commit 6ab8b697d7d1ff0a127a7774489311d878dad04c
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Fri Jul 5 09:12:57 2024 +0200

    Linux 5.10.221
    
    Link: https://lore.kernel.org/r/20240703102904.170852981@linuxfoundation.org
    Tested-by: Jon Hunter <jonathanh@nvidia.com>
    Tested-by: Pavel Machek (CIP) <pavel@denx.de>
    Link: https://lore.kernel.org/r/20240704094505.095988824@linuxfoundation.org
    Tested-by: Jon Hunter <jonathanh@nvidia.com>
    Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
    Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
    Tested-by: Salvatore Bonaccorso <carnil@debian.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ec3adc2af0f119260d4721036cffe5c600734c1e
Author: Yunseong Kim <yskelg@gmail.com>
Date:   Tue Jun 25 02:33:23 2024 +0900

    tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset()
    
    commit bab4923132feb3e439ae45962979c5d9d5c7c1f1 upstream.
    
    In the TRACE_EVENT(qdisc_reset) NULL dereference occurred from
    
     qdisc->dev_queue->dev <NULL> ->name
    
    This situation simulated from bunch of veths and Bluetooth disconnection
    and reconnection.
    
    During qdisc initialization, qdisc was being set to noop_queue.
    In veth_init_queue, the initial tx_num was reduced back to one,
    causing the qdisc reset to be called with noop, which led to the kernel
    panic.
    
    I've attached the GitHub gist link that C converted syz-execprogram
    source code and 3 log of reproduced vmcore-dmesg.
    
     https://gist.github.com/yskelg/cc64562873ce249cdd0d5a358b77d740
    
    Yeoreum and I use two fuzzing tool simultaneously.
    
    One process with syz-executor : https://github.com/google/syzkaller
    
     $ ./syz-execprog -executor=./syz-executor -repeat=1 -sandbox=setuid \
        -enable=none -collide=false log1
    
    The other process with perf fuzzer:
     https://github.com/deater/perf_event_tests/tree/master/fuzzer
    
     $ perf_event_tests/fuzzer/perf_fuzzer
    
    I think this will happen on the kernel version.
    
     Linux kernel version +v6.7.10, +v6.8, +v6.9 and it could happen in v6.10.
    
    This occurred from 51270d573a8d. I think this patch is absolutely
    necessary. Previously, It was showing not intended string value of name.
    
    I've reproduced 3 time from my fedora 40 Debug Kernel with any other module
    or patched.
    
     version: 6.10.0-0.rc2.20240608gitdc772f8237f9.29.fc41.aarch64+debug
    
    [ 5287.164555] veth0_vlan: left promiscuous mode
    [ 5287.164929] veth1_macvtap: left promiscuous mode
    [ 5287.164950] veth0_macvtap: left promiscuous mode
    [ 5287.164983] veth1_vlan: left promiscuous mode
    [ 5287.165008] veth0_vlan: left promiscuous mode
    [ 5287.165450] veth1_macvtap: left promiscuous mode
    [ 5287.165472] veth0_macvtap: left promiscuous mode
    [ 5287.165502] veth1_vlan: left promiscuous mode
    …
    [ 5297.598240] bridge0: port 2(bridge_slave_1) entered blocking state
    [ 5297.598262] bridge0: port 2(bridge_slave_1) entered forwarding state
    [ 5297.598296] bridge0: port 1(bridge_slave_0) entered blocking state
    [ 5297.598313] bridge0: port 1(bridge_slave_0) entered forwarding state
    [ 5297.616090] 8021q: adding VLAN 0 to HW filter on device bond0
    [ 5297.620405] bridge0: port 1(bridge_slave_0) entered disabled state
    [ 5297.620730] bridge0: port 2(bridge_slave_1) entered disabled state
    [ 5297.627247] 8021q: adding VLAN 0 to HW filter on device team0
    [ 5297.629636] bridge0: port 1(bridge_slave_0) entered blocking state
    …
    [ 5298.002798] bridge_slave_0: left promiscuous mode
    [ 5298.002869] bridge0: port 1(bridge_slave_0) entered disabled state
    [ 5298.309444] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
    [ 5298.315206] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
    [ 5298.320207] bond0 (unregistering): Released all slaves
    [ 5298.354296] hsr_slave_0: left promiscuous mode
    [ 5298.360750] hsr_slave_1: left promiscuous mode
    [ 5298.374889] veth1_macvtap: left promiscuous mode
    [ 5298.374931] veth0_macvtap: left promiscuous mode
    [ 5298.374988] veth1_vlan: left promiscuous mode
    [ 5298.375024] veth0_vlan: left promiscuous mode
    [ 5299.109741] team0 (unregistering): Port device team_slave_1 removed
    [ 5299.185870] team0 (unregistering): Port device team_slave_0 removed
    …
    [ 5300.155443] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
    [ 5300.155724] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
    [ 5300.155988] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
    ….
    [ 5301.075531] team0: Port device team_slave_1 added
    [ 5301.085515] bridge0: port 1(bridge_slave_0) entered blocking state
    [ 5301.085531] bridge0: port 1(bridge_slave_0) entered disabled state
    [ 5301.085588] bridge_slave_0: entered allmulticast mode
    [ 5301.085800] bridge_slave_0: entered promiscuous mode
    [ 5301.095617] bridge0: port 1(bridge_slave_0) entered blocking state
    [ 5301.095633] bridge0: port 1(bridge_slave_0) entered disabled state
    …
    [ 5301.149734] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
    [ 5301.173234] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
    [ 5301.180517] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
    [ 5301.193481] hsr_slave_0: entered promiscuous mode
    [ 5301.204425] hsr_slave_1: entered promiscuous mode
    [ 5301.210172] debugfs: Directory 'hsr0' with parent 'hsr' already present!
    [ 5301.210185] Cannot create hsr debugfs directory
    [ 5301.224061] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
    [ 5301.246901] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
    [ 5301.255934] team0: Port device team_slave_0 added
    [ 5301.256480] team0: Port device team_slave_1 added
    [ 5301.256948] team0: Port device team_slave_0 added
    …
    [ 5301.435928] hsr_slave_0: entered promiscuous mode
    [ 5301.446029] hsr_slave_1: entered promiscuous mode
    [ 5301.455872] debugfs: Directory 'hsr0' with parent 'hsr' already present!
    [ 5301.455884] Cannot create hsr debugfs directory
    [ 5301.502664] hsr_slave_0: entered promiscuous mode
    [ 5301.513675] hsr_slave_1: entered promiscuous mode
    [ 5301.526155] debugfs: Directory 'hsr0' with parent 'hsr' already present!
    [ 5301.526164] Cannot create hsr debugfs directory
    [ 5301.563662] hsr_slave_0: entered promiscuous mode
    [ 5301.576129] hsr_slave_1: entered promiscuous mode
    [ 5301.580259] debugfs: Directory 'hsr0' with parent 'hsr' already present!
    [ 5301.580270] Cannot create hsr debugfs directory
    [ 5301.590269] 8021q: adding VLAN 0 to HW filter on device bond0
    
    [ 5301.595872] KASAN: null-ptr-deref in range [0x0000000000000130-0x0000000000000137]
    [ 5301.595877] Mem abort info:
    [ 5301.595881]   ESR = 0x0000000096000006
    [ 5301.595885]   EC = 0x25: DABT (current EL), IL = 32 bits
    [ 5301.595889]   SET = 0, FnV = 0
    [ 5301.595893]   EA = 0, S1PTW = 0
    [ 5301.595896]   FSC = 0x06: level 2 translation fault
    [ 5301.595900] Data abort info:
    [ 5301.595903]   ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
    [ 5301.595907]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
    [ 5301.595911]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
    [ 5301.595915] [dfff800000000026] address between user and kernel address ranges
    [ 5301.595971] Internal error: Oops: 0000000096000006 [#1] SMP
    …
    [ 5301.596076] CPU: 2 PID: 102769 Comm:
    syz-executor.3 Kdump: loaded Tainted:
     G        W         -------  ---  6.10.0-0.rc2.20240608gitdc772f8237f9.29.fc41.aarch64+debug #1
    [ 5301.596080] Hardware name: VMware, Inc. VMware20,1/VBSA,
     BIOS VMW201.00V.21805430.BA64.2305221830 05/22/2023
    [ 5301.596082] pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
    [ 5301.596085] pc : strnlen+0x40/0x88
    [ 5301.596114] lr : trace_event_get_offsets_qdisc_reset+0x6c/0x2b0
    [ 5301.596124] sp : ffff8000beef6b40
    [ 5301.596126] x29: ffff8000beef6b40 x28: dfff800000000000 x27: 0000000000000001
    [ 5301.596131] x26: 6de1800082c62bd0 x25: 1ffff000110aa9e0 x24: ffff800088554f00
    [ 5301.596136] x23: ffff800088554ec0 x22: 0000000000000130 x21: 0000000000000140
    [ 5301.596140] x20: dfff800000000000 x19: ffff8000beef6c60 x18: ffff7000115106d8
    [ 5301.596143] x17: ffff800121bad000 x16: ffff800080020000 x15: 0000000000000006
    [ 5301.596147] x14: 0000000000000002 x13: ffff0001f3ed8d14 x12: ffff700017ddeda5
    [ 5301.596151] x11: 1ffff00017ddeda4 x10: ffff700017ddeda4 x9 : ffff800082cc5eec
    [ 5301.596155] x8 : 0000000000000004 x7 : 00000000f1f1f1f1 x6 : 00000000f2f2f200
    [ 5301.596158] x5 : 00000000f3f3f3f3 x4 : ffff700017dded80 x3 : 00000000f204f1f1
    [ 5301.596162] x2 : 0000000000000026 x1 : 0000000000000000 x0 : 0000000000000130
    [ 5301.596166] Call trace:
    [ 5301.596175]  strnlen+0x40/0x88
    [ 5301.596179]  trace_event_get_offsets_qdisc_reset+0x6c/0x2b0
    [ 5301.596182]  perf_trace_qdisc_reset+0xb0/0x538
    [ 5301.596184]  __traceiter_qdisc_reset+0x68/0xc0
    [ 5301.596188]  qdisc_reset+0x43c/0x5e8
    [ 5301.596190]  netif_set_real_num_tx_queues+0x288/0x770
    [ 5301.596194]  veth_init_queues+0xfc/0x130 [veth]
    [ 5301.596198]  veth_newlink+0x45c/0x850 [veth]
    [ 5301.596202]  rtnl_newlink_create+0x2c8/0x798
    [ 5301.596205]  __rtnl_newlink+0x92c/0xb60
    [ 5301.596208]  rtnl_newlink+0xd8/0x130
    [ 5301.596211]  rtnetlink_rcv_msg+0x2e0/0x890
    [ 5301.596214]  netlink_rcv_skb+0x1c4/0x380
    [ 5301.596225]  rtnetlink_rcv+0x20/0x38
    [ 5301.596227]  netlink_unicast+0x3c8/0x640
    [ 5301.596231]  netlink_sendmsg+0x658/0xa60
    [ 5301.596234]  __sock_sendmsg+0xd0/0x180
    [ 5301.596243]  __sys_sendto+0x1c0/0x280
    [ 5301.596246]  __arm64_sys_sendto+0xc8/0x150
    [ 5301.596249]  invoke_syscall+0xdc/0x268
    [ 5301.596256]  el0_svc_common.constprop.0+0x16c/0x240
    [ 5301.596259]  do_el0_svc+0x48/0x68
    [ 5301.596261]  el0_svc+0x50/0x188
    [ 5301.596265]  el0t_64_sync_handler+0x120/0x130
    [ 5301.596268]  el0t_64_sync+0x194/0x198
    [ 5301.596272] Code: eb15001f 54000120 d343fc02 12000801 (38f46842)
    [ 5301.596285] SMP: stopping secondary CPUs
    [ 5301.597053] Starting crashdump kernel...
    [ 5301.597057] Bye!
    
    After applying our patch, I didn't find any kernel panic errors.
    
    We've found a simple reproducer
    
     # echo 1 > /sys/kernel/debug/tracing/events/qdisc/qdisc_reset/enable
    
     # ip link add veth0 type veth peer name veth1
    
     Error: Unknown device type.
    
    However, without our patch applied, I tested upstream 6.10.0-rc3 kernel
    using the qdisc_reset event and the ip command on my qemu virtual machine.
    
    This 2 commands makes always kernel panic.
    
    Linux version: 6.10.0-rc3
    
    [    0.000000] Linux version 6.10.0-rc3-00164-g44ef20baed8e-dirty
    (paran@fedora) (gcc (GCC) 14.1.1 20240522 (Red Hat 14.1.1-4), GNU ld
    version 2.41-34.fc40) #20 SMP PREEMPT Sat Jun 15 16:51:25 KST 2024
    
    Kernel panic message:
    
    [  615.236484] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
    [  615.237250] Dumping ftrace buffer:
    [  615.237679]    (ftrace buffer empty)
    [  615.238097] Modules linked in: veth crct10dif_ce virtio_gpu
    virtio_dma_buf drm_shmem_helper drm_kms_helper zynqmp_fpga xilinx_can
    xilinx_spi xilinx_selectmap xilinx_core xilinx_pr_decoupler versal_fpga
    uvcvideo uvc videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videodev
    videobuf2_common mc usbnet deflate zstd ubifs ubi rcar_canfd rcar_can
    omap_mailbox ntb_msi_test ntb_hw_epf lattice_sysconfig_spi
    lattice_sysconfig ice40_spi gpio_xilinx dwmac_altr_socfpga mdio_regmap
    stmmac_platform stmmac pcs_xpcs dfl_fme_region dfl_fme_mgr dfl_fme_br
    dfl_afu dfl fpga_region fpga_bridge can can_dev br_netfilter bridge stp
    llc atl1c ath11k_pci mhi ath11k_ahb ath11k qmi_helpers ath10k_sdio
    ath10k_pci ath10k_core ath mac80211 libarc4 cfg80211 drm fuse backlight ipv6
    Jun 22 02:36:5[3   6k152.62-4sm98k4-0k]v  kCePUr:n e1l :P IUDn:a b4le6
    8t oC ohmma: nidpl eN oketr nteali nptaedg i6n.g1 0re.0q-urecs3t- 0at0
    1v6i4r-tgu4a4le fa2d0dbraeeds0se-dir tyd f#f2f08
      615.252376] Hardware name: linux,dummy-virt (DT)
    [  615.253220] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS
    BTYPE=--)
    [  615.254433] pc : strnlen+0x6c/0xe0
    [  615.255096] lr : trace_event_get_offsets_qdisc_reset+0x94/0x3d0
    [  615.256088] sp : ffff800080b269a0
    [  615.256615] x29: ffff800080b269a0 x28: ffffc070f3f98500 x27:
    0000000000000001
    [  615.257831] x26: 0000000000000010 x25: ffffc070f3f98540 x24:
    ffffc070f619cf60
    [  615.259020] x23: 0000000000000128 x22: 0000000000000138 x21:
    dfff800000000000
    [  615.260241] x20: ffffc070f631ad00 x19: 0000000000000128 x18:
    ffffc070f448b800
    [  615.261454] x17: 0000000000000000 x16: 0000000000000001 x15:
    ffffc070f4ba2a90
    [  615.262635] x14: ffff700010164d73 x13: 1ffff80e1e8d5eb3 x12:
    1ffff00010164d72
    [  615.263877] x11: ffff700010164d72 x10: dfff800000000000 x9 :
    ffffc070e85d6184
    [  615.265047] x8 : ffffc070e4402070 x7 : 000000000000f1f1 x6 :
    000000001504a6d3
    [  615.266336] x5 : ffff28ca21122140 x4 : ffffc070f5043ea8 x3 :
    0000000000000000
    [  615.267528] x2 : 0000000000000025 x1 : 0000000000000000 x0 :
    0000000000000000
    [  615.268747] Call trace:
    [  615.269180]  strnlen+0x6c/0xe0
    [  615.269767]  trace_event_get_offsets_qdisc_reset+0x94/0x3d0
    [  615.270716]  trace_event_raw_event_qdisc_reset+0xe8/0x4e8
    [  615.271667]  __traceiter_qdisc_reset+0xa0/0x140
    [  615.272499]  qdisc_reset+0x554/0x848
    [  615.273134]  netif_set_real_num_tx_queues+0x360/0x9a8
    [  615.274050]  veth_init_queues+0x110/0x220 [veth]
    [  615.275110]  veth_newlink+0x538/0xa50 [veth]
    [  615.276172]  __rtnl_newlink+0x11e4/0x1bc8
    [  615.276944]  rtnl_newlink+0xac/0x120
    [  615.277657]  rtnetlink_rcv_msg+0x4e4/0x1370
    [  615.278409]  netlink_rcv_skb+0x25c/0x4f0
    [  615.279122]  rtnetlink_rcv+0x48/0x70
    [  615.279769]  netlink_unicast+0x5a8/0x7b8
    [  615.280462]  netlink_sendmsg+0xa70/0x1190
    
    Yeoreum and I don't know if the patch we wrote will fix the underlying
    cause, but we think that priority is to prevent kernel panic happening.
    So, we're sending this patch.
    
    Fixes: 51270d573a8d ("tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string")
    Link: https://lore.kernel.org/lkml/20240229143432.273b4871@gandalf.local.home/t/
    Cc: netdev@vger.kernel.org
    Tested-by: Yunseong Kim <yskelg@gmail.com>
    Signed-off-by: Yunseong Kim <yskelg@gmail.com>
    Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
    Link: https://lore.kernel.org/r/20240624173320.24945-4-yskelg@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0a95f0f6d64eb9e80bb6008626f68182c32d3976
Author: Udit Kumar <u-kumar1@ti.com>
Date:   Tue Jun 25 21:37:25 2024 +0530

    serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
    
    commit c128a1b0523b685c8856ddc0ac0e1caef1fdeee5 upstream.
    
    Errata i2310[0] says, Erroneous timeout can be triggered,
    if this Erroneous interrupt is not cleared then it may leads
    to storm of interrupts.
    
    Commit 9d141c1e6157 ("serial: 8250_omap: Implementation of Errata i2310")
    which added the workaround but missed ensuring RX FIFO is really empty
    before applying the errata workaround as recommended in the errata text.
    Fix this by adding back check for UART_OMAP_RX_LVL to be 0 for
    workaround to take effect.
    
    [0] https://www.ti.com/lit/pdf/sprz536 page 23
    
    Fixes: 9d141c1e6157 ("serial: 8250_omap: Implementation of Errata i2310")
    Cc: stable@vger.kernel.org
    Reported-by: Vignesh Raghavendra <vigneshr@ti.com>
    Closes: https://lore.kernel.org/all/e96d0c55-0b12-4cbf-9d23-48963543de49@ti.com/
    Signed-off-by: Udit Kumar <u-kumar1@ti.com>
    Link: https://lore.kernel.org/r/20240625160725.2102194-1-u-kumar1@ti.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1bd2dc77029458b32987fe2e4a30d78cc10a55e8
Author: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date:   Wed Mar 9 23:13:45 2022 +0100

    xdp: xdp_mem_allocator can be NULL in trace_mem_connect().
    
    commit e0ae713023a9d09d6e1b454bdc8e8c1dd32c586e upstream.
    
    Since the commit mentioned below __xdp_reg_mem_model() can return a NULL
    pointer. This pointer is dereferenced in trace_mem_connect() which leads
    to segfault.
    
    The trace points (mem_connect + mem_disconnect) were put in place to
    pair connect/disconnect using the IDs. The ID is only assigned if
    __xdp_reg_mem_model() does not return NULL. That connect trace point is
    of no use if there is no ID.
    
    Skip that connect trace point if xdp_alloc is NULL.
    
    [ Toke Høiland-Jørgensen delivered the reasoning for skipping the trace
      point ]
    
    Fixes: 4a48ef70b93b8 ("xdp: Allow registering memory model without rxq reference")
    Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
    Link: https://lore.kernel.org/r/YikmmXsffE+QajTB@linutronix.de
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4686892f615a005133794fc79bb6cef1c156df69
Author: Alex Bee <knaerzche@gmail.com>
Date:   Sun Jun 23 11:01:15 2024 +0200

    arm64: dts: rockchip: Add sound-dai-cells for RK3368
    
    [ Upstream commit 8d7ec44aa5d1eb94a30319074762a1740440cdc8 ]
    
    Add the missing #sound-dai-cells for RK3368's I2S and S/PDIF controllers.
    
    Fixes: f7d89dfe1e31 ("arm64: dts: rockchip: add i2s nodes support for RK3368 SoCs")
    Fixes: 0328d68ea76d ("arm64: dts: rockchip: add rk3368 spdif node")
    Signed-off-by: Alex Bee <knaerzche@gmail.com>
    Link: https://lore.kernel.org/r/20240623090116.670607-4-knaerzche@gmail.com
    Signed-off-by: Heiko Stuebner <heiko@sntech.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit e9918954e370cbe764c80dce89c402e9e792b276
Author: Johan Jonker <jbx6244@gmail.com>
Date:   Thu Jun 13 20:08:10 2024 +0200

    ARM: dts: rockchip: rk3066a: add #sound-dai-cells to hdmi node
    
    [ Upstream commit cca46f811d0000c1522a5e18ea48c27a15e45c05 ]
    
    '#sound-dai-cells' is required to properly interpret
    the list of DAI specified in the 'sound-dai' property,
    so add them to the 'hdmi' node for 'rk3066a.dtsi'.
    
