddbaf13e3609 ("[Bluetooth] Add generic driver for Bluetooth SDIO devices")
    Cc: [email protected]
    Signed-off-by: Zheng Wang <[email protected]>
    Signed-off-by: Luiz Augusto von Dentz <[email protected]>
    [ Denis: Added CVE-2023-1989 and fixes tags. ]
    Signed-off-by: Denis Efremov (Oracle) <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
erofs: ensure that the post-EOF tails are all zeroed [+ + +]
Author: Gao Xiang <[email protected]>
Date:   Thu Aug 31 19:29:58 2023 +0800

    erofs: ensure that the post-EOF tails are all zeroed
    
    commit e4c1cf523d820730a86cae2c6d55924833b6f7ac upstream.
    
    This was accidentally fixed up in commit e4c1cf523d82 but we can't
    take the full change due to other dependancy issues, so here is just
    the actual bugfix that is needed.
    
    [Background]
    
    keltargw reported an issue [1] that with mmaped I/Os, sometimes the
    tail of the last page (after file ends) is not filled with zeroes.
    
    The root cause is that such tail page could be wrongly selected for
    inplace I/Os so the zeroed part will then be filled with compressed
    data instead of zeroes.
    
    A simple fix is to avoid doing inplace I/Os for such tail parts,
    actually that was already fixed upstream in commit e4c1cf523d82
    ("erofs: tidy up z_erofs_do_read_page()") by accident.
    
    [1] https://lore.kernel.org/r/[email protected]
    
    Reported-by: keltargw <[email protected]>
    Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
    Signed-off-by: Gao Xiang <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
 
firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe [+ + +]
Author: Wang Ming <[email protected]>
Date:   Thu Jul 27 14:37:50 2023 -0500

    firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
    
    commit dd218433f2b635d97e8fda3eed047151fd528ce4 upstream.
    
    The devm_memremap() function returns error pointers.
    It never returns NULL. Fix the check.
    
    Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
    Cc: [email protected]
    Signed-off-by: Wang Ming <[email protected]>
    Signed-off-by: Dinh Nguyen <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
fsi: master-ast-cf: Add MODULE_FIRMWARE macro [+ + +]
Author: Juerg Haefliger <[email protected]>
Date:   Wed Jun 28 11:50:39 2023 +0200

    fsi: master-ast-cf: Add MODULE_FIRMWARE macro
    
    commit 3a1d7aff6e65ad6e285e28abe55abbfd484997ee upstream.
    
    The module loads firmware so add a MODULE_FIRMWARE macro to provide that
    information via modinfo.
    
    Fixes: 6a794a27daca ("fsi: master-ast-cf: Add new FSI master using Aspeed ColdFire")
    Cc: [email protected] # 4.19+
    Signed-off-by: Juerg Haefliger <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Joel Stanley <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
HID: wacom: remove the battery when the EKR is off [+ + +]
Author: Aaron Armstrong Skomra <[email protected]>
Date:   Tue Jul 25 15:20:25 2023 -0700

    HID: wacom: remove the battery when the EKR is off
    
    commit 9ac6678b95b0dd9458a7a6869f46e51cd55a1d84 upstream.
    
    Currently the EKR battery remains even after we stop getting information
    from the device. This can lead to a stale battery persisting indefinitely
    in userspace.
    
    The remote sends a heartbeat every 10 seconds. Delete the battery if we
    miss two heartbeats (after 21 seconds). Restore the battery once we see
    a heartbeat again.
    
    Signed-off-by: Aaron Skomra <[email protected]>
    Signed-off-by: Aaron Armstrong Skomra <[email protected]>
    Reviewed-by: Jason Gerecke <[email protected]>
    Fixes: 9f1015d45f62 ("HID: wacom: EKR: attach the power_supply on first connection")
    CC: [email protected]
    Signed-off-by: Jiri Kosina <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
ksmbd: fix wrong DataOffset validation of create context [+ + +]
Author: Namjae Jeon <[email protected]>
Date:   Fri Aug 25 23:39:40 2023 +0900

    ksmbd: fix wrong DataOffset validation of create context
    
    commit 17d5b135bb720832364e8f55f6a887a3c7ec8fdb upstream.
    
    If ->DataOffset of create context is 0, DataBuffer size is not correctly
    validated. This patch change wrong validation code and consider tag
    length in request.
    
