5.15-stable patches

added patches:
	alsa-hda-realtek-fix-headset-mic-no-show-at-resume-back-for-lenovo-alc897-platform.patch
	drm-i915-check-before-removing-mm-notifier.patch
	fs-aio-check-iocb_aio_rw-before-the-struct-aio_kiocb-conversion.patch
	i2c-i801-avoid-potential-double-call-to-gpiod_remove_lookup_table.patch
	mei-me-add-arrow-lake-point-h-did.patch
	mei-me-add-arrow-lake-point-s-did.patch
	tee-optee-fix-kernel-panic-caused-by-incorrect-error-handling.patch
	tracing-use-.flush-call-to-wake-up-readers.patch
	tty-serial-fsl_lpuart-avoid-idle-preamble-pending-if-cts-is-enabled.patch
	usb-gadget-ncm-fix-handling-of-zero-block-length-packets.patch
	usb-port-don-t-try-to-peer-unused-usb-ports-based-on-location.patch
	usb-usb-storage-prevent-divide-by-0-error-in-isd200_ata_command.patch
	vt-fix-unicode-buffer-corruption-when-deleting-characters.patch

14 files changed, 748 insertions, 0 deletions

diff --git a/queue-5.15/alsa-hda-realtek-fix-headset-mic-no-show-at-resume-back-for-lenovo-alc897-platform.patch b/queue-5.15/alsa-hda-realtek-fix-headset-mic-no-show-at-resume-back-for-lenovo-alc897-platform.patch
new file mode 100644
index 0000000000..7771588d8a
--- /dev/null
+++ b/queue-5.15/alsa-hda-realtek-fix-headset-mic-no-show-at-resume-back-for-lenovo-alc897-platform.patch
@@ -0,0 +1,45 @@
+From d397b6e56151099cf3b1f7bfccb204a6a8591720 Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Fri, 1 Mar 2024 15:29:50 +0800
+Subject: ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform
+
+From: Kailang Yang <kailang@realtek.com>
+
+commit d397b6e56151099cf3b1f7bfccb204a6a8591720 upstream.
+
+Headset Mic will no show at resume back.
+This patch will fix this issue.
+
+Fixes: d7f32791a9fc ("ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Link: https://lore.kernel.org/r/4713d48a372e47f98bba0c6120fd8254@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c |    7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10783,8 +10783,7 @@ static void alc897_hp_automute_hook(stru
+ 
+ 	snd_hda_gen_hp_automute(codec, jack);
+ 	vref = spec->gen.hp_jack_present ? (PIN_HP | AC_PINCTL_VREF_100) : PIN_HP;
+-	snd_hda_codec_write(codec, 0x1b, 0, AC_VERB_SET_PIN_WIDGET_CONTROL,
+-			    vref);
++	snd_hda_set_pin_ctl(codec, 0x1b, vref);
+ }
+ 
+ static void alc897_fixup_lenovo_headset_mic(struct hda_codec *codec,
+@@ -10793,6 +10792,10 @@ static void alc897_fixup_lenovo_headset_
+ 	struct alc_spec *spec = codec->spec;
+ 	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+ 		spec->gen.hp_automute_hook = alc897_hp_automute_hook;
++		spec->no_shutup_pins = 1;
++	}
++	if (action == HDA_FIXUP_ACT_PROBE) {
++		snd_hda_set_pin_ctl_cache(codec, 0x1a, PIN_IN | AC_PINCTL_VREF_100);
+ 	}
+ }
+ 
diff --git a/queue-5.15/drm-i915-check-before-removing-mm-notifier.patch b/queue-5.15/drm-i915-check-before-removing-mm-notifier.patch
new file mode 100644
index 0000000000..4ee73b950e
--- /dev/null
+++ b/queue-5.15/drm-i915-check-before-removing-mm-notifier.patch
@@ -0,0 +1,40 @@
+From 01bb1ae35006e473138c90711bad1a6b614a1823 Mon Sep 17 00:00:00 2001
+From: Nirmoy Das <nirmoy.das@intel.com>
+Date: Mon, 19 Feb 2024 13:50:47 +0100
+Subject: drm/i915: Check before removing mm notifier
+
+From: Nirmoy Das <nirmoy.das@intel.com>
+
+commit 01bb1ae35006e473138c90711bad1a6b614a1823 upstream.
+
+Error in mmu_interval_notifier_insert() can leave a NULL
+notifier.mm pointer. Catch that and return early.
+
+Fixes: ed29c2691188 ("drm/i915: Fix userptr so we do not have to worry about obj->mm.lock, v7.")