    Fixes: fadc78062477 ("ARM: dts: rockchip: add rk3066 hdmi nodes")
    Signed-off-by: Johan Jonker <jbx6244@gmail.com>
    Link: https://lore.kernel.org/r/8b229dcc-94e4-4bbc-9efc-9d5ddd694532@gmail.com
    Signed-off-by: Heiko Stuebner <heiko@sntech.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b63d015b7ae9282d50e203370178837f6f19065a
Author: Marc Zyngier <maz@kernel.org>
Date:   Thu Jul 13 08:06:57 2023 +0100

    KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption
    
    commit b321c31c9b7b309dcde5e8854b741c8e6a9a05f0 upstream.
    
    Xiang reports that VMs occasionally fail to boot on GICv4.1 systems when
    running a preemptible kernel, as it is possible that a vCPU is blocked
    without requesting a doorbell interrupt.
    
    The issue is that any preemption that occurs between vgic_v4_put() and
    schedule() on the block path will mark the vPE as nonresident and *not*
    request a doorbell irq. This occurs because when the vcpu thread is
    resumed on its way to block, vcpu_load() will make the vPE resident
    again. Once the vcpu actually blocks, we don't request a doorbell
    anymore, and the vcpu won't be woken up on interrupt delivery.
    
    Fix it by tracking that we're entering WFI, and key the doorbell
    request on that flag. This allows us not to make the vPE resident
    when going through a preempt/schedule cycle, meaning we don't lose
    any state.
    
    Cc: stable@vger.kernel.org
    Fixes: 8e01d9a396e6 ("KVM: arm64: vgic-v4: Move the GICv4 residency flow to be driven by vcpu_load/put")
    Reported-by: Xiang Chen <chenxiang66@hisilicon.com>
    Suggested-by: Zenghui Yu <yuzenghui@huawei.com>
    Tested-by: Xiang Chen <chenxiang66@hisilicon.com>
    Co-developed-by: Oliver Upton <oliver.upton@linux.dev>
    Signed-off-by: Marc Zyngier <maz@kernel.org>
    Acked-by: Zenghui Yu <yuzenghui@huawei.com>
    Link: https://lore.kernel.org/r/20230713070657.3873244-1-maz@kernel.org
    Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
    [ modified to wrangle the vCPU flags directly instead of going through
      the flag helper macros as they have not yet been introduced. Also doing
      the flag wranging in the kvm_arch_vcpu_{un}blocking() hooks as the
      introduction of kvm_vcpu_wfi has not yet happened. See:
      6109c5a6ab7f ("KVM: arm64: Move vGIC v4 handling for WFI out arch callback hook")  ]
    Signed-off-by: James Gowans <jgowans@amazon.com>
    Acked-by: Marc Zyngier <maz@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 91efb15b5a3eb330b2900430c390ec2270dc67a6
Author: Ard Biesheuvel <ardb@kernel.org>
Date:   Sat Jun 29 17:14:02 2024 +0200

    efi/x86: Free EFI memory map only when installing a new one.
    
    [ Commit 75dde792d6f6c2d0af50278bd374bf0c512fe196 upstream ]
    
    The logic in __efi_memmap_init() is shared between two different
    execution flows:
    - mapping the EFI memory map early or late into the kernel VA space, so
      that its entries can be accessed;
    - the x86 specific cloning of the EFI memory map in order to insert new
      entries that are created as a result of making a memory reservation
      via a call to efi_mem_reserve().
    
    In the former case, the underlying memory containing the kernel's view
    of the EFI memory map (which may be heavily modified by the kernel
    itself on x86) is not modified at all, and the only thing that changes
    is the virtual mapping of this memory, which is different between early
    and late boot.
    
    In the latter case, an entirely new allocation is created that carries a
    new, updated version of the kernel's view of the EFI memory map. When
    installing this new version, the old version will no longer be
    referenced, and if the memory was allocated by the kernel, it will leak
    unless it gets freed.
    
    The logic that implements this freeing currently lives on the code path
    that is shared between these two use cases, but it should only apply to
    the latter. So move it to the correct spot.
    
    While at it, drop the dummy definition for non-x86 architectures, as
    that is no longer needed.
    
    Cc: <stable@vger.kernel.org>
    Fixes: f0ef6523475f ("efi: Fix efi_memmap_alloc() leaks")
    Tested-by: Ashish Kalra <Ashish.Kalra@amd.com>
    Link: https://lore.kernel.org/all/36ad5079-4326-45ed-85f6-928ff76483d3@amd.com
    Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e5d730882d27a8556b2522300a4e80405b443067
Author: Ard Biesheuvel <ardb@kernel.org>
Date:   Sat Jun 29 17:14:01 2024 +0200

    efi: xen: Set EFI_PARAVIRT for Xen dom0 boot on all architectures
    
    [ Commit d85e3e34940788578eeffd94e8b7e1d28e7278e9 upstream ]
    
    Currently, the EFI_PARAVIRT flag is only used by Xen dom0 boot on x86,
    even though other architectures also support pseudo-EFI boot, where the
    core kernel is invoked directly and provided with a set of data tables
    that resemble the ones constructed by the EFI stub, which never actually
    runs in that case.
    
    Let's fix this inconsistency, and always set this flag when booting dom0
    via the EFI boot path. Note that Xen on x86 does not provide the EFI
    memory map in this case, whereas other architectures do, so move the
    associated EFI_PARAVIRT check into the x86 platform code.
    
    Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 31e0721aeabde29371f624f56ce2f403508527a5
Author: Ard Biesheuvel <ardb@kernel.org>
Date:   Sat Jun 29 17:14:00 2024 +0200

    efi: memmap: Move manipulation routines into x86 arch tree
    
    [ Commit fdc6d38d64a20c542b1867ebeb8dd03b98829336 upstream ]
    
    The EFI memory map is a description of the memory layout as provided by
    the firmware, and only x86 manipulates it in various different ways for
    its own memory bookkeeping. So let's move the memmap routines that are
    only used by x86 into the x86 arch tree.
    
    [ardb: minor tweaks for linux-5.10.y backport]
    Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 52dc463a76b0441a6031d66d0c8f2fb243950c6a
Author: Liu Zixian <liuzixian4@huawei.com>
Date:   Sat Jun 29 17:13:59 2024 +0200

    efi: Correct comment on efi_memmap_alloc
    
    [ Commit db01ea882bf601252dad57242655da17fd9ad2f5 upstream ]
    
    Returning zero means success now.
    
    Signed-off-by: Liu Zixian <liuzixian4@huawei.com>
    Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d204beedc82f79e1fe95c63fd70c2e9bb04da539
Author: Zheng Zhi Yuan <kevinjone25@g.ncu.edu.tw>
Date:   Sat Jun 29 17:13:58 2024 +0200

    drivers: fix typo in firmware/efi/memmap.c
    
    [ Commit 1df4d1724baafa55e9803414ebcdf1ca702bc958 upstream ]
    
    This patch fixes the spelling error in firmware/efi/memmap.c, changing
    it to the correct word.
    
    Signed-off-by: Zheng Zhi Yuan <kevinjone25@g.ncu.edu.tw>
    Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3b32f265805a49071e2c4568a524398ba22bf93c
Author: Kuniyuki Iwashima <kuniyu@amazon.com>
Date:   Mon Apr 17 16:50:34 2023 +0000

    tcp: Fix data races around icsk->icsk_af_ops.
    
    commit f49cd2f4d6170d27a2c61f1fecb03d8a70c91f57 upstream.
    
    setsockopt(IPV6_ADDRFORM) and tcp_v6_connect() change icsk->icsk_af_ops
    under lock_sock(), but tcp_(get|set)sockopt() read it locklessly.  To
    avoid load/store tearing, we need to add READ_ONCE() and WRITE_ONCE()
    for the reads and writes.
    
    Thanks to Eric Dumazet for providing the syzbot report:
    
    BUG: KCSAN: data-race in tcp_setsockopt / tcp_v6_connect
    
    write to 0xffff88813c624518 of 8 bytes by task 23936 on cpu 0:
    tcp_v6_connect+0x5b3/0xce0 net/ipv6/tcp_ipv6.c:240
    __inet_stream_connect+0x159/0x6d0 net/ipv4/af_inet.c:660
    inet_stream_connect+0x44/0x70 net/ipv4/af_inet.c:724
    __sys_connect_file net/socket.c:1976 [inline]
    __sys_connect+0x197/0x1b0 net/socket.c:1993
    __do_sys_connect net/socket.c:2003 [inline]
    __se_sys_connect net/socket.c:2000 [inline]
    __x64_sys_connect+0x3d/0x50 net/socket.c:2000
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    read to 0xffff88813c624518 of 8 bytes by task 23937 on cpu 1:
    tcp_setsockopt+0x147/0x1c80 net/ipv4/tcp.c:3789
    sock_common_setsockopt+0x5d/0x70 net/core/sock.c:3585
    __sys_setsockopt+0x212/0x2b0 net/socket.c:2252
    __do_sys_setsockopt net/socket.c:2263 [inline]
    __se_sys_setsockopt net/socket.c:2260 [inline]
    __x64_sys_setsockopt+0x62/0x70 net/socket.c:2260
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    value changed: 0xffffffff8539af68 -> 0xffffffff8539aff8
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 1 PID: 23937 Comm: syz-executor.5 Not tainted
    6.0.0-rc4-syzkaller-00331-g4ed9c1e971b1-dirty #0
    
    Hardware name: Google Google Compute Engine/Google Compute Engine,
    BIOS Google 08/26/2022
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Reported-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Kazunori Kobayashi <kazunori.kobayashi@miraclelinux.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ea2ed3f78ab238865b9b9e19a85c1de16d570ab7
Author: Kuniyuki Iwashima <kuniyu@amazon.com>
Date:   Mon Apr 17 16:50:33 2023 +0000

    ipv6: Fix data races around sk->sk_prot.
    
    commit 364f997b5cfe1db0d63a390fe7c801fa2b3115f6 upstream.
    
    Commit 086d49058cd8 ("ipv6: annotate some data-races around sk->sk_prot")
    fixed some data-races around sk->sk_prot but it was not enough.
    
    Some functions in inet6_(stream|dgram)_ops still access sk->sk_prot
    without lock_sock() or rtnl_lock(), so they need READ_ONCE() to avoid
    load tearing.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Kazunori Kobayashi <kazunori.kobayashi@miraclelinux.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d3bf338e9ca4d70f00e44c54ea67a274c7409583
Author: Eric Dumazet <edumazet@google.com>
Date:   Mon Apr 17 16:50:32 2023 +0000

    ipv6: annotate some data-races around sk->sk_prot
    
    commit 086d49058cd8471046ae9927524708820f5fd1c7 upstream.
    
    IPv6 has this hack changing sk->sk_prot when an IPv6 socket
    is 'converted' to an IPv4 one with IPV6_ADDRFORM option.
    
    This operation is only performed for TCP and UDP, knowing
    their 'struct proto' for the two network families are populated
    in the same way, and can not disappear while a reader
    might use and dereference sk->sk_prot.
    
    If we think about it all reads of sk->sk_prot while
    either socket lock or RTNL is not acquired should be using READ_ONCE().
    
    Also note that other layers like MPTCP, XFRM, CHELSIO_TLS also
    write over sk->sk_prot.
    
    BUG: KCSAN: data-race in inet6_recvmsg / ipv6_setsockopt
    
    write to 0xffff8881386f7aa8 of 8 bytes by task 26932 on cpu 0:
     do_ipv6_setsockopt net/ipv6/ipv6_sockglue.c:492 [inline]
     ipv6_setsockopt+0x3758/0x3910 net/ipv6/ipv6_sockglue.c:1019
     udpv6_setsockopt+0x85/0x90 net/ipv6/udp.c:1649
     sock_common_setsockopt+0x5d/0x70 net/core/sock.c:3489
     __sys_setsockopt+0x209/0x2a0 net/socket.c:2180
     __do_sys_setsockopt net/socket.c:2191 [inline]
     __se_sys_setsockopt net/socket.c:2188 [inline]
     __x64_sys_setsockopt+0x62/0x70 net/socket.c:2188
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    read to 0xffff8881386f7aa8 of 8 bytes by task 26911 on cpu 1:
     inet6_recvmsg+0x7a/0x210 net/ipv6/af_inet6.c:659
     ____sys_recvmsg+0x16c/0x320
     ___sys_recvmsg net/socket.c:2674 [inline]
     do_recvmmsg+0x3f5/0xae0 net/socket.c:2768
     __sys_recvmmsg net/socket.c:2847 [inline]
     __do_sys_recvmmsg net/socket.c:2870 [inline]
     __se_sys_recvmmsg net/socket.c:2863 [inline]
     __x64_sys_recvmmsg+0xde/0x160 net/socket.c:2863
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    value changed: 0xffffffff85e0e980 -> 0xffffffff85e01580
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 1 PID: 26911 Comm: syz-executor.3 Not tainted 5.17.0-rc2-syzkaller-00316-g0457e5153e0e-dirty #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Kazunori Kobayashi <kazunori.kobayashi@miraclelinux.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ed07b26c54ef4fbfe67fdd348e951fdbaeed35f8
Author: Matthew Wilcox (Oracle) <willy@infradead.org>
Date:   Mon May 16 10:30:09 2022 -0400

    nfs: Leave pages in the pagecache if readpage failed
    
    commit 0b768a9610c6de9811c6d33900bebfb665192ee1 upstream.
    
    The pagecache handles readpage failing by itself; it doesn't want
    filesystems to remove pages from under it.
    
    Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2e6bbfa1abfe1533cb242d657cca0694c59f4bab
Author: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Date:   Fri Jun 21 16:37:12 2024 +0200

    pwm: stm32: Refuse too small period requests
    
    commit c45fcf46ca2368dafe7e5c513a711a6f0f974308 upstream.
    
    If period_ns is small, prd might well become 0. Catch that case because
    otherwise with
    
            regmap_write(priv->regmap, TIM_ARR, prd - 1);
    
    a few lines down quite a big period is configured.
    
    Fixes: 7edf7369205b ("pwm: Add driver for STM32 plaftorm")
    Cc: stable@vger.kernel.org
    Reviewed-by: Trevor Gamblin <tgamblin@baylibre.com>
    Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
    Link: https://lore.kernel.org/r/b86f62f099983646f97eeb6bfc0117bb2d0c340d.1718979150.git.u.kleine-koenig@baylibre.com
    Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2c43adf36475b2ed60241820f5095e3816d14d26
Author: Jaime Liao <jaimeliao@mxic.com.tw>
Date:   Thu May 20 09:45:08 2021 +0800

    mtd: spinand: macronix: Add support for serial NAND flash
    
    commit c374839f9b4475173e536d1eaddff45cb481dbdf upstream.
    
    Macronix NAND Flash devices are available in different configurations
    and densities.
    
    MX"35" means SPI NAND
    MX35"LF"/"UF" , LF means 3V and UF meands 1.8V
    MX35LF"2G" , 2G means 2Gbits
    MX35LF2G"E4"/"24"/"14",
    E4 means internal ECC and Quad I/O(x4)
    24 means 8-bit ecc requirement and Quad I/O(x4)
    14 means 4-bit ecc requirement and Quad I/O(x4)
    
    MX35LF2G14AC is 3V 2Gbit serial NAND flash device
    (without on-die ECC)
    https://www.mxic.com.tw/Lists/Datasheet/Attachments/7926/MX35LF2G14AC,%203V,%202Gb,%20v1.1.pdf
    
    MX35UF4G24AD is 1.8V 4Gbit serial NAND flash device
    (without on-die ECC)
    https://www.mxic.com.tw/Lists/Datasheet/Attachments/7980/MX35UF4G24AD,%201.8V,%204Gb,%20v0.00.pdf
    
    MX35UF4GE4AD/MX35UF2GE4AD are 1.8V 4G/2Gbit serial
    NAND flash device with 8-bit on-die ECC
    https://www.mxic.com.tw/Lists/Datasheet/Attachments/7983/MX35UF4GE4AD,%201.8V,%204Gb,%20v0.00.pdf
    
    MX35UF2GE4AC/MX35UF1GE4AC are 1.8V 2G/1Gbit serial
    NAND flash device with 8-bit on-die ECC
    https://www.mxic.com.tw/Lists/Datasheet/Attachments/7974/MX35UF2GE4AC,%201.8V,%202Gb,%20v1.0.pdf
    
    MX35UF2G14AC/MX35UF1G14AC are 1.8V 2G/1Gbit serial
    NAND flash device (without on-die ECC)
    https://www.mxic.com.tw/Lists/Datasheet/Attachments/7931/MX35UF2G14AC,%201.8V,%202Gb,%20v1.1.pdf
    
    Validated via normal(default) and QUAD mode by read, erase, read back,
    on Xilinx Zynq PicoZed FPGA board which included Macronix
    SPI Host(drivers/spi/spi-mxic.c).
    
    Signed-off-by: Jaime Liao <jaimeliao@mxic.com.tw>
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Link: https://lore.kernel.org/linux-mtd/1621475108-22523-1-git-send-email-jaimeliao@mxic.com.tw
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d5f75f01994e399500264a07585935adab948ee5
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Thu Jun 20 14:16:37 2024 +0200

    syscalls: fix compat_sys_io_pgetevents_time64 usage
    
    commit d3882564a77c21eb746ba5364f3fa89b88de3d61 upstream.
    
    Using sys_io_pgetevents() as the entry point for compat mode tasks
    works almost correctly, but misses the sign extension for the min_nr
    and nr arguments.
    
    This was addressed on parisc by switching to
    compat_sys_io_pgetevents_time64() in commit 6431e92fc827 ("parisc:
    io_pgetevents_time64() needs compat syscall in 32-bit compat mode"),
    as well as by using more sophisticated system call wrappers on x86 and
    s390. However, arm64, mips, powerpc, sparc and riscv still have the
    same bug.
    
    Change all of them over to use compat_sys_io_pgetevents_time64()
    like parisc already does. This was clearly the intention when the
    function was originally added, but it got hooked up incorrectly in
    the tables.
    
    Cc: stable@vger.kernel.org
    Fixes: 48166e6ea47d ("y2038: add 64-bit time_t syscalls to all 32-bit architectures")
    Acked-by: Heiko Carstens <hca@linux.ibm.com> # s390
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 84bf6b64a1a0dfc6de7e1b1c776d58d608e7865a
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Wed Jun 19 11:34:09 2024 +0200

    ftruncate: pass a signed offset
    
    commit 4b8e88e563b5f666446d002ad0dc1e6e8e7102b0 upstream.
    
    The old ftruncate() syscall, using the 32-bit off_t misses a sign
    extension when called in compat mode on 64-bit architectures.  As a
    result, passing a negative length accidentally succeeds in truncating
    to file size between 2GiB and 4GiB.
    
    Changing the type of the compat syscall to the signed compat_off_t
    changes the behavior so it instead returns -EINVAL.
    
    The native entry point, the truncate() syscall and the corresponding
    loff_t based variants are all correct already and do not suffer
    from this mistake.
    
    Fixes: 3f6d078d4acc ("fix compat truncate/ftruncate")
    Reviewed-by: Christian Brauner <brauner@kernel.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 010de9acbea58fbcbda08e3793d6262086a493fe
Author: Niklas Cassel <cassel@kernel.org>
Date:   Sat Jun 29 14:42:13 2024 +0200

    ata: libata-core: Fix double free on error
    
    commit ab9e0c529eb7cafebdd31fe1644524e80a48b05d upstream.
    
    If e.g. the ata_port_alloc() call in ata_host_alloc() fails, we will jump
    to the err_out label, which will call devres_release_group().
    devres_release_group() will trigger a call to ata_host_release().
    ata_host_release() calls kfree(host), so executing the kfree(host) in
    ata_host_alloc() will lead to a double free:
    
    kernel BUG at mm/slub.c:553!
    Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
    CPU: 11 PID: 599 Comm: (udev-worker) Not tainted 6.10.0-rc5 #47
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014
    RIP: 0010:kfree+0x2cf/0x2f0
    Code: 5d 41 5e 41 5f 5d e9 80 d6 ff ff 4d 89 f1 41 b8 01 00 00 00 48 89 d9 48 89 da
    RSP: 0018:ffffc90000f377f0 EFLAGS: 00010246
    RAX: ffff888112b1f2c0 RBX: ffff888112b1f2c0 RCX: ffff888112b1f320
    RDX: 000000000000400b RSI: ffffffffc02c9de5 RDI: ffff888112b1f2c0
    RBP: ffffc90000f37830 R08: 0000000000000000 R09: 0000000000000000
    R10: ffffc90000f37610 R11: 617461203a736b6e R12: ffffea00044ac780
    R13: ffff888100046400 R14: ffffffffc02c9de5 R15: 0000000000000006
    FS:  00007f2f1cabe980(0000) GS:ffff88813b380000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007f2f1c3acf75 CR3: 0000000111724000 CR4: 0000000000750ef0
    PKRU: 55555554
    Call Trace:
     <TASK>
     ? __die_body.cold+0x19/0x27
     ? die+0x2e/0x50
     ? do_trap+0xca/0x110
     ? do_error_trap+0x6a/0x90
     ? kfree+0x2cf/0x2f0
     ? exc_invalid_op+0x50/0x70
     ? kfree+0x2cf/0x2f0
     ? asm_exc_invalid_op+0x1a/0x20
     ? ata_host_alloc+0xf5/0x120 [libata]
     ? ata_host_alloc+0xf5/0x120 [libata]
     ? kfree+0x2cf/0x2f0
     ata_host_alloc+0xf5/0x120 [libata]
     ata_host_alloc_pinfo+0x14/0xa0 [libata]
     ahci_init_one+0x6c9/0xd20 [ahci]
    
    Ensure that we will not call kfree(host) twice, by performing the kfree()
    only if the devres_open_group() call failed.
    