    Cc: [email protected]
    Reported-by: [email protected] # ZDI-CAN-21824
    Signed-off-by: Namjae Jeon <[email protected]>
    Signed-off-by: Steve French <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

ksmbd: replace one-element array with flex-array member in struct smb2_ea_info [+ + +]
Author: Namjae Jeon <[email protected]>
Date:   Fri Aug 25 23:41:58 2023 +0900

    ksmbd: replace one-element array with flex-array member in struct smb2_ea_info
    
    commit 0ba5439d9afa2722e7728df56f272c89987540a4 upstream.
    
    UBSAN complains about out-of-bounds array indexes on 1-element arrays in
    struct smb2_ea_info.
    
    UBSAN: array-index-out-of-bounds in fs/smb/server/smb2pdu.c:4335:15
    index 1 is out of range for type 'char [1]'
    CPU: 1 PID: 354 Comm: kworker/1:4 Not tainted 6.5.0-rc4 #1
    Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop
    Reference Platform, BIOS 6.00 07/22/2020
    Workqueue: ksmbd-io handle_ksmbd_work [ksmbd]
    Call Trace:
     <TASK>
     __dump_stack linux/lib/dump_stack.c:88
     dump_stack_lvl+0x48/0x70 linux/lib/dump_stack.c:106
     dump_stack+0x10/0x20 linux/lib/dump_stack.c:113
     ubsan_epilogue linux/lib/ubsan.c:217
     __ubsan_handle_out_of_bounds+0xc6/0x110 linux/lib/ubsan.c:348
     smb2_get_ea linux/fs/smb/server/smb2pdu.c:4335
     smb2_get_info_file linux/fs/smb/server/smb2pdu.c:4900
     smb2_query_info+0x63ae/0x6b20 linux/fs/smb/server/smb2pdu.c:5275
     __process_request linux/fs/smb/server/server.c:145
     __handle_ksmbd_work linux/fs/smb/server/server.c:213
     handle_ksmbd_work+0x348/0x10b0 linux/fs/smb/server/server.c:266
     process_one_work+0x85a/0x1500 linux/kernel/workqueue.c:2597
     worker_thread+0xf3/0x13a0 linux/kernel/workqueue.c:2748
     kthread+0x2b7/0x390 linux/kernel/kthread.c:389
     ret_from_fork+0x44/0x90 linux/arch/x86/kernel/process.c:145
     ret_from_fork_asm+0x1b/0x30 linux/arch/x86/entry/entry_64.S:304
     </TASK>
    
    Cc: [email protected]
    Signed-off-by: Namjae Jeon <[email protected]>
    Signed-off-by: Steve French <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
Linux: Linux 5.15.131 [+ + +]
Author: Greg Kroah-Hartman <[email protected]>
Date:   Wed Sep 6 21:28:41 2023 +0100

    Linux 5.15.131
    
    Link: https://lore.kernel.org/r/[email protected]
    Tested-by: Joel Fernandes (Google) <[email protected]>
    Tested-by: SeongJae Park <[email protected]>
    Tested-by: Sudip Mukherjee <[email protected]>
    Tested-by: Linux Kernel Functional Testing <[email protected]>
    Tested-by: Jon Hunter <[email protected]>
    Tested-by: Florian Fainelli <[email protected]>
    Tested-by: Shuah Khan <[email protected]>
    Tested-by: Ron Economos <[email protected]>
    Tested-by: Harshit Mogalapalli <[email protected]>
    Tested-by: Guenter Roeck <[email protected]>
    Tested-by: Allen Pais <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
mmc: au1xmmc: force non-modular build and remove symbol_get usage [+ + +]
Author: Christoph Hellwig <[email protected]>
Date:   Tue Aug 1 19:35:41 2023 +0200

    mmc: au1xmmc: force non-modular build and remove symbol_get usage
    
    commit d4a5c59a955bba96b273ec1a5885bada24c56979 upstream.
    
    au1xmmc is split somewhat awkwardly into the main mmc subsystem driver,
    and callbacks in platform_data that sit under arch/mips/ and are
    always built in.  The latter than call mmc_detect_change through
    symbol_get.  Remove the use of symbol_get by requiring the driver
    to be built in.  In the future the interrupt handlers for card
    insert/eject detection should probably be moved into the main driver,
    and which point it can be built modular again.
    