+Cc: <stable@vger.kernel.org> # v5.13+
+[tursulin: Added Fixes and cc stable.]
+Cc: Andi Shyti <andi.shyti@linux.intel.com>
+Cc: Shawn Lee <shawn.c.lee@intel.com>
+Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240219125047.28906-1-nirmoy.das@intel.com
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+(cherry picked from commit db7bbd13f08774cde0332c705f042e327fe21e73)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_userptr.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
+@@ -374,6 +374,9 @@ i915_gem_userptr_release(struct drm_i915
+ {
+ 	GEM_WARN_ON(obj->userptr.page_ref);
+ 
++	if (!obj->userptr.notifier.mm)
++		return;
++
+ 	mmu_interval_notifier_remove(&obj->userptr.notifier);
+ 	obj->userptr.notifier.mm = NULL;
+ }
diff --git a/queue-5.15/fs-aio-check-iocb_aio_rw-before-the-struct-aio_kiocb-conversion.patch b/queue-5.15/fs-aio-check-iocb_aio_rw-before-the-struct-aio_kiocb-conversion.patch
new file mode 100644
index 0000000000..b2627161ab
--- /dev/null
+++ b/queue-5.15/fs-aio-check-iocb_aio_rw-before-the-struct-aio_kiocb-conversion.patch
@@ -0,0 +1,63 @@
+From 961ebd120565cb60cebe21cb634fbc456022db4a Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Mon, 4 Mar 2024 15:57:15 -0800
+Subject: fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit 961ebd120565cb60cebe21cb634fbc456022db4a upstream.
+
+The first kiocb_set_cancel_fn() argument may point at a struct kiocb
+that is not embedded inside struct aio_kiocb. With the current code,
+depending on the compiler, the req->ki_ctx read happens either before
+the IOCB_AIO_RW test or after that test. Move the req->ki_ctx read such
+that it is guaranteed that the IOCB_AIO_RW test happens first.
+
+Reported-by: Eric Biggers <ebiggers@kernel.org>
+Cc: Benjamin LaHaise <ben@communityfibre.ca>
+Cc: Eric Biggers <ebiggers@google.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Avi Kivity <avi@scylladb.com>
+Cc: Sandeep Dhavale <dhavale@google.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Kent Overstreet <kent.overstreet@linux.dev>
+Cc: stable@vger.kernel.org
+Fixes: b820de741ae4 ("fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20240304235715.3790858-1-bvanassche@acm.org
+Reviewed-by: Jens Axboe <axboe@kernel.dk>
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/aio.c |    8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -564,8 +564,8 @@ static int aio_setup_ring(struct kioctx
+ 
+ void kiocb_set_cancel_fn(struct kiocb *iocb, kiocb_cancel_fn *cancel)
+ {
+-	struct aio_kiocb *req = container_of(iocb, struct aio_kiocb, rw);
+-	struct kioctx *ctx = req->ki_ctx;
++	struct aio_kiocb *req;
++	struct kioctx *ctx;
+ 	unsigned long flags;
+ 
+ 	/*
+@@ -575,9 +575,13 @@ void kiocb_set_cancel_fn(struct kiocb *i
+ 	if (!(iocb->ki_flags & IOCB_AIO_RW))
+ 		return;
+ 
++	req = container_of(iocb, struct aio_kiocb, rw);
++
+ 	if (WARN_ON_ONCE(!list_empty(&req->ki_list)))
+ 		return;
+ 
++	ctx = req->ki_ctx;
++
+ 	spin_lock_irqsave(&ctx->ctx_lock, flags);
+ 	list_add_tail(&req->ki_list, &ctx->active_reqs);
+ 	req->ki_cancel = cancel;
diff --git a/queue-5.15/i2c-i801-avoid-potential-double-call-to-gpiod_remove_lookup_table.patch b/queue-5.15/i2c-i801-avoid-potential-double-call-to-gpiod_remove_lookup_table.patch
new file mode 100644
index 0000000000..1931ad3296
--- /dev/null
+++ b/queue-5.15/i2c-i801-avoid-potential-double-call-to-gpiod_remove_lookup_table.patch
@@ -0,0 +1,48 @@
+From ceb013b2d9a2946035de5e1827624edc85ae9484 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Mon, 4 Mar 2024 21:31:06 +0100
+Subject: i2c: i801: Avoid potential double call to gpiod_remove_lookup_table
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+commit ceb013b2d9a2946035de5e1827624edc85ae9484 upstream.