    Fixes: dafd6c496381 ("libata: ensure host is free'd on error exit paths")
    Cc: stable@vger.kernel.org
    Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
    Reviewed-by: Hannes Reinecke <hare@suse.de>
    Link: https://lore.kernel.org/r/20240629124210.181537-9-cassel@kernel.org
    Signed-off-by: Niklas Cassel <cassel@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit be5016ae5a3b362dd2bafb4c5b22114a84a3c38b
Author: Niklas Cassel <cassel@kernel.org>
Date:   Sat Jun 29 14:42:14 2024 +0200

    ata: ahci: Clean up sysfs file on error
    
    commit eeb25a09c5e0805d92e4ebd12c4b0ad0df1b0295 upstream.
    
    .probe() (ahci_init_one()) calls sysfs_add_file_to_group(), however,
    if probe() fails after this call, we currently never call
    sysfs_remove_file_from_group().
    
    (The sysfs_remove_file_from_group() call in .remove() (ahci_remove_one())
    does not help, as .remove() is not called on .probe() error.)
    
    Thus, if probe() fails after the sysfs_add_file_to_group() call, the next
    time we insmod the module we will get:
    
    sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:04.0/remapped_nvme'
    CPU: 11 PID: 954 Comm: modprobe Not tainted 6.10.0-rc5 #43
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014
    Call Trace:
     <TASK>
     dump_stack_lvl+0x5d/0x80
     sysfs_warn_dup.cold+0x17/0x23
     sysfs_add_file_mode_ns+0x11a/0x130
     sysfs_add_file_to_group+0x7e/0xc0
     ahci_init_one+0x31f/0xd40 [ahci]
    
    Fixes: 894fba7f434a ("ata: ahci: Add sysfs attribute to show remapped NVMe device count")
    Cc: stable@vger.kernel.org
    Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
    Reviewed-by: Hannes Reinecke <hare@suse.de>
    Link: https://lore.kernel.org/r/20240629124210.181537-10-cassel@kernel.org
    Signed-off-by: Niklas Cassel <cassel@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 692858d9edb34887235d94c8f12175c631a54b56
Author: Sven Eckelmann <sven@narfation.org>
Date:   Sat May 4 21:57:30 2024 +0200

    batman-adv: Don't accept TT entries for out-of-spec VIDs
    
    commit 537a350d14321c8cca5efbf0a33a404fec3a9f9e upstream.
    
    The internal handling of VLAN IDs in batman-adv is only specified for
    following encodings:
    
    * VLAN is used
      - bit 15 is 1
      - bit 11 - bit 0 is the VLAN ID (0-4095)
      - remaining bits are 0
    * No VLAN is used
      - bit 15 is 0
      - remaining bits are 0
    
    batman-adv was only preparing new translation table entries (based on its
    soft interface information) using this encoding format. But the receive
    path was never checking if entries in the roam or TT TVLVs were also
    following this encoding.
    
    It was therefore possible to create more than the expected maximum of 4096
    + 1 entries in the originator VLAN list. Simply by setting the "remaining
    bits" to "random" values in corresponding TVLV.
    
    Cc: stable@vger.kernel.org
    Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific")
    Reported-by: Linus Lüssing <linus.luessing@c0d3.blue>
    Signed-off-by: Sven Eckelmann <sven@narfation.org>
    Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 56fc4d3b0bdef691831cd95715a7ca3ebea98b2d
Author: Ma Ke <make24@iscas.ac.cn>
Date:   Tue Jun 25 16:10:29 2024 +0800

    drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
    
    commit 6d411c8ccc0137a612e0044489030a194ff5c843 upstream.
    
    In nv17_tv_get_hd_modes(), the return value of drm_mode_duplicate() is
    assigned to mode, which will lead to a possible NULL pointer dereference
    on failure of drm_mode_duplicate(). The same applies to drm_cvt_mode().
    Add a check to avoid null pointer dereference.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Ma Ke <make24@iscas.ac.cn>
    Signed-off-by: Lyude Paul <lyude@redhat.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20240625081029.2619437-1-make24@iscas.ac.cn
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f771b91f21c46ad1217328d05e72a2c7e3add535
Author: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
Date:   Mon Jun 3 21:54:45 2024 +0200

    drm/i915/gt: Fix potential UAF by revoke of fence registers
    
    commit 996c3412a06578e9d779a16b9e79ace18125ab50 upstream.
    
    CI has been sporadically reporting the following issue triggered by
    igt@i915_selftest@live@hangcheck on ADL-P and similar machines:
    
    <6> [414.049203] i915: Running intel_hangcheck_live_selftests/igt_reset_evict_fence
    ...
    <6> [414.068804] i915 0000:00:02.0: [drm] GT0: GUC: submission enabled
    <6> [414.068812] i915 0000:00:02.0: [drm] GT0: GUC: SLPC enabled
    <3> [414.070354] Unable to pin Y-tiled fence; err:-4
    <3> [414.071282] i915_vma_revoke_fence:301 GEM_BUG_ON(!i915_active_is_idle(&fence->active))
    ...
    <4>[  609.603992] ------------[ cut here ]------------
    <2>[  609.603995] kernel BUG at drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c:301!
    <4>[  609.604003] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
    <4>[  609.604006] CPU: 0 PID: 268 Comm: kworker/u64:3 Tainted: G     U  W          6.9.0-CI_DRM_14785-g1ba62f8cea9c+ #1
    <4>[  609.604008] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023
    <4>[  609.604010] Workqueue: i915 __i915_gem_free_work [i915]
    <4>[  609.604149] RIP: 0010:i915_vma_revoke_fence+0x187/0x1f0 [i915]
    ...
    <4>[  609.604271] Call Trace:
    <4>[  609.604273]  <TASK>
    ...
    <4>[  609.604716]  __i915_vma_evict+0x2e9/0x550 [i915]
    <4>[  609.604852]  __i915_vma_unbind+0x7c/0x160 [i915]
    <4>[  609.604977]  force_unbind+0x24/0xa0 [i915]
    <4>[  609.605098]  i915_vma_destroy+0x2f/0xa0 [i915]
    <4>[  609.605210]  __i915_gem_object_pages_fini+0x51/0x2f0 [i915]
    <4>[  609.605330]  __i915_gem_free_objects.isra.0+0x6a/0xc0 [i915]
    <4>[  609.605440]  process_scheduled_works+0x351/0x690
    ...
    
    In the past, there were similar failures reported by CI from other IGT
    tests, observed on other platforms.
    
    Before commit 63baf4f3d587 ("drm/i915/gt: Only wait for GPU activity
    before unbinding a GGTT fence"), i915_vma_revoke_fence() was waiting for
    idleness of vma->active via fence_update().   That commit introduced
    vma->fence->active in order for the fence_update() to be able to wait
    selectively on that one instead of vma->active since only idleness of
    fence registers was needed.  But then, another commit 0d86ee35097a
    ("drm/i915/gt: Make fence revocation unequivocal") replaced the call to
    fence_update() in i915_vma_revoke_fence() with only fence_write(), and
    also added that GEM_BUG_ON(!i915_active_is_idle(&fence->active)) in front.
    No justification was provided on why we might then expect idleness of
    vma->fence->active without first waiting on it.
    
    The issue can be potentially caused by a race among revocation of fence
    registers on one side and sequential execution of signal callbacks invoked
    on completion of a request that was using them on the other, still
    processed in parallel to revocation of those fence registers.  Fix it by
    waiting for idleness of vma->fence->active in i915_vma_revoke_fence().
    
    Fixes: 0d86ee35097a ("drm/i915/gt: Make fence revocation unequivocal")
    Closes: https://gitlab.freedesktop.org/drm/intel/issues/10021
    Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
    Cc: stable@vger.kernel.org # v5.8+
    Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
    Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20240603195446.297690-2-janusz.krzysztofik@linux.intel.com
    (cherry picked from commit 24bb052d3dd499c5956abad5f7d8e4fd07da7fb1)
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 259549b2ccf795b7f91f7b5aba47286addcfa389
Author: Ma Ke <make24@iscas.ac.cn>
Date:   Tue Jun 25 16:18:28 2024 +0800

    drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
    
    commit 66edf3fb331b6c55439b10f9862987b0916b3726 upstream.
    
    In nv17_tv_get_ld_modes(), the return value of drm_mode_duplicate() is
    assigned to mode, which will lead to a possible NULL pointer dereference
    on failure of drm_mode_duplicate(). Add a check to avoid npd.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Ma Ke <make24@iscas.ac.cn>
    Signed-off-by: Lyude Paul <lyude@redhat.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20240625081828.2620794-1-make24@iscas.ac.cn
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9ec84770e4867f75608e82c6503076dab814f299
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Thu Jun 20 15:24:11 2024 +0200

    hexagon: fix fadvise64_64 calling conventions
    
    commit 896842284c6ccba25ec9d78b7b6e62cdd507c083 upstream.
    
    fadvise64_64() has two 64-bit arguments at the wrong alignment
    for hexagon, which turns them into a 7-argument syscall that is
    not supported by Linux.
    
    The downstream musl port for hexagon actually asks for a 6-argument
    version the same way we do it on arm, csky, powerpc, so make the
    kernel do it the same way to avoid having to change both.
    
    Link: https://github.com/quic/musl/blob/hexagon/arch/hexagon/syscall_arch.h#L78
    Cc: stable@vger.kernel.org
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 690633552986ed86001f1092ff403e9a64fd386b
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Fri Jun 14 09:54:20 2024 +0200

    csky, hexagon: fix broken sys_sync_file_range
    
    commit 3339b99ef6fe38dac43b534cba3a8a0e29fb2eff upstream.
    
    Both of these architectures require u64 function arguments to be
    passed in even/odd pairs of registers or stack slots, which in case of
    sync_file_range would result in a seven-argument system call that is
    not currently possible. The system call is therefore incompatible with
    all existing binaries.
    
    While it would be possible to implement support for seven arguments
    like on mips, it seems better to use a six-argument version, either
    with the normal argument order but misaligned as on most architectures
    or with the reordered sync_file_range2() calling conventions as on
    arm and powerpc.
    
    Cc: stable@vger.kernel.org
    Acked-by: Guo Ren <guoren@kernel.org>
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bf4a43c533d9c3789750192d621425403c64c312
Author: Dragan Simic <dsimic@manjaro.org>
Date:   Mon Jun 10 07:21:12 2024 +0200

    kbuild: Install dtb files as 0644 in Makefile.dtbinst
    
    commit 9cc5f3bf63aa98bd7cc7ce8a8599077fde13283e upstream.
    
    The compiled dtb files aren't executable, so install them with 0644 as their
    permission mode, instead of defaulting to 0755 for the permission mode and
    installing them with the executable bits set.
    
    Some Linux distributions, including Debian, [1][2][3] already include fixes
    in their kernel package build recipes to change the dtb file permissions to
    0644 in their kernel packages.  These changes, when additionally propagated
    into the long-term kernel versions, will allow such distributions to remove
    their downstream fixes.
    
    [1] https://salsa.debian.org/kernel-team/linux/-/merge_requests/642
    [2] https://salsa.debian.org/kernel-team/linux/-/merge_requests/749
    [3] https://salsa.debian.org/kernel-team/linux/-/blob/debian/6.8.12-1/debian/rules.real#L193
    
    Cc: Diederik de Haas <didi.debian@cknow.org>
    Cc: <stable@vger.kernel.org>
    Fixes: aefd80307a05 ("kbuild: refactor Makefile.dtbinst more")
    Signed-off-by: Dragan Simic <dsimic@manjaro.org>
    Reviewed-by: Nicolas Schier <nicolas@fjasle.eu>
    Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f6c839e717901dbd6b1c1ca807b6210222eb70f6
Author: Oleksij Rempel <o.rempel@pengutronix.de>
Date:   Fri Nov 17 13:49:59 2023 +0100

    net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
    
    commit d3e2904f71ea0fe7eaff1d68a2b0363c888ea0fb upstream.
    
    This patch enhances error handling in scenarios with RTS (Request to
    Send) messages arriving closely. It replaces the less informative WARN_ON_ONCE
    backtraces with a new error handling method. This provides clearer error
    messages and allows for the early termination of problematic sessions.
    Previously, sessions were only released at the end of j1939_xtp_rx_rts().
    
    Potentially this could be reproduced with something like:
    testj1939 -r vcan0:0x80 &
    while true; do
            # send first RTS
            cansend vcan0 18EC8090#1014000303002301;
            # send second RTS
            cansend vcan0 18EC8090#1014000303002301;
            # send abort
            cansend vcan0 18EC8090#ff00000000002301;
    done
    
    Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
    Reported-by: syzbot+daa36413a5cedf799ae4@syzkaller.appspotmail.com
    Cc: stable@vger.kernel.org
    Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
    Link: https://lore.kernel.org/all/20231117124959.961171-1-o.rempel@pengutronix.de
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3f177e46c935284d83f3fe74d75693208e8fca13
Author: Oleksij Rempel <o.rempel@pengutronix.de>
Date:   Tue May 28 09:06:48 2024 +0200

    net: can: j1939: recover socket queue on CAN bus error during BAM transmission
    
    commit 9ad1da14ab3bf23087ae45fe399d84a109ddb81a upstream.
    
    Addresses an issue where a CAN bus error during a BAM transmission
    could stall the socket queue, preventing further transmissions even
    after the bus error is resolved. The fix activates the next queued
    session after the error recovery, allowing communication to continue.
    
    Fixes: 9d71dd0c70099 ("can: add support of SAE J1939 protocol")
    Cc: stable@vger.kernel.org
    Reported-by: Alexander Hölzl <alexander.hoelzl@gmx.net>
    Tested-by: Alexander Hölzl <alexander.hoelzl@gmx.net>
    Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
    Link: https://lore.kernel.org/all/20240528070648.1947203-1-o.rempel@pengutronix.de
    Cc: stable@vger.kernel.org
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a2a0ebff7fdeb2f66e29335adf64b9e457300dd4
Author: Shigeru Yoshida <syoshida@redhat.com>
Date:   Fri May 17 12:59:53 2024 +0900

    net: can: j1939: Initialize unused data in j1939_send_one()
    
    commit b7cdf1dd5d2a2d8200efd98d1893684db48fe134 upstream.
    
    syzbot reported kernel-infoleak in raw_recvmsg() [1]. j1939_send_one()
    creates full frame including unused data, but it doesn't initialize
    it. This causes the kernel-infoleak issue. Fix this by initializing
    unused data.
    
    [1]
    BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
    BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline]
    BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline]
    BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
    BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline]
    BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185
     instrument_copy_to_user include/linux/instrumented.h:114 [inline]
     copy_to_user_iter lib/iov_iter.c:24 [inline]
     iterate_ubuf include/linux/iov_iter.h:29 [inline]
     iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
     iterate_and_advance include/linux/iov_iter.h:271 [inline]
     _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185
     copy_to_iter include/linux/uio.h:196 [inline]
     memcpy_to_msg include/linux/skbuff.h:4113 [inline]
     raw_recvmsg+0x2b8/0x9e0 net/can/raw.c:1008
     sock_recvmsg_nosec net/socket.c:1046 [inline]
     sock_recvmsg+0x2c4/0x340 net/socket.c:1068
     ____sys_recvmsg+0x18a/0x620 net/socket.c:2803
     ___sys_recvmsg+0x223/0x840 net/socket.c:2845
     do_recvmmsg+0x4fc/0xfd0 net/socket.c:2939
     __sys_recvmmsg net/socket.c:3018 [inline]
     __do_sys_recvmmsg net/socket.c:3041 [inline]
     __se_sys_recvmmsg net/socket.c:3034 [inline]
     __x64_sys_recvmmsg+0x397/0x490 net/socket.c:3034
     x64_sys_call+0xf6c/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:300
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    
    Uninit was created at:
     slab_post_alloc_hook mm/slub.c:3804 [inline]
     slab_alloc_node mm/slub.c:3845 [inline]
     kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888
     kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577
     __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668
     alloc_skb include/linux/skbuff.h:1313 [inline]
     alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504
     sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795
     sock_alloc_send_skb include/net/sock.h:1842 [inline]
     j1939_sk_alloc_skb net/can/j1939/socket.c:878 [inline]
     j1939_sk_send_loop net/can/j1939/socket.c:1142 [inline]
     j1939_sk_sendmsg+0xc0a/0x2730 net/can/j1939/socket.c:1277
     sock_sendmsg_nosec net/socket.c:730 [inline]
     __sock_sendmsg+0x30f/0x380 net/socket.c:745
     ____sys_sendmsg+0x877/0xb60 net/socket.c:2584
     ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
     __sys_sendmsg net/socket.c:2667 [inline]
     __do_sys_sendmsg net/socket.c:2676 [inline]
     __se_sys_sendmsg net/socket.c:2674 [inline]
     __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674
     x64_sys_call+0xc4b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:47
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    
    Bytes 12-15 of 16 are uninitialized
    Memory access of size 16 starts at ffff888120969690
    Data copied to user address 00000000200017c0
    
    CPU: 1 PID: 5050 Comm: syz-executor198 Not tainted 6.9.0-rc5-syzkaller-00031-g71b1543c83d6 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
    
    Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
    Reported-and-tested-by: syzbot+5681e40d297b30f5b513@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=5681e40d297b30f5b513
    Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
    Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
    Link: https://lore.kernel.org/all/20240517035953.2617090-1-syoshida@redhat.com
    Cc: stable@vger.kernel.org
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 44add57b5b44d08e0b2072e6a8bf58270443708b
Author: Jean-Michel Hautbois <jeanmichel.hautbois@yoseli.org>
Date:   Thu Jun 20 18:29:59 2024 +0200

    tty: mcf: MCF54418 has 10 UARTS
    
    commit 7c92a8bd53f24d50c8cf4aba53bb75505b382fed upstream.
    
    Most of the colfires have up to 5 UARTs but MCF54418 has up-to 10 !
    Change the maximum value authorized.
    
    Signed-off-by: Jean-Michel Hautbois <jeanmichel.hautbois@yoseli.org>
    Cc: stable <stable@kernel.org>
    Fixes: 2545cf6e94b4 ("m68knommu: allow 4 coldfire serial ports")
    Link: https://lore.kernel.org/r/20240620-upstream-uart-v1-1-a9d0d95fb19e@yoseli.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cb879300669881970eabebe64bd509dbbe42b9de
Author: Udit Kumar <u-kumar1@ti.com>
Date:   Wed Jun 19 16:29:03 2024 +0530

    serial: 8250_omap: Implementation of Errata i2310
    
    commit 9d141c1e615795eeb93cd35501ad144ee997a826 upstream.
    
    As per Errata i2310[0], Erroneous timeout can be triggered,
    if this Erroneous interrupt is not cleared then it may leads
    to storm of interrupts, therefore apply Errata i2310 solution.
    
    [0] https://www.ti.com/lit/pdf/sprz536 page 23
    
    Fixes: b67e830d38fa ("serial: 8250: 8250_omap: Fix possible interrupt storm on K3 SoCs")
    Cc: stable@vger.kernel.org
    Signed-off-by: Udit Kumar <u-kumar1@ti.com>
    Link: https://lore.kernel.org/r/20240619105903.165434-1-u-kumar1@ti.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 75ddbf776dd04a09fb9e5267ead5d0c989f84506
Author: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Date:   Sun Jun 9 06:15:46 2024 -0700

    usb: atm: cxacru: fix endpoint checking in cxacru_bind()
    
    commit 2eabb655a968b862bc0c31629a09f0fbf3c80d51 upstream.
    
    Syzbot is still reporting quite an old issue [1] that occurs due to
    incomplete checking of present usb endpoints. As such, wrong
    endpoints types may be used at urb sumbitting stage which in turn
    triggers a warning in usb_submit_urb().
    
    Fix the issue by verifying that required endpoint types are present
    for both in and out endpoints, taking into account cmd endpoint type.
    
    Unfortunately, this patch has not been tested on real hardware.
    
    [1] Syzbot report:
    usb 1-1: BOGUS urb xfer, pipe 1 != type 3
    WARNING: CPU: 0 PID: 8667 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502
    Modules linked in:
    CPU: 0 PID: 8667 Comm: kworker/0:4 Not tainted 5.14.0-rc4-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Workqueue: usb_hub_wq hub_event
    RIP: 0010:usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502
    ...
    Call Trace:
     cxacru_cm+0x3c0/0x8e0 drivers/usb/atm/cxacru.c:649
     cxacru_card_status+0x22/0xd0 drivers/usb/atm/cxacru.c:760
     cxacru_bind+0x7ac/0x11a0 drivers/usb/atm/cxacru.c:1209
     usbatm_usb_probe+0x321/0x1ae0 drivers/usb/atm/usbatm.c:1055
     cxacru_usb_probe+0xdf/0x1e0 drivers/usb/atm/cxacru.c:1363
     usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396
     call_driver_probe drivers/base/dd.c:517 [inline]
     really_probe+0x23c/0xcd0 drivers/base/dd.c:595
     __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747
     driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777
     __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894
     bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
     __device_attach+0x228/0x4a0 drivers/base/dd.c:965
     bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
     device_add+0xc2f/0x2180 drivers/base/core.c:3354
     usb_set_configuration+0x113a/0x1910 drivers/usb/core/message.c:2170
     usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238
     usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293
    
    Reported-and-tested-by: syzbot+00c18ee8497dd3be6ade@syzkaller.appspotmail.com
    Fixes: 902ffc3c707c ("USB: cxacru: Use a bulk/int URB to access the command endpoint")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
    Link: https://lore.kernel.org/r/20240609131546.3932-1-n.zhandarovich@fintech.ru
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 621e90201c84b8fc427c433738a11495d05422d0
Author: Dan Carpenter <dan.carpenter@linaro.org>
Date:   Mon Jun 17 12:31:30 2024 +0300

    usb: musb: da8xx: fix a resource leak in probe()
    
    commit de644a4a86be04ed8a43ef8267d0f7d021941c5e upstream.
    
