-LINUX_VERSION-5.15 = .107
-LINUX_KERNEL_HASH-5.15.107 = 19370e769045681f52cceedb14ecda97e89b1b058133a0c8ad45d35ffbc5afa8
+LINUX_VERSION-5.15 = .108
+LINUX_KERNEL_HASH-5.15.108 = 8beb69ada46f1cbca2f4cf901ec078846035c1cd925d9471422f65aff74243ba
void __user *argp = (void __user *)arg;
long ret = 0;
-@@ -1182,6 +1207,15 @@ static long do_fb_ioctl(struct fb_info *
+@@ -1184,6 +1209,15 @@ static long do_fb_ioctl(struct fb_info *
unlock_fb_info(info);
console_unlock();
break;
default:
lock_fb_info(info);
fb = info->fbops;
-@@ -1321,6 +1355,7 @@ static long fb_compat_ioctl(struct file
+@@ -1323,6 +1357,7 @@ static long fb_compat_ioctl(struct file
case FBIOPAN_DISPLAY:
case FBIOGET_CON2FBMAP:
case FBIOPUT_CON2FBMAP:
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -17538,6 +17538,14 @@ T: git git://linuxtv.org/media_tree.git
+@@ -17537,6 +17537,14 @@ T: git git://linuxtv.org/media_tree.git
F: Documentation/devicetree/bindings/media/i2c/sony,imx412.yaml
F: drivers/media/i2c/imx412.c
+...
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -17552,6 +17552,7 @@ M: Raspberry Pi Kernel Maintenance <kern
+@@ -17551,6 +17551,7 @@ M: Raspberry Pi Kernel Maintenance <kern
L: linux-media@vger.kernel.org
S: Maintained
T: git git://linuxtv.org/media_tree.git
+...
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -17556,6 +17556,14 @@ F: Documentation/devicetree/bindings/med
+@@ -17555,6 +17555,14 @@ F: Documentation/devicetree/bindings/med
F: Documentation/devicetree/bindings/media/i2c/imx477.yaml
F: drivers/media/i2c/imx477.c
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -5981,6 +5981,14 @@ T: git git://anongit.freedesktop.org/drm
+@@ -5980,6 +5980,14 @@ T: git git://anongit.freedesktop.org/drm
F: Documentation/devicetree/bindings/display/multi-inno,mi0283qt.txt
F: drivers/gpu/drm/tiny/mi0283qt.c
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
-@@ -1629,14 +1629,7 @@ static void do_remove_conflicting_frameb
+@@ -1631,14 +1631,7 @@ static void do_remove_conflicting_frameb
* If it's not a platform device, at least print a warning. A
* fix would add code to remove the device from the system.
*/
#include <linux/seq_file.h>
#include <linux/console.h>
#include <linux/kmod.h>
-@@ -1606,36 +1605,18 @@ static void do_remove_conflicting_frameb
+@@ -1608,36 +1607,18 @@ static void do_remove_conflicting_frameb
/* check all firmware fbs and kick off if the base addr overlaps */
for_each_registered_fb(i) {
struct apertures_struct *gen_aper;
}
}
}
-@@ -1973,13 +1954,9 @@ EXPORT_SYMBOL(register_framebuffer);
+@@ -1975,13 +1956,9 @@ EXPORT_SYMBOL(register_framebuffer);
void
unregister_framebuffer(struct fb_info *fb_info)
{
+++ /dev/null
-From 1e020e1b96afdecd20680b5b5be2a6ffc3d27628 Mon Sep 17 00:00:00 2001
-From: Zhihao Cheng <chengzhihao1@huawei.com>
-Date: Mon, 6 Mar 2023 09:33:08 +0800
-Subject: [PATCH] ubi: Fix failure attaching when vid_hdr offset equals to
- (sub)page size
-
-Following process will make ubi attaching failed since commit
-1b42b1a36fc946 ("ubi: ensure that VID header offset ... size"):
-
-ID="0xec,0xa1,0x00,0x15" # 128M 128KB 2KB
-modprobe nandsim id_bytes=$ID
-flash_eraseall /dev/mtd0
-modprobe ubi mtd="0,2048" # set vid_hdr offset as 2048 (one page)
-(dmesg):
- ubi0 error: ubi_attach_mtd_dev [ubi]: VID header offset 2048 too large.