+
+If registering the platform device fails, the lookup table is
+removed in the error path. On module removal we would try to
+remove the lookup table again. Fix this by setting priv->lookup
+only if registering the platform device was successful.
+In addition free the memory allocated for the lookup table in
+the error path.
+
+Fixes: d308dfbf62ef ("i2c: mux/i801: Switch to use descriptor passing")
+Cc: stable@vger.kernel.org
+Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-i801.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -1416,7 +1416,6 @@ static int i801_add_mux(struct i801_priv
+ 				    mux_config->gpios[i], "mux", 0);
+ 	}
+ 	gpiod_add_lookup_table(lookup);
+-	priv->lookup = lookup;
+ 
+ 	/*
+ 	 * Register the mux device, we use PLATFORM_DEVID_NONE here
+@@ -1430,7 +1429,10 @@ static int i801_add_mux(struct i801_priv
+ 				sizeof(struct i2c_mux_gpio_platform_data));
+ 	if (IS_ERR(priv->mux_pdev)) {
+ 		gpiod_remove_lookup_table(lookup);
++		devm_kfree(dev, lookup);
+ 		dev_err(dev, "Failed to register i2c-mux-gpio device\n");
++	} else {
++		priv->lookup = lookup;
+ 	}
+ 
+ 	return PTR_ERR_OR_ZERO(priv->mux_pdev);
diff --git a/queue-5.15/mei-me-add-arrow-lake-point-h-did.patch b/queue-5.15/mei-me-add-arrow-lake-point-h-did.patch
new file mode 100644
index 0000000000..2ea7f46ffa
--- /dev/null
+++ b/queue-5.15/mei-me-add-arrow-lake-point-h-did.patch
@@ -0,0 +1,41 @@
+From 8436f25802ec028ac7254990893f3e01926d9b79 Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Sun, 11 Feb 2024 12:39:12 +0200
+Subject: mei: me: add arrow lake point H DID
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit 8436f25802ec028ac7254990893f3e01926d9b79 upstream.
+
+Add Arrow Lake H device id.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Link: https://lore.kernel.org/r/20240211103912.117105-2-tomas.winkler@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/mei/hw-me-regs.h |    1 +
+ drivers/misc/mei/pci-me.c     |    1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -113,6 +113,7 @@
+ 
+ #define MEI_DEV_ID_MTL_M      0x7E70  /* Meteor Lake Point M */
+ #define MEI_DEV_ID_ARL_S      0x7F68  /* Arrow Lake Point S */
++#define MEI_DEV_ID_ARL_H      0x7770  /* Arrow Lake Point H */
+ 
+ /*
+  * MEI HW Section
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -119,6 +119,7 @@ static const struct pci_device_id mei_me
+ 
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_MTL_M, MEI_ME_PCH15_CFG)},
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_ARL_S, MEI_ME_PCH15_CFG)},
++	{MEI_PCI_DEVICE(MEI_DEV_ID_ARL_H, MEI_ME_PCH15_CFG)},
+ 
+ 	/* required last entry */
+ 	{0, }
diff --git a/queue-5.15/mei-me-add-arrow-lake-point-s-did.patch b/queue-5.15/mei-me-add-arrow-lake-point-s-did.patch
new file mode 100644
index 0000000000..c3f92f0143
--- /dev/null
+++ b/queue-5.15/mei-me-add-arrow-lake-point-s-did.patch
@@ -0,0 +1,41 @@
+From 7a9b9012043e126f6d6f4683e67409312d1b707b Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Sun, 11 Feb 2024 12:39:11 +0200
+Subject: mei: me: add arrow lake point S DID
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit 7a9b9012043e126f6d6f4683e67409312d1b707b upstream.