    Call usb_phy_generic_unregister() if of_platform_populate() fails.
    
    Fixes: d6299b6efbf6 ("usb: musb: Add support of CPPI 4.1 DMA controller to DA8xx")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
    Link: https://lore.kernel.org/r/69af1b1d-d3f4-492b-bcea-359ca5949f30@moroto.mountain
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2798fc1560716c7945587ad43bef8f31f78c00af
Author: Oliver Neukum <oneukum@suse.com>
Date:   Thu Jun 20 13:40:26 2024 +0200

    usb: gadget: printer: fix races against disable
    
    commit e587a7633dfee8987a999cf253f7c52a8e09276c upstream.
    
    printer_read() and printer_write() guard against the race
    against disable() by checking the dev->interface flag,
    which in turn is guarded by a spinlock.
    These functions, however, drop the lock on multiple occasions.
    This means that the test has to be redone after reacquiring
    the lock and before doing IO.
    
    Add the tests.
    
    This also addresses CVE-2024-25741
    
    Fixes: 7f2ca14d2f9b9 ("usb: gadget: function: printer: Interface is disabled and returns error")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Oliver Neukum <oneukum@suse.com>
    Link: https://lore.kernel.org/r/20240620114039.5767-1-oneukum@suse.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 84ca47192f977cf3adea3ba62a2f179e4a6ed02d
Author: Oliver Neukum <oneukum@suse.com>
Date:   Thu Jun 20 11:37:39 2024 +0200

    usb: gadget: printer: SS+ support
    
    commit fd80731e5e9d1402cb2f85022a6abf9b1982ec5f upstream.
    
    We need to treat super speed plus as super speed, not the default,
    which is full speed.
    
    Signed-off-by: Oliver Neukum <oneukum@suse.com>
    Cc: stable <stable@kernel.org>
    Link: https://lore.kernel.org/r/20240620093800.28901-1-oneukum@suse.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ee88636607e1e58d7a43aa1ced8f92a20ac2b607
Author: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
Date:   Thu Jun 20 15:34:31 2024 +0200

    net: usb: ax88179_178a: improve link status logs
    
    commit 058722ee350c0bdd664e467156feb2bf5d9cc271 upstream.
    
    Avoid spurious link status logs that may ultimately be wrong; for example,
    if the link is set to down with the cable plugged, then the cable is
    unplugged and after this the link is set to up, the last new log that is
    appearing is incorrectly telling that the link is up.
    
    In order to avoid errors, show link status logs after link_reset
    processing, and in order to avoid spurious as much as possible, only show
    the link loss when some link status change is detected.
    
    cc: stable@vger.kernel.org
    Fixes: e2ca90c276e1 ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver")
    Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 59a84bcf1cc791c16ccf86cc4ae9637ba3338af3
Author: Vasileios Amoiridis <vassilisamir@gmail.com>
Date:   Thu Jun 6 23:22:56 2024 +0200

    iio: chemical: bme680: Fix sensor data read operation
    
    commit 4241665e6ea063a9c1d734de790121a71db763fc upstream.
    
    A read operation is happening as follows:
    
    a) Set sensor to forced mode
    b) Sensor measures values and update data registers and sleeps again
    c) Read data registers
    
    In the current implementation the read operation happens immediately
    after the sensor is set to forced mode so the sensor does not have
    the time to update properly the registers. This leads to the following
    2 problems:
    
    1) The first ever value which is read by the register is always wrong
    2) Every read operation, puts the register into forced mode and reads
    the data that were calculated in the previous conversion.
    
    This behaviour was tested in 2 ways:
    
    1) The internal meas_status_0 register was read before and after every
    read operation in order to verify that the data were ready even before
    the register was set to forced mode and also to check that after the
    forced mode was set the new data were not yet ready.
    
    2) Physically changing the temperature and measuring the temperature
    
    This commit adds the waiting time in between the set of the forced mode
    and the read of the data. The function is taken from the Bosch BME68x
    Sensor API [1].
    
    [1]: https://github.com/boschsensortec/BME68x_SensorAPI/blob/v4.4.8/bme68x.c#L490
    
    Fixes: 1b3bd8592780 ("iio: chemical: Add support for Bosch BME680 sensor")
    Signed-off-by: Vasileios Amoiridis <vassilisamir@gmail.com>
    Link: https://lore.kernel.org/r/20240606212313.207550-5-vassilisamir@gmail.com
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c326551e99f5416986074ce78bef94f6a404b517
Author: Vasileios Amoiridis <vassilisamir@gmail.com>
Date:   Thu Jun 6 23:22:55 2024 +0200

    iio: chemical: bme680: Fix overflows in compensate() functions
    
    commit fdd478c3ae98c3f13628e110dce9b6cfb0d9b3c8 upstream.
    
    There are cases in the compensate functions of the driver that
    there could be overflows of variables due to bit shifting ops.
    These implications were initially discussed here [1] and they
    were mentioned in log message of Commit 1b3bd8592780 ("iio:
    chemical: Add support for Bosch BME680 sensor").
    
    [1]: https://lore.kernel.org/linux-iio/20180728114028.3c1bbe81@archlinux/
    
    Fixes: 1b3bd8592780 ("iio: chemical: Add support for Bosch BME680 sensor")
    Signed-off-by: Vasileios Amoiridis <vassilisamir@gmail.com>
    Link: https://lore.kernel.org/r/20240606212313.207550-4-vassilisamir@gmail.com
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3d78fc351bee7228a6e625d92d718e86e67a2a3c
Author: Vasileios Amoiridis <vassilisamir@gmail.com>
Date:   Thu Jun 6 23:22:54 2024 +0200

    iio: chemical: bme680: Fix calibration data variable
    
    commit b47c0fee73a810c4503c4a94ea34858a1d865bba upstream.
    
    According to the BME68x Sensor API [1], the h6 calibration
    data variable should be an unsigned integer of size 8.
    
    [1]: https://github.com/boschsensortec/BME68x_SensorAPI/blob/v4.4.8/bme68x_defs.h#L789
    
    Fixes: 1b3bd8592780 ("iio: chemical: Add support for Bosch BME680 sensor")
    Signed-off-by: Vasileios Amoiridis <vassilisamir@gmail.com>
    Link: https://lore.kernel.org/r/20240606212313.207550-3-vassilisamir@gmail.com
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 44f04b1a88d63d6c4df6fe82954c9cdb98447a61
Author: Vasileios Amoiridis <vassilisamir@gmail.com>
Date:   Thu Jun 6 23:22:53 2024 +0200

    iio: chemical: bme680: Fix pressure value output
    
    commit ae1f7b93b52095be6776d0f34957b4f35dda44d9 upstream.
    
    The IIO standard units are measured in kPa while the driver
    is using hPa.
    
    Apart from checking the userspace value itself, it is mentioned also
    in the Bosch API [1] that the pressure value is in Pascal.
    
    [1]: https://github.com/boschsensortec/BME68x_SensorAPI/blob/v4.4.8/bme68x_defs.h#L742
    
    Fixes: 1b3bd8592780 ("iio: chemical: Add support for Bosch BME680 sensor")
    Signed-off-by: Vasileios Amoiridis <vassilisamir@gmail.com>
    Link: https://lore.kernel.org/r/20240606212313.207550-2-vassilisamir@gmail.com
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 28f6d0b5ff9f4a1638f8e2840359deb296716a88
Author: Fernando Yang <hagisf@usp.br>
Date:   Mon Jun 3 15:07:54 2024 -0300

    iio: adc: ad7266: Fix variable checking bug
    
    commit a2b86132955268b2a1703082fbc2d4832fc001b8 upstream.
    
    The ret variable was not checked after iio_device_release_direct_mode(),
    which could possibly cause errors
    
    Fixes: c70df20e3159 ("iio: adc: ad7266: claim direct mode during sensor read")
    Signed-off-by: Fernando Yang <hagisf@usp.br>
    Link: https://lore.kernel.org/r/20240603180757.8560-1-hagisf@usp.br
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 78ece307f82397629be958bc46d7573b4fe3cc86
Author: David Lechner <dlechner@baylibre.com>
Date:   Fri Jun 21 17:22:40 2024 -0500

    counter: ti-eqep: enable clock at probe
    
    [ Upstream commit 0cf81c73e4c6a4861128a8f27861176ec312af4e ]
    
    The TI eQEP clock is both a functional and interface clock. Since it is
    required for the device to function, we should be enabling it at probe.
    
    Up to now, we've just been lucky that the clock was enabled by something
    else on the system already.
    
    Fixes: f213729f6796 ("counter: new TI eQEP driver")
    Reviewed-by: Judith Mendez <jm@ti.com>
    Signed-off-by: David Lechner <dlechner@baylibre.com>
    Link: https://lore.kernel.org/r/20240621-ti-eqep-enable-clock-v2-1-edd3421b54d4@baylibre.com
    Signed-off-by: William Breathitt Gray <wbg@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 76da476a4c60762716ee2d561b6e67a832189fb7
Author: Adrian Hunter <adrian.hunter@intel.com>
Date:   Fri Jun 14 11:00:50 2024 +0300

    mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
    
    commit ab069ce125965a5e282f7b53b86aee76ab32975c upstream.
    
    sdhci_check_ro() can call mmc_gpio_get_ro() while holding the sdhci
    host->lock spinlock. That would be a problem if the GPIO access done by
    mmc_gpio_get_ro() needed to sleep.
    
    However, host->lock is not needed anyway. The mmc core ensures that host
    operations do not race with each other, and asynchronous callbacks like the
    interrupt handler, software timeouts, completion work etc, cannot affect
    sdhci_check_ro().
    
    So remove the locking.
    
    Fixes: 6d5cd068ee59 ("mmc: sdhci: use WP GPIO in sdhci_check_ro()")
    Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20240614080051.4005-3-adrian.hunter@intel.com
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 803835fda351c8aeb0546e784e80999b75c5fc3c
Author: Adrian Hunter <adrian.hunter@intel.com>
Date:   Fri Jun 14 11:00:49 2024 +0300

    mmc: sdhci: Do not invert write-protect twice
    
    commit fbd64f902b93fe9658b855b9892ae59ef6ea22b9 upstream.
    
    mmc_of_parse() reads device property "wp-inverted" and sets
    MMC_CAP2_RO_ACTIVE_HIGH if it is true. MMC_CAP2_RO_ACTIVE_HIGH is used
    to invert a write-protect (AKA read-only) GPIO value.
    
    sdhci_get_property() also reads "wp-inverted" and sets
    SDHCI_QUIRK_INVERTED_WRITE_PROTECT which is used to invert the
    write-protect value as well but also acts upon a value read out from the
    SDHCI_PRESENT_STATE register.
    
    Many drivers call both mmc_of_parse() and sdhci_get_property(),
    so that both MMC_CAP2_RO_ACTIVE_HIGH and
    SDHCI_QUIRK_INVERTED_WRITE_PROTECT will be set if the controller has
    device property "wp-inverted".
    
    Amend the logic in sdhci_check_ro() to allow for that possibility,
    so that the write-protect value is not inverted twice.
    
    Also do not invert the value if it is a negative error value. Note that
    callers treat an error the same as not-write-protected, so the result is
    functionally the same in that case.
    
    Also do not invert the value if sdhci host operation ->get_ro() is used.
    None of the users of that callback set SDHCI_QUIRK_INVERTED_WRITE_PROTECT
    directly or indirectly, but two do call mmc_gpio_get_ro(), so leave it to
    them to deal with that if they ever set SDHCI_QUIRK_INVERTED_WRITE_PROTECT
    in the future.
    
    Fixes: 6d5cd068ee59 ("mmc: sdhci: use WP GPIO in sdhci_check_ro()")
    Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20240614080051.4005-2-adrian.hunter@intel.com
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5048a44a257e40b9c252c8c982cf61338b1d68fe
Author: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Date:   Mon May 27 16:24:41 2024 +0300

    mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
    
    commit ebc4fc34eae8ddfbef49f2bdaced1bf4167ef80d upstream.
    
    jmicron_pmos() and sdhci_pci_probe() use pci_{read,write}_config_byte()
    that return PCIBIOS_* codes. The return code is then returned as is by
    jmicron_probe() and sdhci_pci_probe(). Similarly, the return code is
    also returned as is from jmicron_resume(). Both probe and resume
    functions should return normal errnos.
    
    Convert PCIBIOS_* returns code using pcibios_err_to_errno() into normal
    errno before returning them the fix these issues.
    
    Fixes: 7582041ff3d4 ("mmc: sdhci-pci: fix simple_return.cocci warnings")
    Fixes: 45211e215984 ("sdhci: toggle JMicron PMOS setting")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Acked-by: Adrian Hunter <adrian.hunter@intel.com>
    Link: https://lore.kernel.org/r/20240527132443.14038-1-ilpo.jarvinen@linux.intel.com
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a68b896aa56e435506453ec8835bc991ec3ae687
Author: Jan Kara <jack@suse.cz>
Date:   Fri Jun 14 16:52:43 2024 +0200

    ocfs2: fix DIO failure due to insufficient transaction credits
    
    commit be346c1a6eeb49d8fda827d2a9522124c2f72f36 upstream.
    
    The code in ocfs2_dio_end_io_write() estimates number of necessary
    transaction credits using ocfs2_calc_extend_credits().  This however does
    not take into account that the IO could be arbitrarily large and can
    contain arbitrary number of extents.
    
    Extent tree manipulations do often extend the current transaction but not
    in all of the cases.  For example if we have only single block extents in
    the tree, ocfs2_mark_extent_written() will end up calling
    ocfs2_replace_extent_rec() all the time and we will never extend the
    current transaction and eventually exhaust all the transaction credits if
    the IO contains many single block extents.  Once that happens a
    WARN_ON(jbd2_handle_buffer_credits(handle) <= 0) is triggered in
    jbd2_journal_dirty_metadata() and subsequently OCFS2 aborts in response to
    this error.  This was actually triggered by one of our customers on a
    heavily fragmented OCFS2 filesystem.
    
    To fix the issue make sure the transaction always has enough credits for
    one extent insert before each call of ocfs2_mark_extent_written().
    
    Heming Zhao said:
    
    ------
    PANIC: "Kernel panic - not syncing: OCFS2: (device dm-1): panic forced after error"
    
    PID: xxx  TASK: xxxx  CPU: 5  COMMAND: "SubmitThread-CA"
      #0 machine_kexec at ffffffff8c069932
      #1 __crash_kexec at ffffffff8c1338fa
      #2 panic at ffffffff8c1d69b9
      #3 ocfs2_handle_error at ffffffffc0c86c0c [ocfs2]
      #4 __ocfs2_abort at ffffffffc0c88387 [ocfs2]
      #5 ocfs2_journal_dirty at ffffffffc0c51e98 [ocfs2]
      #6 ocfs2_split_extent at ffffffffc0c27ea3 [ocfs2]
      #7 ocfs2_change_extent_flag at ffffffffc0c28053 [ocfs2]
      #8 ocfs2_mark_extent_written at ffffffffc0c28347 [ocfs2]
      #9 ocfs2_dio_end_io_write at ffffffffc0c2bef9 [ocfs2]
    #10 ocfs2_dio_end_io at ffffffffc0c2c0f5 [ocfs2]
    #11 dio_complete at ffffffff8c2b9fa7
    #12 do_blockdev_direct_IO at ffffffff8c2bc09f
    #13 ocfs2_direct_IO at ffffffffc0c2b653 [ocfs2]
    #14 generic_file_direct_write at ffffffff8c1dcf14
    #15 __generic_file_write_iter at ffffffff8c1dd07b
    #16 ocfs2_file_write_iter at ffffffffc0c49f1f [ocfs2]
    #17 aio_write at ffffffff8c2cc72e
    #18 kmem_cache_alloc at ffffffff8c248dde
    #19 do_io_submit at ffffffff8c2ccada
    #20 do_syscall_64 at ffffffff8c004984
    #21 entry_SYSCALL_64_after_hwframe at ffffffff8c8000ba
    
    Link: https://lkml.kernel.org/r/20240617095543.6971-1-jack@suse.cz
    Link: https://lkml.kernel.org/r/20240614145243.8837-1-jack@suse.cz
    Fixes: c15471f79506 ("ocfs2: fix sparse file & data ordering issue in direct io")
    Signed-off-by: Jan Kara <jack@suse.cz>
    Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
    Reviewed-by: Heming Zhao <heming.zhao@suse.com>
    Cc: Mark Fasheh <mark@fasheh.com>
    Cc: Joel Becker <jlbec@evilplan.org>
    Cc: Junxiao Bi <junxiao.bi@oracle.com>
    Cc: Changwei Ge <gechangwei@live.cn>
    Cc: Gang He <ghe@suse.com>
    Cc: Jun Piao <piaojun@huawei.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 49c09ca35a5f521d7fa18caf62fdf378f15e8aa4
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Jun 28 14:27:22 2024 -0700

    x86: stop playing stack games in profile_pc()
    
    [ Upstream commit 093d9603b60093a9aaae942db56107f6432a5dca ]
    
    The 'profile_pc()' function is used for timer-based profiling, which
    isn't really all that relevant any more to begin with, but it also ends
    up making assumptions based on the stack layout that aren't necessarily
    valid.
    
    Basically, the code tries to account the time spent in spinlocks to the
    caller rather than the spinlock, and while I support that as a concept,
    it's not worth the code complexity or the KASAN warnings when no serious
    profiling is done using timers anyway these days.
    
    And the code really does depend on stack layout that is only true in the
    simplest of cases.  We've lost the comment at some point (I think when
    the 32-bit and 64-bit code was unified), but it used to say:
    
            Assume the lock function has either no stack frame or a copy
            of eflags from PUSHF.
    
    which explains why it just blindly loads a word or two straight off the
    stack pointer and then takes a minimal look at the values to just check
    if they might be eflags or the return pc:
    
            Eflags always has bits 22 and up cleared unlike kernel addresses
    
    but that basic stack layout assumption assumes that there isn't any lock
    debugging etc going on that would complicate the code and cause a stack
    frame.
    
    It causes KASAN unhappiness reported for years by syzkaller [1] and
    others [2].
    
    With no real practical reason for this any more, just remove the code.
    
    Just for historical interest, here's some background commits relating to
    this code from 2006:
    
      0cb91a229364 ("i386: Account spinlocks to the caller during profiling for !FP kernels")
      31679f38d886 ("Simplify profile_pc on x86-64")
    
    and a code unification from 2009:
    
      ef4512882dbe ("x86: time_32/64.c unify profile_pc")
    
    but the basics of this thing actually goes back to before the git tree.
    
    Link: https://syzkaller.appspot.com/bug?extid=84fe685c02cd112a2ac3 [1]
    Link: https://lore.kernel.org/all/CAK55_s7Xyq=nh97=K=G1sxueOFrJDAvPOJAL4TPTCAYvmxO9_A@mail.gmail.com/ [2]
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 38ce307939467def07b2004c6fccc5a4addb36d4
Author: Kent Gibson <warthog618@gmail.com>
Date:   Wed Jun 26 13:29:22 2024 +0800

    gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)
    
    [ Upstream commit 9919cce62f68e6ab68dc2a975b5dc670f8ca7d40 ]
    
    linehandle_set_config() behaves badly when direction is not set.
    The configuration validation is borrowed from linehandle_create(), where,
    to verify the intent of the user, the direction must be set to in order
    to effect a change to the electrical configuration of a line. But, when
    applied to reconfiguration, that validation does not allow for the unset
    direction case, making it possible to clear flags set previously without
    specifying the line direction.
    
    Adding to the inconsistency, those changes are not immediately applied by
    linehandle_set_config(), but will take effect when the line value is next
    get or set.
    
    For example, by requesting a configuration with no flags set, an output
    line with GPIOHANDLE_REQUEST_ACTIVE_LOW and GPIOHANDLE_REQUEST_OPEN_DRAIN
    requested could have those flags cleared, inverting the sense of the line
    and changing the line drive to push-pull on the next line value set.
    
    Ensure the intent of the user by disallowing configurations which do not
    have direction set, returning an error to userspace to indicate that the
    configuration is invalid.
    
    And, for clarity, use lflags, a local copy of gcnf.flags, throughout when
    dealing with the requested flags, rather than a mixture of both.
    