    Signed-off-by: Christoph Hellwig <[email protected]>
    Acked-by: Manuel Lauss <[email protected]>
    Reviewed-by: Arnd Bergmann <[email protected]>
    [mcgrof: squashed in depends on MMC=y suggested by Arnd]
    Signed-off-by: Luis Chamberlain <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules [+ + +]
Author: Christoph Hellwig <[email protected]>
Date:   Tue Aug 1 19:35:44 2023 +0200

    modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
    
    commit 9011e49d54dcc7653ebb8a1e05b5badb5ecfa9f9 upstream.
    
    It has recently come to my attention that nvidia is circumventing the
    protection added in 262e6ae7081d ("modules: inherit
    TAINT_PROPRIETARY_MODULE") by importing exports from their proprietary
    modules into an allegedly GPL licensed module and then rexporting them.
    
    Given that symbol_get was only ever intended for tightly cooperating
    modules using very internal symbols it is logical to restrict it to
    being used on EXPORT_SYMBOL_GPL and prevent nvidia from costly DMCA
    Circumvention of Access Controls law suites.
    
    All symbols except for four used through symbol_get were already exported
    as EXPORT_SYMBOL_GPL, and the remaining four ones were switched over in
    the preparation patches.
    
    Fixes: 262e6ae7081d ("modules: inherit TAINT_PROPRIETARY_MODULE")
    Signed-off-by: Christoph Hellwig <[email protected]>
    Reviewed-by: Greg Kroah-Hartman <[email protected]>
    Signed-off-by: Luis Chamberlain <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index [+ + +]
Author: Christoph Hellwig <[email protected]>
Date:   Tue Aug 1 19:35:42 2023 +0200

    net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index
    
    commit 569820befb16ffc755ab7af71f4f08cc5f68f0fe upstream.
    
    enetc_phc_index is only used via symbol_get, which was only ever
    intended for very internal symbols like this one.  Use EXPORT_SYMBOL_GPL
    for it so that symbol_get can enforce only being used on
    EXPORT_SYMBOL_GPL symbols.
    
    Signed-off-by: Christoph Hellwig <[email protected]>
    Reviewed-by: Jakub Kicinski <[email protected]>
    Reviewed-by: Greg Kroah-Hartman <[email protected]>
    Signed-off-by: Luis Chamberlain <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() [+ + +]
Author: Ryusuke Konishi <[email protected]>
Date:   Sat Aug 5 22:20:38 2023 +0900

    nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
    
    commit f83913f8c5b882a312e72b7669762f8a5c9385e4 upstream.
    
    A syzbot stress test reported that create_empty_buffers() called from
    nilfs_lookup_dirty_data_buffers() can cause a general protection fault.
    
    Analysis using its reproducer revealed that the back reference "mapping"
    from a page/folio has been changed to NULL after dirty page/folio gang
    lookup in nilfs_lookup_dirty_data_buffers().
    
    Fix this issue by excluding pages/folios from being collected if, after
    acquiring a lock on each page/folio, its back reference "mapping" differs
    from the pointer to the address space struct that held the page/folio.
    
    Link: https://lkml.kernel.org/r/[email protected]
    Signed-off-by: Ryusuke Konishi <[email protected]>
    Reported-by: [email protected]
    Closes: https://lkml.kernel.org/r/[email protected]
    Tested-by: Ryusuke Konishi <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Ryusuke Konishi <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse [+ + +]
Author: Ryusuke Konishi <[email protected]>
Date:   Fri Aug 18 22:18:04 2023 +0900

    nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
    
    commit cdaac8e7e5a059f9b5e816cda257f08d0abffacd upstream.
    
    A syzbot stress test using a corrupted disk image reported that
    mark_buffer_dirty() called from __nilfs_mark_inode_dirty() or
    nilfs_palloc_commit_alloc_entry() may output a kernel warning, and can
    panic if the kernel is booted with panic_on_warn.
    
    This is because nilfs2 keeps buffer pointers in local structures for some
    metadata and reuses them, but such buffers may be forcibly discarded by
    nilfs_clear_dirty_page() in some critical situations.
    
    This issue is reported to appear after commit 28a65b49eb53 ("nilfs2: do
    not write dirty data after degenerating to read-only"), but the issue has
    potentially existed before.
    
    Fix this issue by checking the uptodate flag when attempting to reuse an
    internally held buffer, and reloading the metadata instead of reusing the
    buffer if the flag was lost.
    