+
+Add Arrow Lake S device id.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Link: https://lore.kernel.org/r/20240211103912.117105-1-tomas.winkler@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/mei/hw-me-regs.h |    1 +
+ drivers/misc/mei/pci-me.c     |    1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -112,6 +112,7 @@
+ #define MEI_DEV_ID_RPL_S      0x7A68  /* Raptor Lake Point S */
+ 
+ #define MEI_DEV_ID_MTL_M      0x7E70  /* Meteor Lake Point M */
++#define MEI_DEV_ID_ARL_S      0x7F68  /* Arrow Lake Point S */
+ 
+ /*
+  * MEI HW Section
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -118,6 +118,7 @@ static const struct pci_device_id mei_me
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_CFG)},
+ 
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_MTL_M, MEI_ME_PCH15_CFG)},
++	{MEI_PCI_DEVICE(MEI_DEV_ID_ARL_S, MEI_ME_PCH15_CFG)},
+ 
+ 	/* required last entry */
+ 	{0, }
diff --git a/queue-5.15/series b/queue-5.15/series
index 5f32913826..99eb683dbb 100644
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -123,3 +123,16 @@ netfilter-nf_tables-reject-constant-set-with-timeout.patch
 drivers-hv-vmbus-calculate-ring-buffer-size-for-more-efficient-use-of-memory.patch
 xfrm-avoid-clang-fortify-warning-in-copy_to_user_tmpl.patch
 kvm-svm-flush-pages-under-kvm-lock-to-fix-uaf-in-svm_register_enc_region.patch
+tracing-use-.flush-call-to-wake-up-readers.patch
+drm-i915-check-before-removing-mm-notifier.patch
+alsa-hda-realtek-fix-headset-mic-no-show-at-resume-back-for-lenovo-alc897-platform.patch
+usb-usb-storage-prevent-divide-by-0-error-in-isd200_ata_command.patch
+usb-gadget-ncm-fix-handling-of-zero-block-length-packets.patch
+usb-port-don-t-try-to-peer-unused-usb-ports-based-on-location.patch
+tty-serial-fsl_lpuart-avoid-idle-preamble-pending-if-cts-is-enabled.patch
+mei-me-add-arrow-lake-point-s-did.patch
+mei-me-add-arrow-lake-point-h-did.patch
+vt-fix-unicode-buffer-corruption-when-deleting-characters.patch
+fs-aio-check-iocb_aio_rw-before-the-struct-aio_kiocb-conversion.patch
+tee-optee-fix-kernel-panic-caused-by-incorrect-error-handling.patch
+i2c-i801-avoid-potential-double-call-to-gpiod_remove_lookup_table.patch
diff --git a/queue-5.15/tee-optee-fix-kernel-panic-caused-by-incorrect-error-handling.patch b/queue-5.15/tee-optee-fix-kernel-panic-caused-by-incorrect-error-handling.patch
new file mode 100644
index 0000000000..a911514993
--- /dev/null
+++ b/queue-5.15/tee-optee-fix-kernel-panic-caused-by-incorrect-error-handling.patch
@@ -0,0 +1,59 @@
+From 95915ba4b987cf2b222b0f251280228a1ff977ac Mon Sep 17 00:00:00 2001
+From: Sumit Garg <sumit.garg@linaro.org>
+Date: Fri, 1 Mar 2024 20:07:31 +0530
+Subject: tee: optee: Fix kernel panic caused by incorrect error handling
+
+From: Sumit Garg <sumit.garg@linaro.org>
+
+commit 95915ba4b987cf2b222b0f251280228a1ff977ac upstream.
+
+The error path while failing to register devices on the TEE bus has a
+bug leading to kernel panic as follows:
+
+[   15.398930] Unable to handle kernel paging request at virtual address ffff07ed00626d7c
+[   15.406913] Mem abort info:
+[   15.409722]   ESR = 0x0000000096000005
+[   15.413490]   EC = 0x25: DABT (current EL), IL = 32 bits
+[   15.418814]   SET = 0, FnV = 0
+[   15.421878]   EA = 0, S1PTW = 0
+[   15.425031]   FSC = 0x05: level 1 translation fault
+[   15.429922] Data abort info:
+[   15.432813]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
+[   15.438310]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+[   15.443372]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+[   15.448697] swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000d9e3e000
+[   15.455413] [ffff07ed00626d7c] pgd=1800000bffdf9003, p4d=1800000bffdf9003, pud=0000000000000000
+[   15.464146] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
+
+Commit 7269cba53d90 ("tee: optee: Fix supplicant based device enumeration")
+lead to the introduction of this bug. So fix it appropriately.
+
+Reported-by: Mikko Rapeli <mikko.rapeli@linaro.org>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218542
+Fixes: 7269cba53d90 ("tee: optee: Fix supplicant based device enumeration")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tee/optee/device.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/tee/optee/device.c
++++ b/drivers/tee/optee/device.c
+@@ -90,13 +90,14 @@ static int optee_register_device(const u
+ 	if (rc) {
+ 		pr_err("device registration failed, err: %d\n", rc);
+ 		put_device(&optee_device->dev);
++		return rc;
+ 	}
+ 
+ 	if (func == PTA_CMD_GET_DEVICES_SUPP)
+ 		device_create_file(&optee_device->dev,
+ 				   &dev_attr_need_supplicant);
+ 
+-	return rc;
++	return 0;
+ }
+ 
+ static int __optee_enumerate_devices(u32 func)
diff --git a/queue-5.15/tracing-use-.flush-call-to-wake-up-readers.patch b/queue-5.15/tracing-use-.flush-call-to-wake-up-readers.patch
new file mode 100644
index 0000000000..b68a4b6f9c
--- /dev/null
+++ b/queue-5.15/tracing-use-.flush-call-to-wake-up-readers.patch
@@ -0,0 +1,89 @@
+From e5d7c1916562f0e856eb3d6f569629fcd535fed2 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
+Date: Fri, 8 Mar 2024 15:24:05 -0500
+Subject: tracing: Use .flush() call to wake up readers
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+commit e5d7c1916562f0e856eb3d6f569629fcd535fed2 upstream.