    Fixes: e588bb1eae31 ("gpio: add new SET_CONFIG ioctl() to gpio chardev")
    Signed-off-by: Kent Gibson <warthog618@gmail.com>
    Link: https://lore.kernel.org/r/20240626052925.174272-2-warthog618@gmail.com
    Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit e44a83bf15c4db053ac6dfe96a23af184c9136d9
Author: Aleksandr Mishin <amishin@t-argos.ru>
Date:   Tue Jun 18 17:43:44 2024 +0300

    gpio: davinci: Validate the obtained number of IRQs
    
    [ Upstream commit 7aa9b96e9a73e4ec1771492d0527bd5fc5ef9164 ]
    
    Value of pdata->gpio_unbanked is taken from Device Tree. In case of broken
    DT due to any error this value can be any. Without this value validation
    there can be out of chips->irqs array boundaries access in
    davinci_gpio_probe().
    
    Validate the obtained nirq value so that it won't exceed the maximum
    number of IRQs per bank.
    
    Found by Linux Verification Center (linuxtesting.org) with SVACE.
    
    Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering")
    Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
    Link: https://lore.kernel.org/r/20240618144344.16943-1-amishin@t-argos.ru
    Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 98eae65cb5e3bf4aaf658b428f2608739ee1638e
Author: Liu Ying <victor.liu@nxp.com>
Date:   Mon Jun 24 09:56:12 2024 +0800

    drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA
    
    [ Upstream commit 37ce99b77762256ec9fda58d58fd613230151456 ]
    
    KOE TX26D202VM0BWA panel spec indicates the DE signal is active high in
    timing chart, so add DISPLAY_FLAGS_DE_HIGH flag in display timing flags.
    This aligns display_timing with panel_desc.
    
    Fixes: 8a07052440c2 ("drm/panel: simple: Add support for KOE TX26D202VM0BWA panel")
    Signed-off-by: Liu Ying <victor.liu@nxp.com>
    Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
    Link: https://lore.kernel.org/r/20240624015612.341983-1-victor.liu@nxp.com
    Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
    Link: https://patchwork.freedesktop.org/patch/msgid/20240624015612.341983-1-victor.liu@nxp.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit cb4e7a8f3965e200447ac2c59211f07464b64be1
Author: Hannes Reinecke <hare@suse.de>
Date:   Mon Jun 17 09:27:27 2024 +0200

    nvme: fixup comment for nvme RDMA Provider Type
    
    [ Upstream commit f80a55fa90fa76d01e3fffaa5d0413e522ab9a00 ]
    
    PRTYPE is the provider type, not the QP service type.
    
    Fixes: eb793e2c9286 ("nvme.h: add NVMe over Fabrics definitions")
    Signed-off-by: Hannes Reinecke <hare@kernel.org>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Keith Busch <kbusch@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 1a7a494184cf64fac81b8a72da53002652327926
Author: Erick Archer <erick.archer@outlook.com>
Date:   Sat Mar 30 17:34:47 2024 +0100

    drm/radeon/radeon_display: Decrease the size of allocated memory
    
    [ Upstream commit ae6a233092747e9652eb793d92f79d0820e01c6a ]
    
    This is an effort to get rid of all multiplications from allocation
    functions in order to prevent integer overflows [1] [2].
    
    In this case, the memory allocated to store RADEONFB_CONN_LIMIT pointers
    to "drm_connector" structures can be avoided. This is because this
    memory area is never accessed.
    
    Also, in the kzalloc function, it is preferred to use sizeof(*pointer)
    instead of sizeof(type) due to the type of the variable can change and
    one needs not change the former (unlike the latter).
    
    At the same time take advantage to remove the "#if 0" block, the code
    where the removed memory area was accessed, and the RADEONFB_CONN_LIMIT
    constant due to now is never used.
    
    Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments [1]
    Link: https://github.com/KSPP/linux/issues/160 [2]
    Acked-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Erick Archer <erick.archer@outlook.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a45c45767bfe8d7c1ff5a1de931cfe0a85d523f7
Author: Andrew Davis <afd@ti.com>
Date:   Mon Mar 25 11:55:07 2024 -0500

    soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message
    
    [ Upstream commit ddbf3204f600a4d1f153498f618369fca352ae00 ]
    
    mbox_send_message() sends a u32 bit message, not a pointer to a message.
    We only convert to a pointer type as a generic type. If we want to send
    a dummy message of 0, then simply send 0 (NULL).
    
    Signed-off-by: Andrew Davis <afd@ti.com>
    Link: https://lore.kernel.org/r/20240325165507.30323-1-afd@ti.com
    Signed-off-by: Nishanth Menon <nm@ti.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit e47d3babaa472d8d8b0a41c69b45288b994ff4dc
Author: Ricardo Ribalda <ribalda@chromium.org>
Date:   Mon Mar 25 14:50:25 2024 +0000

    media: dvbdev: Initialize sbuf
    
    [ Upstream commit 17d1316de0d7dc1bdc5d6e3ad4efd30a9bf1a381 ]
    
    Because the size passed to copy_from_user() cannot be known beforehand,
    it needs to be checked during runtime with check_object_size. That makes
    gcc believe that the content of sbuf can be used before init.
    
    Fix:
    ./include/linux/thread_info.h:215:17: warning: ‘sbuf’ may be used uninitialized [-Wmaybe-uninitialized]
    
    Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit d23982ea9aa438f35a8c8a6305943e98a8db90f6
Author: Oswald Buddenhagen <oswald.buddenhagen@gmx.de>
Date:   Sat Apr 6 08:48:20 2024 +0200

    ALSA: emux: improve patch ioctl data validation
    
    [ Upstream commit 89b32ccb12ae67e630c6453d778ec30a592a212f ]
    
    In load_data(), make the validation of and skipping over the main info
    block match that in load_guspatch().
    
    In load_guspatch(), add checking that the specified patch length matches
    the actually supplied data, like load_data() already did.
    
    Signed-off-by: Oswald Buddenhagen <oswald.buddenhagen@gmx.de>
    Message-ID: <20240406064830.1029573-8-oswald.buddenhagen@gmx.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 763896ab62a672d728f5eb10ac90d98c607a8509
Author: Dawei Li <dawei.li@shingroup.cn>
Date:   Sun Mar 31 13:34:41 2024 +0800

    net/dpaa2: Avoid explicit cpumask var allocation on stack
    
    [ Upstream commit d33fe1714a44ff540629b149d8fab4ac6967585c ]
    
    For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask
    variable on stack is not recommended since it can cause potential stack
    overflow.
    
    Instead, kernel code should always use *cpumask_var API(s) to allocate
    cpumask var in config-neutral way, leaving allocation strategy to
    CONFIG_CPUMASK_OFFSTACK.
    
    Use *cpumask_var API(s) to address it.
    
    Signed-off-by: Dawei Li <dawei.li@shingroup.cn>
    Link: https://lore.kernel.org/r/20240331053441.1276826-3-dawei.li@shingroup.cn
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 9dadab0db7d904413ea1cdaa13f127da05c31e71
Author: Dawei Li <dawei.li@shingroup.cn>
Date:   Sun Mar 31 13:34:40 2024 +0800

    net/iucv: Avoid explicit cpumask var allocation on stack
    
    [ Upstream commit be4e1304419c99a164b4c0e101c7c2a756b635b9 ]
    
    For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask
    variable on stack is not recommended since it can cause potential stack
    overflow.
    
    Instead, kernel code should always use *cpumask_var API(s) to allocate
    cpumask var in config-neutral way, leaving allocation strategy to
    CONFIG_CPUMASK_OFFSTACK.
    
    Use *cpumask_var API(s) to address it.
    
    Signed-off-by: Dawei Li <dawei.li@shingroup.cn>
    Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
    Link: https://lore.kernel.org/r/20240331053441.1276826-2-dawei.li@shingroup.cn
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3d6432f20f0040837885ddab2e0a7fdb7f790035
Author: Anton Protopopov <aspsk@isovalent.com>
Date:   Tue Mar 26 10:17:42 2024 +0000

    bpf: Add a check for struct bpf_fib_lookup size
    
    [ Upstream commit 59b418c7063d30e0a3e1f592d47df096db83185c ]
    
    The struct bpf_fib_lookup should not grow outside of its 64 bytes.
    Add a static assert to validate this.
    
    Suggested-by: David Ahern <dsahern@kernel.org>
    Signed-off-by: Anton Protopopov <aspsk@isovalent.com>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Link: https://lore.kernel.org/bpf/20240326101742.17421-4-aspsk@isovalent.com
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 37f646c6040f3c9f8c28101bd6559fb07cb12be0
Author: Denis Arefev <arefev@swemel.ru>
Date:   Fri Mar 15 12:37:58 2024 +0300

    mtd: partitions: redboot: Added conversion of operands to a larger type
    
    [ Upstream commit 1162bc2f8f5de7da23d18aa4b7fbd4e93c369c50 ]
    
    The value of an arithmetic expression directory * master->erasesize is
    subject to overflow due to a failure to cast operands to a larger data
    type before perfroming arithmetic
    
    Found by Linux Verification Center (linuxtesting.org) with SVACE.
    
    Signed-off-by: Denis Arefev <arefev@swemel.ru>
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Link: https://lore.kernel.org/linux-mtd/20240315093758.20790-1-arefev@swemel.ru
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit cae52f61fda0f5d2949dc177f984c9e187d4c6a0
Author: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Date:   Sun Mar 17 17:48:39 2024 +0200

    drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
    
    [ Upstream commit ee7860cd8b5763017f8dc785c2851fecb7a0c565 ]
    
    The ilitek-ili9881c controls the reset GPIO using the non-sleeping
    gpiod_set_value() function. This complains loudly when the GPIO
    controller needs to sleep. As the caller can sleep, use
    gpiod_set_value_cansleep() to fix the issue.
    
    Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
    Link: https://lore.kernel.org/r/20240317154839.21260-1-laurent.pinchart@ideasonboard.com
    Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
    Link: https://patchwork.freedesktop.org/patch/msgid/20240317154839.21260-1-laurent.pinchart@ideasonboard.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5d43d789b57943720dca4181a05f6477362b94cf
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Wed Jun 26 23:15:38 2024 +0200

    netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
    
    [ Upstream commit 7931d32955e09d0a11b1fe0b6aac1bfa061c005c ]
    
    register store validation for NFT_DATA_VALUE is conditional, however,
    the datatype is always either NFT_DATA_VALUE or NFT_DATA_VERDICT. This
    only requires a new helper function to infer the register type from the
    set datatype so this conditional check can be removed. Otherwise,
    pointer to chain object can be leaked through the registers.
    
    Fixes: 96518518cc41 ("netfilter: add nftables")
    Reported-by: Linus Torvalds <torvalds@linuxfoundation.org>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 4e6367fe3210807912b361ac1e6fa26ac7fddd3a
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Wed Jun 19 14:27:55 2024 +0200

    parisc: use correct compat recv/recvfrom syscalls
    
    [ Upstream commit 20a50787349fadf66ac5c48f62e58d753878d2bb ]
    
    Johannes missed parisc back when he introduced the compat version
    of these syscalls, so receiving cmsg messages that require a compat
    conversion is still broken.
    
    Use the correct calls like the other architectures do.
    
    Fixes: 1dacc76d0014 ("net/compat/wext: send different messages to compat tasks")
    Acked-by: Helge Deller <deller@gmx.de>
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 7620738513f742da68a0f048dad0a8aff1c5040b
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Wed Jun 19 12:49:39 2024 +0200

    sparc: fix compat recv/recvfrom syscalls
    
    [ Upstream commit d6fbd26fb872ec518d25433a12e8ce8163e20909 ]
    
    sparc has the wrong compat version of recv() and recvfrom() for both the
    direct syscalls and socketcall().
    
    The direct syscalls just need to use the compat version. For socketcall,
    the same thing could be done, but it seems better to completely remove
    the custom assembler code for it and just use the same implementation that
    everyone else has.
    
    Fixes: 1dacc76d0014 ("net/compat/wext: send different messages to compat tasks")
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 2a700b8de527372ca26a99660fdb68c3db01c85d
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Wed Jun 19 14:07:30 2024 +0200

    sparc: fix old compat_sys_select()
    
    [ Upstream commit bae6428a9fffb2023191b0723e276cf1377a7c9f ]
    
    sparc has two identical select syscalls at numbers 93 and 230, respectively.
    During the conversion to the modern syscall.tbl format, the older one of the
    two broke in compat mode, and now refers to the native 64-bit syscall.
    
    Restore the correct behavior. This has very little effect, as glibc has
    been using the newer number anyway.
    
    Fixes: 6ff645dd683a ("sparc: add system call table generation support")
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 1095b8efbb13a6a5fa583ed373ee1ccab29da2d0
Author: Daniil Dulov <d.dulov@aladdin.ru>
Date:   Mon Jun 24 11:07:47 2024 +0300

    xdp: Remove WARN() from __xdp_reg_mem_model()
    
    [ Upstream commit 7e9f79428372c6eab92271390851be34ab26bfb4 ]
    
    syzkaller reports a warning in __xdp_reg_mem_model().
    
    The warning occurs only if __mem_id_init_hash_table() returns an error. It
    returns the error in two cases:
    
      1. memory allocation fails;
      2. rhashtable_init() fails when some fields of rhashtable_params
         struct are not initialized properly.
    
    The second case cannot happen since there is a static const rhashtable_params
    struct with valid fields. So, warning is only triggered when there is a
    problem with memory allocation.
    
    Thus, there is no sense in using WARN() to handle this error and it can be
    safely removed.
    
    WARNING: CPU: 0 PID: 5065 at net/core/xdp.c:299 __xdp_reg_mem_model+0x2d9/0x650 net/core/xdp.c:299
    
    CPU: 0 PID: 5065 Comm: syz-executor883 Not tainted 6.8.0-syzkaller-05271-gf99c5f563c17 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
    RIP: 0010:__xdp_reg_mem_model+0x2d9/0x650 net/core/xdp.c:299
    
    Call Trace:
     xdp_reg_mem_model+0x22/0x40 net/core/xdp.c:344
     xdp_test_run_setup net/bpf/test_run.c:188 [inline]
     bpf_test_run_xdp_live+0x365/0x1e90 net/bpf/test_run.c:377
     bpf_prog_test_run_xdp+0x813/0x11b0 net/bpf/test_run.c:1267
     bpf_prog_test_run+0x33a/0x3b0 kernel/bpf/syscall.c:4240
     __sys_bpf+0x48d/0x810 kernel/bpf/syscall.c:5649
     __do_sys_bpf kernel/bpf/syscall.c:5738 [inline]
     __se_sys_bpf kernel/bpf/syscall.c:5736 [inline]
     __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736
     do_syscall_64+0xfb/0x240
     entry_SYSCALL_64_after_hwframe+0x6d/0x75
    
    Found by Linux Verification Center (linuxtesting.org) with syzkaller.
    
    Fixes: 8d5d88527587 ("xdp: rhashtable with allocator ID to pointer mapping")
    Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Acked-by: Jesper Dangaard Brouer <hawk@kernel.org>
    Link: https://lore.kernel.org/all/20240617162708.492159-1-d.dulov@aladdin.ru
    Link: https://lore.kernel.org/bpf/20240624080747.36858-1-d.dulov@aladdin.ru
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5a3035306a0becc121023c5ef363bdf165f4f1ba
Author: Toke Høiland-Jørgensen <toke@redhat.com>
Date:   Mon Jan 3 16:08:06 2022 +0100

    xdp: Allow registering memory model without rxq reference
    
    [ Upstream commit 4a48ef70b93b8c7ed5190adfca18849e76387b80 ]
    
    The functions that register an XDP memory model take a struct xdp_rxq as
    parameter, but the RXQ is not actually used for anything other than pulling
    out the struct xdp_mem_info that it embeds. So refactor the register
    functions and export variants that just take a pointer to the xdp_mem_info.
    
    This is in preparation for enabling XDP_REDIRECT in bpf_prog_run(), using a
    page_pool instance that is not connected to any network device.
    
    Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Link: https://lore.kernel.org/bpf/20220103150812.87914-2-toke@redhat.com
    Stable-dep-of: 7e9f79428372 ("xdp: Remove WARN() from __xdp_reg_mem_model()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f4aa8268d774210e6bbbeb5e9b1570b2d2962d77
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Fri Jun 25 15:16:12 2021 -0700

    xdp: Move the rxq_info.mem clearing to unreg_mem_model()
    
    [ Upstream commit a78cae2476812cecaa4a33d0086bbb53986906bc ]
    
    xdp_rxq_info_unreg() implicitly calls xdp_rxq_info_unreg_mem_model().
    This may well be confusing to the driver authors, and lead to double free
    if they call xdp_rxq_info_unreg_mem_model() before xdp_rxq_info_unreg()
    (when mem model type == MEM_TYPE_PAGE_POOL).
    
    In fact error path of mvpp2_rxq_init() seems to currently do exactly that.
    
    The double free will result in refcount underflow in page_pool_destroy().
    Make the interface a little more programmer friendly by clearing type and
    id so that xdp_rxq_info_unreg_mem_model() can be called multiple times.
    
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Link: https://lore.kernel.org/bpf/20210625221612.2637086-1-kuba@kernel.org
    Stable-dep-of: 7e9f79428372 ("xdp: Remove WARN() from __xdp_reg_mem_model()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 0427f74a79538df6c91d4de296ce5e87fe9c9e8b
Author: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com>
Date:   Fri Jun 21 16:43:20 2024 +0200

    net: phy: micrel: add Microchip KSZ 9477 to the device table
    
    [ Upstream commit 54a4e5c16382e871c01dd82b47e930fdce30406b ]
    
    PHY_ID_KSZ9477 was supported but not added to the device table passed to
    MODULE_DEVICE_TABLE.
    
    Fixes: fc3973a1fa09 ("phy: micrel: add Microchip KSZ 9477 Switch PHY support")
    Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com>
    Reviewed-by: Andrew Lunn <andrew@lunn.ch>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 65a9383389db7bea170eacd9e619805e79660c2f
Author: Tristram Ha <tristram.ha@microchip.com>
Date:   Tue Jun 18 17:16:42 2024 -0700

    net: dsa: microchip: fix initial port flush problem
    
    [ Upstream commit ad53f5f54f351e967128edbc431f0f26427172cf ]
    
    The very first flush in any port will flush all learned addresses in all
    ports.  This can be observed by unplugging the cable from one port while
    additional ports are connected and dumping the fdb entries.
    
    This problem is caused by the initially wrong value programmed to the
    REG_SW_LUE_CTRL_1 register.  Setting SW_FLUSH_STP_TABLE and
    SW_FLUSH_MSTP_TABLE bits does not have an immediate effect.  It is when
    ksz9477_flush_dyn_mac_table() is called then the SW_FLUSH_STP_TABLE bit
    takes effect and flushes all learned entries.  After that call both bits
    are reset and so the next port flush will not cause such problem again.
    
    Fixes: b987e98e50ab ("dsa: add DSA switch driver for Microchip KSZ9477")
    Signed-off-by: Tristram Ha <tristram.ha@microchip.com>
    Link: https://patch.msgid.link/1718756202-2731-1-git-send-email-Tristram.Ha@microchip.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3662eb2170e59b58ad479982dc1084889ba757b9
Author: Elinor Montmasson <elinor.montmasson@savoirfairelinux.com>
Date:   Thu Jun 20 15:25:03 2024 +0200

    ASoC: fsl-asoc-card: set priv->pdev before using it
    
    [ Upstream commit 90f3feb24172185f1832636264943e8b5e289245 ]
    
    priv->pdev pointer was set after being used in
    fsl_asoc_card_audmux_init().
    Move this assignment at the start of the probe function, so
    sub-functions can correctly use pdev through priv.
    
    fsl_asoc_card_audmux_init() dereferences priv->pdev to get access to the
    dev struct, used with dev_err macros.
    As priv is zero-initialised, there would be a NULL pointer dereference.
    Note that if priv->dev is dereferenced before assignment but never used,
    for example if there is no error to be printed, the driver won't crash
    probably due to compiler optimisations.
    
    Fixes: 708b4351f08c ("ASoC: fsl: Add Freescale Generic ASoC Sound Card with ASRC support")
    Signed-off-by: Elinor Montmasson <elinor.montmasson@savoirfairelinux.com>
    Link: https://patch.msgid.link/20240620132511.4291-2-elinor.montmasson@savoirfairelinux.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 229e145a810d326de2357c7f9211cf7a90d389c3
Author: Jeff Layton <jlayton@kernel.org>
Date:   Wed Jun 26 14:27:45 2024 -0400

    nfsd: hold a lighter-weight client reference over CB_RECALL_ANY
    
    [ Upstream commit 10396f4df8b75ff6ab0aa2cd74296565466f2c8d ]
    
    Currently the CB_RECALL_ANY job takes a cl_rpc_users reference to the
    client. While a callback job is technically an RPC that counter is
    really more for client-driven RPCs, and this has the effect of
    preventing the client from being unhashed until the callback completes.
    
    If nfsd decides to send a CB_RECALL_ANY just as the client reboots, we
    can end up in a situation where the callback can't complete on the (now
    dead) callback channel, but the new client can't connect because the old
    client can't be unhashed. This usually manifests as a NFS4ERR_DELAY
    return on the CREATE_SESSION operation.
    
    The job is only holding a reference to the client so it can clear a flag
    after the RPC completes. Fix this by having CB_RECALL_ANY instead hold a
    reference to the cl_nfsdfs.cl_ref. Typically we only take that sort of
    reference when dealing with the nfsdfs info files, but it should work
    appropriately here to ensure that the nfs4_client doesn't disappear.
    