- UBI error: cannot attach mtd0
- UBI error: cannot initialize UBI, error -22
-
-Rework original solution, the key point is making sure
-'vid_hdr_shift + UBI_VID_HDR_SIZE < ubi->vid_hdr_alsize',
-so we should check vid_hdr_shift rather not vid_hdr_offset.
-Then, ubi still support (sub)page aligined VID header offset.
-
-Fixes: 1b42b1a36fc946 ("ubi: ensure that VID header offset ... size")
-Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
-Tested-by: Nicolas Schichan <nschichan@freebox.fr>
-Tested-by: Miquel Raynal <miquel.raynal@bootlin.com> # v5.10, v4.19
-Signed-off-by: Richard Weinberger <richard@nod.at>
----
- drivers/mtd/ubi/build.c | 21 +++++++++++++++------
- 1 file changed, 15 insertions(+), 6 deletions(-)
-
---- a/drivers/mtd/ubi/build.c
-+++ b/drivers/mtd/ubi/build.c
-@@ -664,12 +664,6 @@ static int io_init(struct ubi_device *ub
- ubi->ec_hdr_alsize = ALIGN(UBI_EC_HDR_SIZE, ubi->hdrs_min_io_size);
- ubi->vid_hdr_alsize = ALIGN(UBI_VID_HDR_SIZE, ubi->hdrs_min_io_size);
-
-- if (ubi->vid_hdr_offset && ((ubi->vid_hdr_offset + UBI_VID_HDR_SIZE) >
-- ubi->vid_hdr_alsize)) {
-- ubi_err(ubi, "VID header offset %d too large.", ubi->vid_hdr_offset);
-- return -EINVAL;
-- }
--
- dbg_gen("min_io_size %d", ubi->min_io_size);
- dbg_gen("max_write_size %d", ubi->max_write_size);
- dbg_gen("hdrs_min_io_size %d", ubi->hdrs_min_io_size);
-@@ -687,6 +681,21 @@ static int io_init(struct ubi_device *ub
- ubi->vid_hdr_aloffset;
- }
-
-+ /*
-+ * Memory allocation for VID header is ubi->vid_hdr_alsize
-+ * which is described in comments in io.c.
-+ * Make sure VID header shift + UBI_VID_HDR_SIZE not exceeds
-+ * ubi->vid_hdr_alsize, so that all vid header operations
-+ * won't access memory out of bounds.
-+ */
-+ if ((ubi->vid_hdr_shift + UBI_VID_HDR_SIZE) > ubi->vid_hdr_alsize) {
-+ ubi_err(ubi, "Invalid VID header offset %d, VID header shift(%d)"
-+ " + VID header size(%zu) > VID header aligned size(%d).",
-+ ubi->vid_hdr_offset, ubi->vid_hdr_shift,
-+ UBI_VID_HDR_SIZE, ubi->vid_hdr_alsize);
-+ return -EINVAL;
-+ }
-+
- /* Similar for the data offset */
- ubi->leb_start = ubi->vid_hdr_offset + UBI_VID_HDR_SIZE;
- ubi->leb_start = ALIGN(ubi->leb_start, ubi->min_io_size);
+++ /dev/null
-From: Liang Chen <liangchen.linux@gmail.com>
-Date: Thu, 13 Apr 2023 17:03:53 +0800
-Subject: [PATCH] skbuff: Fix a race between coalescing and releasing SKBs
-
-Commit 1effe8ca4e34 ("skbuff: fix coalescing for page_pool fragment
-recycling") allowed coalescing to proceed with non page pool page and page
-pool page when @from is cloned, i.e.
-
-to->pp_recycle --> false
-from->pp_recycle --> true
-skb_cloned(from) --> true
-
-However, it actually requires skb_cloned(@from) to hold true until
-coalescing finishes in this situation. If the other cloned SKB is
-released while the merging is in process, from_shinfo->nr_frags will be
-set to 0 toward the end of the function, causing the increment of frag
-page _refcount to be unexpectedly skipped resulting in inconsistent
-reference counts. Later when SKB(@to) is released, it frees the page
-directly even though the page pool page is still in use, leading to
-use-after-free or double-free errors. So it should be prohibited.