+
+The .release() function does not get called until all readers of a file
+descriptor are finished.
+
+If a thread is blocked on reading a file descriptor in ring_buffer_wait(),
+and another thread closes the file descriptor, it will not wake up the
+other thread as ring_buffer_wake_waiters() is called by .release(), and
+that will not get called until the .read() is finished.
+
+The issue originally showed up in trace-cmd, but the readers are actually
+other processes with their own file descriptors. So calling close() would wake
+up the other tasks because they are blocked on another descriptor then the
+one that was closed(). But there's other wake ups that solve that issue.
+
+When a thread is blocked on a read, it can still hang even when another
+thread closed its descriptor.
+
+This is what the .flush() callback is for. Have the .flush() wake up the
+readers.
+
+Link: https://lore.kernel.org/linux-trace-kernel/20240308202432.107909457@goodmis.org
+
+Cc: stable@vger.kernel.org
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: linke li <lilinke99@qq.com>
+Cc: Rabin Vincent <rabin@rab.in>
+Fixes: f3ddb74ad0790 ("tracing: Wake up ring buffer waiters on closing of the file")
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace.c |   21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -8228,6 +8228,20 @@ tracing_buffers_read(struct file *filp,
+ 	return size;
+ }
+ 
++static int tracing_buffers_flush(struct file *file, fl_owner_t id)
++{
++	struct ftrace_buffer_info *info = file->private_data;
++	struct trace_iterator *iter = &info->iter;
++
++	iter->wait_index++;
++	/* Make sure the waiters see the new wait_index */
++	smp_wmb();
++
++	ring_buffer_wake_waiters(iter->array_buffer->buffer, iter->cpu_file);
++
++	return 0;
++}
++
+ static int tracing_buffers_release(struct inode *inode, struct file *file)
+ {
+ 	struct ftrace_buffer_info *info = file->private_data;
+@@ -8239,12 +8253,6 @@ static int tracing_buffers_release(struc
+ 
+ 	__trace_array_put(iter->tr);
+ 
+-	iter->wait_index++;
+-	/* Make sure the waiters see the new wait_index */
+-	smp_wmb();
+-
+-	ring_buffer_wake_waiters(iter->array_buffer->buffer, iter->cpu_file);
+-
+ 	if (info->spare)
+ 		ring_buffer_free_read_page(iter->array_buffer->buffer,
+ 					   info->spare_cpu, info->spare);
+@@ -8458,6 +8466,7 @@ static const struct file_operations trac
+ 	.read		= tracing_buffers_read,
+ 	.poll		= tracing_buffers_poll,
+ 	.release	= tracing_buffers_release,
++	.flush		= tracing_buffers_flush,
+ 	.splice_read	= tracing_buffers_splice_read,
+ 	.unlocked_ioctl = tracing_buffers_ioctl,
+ 	.llseek		= no_llseek,
diff --git a/queue-5.15/tty-serial-fsl_lpuart-avoid-idle-preamble-pending-if-cts-is-enabled.patch b/queue-5.15/tty-serial-fsl_lpuart-avoid-idle-preamble-pending-if-cts-is-enabled.patch
new file mode 100644
index 0000000000..2d88cb6b0d
--- /dev/null
+++ b/queue-5.15/tty-serial-fsl_lpuart-avoid-idle-preamble-pending-if-cts-is-enabled.patch
@@ -0,0 +1,52 @@
+From 74cb7e0355fae9641f825afa389d3fba3b617714 Mon Sep 17 00:00:00 2001
+From: Sherry Sun <sherry.sun@nxp.com>
+Date: Tue, 5 Mar 2024 09:57:06 +0800
+Subject: tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sherry Sun <sherry.sun@nxp.com>
+
+commit 74cb7e0355fae9641f825afa389d3fba3b617714 upstream.