    Fixes: 44df6f439a17 ("NFSD: add delegation reaper to react to low memory condition")
    Reported-by: Vladimir Benes <vbenes@redhat.com>
    Signed-off-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a4f3907ab50b62304f6341f21cda094e1cf2766d
Author: Chuck Lever <chuck.lever@oracle.com>
Date:   Wed Jun 26 14:27:44 2024 -0400

    SUNRPC: Fix svcxdr_init_encode's buflen calculation
    
    [ Upstream commit 1242a87da0d8cd2a428e96ca68e7ea899b0f4624 ]
    
    Commit 2825a7f90753 ("nfsd4: allow encoding across page boundaries")
    added an explicit computation of the remaining length in the rq_res
    XDR buffer.
    
    The computation appears to suffer from an "off-by-one" bug. Because
    buflen is too large by one page, XDR encoding can run off the end of
    the send buffer by eventually trying to use the struct page address
    in rq_page_end, which always contains NULL.
    
    Fixes: bddfdbcddbe2 ("NFSD: Extract the svcxdr_init_encode() helper")
    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f1ef3dc758c7631246b0da8fe8d216886a05a209
Author: Chuck Lever <chuck.lever@oracle.com>
Date:   Wed Jun 26 14:27:43 2024 -0400

    SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation
    
    [ Upstream commit 90bfc37b5ab91c1a6165e3e5cfc49bf04571b762 ]
    
    Ensure that stream-based argument decoding can't go past the actual
    end of the receive buffer. xdr_init_decode's calculation of the
    value of xdr->end over-estimates the end of the buffer because the
    Linux kernel RPC server code does not remove the size of the RPC
    header from rqstp->rq_arg before calling the upper layer's
    dispatcher.
    
    The server-side still uses the svc_getnl() macros to decode the
    RPC call header. These macros reduce the length of the head iov
    but do not update the total length of the message in the buffer
    (buf->len).
    
    A proper fix for this would be to replace the use of svc_getnl() and
    friends in the RPC header decoder, but that would be a large and
    invasive change that would be difficult to backport.
    
    Fixes: 5191955d6fc6 ("SUNRPC: Prepare for xdr_stream-style decoding on the server-side")
    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit be20af24585df70d58198d7d3eb02d26f1e5a6c7
Author: Chuck Lever <chuck.lever@oracle.com>
Date:   Wed Jun 26 14:27:42 2024 -0400

    SUNRPC: Fix a NULL pointer deref in trace_svc_stats_latency()
    
    [ Upstream commit 5c11720767f70d34357d00a15ba5a0ad052c40fe ]
    
    Some paths through svc_process() leave rqst->rq_procinfo set to
    NULL, which triggers a crash if tracing happens to be enabled.
    
    Fixes: 89ff87494c6e ("SUNRPC: Display RPC procedure names instead of proc numbers")
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3de81c1e84bf84803308da3272a829a7655c5336
Author: Yunjian Wang <wangyunjian@huawei.com>
Date:   Wed Jun 26 14:27:41 2024 -0400

    SUNRPC: Fix null pointer dereference in svc_rqst_free()
    
    [ Upstream commit b9f83ffaa0c096b4c832a43964fe6bff3acffe10 ]
    
    When alloc_pages_node() returns null in svc_rqst_alloc(), the
    null rq_scratch_page pointer will be dereferenced when calling
    put_page() in svc_rqst_free(). Fix it by adding a null check.
    
    Addresses-Coverity: ("Dereference after null check")
    Fixes: 5191955d6fc6 ("SUNRPC: Prepare for xdr_stream-style decoding on the server-side")
    Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 310dee723530a8c85915d058c12277de58c3f611
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Thu Jun 27 02:41:13 2024 +0200

    netfilter: nf_tables: validate family when identifying table via handle
    
    [ Upstream commit f6e1532a2697b81da00bfb184e99d15e01e9d98c ]
    
    Validate table family when looking up for it via NFTA_TABLE_HANDLE.
    
    Fixes: 3ecbfd65f50e ("netfilter: nf_tables: allocate handle and delete objects via handle")
    Reported-by: Xingyuan Mo <hdthky0@gmail.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit d8a04a6bfa75251ba7bcc3651ed211e82f13f388
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Mon May 20 09:05:21 2024 -0400

    drm/amdgpu: fix UBSAN warning in kv_dpm.c
    
    [ Upstream commit f0d576f840153392d04b2d52cf3adab8f62e8cb6 ]
    
    Adds bounds check for sumo_vid_mapping_entry.
    
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3392
    Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 52af94393dd608ee0f8b375dfbcc3139737e501c
Author: Huang-Huang Bao <i@eh5.me>
Date:   Thu Jun 6 20:57:55 2024 +0800

    pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
    
    [ Upstream commit 4ea4d4808e342ddf89ba24b93ffa2057005aaced ]
    
    rockchip_pmx_set reset all pinmuxs in group to 0 in the case of error,
    add missing bank data retrieval in that code to avoid setting mux on
    unexpected pins.
    
    Fixes: 14797189b35e ("pinctrl: rockchip: add return value to rockchip_set_mux")
    Reviewed-by: Heiko Stuebner <heiko@sntech.de>
    Signed-off-by: Huang-Huang Bao <i@eh5.me>
    Link: https://lore.kernel.org/r/20240606125755.53778-5-i@eh5.me
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 6531f8c6663cb890250dcc5973444c5c9c07edda
Author: Huang-Huang Bao <i@eh5.me>
Date:   Thu Jun 6 20:57:54 2024 +0800

    pinctrl: rockchip: use dedicated pinctrl type for RK3328
    
    [ Upstream commit 01b4b1d1cec48ef4c26616c2fc4600b2c9fec05a ]
    
    rk3328_pin_ctrl uses type of RK3288 which has a hack in
    rockchip_pinctrl_suspend and rockchip_pinctrl_resume to restore GPIO6-C6
    at assume, the hack is not applicable to RK3328 as GPIO6 is not even
    exist in it. So use a dedicated pinctrl type to skip this hack.
    
    Fixes: 3818e4a7678e ("pinctrl: rockchip: Add rk3328 pinctrl support")
    Reviewed-by: Heiko Stuebner <heiko@sntech.de>
    Signed-off-by: Huang-Huang Bao <i@eh5.me>
    Link: https://lore.kernel.org/r/20240606125755.53778-4-i@eh5.me
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 926cb583b9ef8463ee346ee03b4fce48cd81a6f3
Author: Jianqun Xu <jay.xu@rock-chips.com>
Date:   Mon Aug 16 09:19:41 2021 +0800

    pinctrl/rockchip: separate struct rockchip_pin_bank to a head file
    
    [ Upstream commit e1450694e94657458395af886d2467d6ac3355af ]
    
    Separate struct rockchip_pin_bank to pinctrl-rockchip.h file, which will
    be used by gpio-rockchip driver in the future.
    
    Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>
    Link: https://lore.kernel.org/r/20210816011948.1118959-3-jay.xu@rock-chips.com
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Stable-dep-of: 01b4b1d1cec4 ("pinctrl: rockchip: use dedicated pinctrl type for RK3328")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit cfa2527ac80a618c19deff9f6478b9a7e85134cc
Author: Huang-Huang Bao <i@eh5.me>
Date:   Thu Jun 6 20:57:53 2024 +0800

    pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
    
    [ Upstream commit 5ef6914e0bf578357b4c906ffe6b26e7eedb8ccf ]
    
    The pinmux bits for GPIO3-B1 to GPIO3-B6 pins are not explicitly
    specified in RK3328 TRM, however we can get hint from pad name and its
    correspinding IOMUX setting for pins in interface descriptions. The
    correspinding IOMIX settings for these pins can be found in the same
    row next to occurrences of following pad names in RK3328 TRM.
    
    GPIO3-B1:  IO_TSPd5m0_CIFdata5m0_GPIO3B1vccio6
    GPIO3-B2: IO_TSPd6m0_CIFdata6m0_GPIO3B2vccio6
    GPIO3-B3: IO_TSPd7m0_CIFdata7m0_GPIO3B3vccio6
    GPIO3-B4: IO_CARDclkm0_GPIO3B4vccio6
    GPIO3-B5: IO_CARDrstm0_GPIO3B5vccio6
    GPIO3-B6: IO_CARDdetm0_GPIO3B6vccio6
    
    Add pinmux data to rk3328_mux_recalced_data as mux register offset for
    these pins does not follow rockchip convention.
    
    Signed-off-by: Huang-Huang Bao <i@eh5.me>
    Reviewed-by: Heiko Stuebner <heiko@sntech.de>
    Fixes: 3818e4a7678e ("pinctrl: rockchip: Add rk3328 pinctrl support")
    Link: https://lore.kernel.org/r/20240606125755.53778-3-i@eh5.me
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 6ff152b2be889eb423ae4d34044dcf020b3365bf
Author: Huang-Huang Bao <i@eh5.me>
Date:   Thu Jun 6 20:57:52 2024 +0800

    pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
    
    [ Upstream commit e8448a6c817c2aa6c6af785b1d45678bd5977e8d ]
    
    The pinmux bits for GPIO2-B0 to GPIO2-B6 actually have 2 bits width,
    correct the bank flag for GPIO2-B. The pinmux bits for GPIO2-B7 is
    recalculated so it remain unchanged.
    
    The pinmux bits for those pins are not explicitly specified in RK3328
    TRM, however we can get hint from pad name and its correspinding IOMUX
    setting for pins in interface descriptions. The correspinding IOMIX
    settings for GPIO2-B0 to GPIO2-B6 can be found in the same row next to
    occurrences of following pad names in RK3328 TRM.
    
    GPIO2-B0: IO_SPIclkm0_GPIO2B0vccio5
    GPIO2-B1: IO_SPItxdm0_GPIO2B1vccio5
    GPIO2-B2: IO_SPIrxdm0_GPIO2B2vccio5
    GPIO2-B3: IO_SPIcsn0m0_GPIO2B3vccio5
    GPIO2-B4: IO_SPIcsn1m0_FLASHvol_sel_GPIO2B4vccio5
    GPIO2-B5: IO_ I2C2sda_TSADCshut_GPIO2B5vccio5
    GPIO2-B6: IO_ I2C2scl_GPIO2B6vccio5
    
    This fix has been tested on NanoPi R2S for fixing confliting pinmux bits
    between GPIO2-B7 with GPIO2-B5.
    
    Signed-off-by: Huang-Huang Bao <i@eh5.me>
    Reviewed-by: Heiko Stuebner <heiko@sntech.de>
    Fixes: 3818e4a7678e ("pinctrl: rockchip: Add rk3328 pinctrl support")
    Link: https://lore.kernel.org/r/20240606125755.53778-2-i@eh5.me
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b813e3fd102a959c5b208ed68afe27e0137a561b
Author: Hagar Hemdan <hagarhem@amazon.com>
Date:   Tue Jun 4 08:58:38 2024 +0000

    pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
    
    [ Upstream commit adec57ff8e66aee632f3dd1f93787c13d112b7a1 ]
    
    In create_pinctrl(), pinctrl_maps_mutex is acquired before calling
    add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl()
    calls pinctrl_free(). However, pinctrl_free() attempts to acquire
    pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to
    a potential deadlock.
    
    This patch resolves the issue by releasing pinctrl_maps_mutex before
    calling pinctrl_free(), preventing the deadlock.
    
    This bug was discovered and resolved using Coverity Static Analysis
    Security Testing (SAST) by Synopsys, Inc.
    
    Fixes: 42fed7ba44e4 ("pinctrl: move subsystem mutex to pinctrl_dev struct")
    Suggested-by: Maximilian Heyne <mheyne@amazon.de>
    Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
    Link: https://lore.kernel.org/r/20240604085838.3344-1-hagarhem@amazon.com
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b6be2b025c724fbf2829fc00b37662fc6ec4bd0c
Author: John Keeping <jkeeping@inmusicbrands.com>
Date:   Thu May 23 09:56:24 2024 +0100

    Input: ili210x - fix ili251x_read_touch_data() return value
    
    [ Upstream commit 9f0fad0382124e7e23b3c730fa78818c22c89c0a ]
    
    The caller of this function treats all non-zero values as an error, so
    the return value of i2c_master_recv() cannot be returned directly.
    
    This fixes touch reporting when there are more than 6 active touches.
    
    Fixes: ef536abd3afd1 ("Input: ili210x - define and use chip operations structure")
    Signed-off-by: John Keeping <jkeeping@inmusicbrands.com>
    Link: https://lore.kernel.org/r/20240523085624.2295988-1-jkeeping@inmusicbrands.com
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f0ef5ca85f432a7e90e103d0de4bf9d4bd140794
Author: Mario Limonciello <mario.limonciello@amd.com>
Date:   Thu May 9 13:45:02 2024 -0500

    ACPI: x86: Force StorageD3Enable on more products
    
    [ Upstream commit e79a10652bbd320649da705ca1ea0c04351af403 ]
    
    A Rembrandt-based HP thin client is reported to have problems where
    the NVME disk isn't present after resume from s2idle.
    
    This is because the NVME disk wasn't put into D3 at suspend, and
    that happened because the StorageD3Enable _DSD was missing in the BIOS.
    
    As AMD's architecture requires that the NVME is in D3 for s2idle, adjust
    the criteria for force_storage_d3 to match *all* Zen SoCs when the FADT
    advertises low power idle support.
    
    This will ensure that any future products with this BIOS deficiency don't
    need to be added to the allow list of overrides.
    
    Cc: All applicable <stable@vger.kernel.org>
    Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
    Acked-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3f830c24840077d7de0e1ee05a37a09a33da999d
Author: Mario Limonciello <mario.limonciello@amd.com>
Date:   Fri Mar 31 11:08:42 2023 -0500

    ACPI: x86: utils: Add Picasso to the list for forcing StorageD3Enable
    
    [ Upstream commit 10b6b4a8ac6120ec36555fd286eed577f7632e3b ]
    
    Picasso was the first APU that introduced s2idle support from AMD,
    and it was predating before vendors started to use `StorageD3Enable`
    in their firmware.
    
    Windows doesn't have problems with this hardware and NVME so it was
    likely on the list of hardcoded CPUs to use this behavior in Windows.
    
    Add it to the list for Linux to avoid NVME resume issues.
    
    Reported-by: Stuart Axon <stuaxo2@yahoo.com>
    Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2449
    Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Stable-dep-of: e79a10652bbd ("ACPI: x86: Force StorageD3Enable on more products")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit bb1758cc4af868c8b253b83816a09fd6a90d171d
Author: Mario Limonciello <mario.limonciello@amd.com>
Date:   Tue Feb 28 16:11:28 2023 -0600

    ACPI: x86: utils: Add Cezanne to the list for forcing StorageD3Enable
    
    [ Upstream commit e2a56364485e7789e7b8f342637c7f3a219f7ede ]
    
    commit 018d6711c26e4 ("ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1
    for StorageD3Enable") introduced a quirk to allow a system with ambiguous
    use of _ADR 0 to force StorageD3Enable.
    
    It was reported that several more Dell systems suffered the same symptoms.
    As the list is continuing to grow but these are all Cezanne systems,
    instead add Cezanne to the CPU list to apply the StorageD3Enable property
    and remove the whole list.
    
    It was also reported that an HP system only has StorageD3Enable on the ACPI
    device for the first NVME disk, not the second.
    
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=217003
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=216773
    Reported-by: David Alvarez Lombardi <dqalombardi@proton.me>
    Reported-by: dbilios@stdio.gr
    Reported-and-tested-by: Elvis Angelaccio <elvis.angelaccio@kde.org>
    Tested-by: victor.bonnelle@proton.me
    Tested-by: hurricanepootis@protonmail.com
    Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Stable-dep-of: e79a10652bbd ("ACPI: x86: Force StorageD3Enable on more products")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit c2a6ab506fd27243841fd5d66bc96d323b2c9039
Author: Mario Limonciello <mario.limonciello@amd.com>
Date:   Fri Oct 14 07:11:36 2022 -0500

    ACPI: x86: Add another system to quirk list for forcing StorageD3Enable
    
    [ Upstream commit 2124becad797245d49252d2d733aee0322233d7e ]
    
    commit 018d6711c26e4 ("ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1
    for StorageD3Enable") introduced a quirk to allow a system with ambiguous
    use of _ADR 0 to force StorageD3Enable.
    
    Julius Brockmann reports that Inspiron 16 5625 suffers that same symptoms.
    Add this other system to the list as well.
    
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=216440
    Reported-and-tested-by: Julius Brockmann <mail@juliusbrockmann.com>
    Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Stable-dep-of: e79a10652bbd ("ACPI: x86: Force StorageD3Enable on more products")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit fe73b1d0804de57556ae35728947350b530d15a7
Author: Mario Limonciello <mario.limonciello@amd.com>
Date:   Thu Sep 15 13:23:14 2022 -0500

    ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 for StorageD3Enable
    
    [ Upstream commit 018d6711c26e4bd26e20a819fcc7f8ab902608f3 ]
    
    Dell Inspiron 14 2-in-1 has two ACPI nodes under GPP1 both with _ADR of
    0, both without _HID.  It's ambiguous which the kernel should take, but
    it seems to take "DEV0".  Unfortunately "DEV0" is missing the device
    property `StorageD3Enable` which is present on "NVME".
    
    To avoid this causing problems for suspend, add a quirk for this system
    to behave like `StorageD3Enable` property was found.
    
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=216440
    Reported-and-tested-by: Luya Tshimbalanga <luya@fedoraproject.org>
    Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
    Reviewed-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Stable-dep-of: e79a10652bbd ("ACPI: x86: Force StorageD3Enable on more products")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 83f65222100523e818348f2d243745a1376b4dcf
Author: Mario Limonciello <mario.limonciello@amd.com>
Date:   Wed Jun 9 13:40:18 2021 -0500

    ACPI: Add quirks for AMD Renoir/Lucienne CPUs to force the D3 hint
    
    [ Upstream commit 6485fc18faa01e8845b1e5bb55118e633f84d1f2 ]
    
    AMD systems from Renoir and Lucienne require that the NVME controller
    is put into D3 over a Modern Standby / suspend-to-idle
    cycle.  This is "typically" accomplished using the `StorageD3Enable`
    property in the _DSD, but this property was introduced after many
    of these systems launched and most OEM systems don't have it in
    their BIOS.
    
    On AMD Renoir without these drives going into D3 over suspend-to-idle
    the resume will fail with the NVME controller being reset and a trace
    like this in the kernel logs:
    ```
    [   83.556118] nvme nvme0: I/O 161 QID 2 timeout, aborting
    [   83.556178] nvme nvme0: I/O 162 QID 2 timeout, aborting
    [   83.556187] nvme nvme0: I/O 163 QID 2 timeout, aborting
    [   83.556196] nvme nvme0: I/O 164 QID 2 timeout, aborting
    [   95.332114] nvme nvme0: I/O 25 QID 0 timeout, reset controller
    [   95.332843] nvme nvme0: Abort status: 0x371
    [   95.332852] nvme nvme0: Abort status: 0x371
    [   95.332856] nvme nvme0: Abort status: 0x371
    [   95.332859] nvme nvme0: Abort status: 0x371
    [   95.332909] PM: dpm_run_callback(): pci_pm_resume+0x0/0xe0 returns -16
    [   95.332936] nvme 0000:03:00.0: PM: failed to resume async: error -16
    ```
    
    The Microsoft documentation for StorageD3Enable mentioned that Windows has
    a hardcoded allowlist for D3 support, which was used for these platforms.
    Introduce quirks to hardcode them for Linux as well.
    
    As this property is now "standardized", OEM systems using AMD Cezanne and
    newer APU's have adopted this property, and quirks like this should not be
    necessary.
    
    CC: Shyam-sundar S-k <Shyam-sundar.S-k@amd.com>
    CC: Alexander Deucher <Alexander.Deucher@amd.com>
    CC: Prike Liang <prike.liang@amd.com>
    Link: https://docs.microsoft.com/en-us/windows-hardware/design/component-guidelines/power-management-for-storage-hardware-devices-intro
    Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
    Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Tested-by: Julian Sikorski <belegdol@gmail.com>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Stable-dep-of: e79a10652bbd ("ACPI: x86: Force StorageD3Enable on more products")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b055752675cd1d1db4ac9c2750db3dc3e89ea261
Author: Enzo Matsumiya <ematsumiya@suse.de>
Date:   Thu Jun 6 13:13:13 2024 -0300

    smb: client: fix deadlock in smb2_find_smb_tcon()
    
    [ Upstream commit 02c418774f76a0a36a6195c9dbf8971eb4130a15 ]
    
    Unlock cifs_tcp_ses_lock before calling cifs_put_smb_ses() to avoid such
    deadlock.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
    Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
    Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 78ebec450ef4f0720c592638d92bad679d75d7ce
Author: Shyam Prasad N <sprasad@microsoft.com>
Date:   Sun May 23 16:54:42 2021 +0000

    cifs: missed ref-counting smb session in find
    
    [ Upstream commit e695a9ad0305af6e8b0cbc24a54976ac2120cbb3 ]
    
    When we lookup an smb session based on session id,
    we did not up the ref-count for the session. This can
    potentially cause issues if the session is freed from under us.
    
    Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
    Reviewed-by: Aurelien Aptel <aaptel@suse.com>
    Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Stable-dep-of: 02c418774f76 ("smb: client: fix deadlock in smb2_find_smb_tcon()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b03555a8fa054f7310965aec481f89964d3b149f
Author: Yazen Ghannam <yazen.ghannam@amd.com>
Date:   Mon Apr 3 16:42:44 2023 +0000

    x86/amd_nb: Check for invalid SMN reads
    
    [ Upstream commit c625dabbf1c4a8e77e4734014f2fde7aa9071a1f ]
    
    AMD Zen-based systems use a System Management Network (SMN) that
    provides access to implementation-specific registers.
    