    Link: https://lkml.kernel.org/r/[email protected]
    Signed-off-by: Ryusuke Konishi <[email protected]>
    Reported-by: [email protected]
    Closes: https://lkml.kernel.org/r/[email protected]
    Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption")
    Tested-by: Ryusuke Konishi <[email protected]>
    Cc: <[email protected]> # 3.10+
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
pinctrl: amd: Don't show `Invalid config param` errors [+ + +]
Author: Mario Limonciello <[email protected]>
Date:   Mon Jul 17 15:16:52 2023 -0500

    pinctrl: amd: Don't show `Invalid config param` errors
    
    commit 87b549efcb0f7934b0916d2a00607a878b6f1e0f upstream.
    
    On some systems amd_pinconf_set() is called with parameters
    0x8 (PIN_CONFIG_DRIVE_PUSH_PULL) or 0x14 (PIN_CONFIG_PERSIST_STATE)
    which are not supported by pinctrl-amd.
    
    Don't show an err message when called with an invalid parameter,
    downgrade this to debug instead.
    
    Cc: [email protected] # 6.1
    Fixes: 635a750d958e1 ("pinctrl: amd: Use amd_pinconf_set() for all config options")
    Signed-off-by: Mario Limonciello <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Linus Walleij <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff [+ + +]
Author: Christoph Hellwig <[email protected]>
Date:   Tue Aug 1 19:35:43 2023 +0200

    rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff
    
    commit 95e7ebc6823170256a8ce19fad87912805bfa001 upstream.
    
    ds1685_rtc_poweroff is only used externally via symbol_get, which was
    only ever intended for very internal symbols like this one.  Use
    EXPORT_SYMBOL_GPL for it so that symbol_get can enforce only being used
    on EXPORT_SYMBOL_GPL symbols.
    
    Signed-off-by: Christoph Hellwig <[email protected]>
    Acked-by: Joshua Kinard <[email protected]>
    Reviewed-by: Greg Kroah-Hartman <[email protected]>
    Signed-off-by: Luis Chamberlain <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
serial: qcom-geni: fix opp vote on shutdown [+ + +]
Author: Johan Hovold <[email protected]>
Date:   Fri Jul 14 15:02:13 2023 +0200

    serial: qcom-geni: fix opp vote on shutdown
    
    commit 8ece7b754bc34ffd7fcc8269ccb9128e72ca76d8 upstream.
    
    The operating-performance-point vote needs to be dropped when shutting
    down the port to avoid wasting power by keeping resources like power
    domains in an unnecessarily high performance state (e.g. when a UART
    connected Bluetooth controller is not in use).
    
    Fixes: a5819b548af0 ("tty: serial: qcom_geni_serial: Use OPP API to set clk/perf state")
    Cc: [email protected]      # 5.9
    Cc: Rajendra Nayak <[email protected]>
    Cc: Matthias Kaehlcke <[email protected]>
    Signed-off-by: Johan Hovold <[email protected]>
    Acked-by: Konrad Dybcio <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

serial: sc16is7xx: fix broken port 0 uart init [+ + +]
Author: Hugo Villeneuve <[email protected]>
Date:   Mon Aug 7 17:45:51 2023 -0400

    serial: sc16is7xx: fix broken port 0 uart init
    
    commit 2861ed4d6e6d1a2c9de9bf5b0abd996c2dc673d0 upstream.
    
    The sc16is7xx_config_rs485() function is called only for the second
    port (index 1, channel B), causing initialization problems for the
    first port.
    
    For the sc16is7xx driver, port->membase and port->mapbase are not set,
    and their default values are 0. And we set port->iobase to the device
    index. This means that when the first device is registered using the
    uart_add_one_port() function, the following values will be in the port
    structure:
        port->membase = 0
        port->mapbase = 0
        port->iobase  = 0
    
    Therefore, the function uart_configure_port() in serial_core.c will
    exit early because of the following check:
            /*
             * If there isn't a port here, don't do anything further.
             */
            if (!port->iobase && !port->mapbase && !port->membase)
                    return;
    
    Typically, I2C and SPI drivers do not set port->membase and
    port->mapbase.
    
    The max310x driver sets port->membase to ~0 (all ones). By
    implementing the same change in this driver, uart_configure_port() is
    now correctly executed for all ports.
    