+
+If the remote uart device is not connected or not enabled after booting
+up, the CTS line is high by default. At this time, if we enable the flow
+control when opening the device(for example, using “stty -F /dev/ttyLP4
+crtscts” command), there will be a pending idle preamble(first writing 0
+and then writing 1 to UARTCTRL_TE will queue an idle preamble) that
+cannot be sent out, resulting in the uart port fail to close(waiting for
+TX empty), so the user space stty will have to wait for a long time or
+forever.
+
+This is an LPUART IP bug(idle preamble has higher priority than CTS),
+here add a workaround patch to enable TX CTS after enabling UARTCTRL_TE,
+so that the idle preamble does not get stuck due to CTS is deasserted.
+
+Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
+Link: https://lore.kernel.org/r/20240305015706.1050769-1-sherry.sun@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/fsl_lpuart.c |    7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -2237,9 +2237,12 @@ lpuart32_set_termios(struct uart_port *p
+ 
+ 	lpuart32_write(&sport->port, bd, UARTBAUD);
+ 	lpuart32_serial_setbrg(sport, baud);
+-	lpuart32_write(&sport->port, modem, UARTMODIR);
+-	lpuart32_write(&sport->port, ctrl, UARTCTRL);
++	/* disable CTS before enabling UARTCTRL_TE to avoid pending idle preamble */
++	lpuart32_write(&sport->port, modem & ~UARTMODIR_TXCTSE, UARTMODIR);
+ 	/* restore control register */
++	lpuart32_write(&sport->port, ctrl, UARTCTRL);
++	/* re-enable the CTS if needed */
++	lpuart32_write(&sport->port, modem, UARTMODIR);
+ 
+ 	if (old && sport->lpuart_dma_rx_use) {
+ 		if (!lpuart_start_rx_dma(sport))
diff --git a/queue-5.15/usb-gadget-ncm-fix-handling-of-zero-block-length-packets.patch b/queue-5.15/usb-gadget-ncm-fix-handling-of-zero-block-length-packets.patch
new file mode 100644
index 0000000000..4a822483d2
--- /dev/null
+++ b/queue-5.15/usb-gadget-ncm-fix-handling-of-zero-block-length-packets.patch
@@ -0,0 +1,63 @@
+From f90ce1e04cbcc76639d6cba0fdbd820cd80b3c70 Mon Sep 17 00:00:00 2001
+From: Krishna Kurapati <quic_kriskura@quicinc.com>
+Date: Wed, 28 Feb 2024 17:24:41 +0530
+Subject: usb: gadget: ncm: Fix handling of zero block length packets
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krishna Kurapati <quic_kriskura@quicinc.com>
+
+commit f90ce1e04cbcc76639d6cba0fdbd820cd80b3c70 upstream.
+
+While connecting to a Linux host with CDC_NCM_NTB_DEF_SIZE_TX
+set to 65536, it has been observed that we receive short packets,
+which come at interval of 5-10 seconds sometimes and have block
+length zero but still contain 1-2 valid datagrams present.
+
+According to the NCM spec:
+
+"If wBlockLength = 0x0000, the block is terminated by a
+short packet. In this case, the USB transfer must still
+be shorter than dwNtbInMaxSize or dwNtbOutMaxSize. If
+exactly dwNtbInMaxSize or dwNtbOutMaxSize bytes are sent,
+and the size is a multiple of wMaxPacketSize for the
+given pipe, then no ZLP shall be sent.
+
+wBlockLength= 0x0000 must be used with extreme care, because
+of the possibility that the host and device may get out of
+sync, and because of test issues.
+
+wBlockLength = 0x0000 allows the sender to reduce latency by
+starting to send a very large NTB, and then shortening it when
+the sender discovers that there’s not sufficient data to justify
+sending a large NTB"
+
+However, there is a potential issue with the current implementation,
+as it checks for the occurrence of multiple NTBs in a single
+giveback by verifying if the leftover bytes to be processed is zero
+or not. If the block length reads zero, we would process the same
+NTB infintely because the leftover bytes is never zero and it leads
+to a crash. Fix this by bailing out if block length reads zero.