    SMN accesses are done indirectly through an index/data pair in PCI
    config space. The PCI config access may fail and return an error code.
    This would prevent the "read" value from being updated.
    
    However, the PCI config access may succeed, but the return value may be
    invalid. This is in similar fashion to PCI bad reads, i.e. return all
    bits set.
    
    Most systems will return 0 for SMN addresses that are not accessible.
    This is in line with AMD convention that unavailable registers are
    Read-as-Zero/Writes-Ignored.
    
    However, some systems will return a "PCI Error Response" instead. This
    value, along with an error code of 0 from the PCI config access, will
    confuse callers of the amd_smn_read() function.
    
    Check for this condition, clear the return value, and set a proper error
    code.
    
    Fixes: ddfe43cdc0da ("x86/amd_nb: Add SMN and Indirect Data Fabric access for AMD Fam17h")
    Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
    Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20230403164244.471141-1-yazen.ghannam@amd.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 0caf70a8e8168bfcedfb85d09e7f3d76d69f5bf1
Author: Naveen Naidu <naveennaidu479@gmail.com>
Date:   Thu Nov 18 19:33:11 2021 +0530

    PCI: Add PCI_ERROR_RESPONSE and related definitions
    
    [ Upstream commit 57bdeef4716689d9b0e3571034d65cf420f6efcd ]
    
    A config or MMIO read from a PCI device that doesn't exist or doesn't
    respond causes a PCI error. There's no real data to return to satisfy the
    CPU read, so most hardware fabricates ~0 data.
    
    Add a PCI_ERROR_RESPONSE definition for that and use it where appropriate
    to make these checks consistent and easier to find.
    
    Also add helper definitions PCI_SET_ERROR_RESPONSE() and
    PCI_POSSIBLE_ERROR() to make the code more readable.
    
    Suggested-by: Bjorn Helgaas <bhelgaas@google.com>
    Link: https://lore.kernel.org/r/55563bf4dfc5d3fdc96695373c659d099bf175b1.1637243717.git.naveennaidu479@gmail.com
    Signed-off-by: Naveen Naidu <naveennaidu479@gmail.com>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Reviewed-by: Pali Rohár <pali@kernel.org>
    Stable-dep-of: c625dabbf1c4 ("x86/amd_nb: Check for invalid SMN reads")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a335ad77bda22a5fff43078be7e7bc2a37d2ffab
Author: Haifeng Xu <haifeng.xu@shopee.com>
Date:   Mon May 13 10:39:48 2024 +0000

    perf/core: Fix missing wakeup when waiting for context reference
    
    [ Upstream commit 74751ef5c1912ebd3e65c3b65f45587e05ce5d36 ]
    
    In our production environment, we found many hung tasks which are
    blocked for more than 18 hours. Their call traces are like this:
    
    [346278.191038] __schedule+0x2d8/0x890
    [346278.191046] schedule+0x4e/0xb0
    [346278.191049] perf_event_free_task+0x220/0x270
    [346278.191056] ? init_wait_var_entry+0x50/0x50
    [346278.191060] copy_process+0x663/0x18d0
    [346278.191068] kernel_clone+0x9d/0x3d0
    [346278.191072] __do_sys_clone+0x5d/0x80
    [346278.191076] __x64_sys_clone+0x25/0x30
    [346278.191079] do_syscall_64+0x5c/0xc0
    [346278.191083] ? syscall_exit_to_user_mode+0x27/0x50
    [346278.191086] ? do_syscall_64+0x69/0xc0
    [346278.191088] ? irqentry_exit_to_user_mode+0x9/0x20
    [346278.191092] ? irqentry_exit+0x19/0x30
    [346278.191095] ? exc_page_fault+0x89/0x160
    [346278.191097] ? asm_exc_page_fault+0x8/0x30
    [346278.191102] entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    The task was waiting for the refcount become to 1, but from the vmcore,
    we found the refcount has already been 1. It seems that the task didn't
    get woken up by perf_event_release_kernel() and got stuck forever. The
    below scenario may cause the problem.
    
    Thread A                                        Thread B
    ...                                             ...
    perf_event_free_task                            perf_event_release_kernel
                                                       ...
                                                       acquire event->child_mutex
                                                       ...
                                                       get_ctx
       ...                                             release event->child_mutex
       acquire ctx->mutex
       ...
       perf_free_event (acquire/release event->child_mutex)
       ...
       release ctx->mutex
       wait_var_event
                                                       acquire ctx->mutex
                                                       acquire event->child_mutex
                                                       # move existing events to free_list
                                                       release event->child_mutex
                                                       release ctx->mutex
                                                       put_ctx
    ...                                             ...
    
    In this case, all events of the ctx have been freed, so we couldn't
    find the ctx in free_list and Thread A will miss the wakeup. It's thus
    necessary to add a wakeup after dropping the reference.
    
    Fixes: 1cf8dfe8a661 ("perf/core: Fix race between close() and fork()")
    Signed-off-by: Haifeng Xu <haifeng.xu@shopee.com>
    Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
    Acked-by: Mark Rutland <mark.rutland@arm.com>
    Cc: stable@vger.kernel.org
    Link: https://lkml.kernel.org/r/20240513103948.33570-1-haifeng.xu@shopee.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 695f20c6785d3e1ce42aa9a1fb06a1fd2828c89b
Author: Matthias Maennich <maennich@google.com>
Date:   Tue May 28 11:32:43 2024 +0000

    kheaders: explicitly define file modes for archived headers
    
    [ Upstream commit 3bd27a847a3a4827a948387cc8f0dbc9fa5931d5 ]
    
    Build environments might be running with different umask settings
    resulting in indeterministic file modes for the files contained in
    kheaders.tar.xz. The file itself is served with 444, i.e. world
    readable. Archive the files explicitly with 744,a+X to improve
    reproducibility across build environments.
    
    --mode=0444 is not suitable as directories need to be executable. Also,
    444 makes it hard to delete all the readonly files after extraction.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Matthias Maennich <maennich@google.com>
    Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 247c3f8958ab847fb86c024413763361f0556f80
Author: Masahiro Yamada <masahiroy@kernel.org>
Date:   Sun May 21 22:23:35 2023 +0900

    Revert "kheaders: substituting --sort in archive creation"
    
    [ Upstream commit 49c386ebbb43394ff4773ce24f726f6afc4c30c8 ]
    
    This reverts commit 700dea5a0bea9f64eba89fae7cb2540326fdfdc1.
    
    The reason for that commit was --sort=ORDER introduced in
    tar 1.28 (2014). More than 3 years have passed since then.
    
    Requiring GNU tar 1.28 should be fine now because we require
    GCC 5.1 (2015).
    
    Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
    Reviewed-by: Nicolas Schier <nicolas@fjasle.eu>
    Stable-dep-of: 3bd27a847a3a ("kheaders: explicitly define file modes for archived headers")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 61c1c98e2607120ce9c3fa1bf75e6da909712b27
Author: Ken Milmore <ken.milmore@gmail.com>
Date:   Tue May 21 23:45:50 2024 +0100

    r8169: Fix possible ring buffer corruption on fragmented Tx packets.
    
    [ Upstream commit c71e3a5cffd5309d7f84444df03d5b72600cc417 ]
    
    An issue was found on the RTL8125b when transmitting small fragmented
    packets, whereby invalid entries were inserted into the transmit ring
    buffer, subsequently leading to calls to dma_unmap_single() with a null
    address.
    
    This was caused by rtl8169_start_xmit() not noticing changes to nr_frags
    which may occur when small packets are padded (to work around hardware
    quirks) in rtl8169_tso_csum_v2().
    
    To fix this, postpone inspecting nr_frags until after any padding has been
    applied.
    
    Fixes: 9020845fb5d6 ("r8169: improve rtl8169_start_xmit")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ken Milmore <ken.milmore@gmail.com>
    Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
    Link: https://lore.kernel.org/r/27ead18b-c23d-4f49-a020-1fc482c5ac95@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5c88f4f6341cfc7cc65e08d8e6e38b3df8004f4c
Author: Heiner Kallweit <hkallweit1@gmail.com>
Date:   Tue Nov 17 21:34:09 2020 +0100

    r8169: remove not needed check in rtl8169_start_xmit
    
    [ Upstream commit bd4bdeb4f29027199c68104fbdfa07ad45390cc1 ]
    
    In rtl_tx() the released descriptors are zero'ed by
    rtl8169_unmap_tx_skb(). And in the beginning of rtl8169_start_xmit()
    we check that enough descriptors are free, therefore there's no way
    the DescOwn bit can be set here.
    
    Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
    Link: https://lore.kernel.org/r/6965d665-6c50-90c5-70e6-0bb335d4ea47@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Stable-dep-of: c71e3a5cffd5 ("r8169: Fix possible ring buffer corruption on fragmented Tx packets.")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 48833226fb0832627f54d215314c7cefb7d3a624
Author: Heiner Kallweit <hkallweit1@gmail.com>
Date:   Mon Nov 16 17:03:14 2020 +0100

    r8169: remove nr_frags argument from rtl_tx_slots_avail
    
    [ Upstream commit 83c317d7b36bb3858cf1cb86d2635ec3f3bd6ea3 ]
    
    The only time when nr_frags isn't SKB_MAX_FRAGS is when entering
    rtl8169_start_xmit(). However we can use SKB_MAX_FRAGS also here
    because when queue isn't stopped there should always be room for
    MAX_SKB_FRAGS + 1 descriptors.
    
    Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
    Link: https://lore.kernel.org/r/3d1f2ad7-31d5-2cac-4f4a-394f8a3cab63@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Stable-dep-of: c71e3a5cffd5 ("r8169: Fix possible ring buffer corruption on fragmented Tx packets.")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 41eeb13459b2ede1e2094436036ff8f680b7af7f
Author: Heiner Kallweit <hkallweit1@gmail.com>
Date:   Sat Nov 14 21:49:53 2020 +0100

    r8169: improve rtl8169_start_xmit
    
    [ Upstream commit 41294e6a434d4f19e957c55b275ea0324f275009 ]
    
    Improve the following in rtl8169_start_xmit:
    - tp->cur_tx can be accessed in parallel by rtl_tx(), therefore
      annotate the race by using WRITE_ONCE
    - avoid checking stop_queue a second time by moving the doorbell check
    - netif_stop_queue() uses atomic operation set_bit() that includes a
      full memory barrier on some platforms, therefore use
      smp_mb__after_atomic to avoid overhead
    
    Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
    Link: https://lore.kernel.org/r/80085451-3eaf-507a-c7c0-08d607c46fbc@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Stable-dep-of: c71e3a5cffd5 ("r8169: Fix possible ring buffer corruption on fragmented Tx packets.")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 04f9d0cd3974554afc1b9b6ce13990f95aa83bfd
Author: Heiner Kallweit <hkallweit1@gmail.com>
Date:   Wed Nov 11 22:56:29 2020 +0100

    r8169: improve rtl_tx
    
    [ Upstream commit ca1ab89cd2d654661f559bd83ad9fc7323cb6c86 ]
    
    We can simplify the for() condition and eliminate variable tx_left.
    The change also considers that tp->cur_tx may be incremented by a
    racing rtl8169_start_xmit().
    In addition replace the write to tp->dirty_tx and the following
    smp_mb() with an equivalent call to smp_store_mb(). This implicitly
    adds a WRITE_ONCE() to the write.
    
    Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
    Link: https://lore.kernel.org/r/c2e19e5e-3d3f-d663-af32-13c3374f5def@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Stable-dep-of: c71e3a5cffd5 ("r8169: Fix possible ring buffer corruption on fragmented Tx packets.")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 6d3eb1658be6a404b8c3e1b9f6cf6a1ea2be401a
Author: Heiner Kallweit <hkallweit1@gmail.com>
Date:   Thu Oct 29 18:56:06 2020 +0100

    r8169: remove unneeded memory barrier in rtl_tx
    
    [ Upstream commit 3a689e34973e8717cd57991c6fcf527dc56062b5 ]
    
    tp->dirty_tx isn't changed outside rtl_tx(). Therefore I see no need
    to guarantee a specific order of reading tp->dirty_tx and tp->cur_tx.
    Having said that we can remove the memory barrier.
    In addition use READ_ONCE() when reading tp->cur_tx because it can
    change in parallel to rtl_tx().
    
    Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
    Link: https://lore.kernel.org/r/2264563a-fa9e-11b0-2c42-31bc6b8e2790@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Stable-dep-of: c71e3a5cffd5 ("r8169: Fix possible ring buffer corruption on fragmented Tx packets.")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 40a697e34517fdbb3a31bfd50776575bd1886bc0
Author: Tony Luck <tony.luck@intel.com>
Date:   Mon May 20 15:45:33 2024 -0700

    x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL
    
    [ Upstream commit 93022482b2948a9a7e9b5a2bb685f2e1cb4c3348 ]
    
    Code in v6.9 arch/x86/kernel/smpboot.c was changed by commit
    
      4db64279bc2b ("x86/cpu: Switch to new Intel CPU model defines") from:
    
      static const struct x86_cpu_id intel_cod_cpu[] = {
              X86_MATCH_INTEL_FAM6_MODEL(HASWELL_X, 0),       /* COD */
              X86_MATCH_INTEL_FAM6_MODEL(BROADWELL_X, 0),     /* COD */
              X86_MATCH_INTEL_FAM6_MODEL(ANY, 1),             /* SNC */     <--- 443
              {}
      };
    
      static bool match_llc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
      {
              const struct x86_cpu_id *id = x86_match_cpu(intel_cod_cpu);
    
    to:
    
      static const struct x86_cpu_id intel_cod_cpu[] = {
               X86_MATCH_VFM(INTEL_HASWELL_X,   0),    /* COD */
               X86_MATCH_VFM(INTEL_BROADWELL_X, 0),    /* COD */
               X86_MATCH_VFM(INTEL_ANY,         1),    /* SNC */
               {}
       };
    
      static bool match_llc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
      {
              const struct x86_cpu_id *id = x86_match_cpu(intel_cod_cpu);
    
    On an Intel CPU with SNC enabled this code previously matched the rule on line
    443 to avoid printing messages about insane cache configuration.  The new code
    did not match any rules.
    
    Expanding the macros for the intel_cod_cpu[] array shows that the old is
    equivalent to:
    
      static const struct x86_cpu_id intel_cod_cpu[] = {
      [0] = { .vendor = 0, .family = 6, .model = 0x3F, .steppings = 0, .feature = 0, .driver_data = 0 },
      [1] = { .vendor = 0, .family = 6, .model = 0x4F, .steppings = 0, .feature = 0, .driver_data = 0 },
      [2] = { .vendor = 0, .family = 6, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 1 },
      [3] = { .vendor = 0, .family = 0, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 0 }
      }
    
    while the new code expands to:
    
      static const struct x86_cpu_id intel_cod_cpu[] = {
      [0] = { .vendor = 0, .family = 6, .model = 0x3F, .steppings = 0, .feature = 0, .driver_data = 0 },
      [1] = { .vendor = 0, .family = 6, .model = 0x4F, .steppings = 0, .feature = 0, .driver_data = 0 },
      [2] = { .vendor = 0, .family = 0, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 1 },
      [3] = { .vendor = 0, .family = 0, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 0 }
      }
    
    Looking at the code for x86_match_cpu():
    
      const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match)
      {
               const struct x86_cpu_id *m;
               struct cpuinfo_x86 *c = &boot_cpu_data;
    
               for (m = match;
                    m->vendor | m->family | m->model | m->steppings | m->feature;
                    m++) {
                    ...
               }
               return NULL;
    
    it is clear that there was no match because the ANY entry in the table (array
    index 2) is now the loop termination condition (all of vendor, family, model,
    steppings, and feature are zero).
    
    So this code was working before because the "ANY" check was looking for any
    Intel CPU in family 6. But fails now because the family is a wild card. So the
    root cause is that x86_match_cpu() has never been able to match on a rule with
    just X86_VENDOR_INTEL and all other fields set to wildcards.
    
    Add a new flags field to struct x86_cpu_id that has a bit set to indicate that
    this entry in the array is valid. Update X86_MATCH*() macros to set that bit.
    Change the end-marker check in x86_match_cpu() to just check the flags field
    for this bit.
    
    Backporter notes: The commit in Fixes is really the one that is broken:
    you can't have m->vendor as part of the loop termination conditional in
    x86_match_cpu() because it can happen - as it has happened above
    - that that whole conditional is 0 albeit vendor == 0 is a valid case
    - X86_VENDOR_INTEL is 0.
    
    However, the only case where the above happens is the SNC check added by
    4db64279bc2b1 so you only need this fix if you have backported that
    other commit
    
      4db64279bc2b ("x86/cpu: Switch to new Intel CPU model defines")
    
    Fixes: 644e9cbbe3fc ("Add driver auto probing for x86 features v4")
    Suggested-by: Thomas Gleixner <tglx@linutronix.de>
    Suggested-by: Borislav Petkov <bp@alien8.de>
    Signed-off-by: Tony Luck <tony.luck@intel.com>
    Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
    Cc: <stable+noautosel@kernel.org> # see above
    Link: https://lore.kernel.org/r/20240517144312.GBZkdtAOuJZCvxhFbJ@fat_crate.local
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 50b1b4e4f3a65813ab6edf487b90252672245466
Author: Tony Luck <tony.luck@intel.com>
Date:   Tue Apr 16 14:19:04 2024 -0700

    x86/cpu/vfm: Add new macros to work with (vendor/family/model) values
    
    [ Upstream commit e6dfdc2e89a0adedf455814c91b977d6a584cc88 ]
    
    To avoid adding a slew of new macros for each new Intel CPU family
    switch over from providing CPU model number #defines to a new
    scheme that encodes vendor, family, and model in a single number.
    
      [ bp: s/casted/cast/g ]
    
    Signed-off-by: Tony Luck <tony.luck@intel.com>
    Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
    Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
    Link: https://lore.kernel.org/r/20240416211941.9369-3-tony.luck@intel.com
    Stable-dep-of: 93022482b294 ("x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 0e84701753acc8332a3da54f3d2522b73afe8c02
Author: Jeff Johnson <quic_jjohnson@quicinc.com>
Date:   Sat May 18 15:54:49 2024 -0700

    tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
    
    [ Upstream commit 23748e3e0fbfe471eff5ce439921629f6a427828 ]
    
    Fix the 'make W=1' warning:
    
    WARNING: modpost: missing MODULE_DESCRIPTION() in kernel/trace/preemptirq_delay_test.o
    
    Link: https://lore.kernel.org/linux-trace-kernel/20240518-md-preemptirq_delay_test-v1-1-387d11b30d85@quicinc.com
    
    Cc: stable@vger.kernel.org
    Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Fixes: f96e8577da10 ("lib: Add module for testing preemptoff/irqsoff latency tracers")
    Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
    Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
    Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 2c3d7b03b658dc8bfa6112b194b67b92a87e081b
Author: Matthew Mirvish <matthew@mm12.xyz>
Date:   Thu May 9 09:11:17 2024 +0800

    bcache: fix variable length array abuse in btree_iter
    
    [ Upstream commit 3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31 ]
    
    btree_iter is used in two ways: either allocated on the stack with a
    fixed size MAX_BSETS, or from a mempool with a dynamic size based on the
    specific cache set. Previously, the struct had a fixed-length array of
    size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized
    iterators, which causes UBSAN to complain.
    
    This patch uses the same approach as in bcachefs's sort_iter and splits
    the iterator into a btree_iter with a flexible array member and a
    btree_iter_stack which embeds a btree_iter as well as a fixed-length
    data array.
    
    Cc: stable@vger.kernel.org
    Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039368
    Signed-off-by: Matthew Mirvish <matthew@mm12.xyz>
    Signed-off-by: Coly Li <colyli@suse.de>
    Link: https://lore.kernel.org/r/20240509011117.2697-3-colyli@suse.de
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 6337072467296defa7d1b0160c03de3d39b1d318
Author: Vamshi Gajjela <vamshigajjela@google.com>
Date:   Tue May 7 14:07:41 2024 -0700

    spmi: hisi-spmi-controller: Do not override device identifier
    
    [ Upstream commit eda4923d78d634482227c0b189d9b7ca18824146 ]
    
    'nr' member of struct spmi_controller, which serves as an identifier
    for the controller/bus. This value is a dynamic ID assigned in
    spmi_controller_alloc, and overriding it from the driver results in an
    ida_free error "ida_free called for id=xx which is not allocated".
    
    Signed-off-by: Vamshi Gajjela <vamshigajjela@google.com>
    Fixes: 70f59c90c819 ("staging: spmi: add Hikey 970 SPMI controller driver")
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20240228185116.1269-1-vamshigajjela@google.com
    Signed-off-by: Stephen Boyd <sboyd@kernel.org>
    Link: https://lore.kernel.org/r/20240507210809.3479953-5-sboyd@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 90551062fd6978c7bc9c9d363b6cea4c9cf2129d
Author: Trond Myklebust <trond.myklebust@hammerspace.com>
Date:   Mon May 6 12:30:04 2024 -0400

    knfsd: LOOKUP can return an illegal error value
    
    [ Upstream commit e221c45da3770962418fb30c27d941bbc70d595a ]
    
    The 'NFS error' NFSERR_OPNOTSUPP is not described by any of the official
    NFS related RFCs, but appears to have snuck into some older .x files for
    NFSv2.
    Either way, it is not in RFC1094, RFC1813 or any of the NFSv4 RFCs, so
    should not be returned by the knfsd server, and particularly not by the
    "LOOKUP" operation.
    