-
-The double-free error message below prompted us to investigate:
-BUG: Bad page state in process swapper/1 pfn:0e0d1
-page:00000000c6548b28 refcount:-1 mapcount:0 mapping:0000000000000000
-index:0x2 pfn:0xe0d1
-flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)
-raw: 000fffffc0000000 0000000000000000 ffffffff00000101 0000000000000000
-raw: 0000000000000002 0000000000000000 ffffffffffffffff 0000000000000000
-page dumped because: nonzero _refcount
-
-CPU: 1 PID: 0 Comm: swapper/1 Tainted: G E 6.2.0+
-Call Trace:
- <IRQ>
-dump_stack_lvl+0x32/0x50
-bad_page+0x69/0xf0
-free_pcp_prepare+0x260/0x2f0
-free_unref_page+0x20/0x1c0
-skb_release_data+0x10b/0x1a0
-napi_consume_skb+0x56/0x150
-net_rx_action+0xf0/0x350
-? __napi_schedule+0x79/0x90
-__do_softirq+0xc8/0x2b1
-__irq_exit_rcu+0xb9/0xf0
-common_interrupt+0x82/0xa0
-</IRQ>
-<TASK>
-asm_common_interrupt+0x22/0x40
-RIP: 0010:default_idle+0xb/0x20
-
-Fixes: 53e0961da1c7 ("page_pool: add frag page recycling support in page pool")
-Signed-off-by: Liang Chen <liangchen.linux@gmail.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Link: https://lore.kernel.org/r/20230413090353.14448-1-liangchen.linux@gmail.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
----
-
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -5397,18 +5397,18 @@ bool skb_try_coalesce(struct sk_buff *to
- if (skb_cloned(to))
- return false;
-
-- /* In general, avoid mixing slab allocated and page_pool allocated
-- * pages within the same SKB. However when @to is not pp_recycle and
-- * @from is cloned, we can transition frag pages from page_pool to
-- * reference counted.
-- *
-- * On the other hand, don't allow coalescing two pp_recycle SKBs if
-- * @from is cloned, in case the SKB is using page_pool fragment
-+ /* In general, avoid mixing page_pool and non-page_pool allocated
-+ * pages within the same SKB. Additionally avoid dealing with clones
-+ * with page_pool pages, in case the SKB is using page_pool fragment
- * references (PP_FLAG_PAGE_FRAG). Since we only take full page
- * references for cloned SKBs at the moment that would result in
- * inconsistent reference counts.
-+ * In theory we could take full references if @from is cloned and
-+ * !@to->pp_recycle but its tricky (due to potential race with
-+ * the clone disappearing) and rare, so not worth dealing with.
- */
-- if (to->pp_recycle != (from->pp_recycle && !skb_cloned(from)))
-+ if (to->pp_recycle != from->pp_recycle ||
-+ (from->pp_recycle && skb_cloned(from)))
- return false;
-
- if (len <= skb_tailroom(to)) {
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -11790,6 +11790,14 @@ L: netdev@vger.kernel.org
+@@ -11789,6 +11789,14 @@ L: netdev@vger.kernel.org
S: Maintained
F: drivers/net/ethernet/mediatek/
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
-@@ -234,6 +234,7 @@ struct sfp {
+@@ -240,6 +240,7 @@ struct sfp {
bool need_poll;
struct mutex st_mutex; /* Protects state */
unsigned int state_soft_mask;
unsigned int state;
struct delayed_work poll;
-@@ -499,17 +500,18 @@ static void sfp_soft_set_state(struct sf
+@@ -505,17 +506,18 @@ static void sfp_soft_set_state(struct sf
static void sfp_soft_start_poll(struct sfp *sfp)
{
const struct sfp_eeprom_id *id = &sfp->id;
if (sfp->state_soft_mask & (SFP_F_LOS | SFP_F_TX_FAULT) &&
!sfp->need_poll)
-@@ -523,10 +525,11 @@ static void sfp_soft_stop_poll(struct sf
+@@ -529,10 +531,11 @@ static void sfp_soft_stop_poll(struct sf
static unsigned int sfp_get_state(struct sfp *sfp)
{