+
+Cc: stable@vger.kernel.org
+Fixes: 427694cfaafa ("usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call")
+Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
+Reviewed-by: Maciej Żenczykowski <maze@google.com>
+Link: https://lore.kernel.org/r/20240228115441.2105585-1-quic_kriskura@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_ncm.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -1352,7 +1352,7 @@ parse_ntb:
+ 	if (to_process == 1 &&
+ 	    (*(unsigned char *)(ntb_ptr + block_len) == 0x00)) {
+ 		to_process--;
+-	} else if (to_process > 0) {
++	} else if ((to_process > 0) && (block_len != 0)) {
+ 		ntb_ptr = (unsigned char *)(ntb_ptr + block_len);
+ 		goto parse_ntb;
+ 	}
diff --git a/queue-5.15/usb-port-don-t-try-to-peer-unused-usb-ports-based-on-location.patch b/queue-5.15/usb-port-don-t-try-to-peer-unused-usb-ports-based-on-location.patch
new file mode 100644
index 0000000000..76258ca37f
--- /dev/null
+++ b/queue-5.15/usb-port-don-t-try-to-peer-unused-usb-ports-based-on-location.patch
@@ -0,0 +1,59 @@
+From 69c63350e573367f9c8594162288cffa8a26d0d1 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Fri, 23 Feb 2024 01:33:43 +0200
+Subject: usb: port: Don't try to peer unused USB ports based on location
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 69c63350e573367f9c8594162288cffa8a26d0d1 upstream.
+
+Unused USB ports may have bogus location data in ACPI PLD tables.
+This causes port peering failures as these unused USB2 and USB3 ports
+location may match.
+
+Due to these failures the driver prints a
+"usb: port power management may be unreliable" warning, and
+unnecessarily blocks port power off during runtime suspend.
+
+This was debugged on a couple DELL systems where the unused ports
+all returned zeroes in their location data.
+Similar bugreports exist for other systems.
+
+Don't try to peer or match ports that have connect type set to
+USB_PORT_NOT_USED.
+
+Fixes: 3bfd659baec8 ("usb: find internal hub tier mismatch via acpi")
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218465
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218486
+Tested-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Link: https://lore.kernel.org/linux-usb/5406d361-f5b7-4309-b0e6-8c94408f7d75@molgen.mpg.de
+Cc: stable@vger.kernel.org # v3.16+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218490
+Link: https://lore.kernel.org/r/20240222233343.71856-1-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/port.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/core/port.c
++++ b/drivers/usb/core/port.c
+@@ -450,7 +450,7 @@ static int match_location(struct usb_dev
+ 	struct usb_hub *peer_hub = usb_hub_to_struct_hub(peer_hdev);
+ 	struct usb_device *hdev = to_usb_device(port_dev->dev.parent->parent);
+ 
+-	if (!peer_hub)
++	if (!peer_hub || port_dev->connect_type == USB_PORT_NOT_USED)
+ 		return 0;
+ 
+ 	hcd = bus_to_hcd(hdev->bus);
+@@ -461,7 +461,8 @@ static int match_location(struct usb_dev
+ 
+ 	for (port1 = 1; port1 <= peer_hdev->maxchild; port1++) {
+ 		peer = peer_hub->ports[port1 - 1];
+-		if (peer && peer->location == port_dev->location) {
++		if (peer && peer->connect_type != USB_PORT_NOT_USED &&
++		    peer->location == port_dev->location) {
+ 			link_peers_report(port_dev, peer);
+ 			return 1; /* done */
+ 		}
diff --git a/queue-5.15/usb-usb-storage-prevent-divide-by-0-error-in-isd200_ata_command.patch b/queue-5.15/usb-usb-storage-prevent-divide-by-0-error-in-isd200_ata_command.patch
new file mode 100644
index 0000000000..4843a7bf41
--- /dev/null
+++ b/queue-5.15/usb-usb-storage-prevent-divide-by-0-error-in-isd200_ata_command.patch
@@ -0,0 +1,101 @@
+From 014bcf41d946b36a8f0b8e9b5d9529efbb822f49 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Thu, 29 Feb 2024 14:30:06 -0500
+Subject: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 014bcf41d946b36a8f0b8e9b5d9529efbb822f49 upstream.
+
+The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values
+in the ATA ID information to calculate cylinder and head values when
+creating a CDB for READ or WRITE commands.  The calculation involves
+division and modulus operations, which will cause a crash if either of
+these values is 0.  While this never happens with a genuine device, it
+could happen with a flawed or subversive emulation, as reported by the
+syzbot fuzzer.
+
+Protect against this possibility by refusing to bind to the device if
+either the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID
+information is 0.  This requires isd200_Initialization() to return a
+negative error code when initialization fails; currently it always
+returns 0 (even when there is an error).