    Fixes: dfeae619d781 ("serial: sc16is7xx")
    Cc: [email protected]
    Signed-off-by: Hugo Villeneuve <[email protected]>
    Reviewed-by: Ilpo Järvinen <[email protected]>
    Reviewed-by: Lech Perczak <[email protected]>
    Tested-by: Lech Perczak <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

serial: sc16is7xx: fix bug when first setting GPIO direction [+ + +]
Author: Hugo Villeneuve <[email protected]>
Date:   Mon Aug 7 17:45:55 2023 -0400

    serial: sc16is7xx: fix bug when first setting GPIO direction
    
    commit 9baeea723c0fb9c3ba9a336369f758ed9bc6831d upstream.
    
    When configuring a pin as an output pin with a value of logic 0, we
    end up as having a value of logic 1 on the output pin. Setting a
    logic 0 a second time (or more) after that will correctly output a
    logic 0 on the output pin.
    
    By default, all GPIO pins are configured as inputs. When we enter
    sc16is7xx_gpio_direction_output() for the first time, we first set the
    desired value in IOSTATE, and then we configure the pin as an output.
    The datasheet states that writing to IOSTATE register will trigger a
    transfer of the value to the I/O pin configured as output, so if the
    pin is configured as an input, nothing will be transferred.
    
    Therefore, set the direction first in IODIR, and then set the desired
    value in IOSTATE.
    
    This is what is done in NXP application note AN10587.
    
    Fixes: dfeae619d781 ("serial: sc16is7xx")
    Cc: [email protected]
    Signed-off-by: Hugo Villeneuve <[email protected]>
    Reviewed-by: Lech Perczak <[email protected]>
    Tested-by: Lech Perczak <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
staging: rtl8712: fix race condition [+ + +]
Author: Nam Cao <[email protected]>
Date:   Mon Jul 31 13:06:20 2023 +0200

    staging: rtl8712: fix race condition
    
    commit 1422b526fba994cf05fd288a152106563b875fce upstream.
    
    In probe function, request_firmware_nowait() is called to load firmware
    asynchronously. At completion of firmware loading, register_netdev() is
    called. However, a mutex needed by netdev is initialized after the call
    to request_firmware_nowait(). Consequently, it can happen that
    register_netdev() is called before the driver is ready.
    
    Move the mutex initialization into r8712_init_drv_sw(), which is called
    before request_firmware_nowait().
    
    Reported-by: [email protected]
    Closes: https://lore.kernel.org/linux-staging/[email protected]/T/#u
    Fixes: 8c213fa59199 ("staging: r8712u: Use asynchronous firmware loading")
    Cc: stable <[email protected]>
    Signed-off-by: Nam Cao <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
tcpm: Avoid soft reset when partner does not support get_status [+ + +]
Author: Badhri Jagan Sridharan <[email protected]>
Date:   Sun Aug 20 04:44:48 2023 +0000

    tcpm: Avoid soft reset when partner does not support get_status
    
    commit 78e0ea4277546debf7e96797ac3b768539cc44f6 upstream.
    
    When partner does not support get_status message, tcpm right now
    responds with soft reset message. This causes PD renegotiation to
    happen and resets PPS link. Avoid soft resetting the link when
    partner does not support get_status message to mitigate PPS resets.
    
    [  208.926752] Setting voltage/current limit 9500 mV 2450 mA
    [  208.930407] set_auto_vbus_discharge_threshold mode:3 pps_active:y vbus:9500 ret:0
    [  208.930418] state change SNK_TRANSITION_SINK -> SNK_READY [rev3 POWER_NEGOTIATION]
    [  208.930455] AMS POWER_NEGOTIATION finished
    
    // ALERT message from the Source
    [  213.948442] PD RX, header: 0x19a6 [1]
    [  213.948451] state change SNK_READY -> GET_STATUS_SEND [rev3 GETTING_SOURCE_SINK_STATUS]
    [  213.948457] PD TX, header: 0x492
    [  213.950402] PD TX complete, status: 0
    [  213.950427] pending state change GET_STATUS_SEND -> GET_STATUS_SEND_TIMEOUT @ 60 ms [rev3 GETTING_SOURCE_SINK_STATUS]
    
    // NOT_SUPPORTED from the Source
    [  213.959954] PD RX, header: 0xbb0 [1]
    