state |= sfp_soft_get_state(sfp);
return state;
-@@ -1940,6 +1943,15 @@ static int sfp_sm_mod_probe(struct sfp *
+@@ -1942,6 +1945,15 @@ static int sfp_sm_mod_probe(struct sfp *
if (ret < 0)
return ret;
if (!memcmp(id.base.vendor_name, "ALCATELLUCENT ", 16) &&
!memcmp(id.base.vendor_pn, "3FE46541AA ", 16))
sfp->module_t_start_up = T_START_UP_BAD_GPON;
-@@ -2565,6 +2577,8 @@ static int sfp_probe(struct platform_dev
+@@ -2568,6 +2580,8 @@ static int sfp_probe(struct platform_dev
return PTR_ERR(sfp->gpio[i]);
}
ret = ops->module_insert(bus->upstream, id);
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
-@@ -253,6 +253,8 @@ struct sfp {
+@@ -259,6 +259,8 @@ struct sfp {
unsigned int module_t_start_up;
bool tx_fault_ignore;
#if IS_ENABLED(CONFIG_HWMON)
struct sfp_diag diag;
struct delayed_work hwmon_probe;
-@@ -309,6 +311,93 @@ static const struct of_device_id sfp_of_
+@@ -315,6 +317,93 @@ static const struct of_device_id sfp_of_
};
MODULE_DEVICE_TABLE(of, sfp_of_match);
static unsigned long poll_jiffies;
static unsigned int sfp_gpio_get_state(struct sfp *sfp)
-@@ -1964,6 +2053,8 @@ static int sfp_sm_mod_probe(struct sfp *
+@@ -1966,6 +2055,8 @@ static int sfp_sm_mod_probe(struct sfp *
else
sfp->tx_fault_ignore = false;
return 0;
}
-@@ -2075,7 +2166,8 @@ static void sfp_sm_module(struct sfp *sf
+@@ -2077,7 +2168,8 @@ static void sfp_sm_module(struct sfp *sf
break;
/* Report the module insertion to the upstream device */
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
-@@ -311,6 +311,11 @@ static const struct of_device_id sfp_of_
+@@ -317,6 +317,11 @@ static const struct of_device_id sfp_of_
};
MODULE_DEVICE_TABLE(of, sfp_of_match);
static void sfp_quirk_2500basex(const struct sfp_eeprom_id *id,
unsigned long *modes)
{
-@@ -341,6 +346,7 @@ static const struct sfp_quirk sfp_quirks
+@@ -347,6 +352,7 @@ static const struct sfp_quirk sfp_quirks
.vendor = "ALCATELLUCENT",
.part = "3FE46541AA",
.modes = sfp_quirk_2500basex,
}, {
// Huawei MA5671A can operate at 2500base-X, but report 1.2GBd
// NRZ in their EEPROM
-@@ -2041,11 +2047,7 @@ static int sfp_sm_mod_probe(struct sfp *
+@@ -2043,11 +2049,7 @@ static int sfp_sm_mod_probe(struct sfp *
if (sfp->gpio[GPIO_LOS])
sfp->state_hw_mask |= SFP_F_LOS;
if (!memcmp(id.base.vendor_name, "HUAWEI ", 16) &&
!memcmp(id.base.vendor_pn, "MA5671A ", 16))
-@@ -2054,6 +2056,8 @@ static int sfp_sm_mod_probe(struct sfp *
+@@ -2056,6 +2058,8 @@ static int sfp_sm_mod_probe(struct sfp *
sfp->tx_fault_ignore = false;
sfp->quirk = sfp_lookup_quirk(&id);
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
-@@ -316,6 +316,11 @@ static void sfp_fixup_long_startup(struc
+@@ -322,6 +322,11 @@ static void sfp_fixup_long_startup(struc
sfp->module_t_start_up = T_START_UP_BAD_GPON;
}
static void sfp_quirk_2500basex(const struct sfp_eeprom_id *id,
unsigned long *modes)
{
-@@ -353,6 +358,7 @@ static const struct sfp_quirk sfp_quirks
+@@ -359,6 +364,7 @@ static const struct sfp_quirk sfp_quirks
.vendor = "HUAWEI",
.part = "MA5671A",
.modes = sfp_quirk_2500basex,
}, {
// Lantech 8330-262D-E can operate at 2500base-X, but
// incorrectly report 2500MBd NRZ in their EEPROM
-@@ -2049,11 +2055,7 @@ static int sfp_sm_mod_probe(struct sfp *
+@@ -2051,11 +2057,7 @@ static int sfp_sm_mod_probe(struct sfp *
sfp->module_t_start_up = T_START_UP;
linkmode_or(support, support, modes);
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
-@@ -321,6 +321,15 @@ static void sfp_fixup_ignore_tx_fault(st
+@@ -327,6 +327,15 @@ static void sfp_fixup_ignore_tx_fault(st