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: syzbot+28748250ab47a8f04100@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/linux-usb/0000000000003eb868061245ba7f@google.com/
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Reviewed-by: PrasannaKumar Muralidharan <prasannatsmkumar@gmail.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Link: https://lore.kernel.org/r/b1e605ea-333f-4ac0-9511-da04f411763e@rowland.harvard.edu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/storage/isd200.c |   23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/storage/isd200.c
++++ b/drivers/usb/storage/isd200.c
+@@ -1105,7 +1105,7 @@ static void isd200_dump_driveid(struct u
+ static int isd200_get_inquiry_data( struct us_data *us )
+ {
+ 	struct isd200_info *info = (struct isd200_info *)us->extra;
+-	int retStatus = ISD200_GOOD;
++	int retStatus;
+ 	u16 *id = info->id;
+ 
+ 	usb_stor_dbg(us, "Entering isd200_get_inquiry_data\n");
+@@ -1137,6 +1137,13 @@ static int isd200_get_inquiry_data( stru
+ 				isd200_fix_driveid(id);
+ 				isd200_dump_driveid(us, id);
+ 
++				/* Prevent division by 0 in isd200_scsi_to_ata() */
++				if (id[ATA_ID_HEADS] == 0 || id[ATA_ID_SECTORS] == 0) {
++					usb_stor_dbg(us, "   Invalid ATA Identify data\n");
++					retStatus = ISD200_ERROR;
++					goto Done;
++				}
++
+ 				memset(&info->InquiryData, 0, sizeof(info->InquiryData));
+ 
+ 				/* Standard IDE interface only supports disks */
+@@ -1202,6 +1209,7 @@ static int isd200_get_inquiry_data( stru
+ 		}
+ 	}
+ 
++ Done:
+ 	usb_stor_dbg(us, "Leaving isd200_get_inquiry_data %08X\n", retStatus);
+ 
+ 	return(retStatus);
+@@ -1481,22 +1489,27 @@ static int isd200_init_info(struct us_da
+ 
+ static int isd200_Initialization(struct us_data *us)
+ {
++	int rc = 0;
++
+ 	usb_stor_dbg(us, "ISD200 Initialization...\n");
+ 
+ 	/* Initialize ISD200 info struct */
+ 
+-	if (isd200_init_info(us) == ISD200_ERROR) {
++	if (isd200_init_info(us) < 0) {
+ 		usb_stor_dbg(us, "ERROR Initializing ISD200 Info struct\n");
++		rc = -ENOMEM;
+ 	} else {
+ 		/* Get device specific data */
+ 
+-		if (isd200_get_inquiry_data(us) != ISD200_GOOD)
++		if (isd200_get_inquiry_data(us) != ISD200_GOOD) {
+ 			usb_stor_dbg(us, "ISD200 Initialization Failure\n");
+-		else
++			rc = -EINVAL;
++		} else {
+ 			usb_stor_dbg(us, "ISD200 Initialization complete\n");
++		}
+ 	}
+ 
+-	return 0;
++	return rc;
+ }
+ 
+ 
diff --git a/queue-5.15/vt-fix-unicode-buffer-corruption-when-deleting-characters.patch b/queue-5.15/vt-fix-unicode-buffer-corruption-when-deleting-characters.patch
new file mode 100644
index 0000000000..2b06df85eb
--- /dev/null
+++ b/queue-5.15/vt-fix-unicode-buffer-corruption-when-deleting-characters.patch
@@ -0,0 +1,34 @@
+From 1581dafaf0d34bc9c428a794a22110d7046d186d Mon Sep 17 00:00:00 2001
+From: Nicolas Pitre <nico@fluxnic.net>
+Date: Thu, 29 Feb 2024 17:15:27 -0500
+Subject: vt: fix unicode buffer corruption when deleting characters
+
+From: Nicolas Pitre <nico@fluxnic.net>
+
+commit 1581dafaf0d34bc9c428a794a22110d7046d186d upstream.
+
+This is the same issue that was fixed for the VGA text buffer in commit
+39cdb68c64d8 ("vt: fix memory overlapping when deleting chars in the
+buffer"). The cure is also the same i.e. replace memcpy() with memmove()
+due to the overlaping buffers.
+
+Signed-off-by: Nicolas Pitre <nico@fluxnic.net>
+Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition")
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/sn184on2-3p0q-0qrq-0218-895349s4753o@syhkavp.arg
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/vt/vt.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -398,7 +398,7 @@ static void vc_uniscr_delete(struct vc_d
+ 		char32_t *ln = uniscr->lines[vc->state.y];
+ 		unsigned int x = vc->state.x, cols = vc->vc_cols;
+ 
+-		memcpy(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln));
++		memmove(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln));
+ 		memset32(&ln[cols - nr], ' ', nr);
+ 	}
+ }