    // sink sends SOFT_RESET
    [  213.959958] state change GET_STATUS_SEND -> SNK_SOFT_RESET [rev3 GETTING_SOURCE_SINK_STATUS]
    [  213.959962] AMS GETTING_SOURCE_SINK_STATUS finished
    [  213.959964] AMS SOFT_RESET_AMS start
    [  213.959966] state change SNK_SOFT_RESET -> AMS_START [rev3 SOFT_RESET_AMS]
    [  213.959969] state change AMS_START -> SOFT_RESET_SEND [rev3 SOFT_RESET_AMS]
    
    Cc: [email protected]
    Fixes: 8dea75e11380 ("usb: typec: tcpm: Protocol Error handling")
    Signed-off-by: Badhri Jagan Sridharan <[email protected]>
    Acked-by: Heikki Krogerus <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0 [+ + +]
Author: Xu Yang <[email protected]>
Date:   Tue Jun 27 19:21:24 2023 +0800

    usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0
    
    commit 36668515d56bf73f06765c71e08c8f7465f1e5c4 upstream.
    
    In current driver, the value of tuning parameter will not take effect
    if samsung,picophy-* is assigned as 0. Because 0 is also a valid value
    acccording to the description of USB_PHY_CFG1 register, this will improve
    the logic to let it work.
    
    Fixes: 58a3cefb3840 ("usb: chipidea: imx: add two samsung picophy parameters tuning implementation")
    cc: <[email protected]>
    Signed-off-by: Xu Yang <[email protected]>
    Acked-by: Peter Chen <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

usb: dwc3: meson-g12a: do post init to fix broken usb after resumption [+ + +]
Author: Luke Lu <[email protected]>
Date:   Wed Aug 9 21:29:11 2023 +0000

    usb: dwc3: meson-g12a: do post init to fix broken usb after resumption
    
    commit 1fa206bb764f37d2ab4bf671e483153ef0659b34 upstream.
    
    Device connected to usb otg port of GXL-based boards can not be
    recognised after resumption, doesn't recover even if disconnect and
    reconnect the device. dmesg shows it disconnects during resumption.
    
    [   41.492911] usb 1-2: USB disconnect, device number 3
    [   41.499346] usb 1-2: unregistering device
    [   41.511939] usb 1-2: unregistering interface 1-2:1.0
    
    Calling usb_post_init() will fix this issue, and it's tested and
    verified on libretech's aml-s905x-cc board.
    
    Cc: [email protected] # v5.8+
    Fixes: c99993376f72 ("usb: dwc3: Add Amlogic G12A DWC3 glue")
    Signed-off-by: Luke Lu <[email protected]>
    Acked-by: Neil Armstrong <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
USB: serial: option: add FOXCONN T99W368/T99W373 product [+ + +]
Author: Slark Xiao <[email protected]>
Date:   Wed Aug 23 15:57:51 2023 +0800

    USB: serial: option: add FOXCONN T99W368/T99W373 product
    
    commit 4d9488b294e1f8353bbcadc4c7172a7f7490199b upstream.
    
    The difference of T99W368 and T99W373 is the chip solution.
    T99W368 is designed based on Qualcomm SDX65 and T99W373 is SDX62.
    
    Test evidence as below:
    T:  Bus=01 Lev=02 Prnt=05 Port=00 Cnt=01 Dev#=  7 Spd=480 MxCh= 0
    D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0489 ProdID=e0f0 Rev=05.04
    S:  Manufacturer=FII
    S:  Product=OLYMPIC USB WWAN Adapter
    S:  SerialNumber=78ada8c4
    C:  #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
    I:  If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
    I:  If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
    I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
    I:  If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    I:  If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
    I:  If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
    
    T:  Bus=01 Lev=02 Prnt=05 Port=00 Cnt=01 Dev#=  8 Spd=480 MxCh= 0
    D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0489 ProdID=e0ee Rev=05.04
    S:  Manufacturer=FII
    S:  Product=OLYMPIC USB WWAN Adapter
    S:  SerialNumber=78ada8d5
    C:  #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
    I:  If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
    I:  If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
    I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
    I:  If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    I:  If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
    I:  If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
    
    Both of them share the same port configuration:
    0&1: MBIM, 2: Modem, 3:GNSS, 4:NMEA, 5:Diag
    GNSS port don't use serial driver.
    