sfp->tx_fault_ignore = true;
}
static void sfp_quirk_2500basex(const struct sfp_eeprom_id *id,
unsigned long *modes)
{
-@@ -353,6 +362,10 @@ static const struct sfp_quirk sfp_quirks
+@@ -359,6 +368,10 @@ static const struct sfp_quirk sfp_quirks
.modes = sfp_quirk_2500basex,
.fixup = sfp_fixup_long_startup,
}, {
// Huawei MA5671A can operate at 2500base-X, but report 1.2GBd
// NRZ in their EEPROM
.vendor = "HUAWEI",
-@@ -369,16 +382,18 @@ static const struct sfp_quirk sfp_quirks
+@@ -375,16 +388,18 @@ static const struct sfp_quirk sfp_quirks
.vendor = "UBNT",
.part = "UF-INSTANT",
.modes = sfp_quirk_ubnt_uf_instant,
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
-@@ -366,6 +366,10 @@ static const struct sfp_quirk sfp_quirks
+@@ -372,6 +372,10 @@ static const struct sfp_quirk sfp_quirks
.part = "HL-GSFP",
.fixup = sfp_fixup_halny_gsfp,
}, {
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -17962,6 +17962,11 @@ L: netdev@vger.kernel.org
+@@ -17961,6 +17961,11 @@ L: netdev@vger.kernel.org
S: Maintained
F: drivers/net/ethernet/dlink/sundance.c
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -12362,6 +12362,14 @@ S: Supported
+@@ -12361,6 +12361,14 @@ S: Supported
F: Documentation/devicetree/bindings/mtd/atmel-nand.txt
F: drivers/mtd/nand/raw/atmel/*
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
-@@ -377,6 +377,11 @@ static const struct sfp_quirk sfp_quirks
+@@ -383,6 +383,11 @@ static const struct sfp_quirk sfp_quirks
.modes = sfp_quirk_2500basex,
.fixup = sfp_fixup_ignore_tx_fault,
}, {
// Lantech 8330-262D-E can operate at 2500base-X, but
// incorrectly report 2500MBd NRZ in their EEPROM
.vendor = "Lantech",
-@@ -2310,7 +2315,8 @@ static void sfp_sm_main(struct sfp *sfp,
+@@ -2312,7 +2317,8 @@ static void sfp_sm_main(struct sfp *sfp,
* or t_start_up, so assume there is a fault.
*/
sfp_sm_fault(sfp, SFP_S_INIT_TX_FAULT,
} else if (event == SFP_E_TIMEOUT || event == SFP_E_TX_CLEAR) {
init_done:
sfp->sm_phy_retries = R_PHY_RETRY;
-@@ -2533,10 +2539,12 @@ static void sfp_check_state(struct sfp *
+@@ -2535,10 +2541,12 @@ static void sfp_check_state(struct sfp *
mutex_lock(&sfp->st_mutex);
state = sfp_get_state(sfp);
changed = state ^ sfp->state;
+};
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -7527,6 +7527,14 @@ F: drivers/ptp/ptp_qoriq.c
+@@ -7526,6 +7526,14 @@ F: drivers/ptp/ptp_qoriq.c
F: drivers/ptp/ptp_qoriq_debugfs.c
F: include/linux/fsl/ptp_qoriq.h
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -11798,6 +11798,14 @@ S: Maintained
+@@ -11797,6 +11797,14 @@ S: Maintained
F: drivers/net/pcs/pcs-mtk-lynxi.c
F: include/linux/pcs/pcs-mtk-lynxi.h
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -9064,6 +9064,22 @@ F: include/net/nl802154.h
+@@ -9063,6 +9063,22 @@ F: include/net/nl802154.h
F: net/ieee802154/
F: net/mac802154/
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -15899,6 +15899,13 @@ S: Maintained
+@@ -15898,6 +15898,13 @@ S: Maintained
F: include/sound/rt*.h
F: sound/soc/codecs/rt*
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
-@@ -2151,6 +2151,13 @@ static void sfp_sm_module(struct sfp *sf
+@@ -2153,6 +2153,13 @@ static void sfp_sm_module(struct sfp *sf
return;
}
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
-@@ -543,32 +543,72 @@ static int sfp_i2c_write(struct sfp *sfp
+@@ -549,32 +549,72 @@ static int sfp_i2c_write(struct sfp *sfp
return ret == ARRAY_SIZE(msgs) ? len : 0;
}
projects / openwrt / staging / dedeckeh.git / commitdiff