    Signed-off-by: Slark Xiao <[email protected]>
    Cc: [email protected]
    Signed-off-by: Johan Hovold <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

USB: serial: option: add Quectel EM05G variant (0x030e) [+ + +]
Author: Martin Kohn <[email protected]>
Date:   Thu Jul 27 22:23:00 2023 +0000

    USB: serial: option: add Quectel EM05G variant (0x030e)
    
    commit 873854c02364ebb991fc06f7148c14dfb5419e1b upstream.
    
    Add Quectel EM05G with product ID 0x030e.
    Interface 4 is used for qmi.
    
    T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=480  MxCh= 0
    D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=2c7c ProdID=030e Rev= 3.18
    S:  Manufacturer=Quectel
    S:  Product=Quectel EM05-G
    C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
    I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
    E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
    E:  Ad=85(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
    E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
    E:  Ad=87(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
    E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
    E:  Ad=89(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
    E:  Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    
    Signed-off-by: Martin Kohn <[email protected]>
    Cc: [email protected]
    Signed-off-by: Johan Hovold <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
usb: typec: tcpci: clear the fault status bit [+ + +]
Author: Marco Felsch <[email protected]>
Date:   Wed Aug 16 14:25:02 2023 -0300

    usb: typec: tcpci: clear the fault status bit
    
    commit 23e60c8daf5ec2ab1b731310761b668745fcf6ed upstream.
    
    According the "USB Type-C Port Controller Interface Specification v2.0"
    the TCPC sets the fault status register bit-7
    (AllRegistersResetToDefault) once the registers have been reset to
    their default values.
    
    This triggers an alert(-irq) on PTN5110 devices albeit we do mask the
    fault-irq, which may cause a kernel hang. Fix this generically by writing
    a one to the corresponding bit-7.
    
    Cc: [email protected]
    Fixes: 74e656d6b055 ("staging: typec: Type-C Port Controller Interface driver (tcpci)")
    Reported-by: "Angus Ainslie (Purism)" <[email protected]>
    Closes: https://lore.kernel.org/all/[email protected]/
    Reported-by: Christian Bach <[email protected]>
    Closes: https://lore.kernel.org/regressions/ZR0P278MB07737E5F1D48632897D51AC3EB329@ZR0P278MB0773.CHEP278.PROD.OUTLOOK.COM/t/
    Signed-off-by: Marco Felsch <[email protected]>
    Signed-off-by: Fabio Estevam <[email protected]>
    Reviewed-by: Guenter Roeck <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Fabio Estevam <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

usb: typec: tcpci: move tcpci.h to include/linux/usb/ [+ + +]
Author: Xin Ji <[email protected]>
Date:   Wed Jul 6 16:34:31 2022 +0800

    usb: typec: tcpci: move tcpci.h to include/linux/usb/
    
    commit 7963d4d710112bc457f99bdb56608211e561190e upstream.
    
    USB PD controllers which consisting of a microcontroller (acting as the TCPM)
    and a port controller (TCPC) - may require that the driver for the PD
    controller accesses directly also the on-chip port controller in some cases.
    
    Move tcpci.h to include/linux/usb/ is convenience access TCPC registers.
    
    Reviewed-by: Heikki Krogerus <[email protected]>
    Signed-off-by: Xin Ji <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Stable-dep-of: 23e60c8daf5e ("usb: typec: tcpci: clear the fault status bit")
    Signed-off-by: Fabio Estevam <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
wifi: mt76: mt7921: do not support one stream on secondary antenna only [+ + +]
Author: Deren Wu <[email protected]>
Date:   Wed May 10 14:51:13 2023 +0800

    wifi: mt76: mt7921: do not support one stream on secondary antenna only
    
    commit d616d3680264beb9a9d2c4fc681064b06f447eeb upstream.
    
    mt7921 support following antenna combiantions only.
    * primary + secondary (2x2)
    * primary only        (1x1)
    
    Since we cannot work on secondary antenna only, return error if the
    antenna bitmap is 0x2 in .set_antenna().
    
    For example:
    iw phy0 set antenna 3 3 /* valid */
    iw phy0 set antenna 1 1 /* valid */
    iw phy0 set antenna 2 2 /* invalid */
    
    Cc: [email protected]
    Fixes: e0f9fdda81bd ("mt76: mt7921: add ieee80211_ops")
    Suggested-by: Knox Chiou <[email protected]>
    Signed-off-by: Deren Wu <[email protected]>
    Signed-off-by: Felix Fietkau <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>