    Instead, let's return NFSERR_STALE, which is more appropriate if the
    filesystem encodes the filehandle as FILEID_INVALID.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f77c8a2ce21e6a11658be63995fad0171ff425a4
Author: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Date:   Mon Apr 15 19:00:23 2024 +0300

    pmdomain: ti-sci: Fix duplicate PD referrals
    
    [ Upstream commit 670c900f69645db394efb38934b3344d8804171a ]
    
    When the dts file has multiple referrers to a single PD (e.g.
    simple-framebuffer and dss nodes both point to the DSS power-domain) the
    ti-sci driver will create two power domains, both with the same ID, and
    that will cause problems as one of the power domains will hide the other
    one.
    
    Fix this checking if a PD with the ID has already been created, and only
    create a PD for new IDs.
    
    Fixes: efa5c01cd7ee ("soc: ti: ti_sci_pm_domains: switch to use multiple genpds instead of one")
    Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20240415-ti-sci-pd-v1-1-a0e56b8ad897@ideasonboard.com
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5fe1b2c72e9edaa5bb64f50dca11bafd62bdc8cd
Author: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Date:   Thu Apr 25 21:09:21 2024 +0300

    wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power
    
    [ Upstream commit de4d4be4fa64ed7b4aa1c613061015bd8fa98b24 ]
    
    Different channels have different TX power settings. rtl8192de is using
    the TX power setting from the wrong channel in the 5 GHz band because
    _rtl92c_phy_get_rightchnlplace expects an array which includes all the
    channel numbers, but it's using an array which includes only the 5 GHz
    channel numbers.
    
    Use the array channel_all (defined in rtl8192de/phy.c) instead of
    the incorrect channel5g (defined in core.c).
    
    Tested only with rtl8192du, which will use the same TX power code.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
    Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
    Link: https://msgid.link/c7653517-cf88-4f57-b79a-8edb0a8b32f0@gmail.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 33628b6ed3ccb6a9dffd4e2b7f76f9b13a657cfe
Author: Kees Cook <kees@kernel.org>
Date:   Fri Nov 19 11:22:33 2021 -0800

    rtlwifi: rtl8192de: Style clean-ups
    
    [ Upstream commit 69831173fcbbfebb7aa2d76523deaf0b87b8eddd ]
    
    Clean up some style issues:
    - Use ARRAY_SIZE() even though it's a u8 array.
    - Remove redundant CHANNEL_MAX_NUMBER_2G define.
    Additionally fix some dead code WARNs.
    
    Acked-by: Ping-Ke Shih <pkshih@realtek.com>
    Link: https://lore.kernel.org/lkml/57d0d1b6064342309f680f692192556c@realtek.com/
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/20211119192233.1021063-1-keescook@chromium.org
    Stable-dep-of: de4d4be4fa64 ("wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 77942a027231ac7670788f26543a133d65b18e9c
Author: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date:   Tue Mar 12 19:31:04 2024 +0100

    ARM: dts: samsung: smdk4412: fix keypad no-autorepeat
    
    [ Upstream commit 4ac4c1d794e7ff454d191bbdab7585ed8dbf3758 ]
    
    Although the Samsung SoC keypad binding defined
    linux,keypad-no-autorepeat property, Linux driver never implemented it
    and always used linux,input-no-autorepeat.  Correct the DTS to use
    property actually implemented.
    
    This also fixes dtbs_check errors like:
    
      exynos4412-smdk4412.dtb: keypad@100a0000: 'key-A', 'key-B', 'key-C', 'key-D', 'key-E', 'linux,keypad-no-autorepeat' do not match any of the regexes: '^key-[0-9a-z]+$', 'pinctrl-[0-9]+'
    
    Cc: <stable@vger.kernel.org>
    Fixes: c9b92dd70107 ("ARM: dts: Add keypad entries to SMDK4412")
    Link: https://lore.kernel.org/r/20240312183105.715735-3-krzysztof.kozlowski@linaro.org
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 1fdaecc326f0cf8628474c87df47cf2b73f66728
Author: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date:   Tue Mar 12 19:31:03 2024 +0100

    ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat
    
    [ Upstream commit 88208d3cd79821117fd3fb80d9bcab618467d37b ]
    
    Although the Samsung SoC keypad binding defined
    linux,keypad-no-autorepeat property, Linux driver never implemented it
    and always used linux,input-no-autorepeat.  Correct the DTS to use
    property actually implemented.
    
    This also fixes dtbs_check errors like:
    
      exynos4412-origen.dtb: keypad@100a0000: 'linux,keypad-no-autorepeat' does not match any of the regexes: '^key-[0-9a-z]+$', 'pinctrl-[0-9]+'
    
    Cc: <stable@vger.kernel.org>
    Fixes: bd08f6277e44 ("ARM: dts: Add keypad entries to Exynos4412 based Origen")
    Link: https://lore.kernel.org/r/20240312183105.715735-2-krzysztof.kozlowski@linaro.org
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b263a895d8a178eeb0987c062edfee45eb65135e
Author: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date:   Tue Mar 12 19:31:02 2024 +0100

    ARM: dts: samsung: smdkv310: fix keypad no-autorepeat
    
    [ Upstream commit 87d8e522d6f5a004f0aa06c0def302df65aff296 ]
    
    Although the Samsung SoC keypad binding defined
    linux,keypad-no-autorepeat property, Linux driver never implemented it
    and always used linux,input-no-autorepeat.  Correct the DTS to use
    property actually implemented.
    
    This also fixes dtbs_check errors like:
    
      exynos4210-smdkv310.dtb: keypad@100a0000: 'linux,keypad-no-autorepeat' does not match any of the regexes: '^key-[0-9a-z]+$', 'pinctrl-[0-9]+'
    
    Cc: <stable@vger.kernel.org>
    Fixes: 0561ceabd0f1 ("ARM: dts: Add intial dts file for EXYNOS4210 SoC, SMDKV310 and ORIGEN")
    Link: https://lore.kernel.org/r/20240312183105.715735-1-krzysztof.kozlowski@linaro.org
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit cc255080c1c59f1749c7bedd4281bd809d49ee3a
Author: Martin Leung <martin.leung@amd.com>
Date:   Mon Feb 26 13:20:08 2024 -0500

    drm/amd/display: revert Exit idle optimizations before HDCP execution
    
    commit f2703a3596a279b0be6eeed4c500bdbaa8dc3ce4 upstream.
    
    why and how:
    causes black screen on PNP on DCN 3.5
    
    This reverts commit f30a3bea92bd ("drm/amd/display: Exit idle
    optimizations before HDCP execution")
    
    Cc: Mario Limonciello <mario.limonciello@amd.com>
    Cc: Alex Deucher <alexander.deucher@amd.com>
    Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
    Acked-by: Wayne Lin <wayne.lin@amd.com>
    Signed-off-by: Martin Leung <martin.leung@amd.com>
    Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5d7fef7522b1f7617d92744c38ecaf9cd0a68417
Author: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date:   Thu Jun 20 13:34:50 2024 +0200

    dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to i2c-controller schema
    
    commit 5c8cfd592bb7632200b4edac8f2c7ec892ed9d81 upstream.
    
    The referenced i2c-controller.yaml schema is provided by dtschema
    package (outside of Linux kernel), so use full path to reference it.
    
    Cc: stable@vger.kernel.org
    Fixes: 1acd4577a66f ("dt-bindings: i2c: convert i2c-cros-ec-tunnel to json-schema")
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
    Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7884f4afeccb501ac581329bfda1eb2a2c65bc4f
Author: Grygorii Tertychnyi <grembeter@gmail.com>
Date:   Mon May 20 17:39:32 2024 +0200

    i2c: ocores: set IACK bit after core is enabled
    
    commit 5a72477273066b5b357801ab2d315ef14949d402 upstream.
    
    Setting IACK bit when core is disabled does not clear the "Interrupt Flag"
    bit in the status register, and the interrupt remains pending.
    
    Sometimes it causes failure for the very first message transfer, that is
    usually a device probe.
    
    Hence, set IACK bit after core is enabled to clear pending interrupt.
    
    Fixes: 18f98b1e3147 ("[PATCH] i2c: New bus driver for the OpenCores I2C controller")
    Signed-off-by: Grygorii Tertychnyi <grygorii.tertychnyi@leica-geosystems.com>
    Acked-by: Peter Korsgaard <peter@korsgaard.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7879b54f0b9046226f1b52e3aa9a06724b54b413
Author: Aleksandr Nogikh <nogikh@google.com>
Date:   Tue Jun 11 15:32:29 2024 +0200

    kcov: don't lose track of remote references during softirqs
    
    commit 01c8f9806bde438ca1c8cbbc439f0a14a6694f6c upstream.
    
    In kcov_remote_start()/kcov_remote_stop(), we swap the previous KCOV
    metadata of the current task into a per-CPU variable.  However, the
    kcov_mode_enabled(mode) check is not sufficient in the case of remote KCOV
    coverage: current->kcov_mode always remains KCOV_MODE_DISABLED for remote
    KCOV objects.
    
    If the original task that has invoked the KCOV_REMOTE_ENABLE ioctl happens
    to get interrupted and kcov_remote_start() is called, it ultimately leads
    to kcov_remote_stop() NOT restoring the original KCOV reference.  So when
    the task exits, all registered remote KCOV handles remain active forever.
    
    The most uncomfortable effect (at least for syzkaller) is that the bug
    prevents the reuse of the same /sys/kernel/debug/kcov descriptor.  If
    we obtain it in the parent process and then e.g.  drop some
    capabilities and continuously fork to execute individual programs, at
    some point current->kcov of the forked process is lost,
    kcov_task_exit() takes no action, and all KCOV_REMOTE_ENABLE ioctls
    calls from subsequent forks fail.
    
    And, yes, the efficiency is also affected if we keep on losing remote
    kcov objects.
    a) kcov_remote_map keeps on growing forever.
    b) (If I'm not mistaken), we're also not freeing the memory referenced
    by kcov->area.
    
    Fix it by introducing a special kcov_mode that is assigned to the task
    that owns a KCOV remote object.  It makes kcov_mode_enabled() return true
    and yet does not trigger coverage collection in __sanitizer_cov_trace_pc()
    and write_comp_data().
    
    [nogikh@google.com: replace WRITE_ONCE() with an ordinary assignment]
      Link: https://lkml.kernel.org/r/20240614171221.2837584-1-nogikh@google.com
    Link: https://lkml.kernel.org/r/20240611133229.527822-1-nogikh@google.com
    Fixes: 5ff3b30ab57d ("kcov: collect coverage from interrupts")
    Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
    Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
    Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
    Tested-by: Andrey Konovalov <andreyknvl@gmail.com>
    Cc: Alexander Potapenko <glider@google.com>
    Cc: Arnd Bergmann <arnd@arndb.de>
    Cc: Marco Elver <elver@google.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b1684798a300ecc1cfcae4c642799ce5ed3cec2e
Author: Peter Oberparleiter <oberpar@linux.ibm.com>
Date:   Mon Jun 10 11:27:43 2024 +0200

    gcov: add support for GCC 14
    
    commit c1558bc57b8e5b4da5d821537cd30e2e660861d8 upstream.
    
    Using gcov on kernels compiled with GCC 14 results in truncated 16-byte
    long .gcda files with no usable data.  To fix this, update GCOV_COUNTERS
    to match the value defined by GCC 14.
    
    Tested with GCC versions 14.1.0 and 13.2.0.
    
    Link: https://lkml.kernel.org/r/20240610092743.1609845-1-oberpar@linux.ibm.com
    Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
    Reported-by: Allison Henderson <allison.henderson@oracle.com>
    Reported-by: Chuck Lever III <chuck.lever@oracle.com>
    Tested-by: Chuck Lever <chuck.lever@oracle.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit febe794b83693257f21a23d2e03ea695a62449c8
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Mon May 20 09:11:45 2024 -0400

    drm/radeon: fix UBSAN warning in kv_dpm.c
    
    commit a498df5421fd737d11bfd152428ba6b1c8538321 upstream.
    
    Adds bounds check for sumo_vid_mapping_entry.
    
    Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 71bea3e64879f762260f20b2b153d0da3d78b89c
Author: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
Date:   Wed Jun 5 12:39:23 2024 -0300

    ALSA: hda/realtek: Limit mic boost on N14AP7
    
    commit 86a433862912f52597263aa224a9ed82bcd533bf upstream.
    
    The internal mic boost on the N14AP7 is too high. Fix this by applying the
    ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine to limit the gain.
    
    Signed-off-by: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
    Cc: <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20240605153923.2837-1-edson.drosdeck@gmail.com
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7186b81c1f15e39069b1af172c6a951728ed3511
Author: Patrisious Haddad <phaddad@nvidia.com>
Date:   Tue May 28 15:52:56 2024 +0300

    RDMA/mlx5: Add check for srq max_sge attribute
    
    [ Upstream commit 36ab7ada64caf08f10ee5a114d39964d1f91e81d ]
    
    max_sge attribute is passed by the user, and is inserted and used
    unchecked, so verify that the value doesn't exceed maximum allowed value
    before using it.
    
    Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
    Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
    Link: https://lore.kernel.org/r/277ccc29e8d57bfd53ddeb2ac633f2760cf8cdd0.1716900410.git.leon@kernel.org
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 6eca23100e9030725f69c1babacd58803f29ec8d
Author: Raju Rangoju <Raju.Rangoju@amd.com>
Date:   Fri Jun 14 19:31:49 2024 +0530

    ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
    
    [ Upstream commit a83e1385b780d41307433ddbc86e3c528db031f0 ]
    
    Undo the modifications made in commit d410ee5109a1 ("ACPICA: avoid
    "Info: mapping multiple BARs. Your kernel is fine.""). The initial
    purpose of this commit was to stop memory mappings for operation
    regions from overlapping page boundaries, as it can trigger warnings
    if different page attributes are present.
    
    However, it was found that when this situation arises, mapping
    continues until the boundary's end, but there is still an attempt to
    read/write the entire length of the map, leading to a NULL pointer
    deference. For example, if a four-byte mapping request is made but
    only one byte is mapped because it hits the current page boundary's
    end, a four-byte read/write attempt is still made, resulting in a NULL
    pointer deference.
    
    Instead, map the entire length, as the ACPI specification does not
    mandate that it must be within the same page boundary. It is
    permissible for it to be mapped across different regions.
    
    Link: https://github.com/acpica/acpica/pull/954
    Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218849
    Fixes: d410ee5109a1 ("ACPICA: avoid "Info: mapping multiple BARs. Your kernel is fine."")
    Co-developed-by: Sanath S <Sanath.S@amd.com>
    Signed-off-by: Sanath S <Sanath.S@amd.com>
    Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f3d17826d6b6bba58c3c86cf81312e2af6d4df66
Author: Nikita Shubin <n.shubin@yadro.com>
Date:   Tue May 14 13:52:31 2024 +0300

    dmaengine: ioatdma: Fix missing kmem_cache_destroy()
    
    [ Upstream commit 5422145d0b749ad554ada772133b9b20f9fb0ec8 ]
    
    Fix missing kmem_cache_destroy() for ioat_sed_cache in
    ioat_exit_module().
    
    Noticed via:
    
    ```
    modprobe ioatdma
    rmmod ioatdma
    modprobe ioatdma
    debugfs: Directory 'ioat_sed_ent' with parent 'slab' already present!
    ```
    
    Fixes: c0f28ce66ecf ("dmaengine: ioatdma: move all the init routines")
    Signed-off-by: Nikita Shubin <n.shubin@yadro.com>
    Acked-by: Dave Jiang <dave.jiang@intel.com>
    Link: https://lore.kernel.org/r/20240514-ioatdma_fixes-v1-1-2776a0913254@yadro.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 34cc20a5441dd0b6a94f045d346a53bbc2bbf32a
Author: Nikita Shubin <n.shubin@yadro.com>
Date:   Tue May 28 09:09:25 2024 +0300

    dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
    
    [ Upstream commit 29b7cd255f3628e0d65be33a939d8b5bba10aa62 ]
    
    If probing fails we end up with leaking ioatdma_device and each
    allocated channel.
    
    Following kmemleak easy to reproduce by injecting an error in
    ioat_alloc_chan_resources() when doing ioat_dma_self_test().
    
    unreferenced object 0xffff888014ad5800 (size 1024): [..]
        [<ffffffff827692ca>] kmemleak_alloc+0x4a/0x80
        [<ffffffff81430600>] kmalloc_trace+0x270/0x2f0
        [<ffffffffa000b7d1>] ioat_pci_probe+0xc1/0x1c0 [ioatdma]
    [..]
    
    repeated for each ioatdma channel:
    
    unreferenced object 0xffff8880148e5c00 (size 512): [..]
        [<ffffffff827692ca>] kmemleak_alloc+0x4a/0x80
        [<ffffffff81430600>] kmalloc_trace+0x270/0x2f0
        [<ffffffffa0009641>] ioat_enumerate_channels+0x101/0x2d0 [ioatdma]
        [<ffffffffa000b266>] ioat3_dma_probe+0x4d6/0x970 [ioatdma]
        [<ffffffffa000b891>] ioat_pci_probe+0x181/0x1c0 [ioatdma]
    [..]
    
    Fixes: bf453a0a18b2 ("dmaengine: ioat: Support in-use unbind")
    Signed-off-by: Nikita Shubin <n.shubin@yadro.com>
    Reviewed-by: Dave Jiang <dave.jiang@intel.com>
    Link: https://lore.kernel.org/r/20240528-ioatdma-fixes-v2-3-a9f2fbe26ab1@yadro.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 768ae5e02551b38bc604bb0aca4bfba90aeaa9dc
Author: Nikita Shubin <n.shubin@yadro.com>
Date:   Tue May 28 09:09:24 2024 +0300

    dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
    
    [ Upstream commit f0dc9fda2e0ee9e01496c2f5aca3a831131fad79 ]
    
    Make sure we are disabling interrupts and destroying DMA pool if
    pcie_capability_read/write_word() call failed.
    
    Fixes: 511deae0261c ("dmaengine: ioatdma: disable relaxed ordering for ioatdma")
    Signed-off-by: Nikita Shubin <n.shubin@yadro.com>
    Reviewed-by: Dave Jiang <dave.jiang@intel.com>
    Link: https://lore.kernel.org/r/20240528-ioatdma-fixes-v2-2-a9f2fbe26ab1@yadro.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a486fca282a9fb3b95e46002acb2bdc2744e9bdf
Author: Bjorn Helgaas <bhelgaas@google.com>
Date:   Tue Mar 7 15:46:15 2023 -0600

    dmaengine: ioat: use PCI core macros for PCIe Capability
    
    [ Upstream commit 8f6707d0773be31972768abd6e0bf7b8515b5b1a ]
    
    The PCIe Capability is defined by the PCIe spec, so use the PCI_EXP_DEVCTL
    macros defined by the PCI core instead of defining copies in IOAT.  This
    makes it easier to find all uses of the PCIe Device Control register.  No
    functional change intended.
    
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Acked-by: Dave Jiang <dave.jiang@intel.com>
    Link: https://lore.kernel.org/r/20230307214615.887354-1-helgaas@kernel.org
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Stable-dep-of: f0dc9fda2e0e ("dmaengine: ioatdma: Fix error path in ioat3_dma_probe()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit c017a8e3e30c663054e5d087e2d87ef68747bda6
Author: Nikita Shubin <n.shubin@yadro.com>
Date:   Tue May 28 09:09:23 2024 +0300

    dmaengine: ioatdma: Fix leaking on version mismatch
    
    [ Upstream commit 1b11b4ef6bd68591dcaf8423c7d05e794e6aec6f ]
    
    Fix leaking ioatdma_device if I/OAT version is less than IOAT_VER_3_0.
    
    Fixes: bf453a0a18b2 ("dmaengine: ioat: Support in-use unbind")
    Signed-off-by: Nikita Shubin <n.shubin@yadro.com>
    Reviewed-by: Dave Jiang <dave.jiang@intel.com>
    Link: https://lore.kernel.org/r/20240528-ioatdma-fixes-v2-1-a9f2fbe26ab1@yadro.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f99b00ed9b928a61144abdad2730de495c63a66f
Author: Bjorn Helgaas <bhelgaas@google.com>
Date:   Tue Mar 7 13:26:54 2023 -0600

    dmaengine: ioat: Drop redundant pci_enable_pcie_error_reporting()
    
    [ Upstream commit e32622f84ae289dc7a04e9f01cd62cb914fdc5c6 ]
    
    pci_enable_pcie_error_reporting() enables the device to send ERR_*
    Messages.  Since f26e58bf6f54 ("PCI/AER: Enable error reporting when AER is
    native"), the PCI core does this for all devices during enumeration, so the
    driver doesn't need to do it itself.
    
    Remove the redundant pci_enable_pcie_error_reporting() call from the
    driver.  Also remove the corresponding pci_disable_pcie_error_reporting()
    from the driver .remove() path.
    
    Note that this only controls ERR_* Messages from the device.  An ERR_*
    Message may cause the Root Port to generate an interrupt, depending on the
    AER Root Error Command register managed by the AER service driver.
    
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Acked-by: Dave Jiang <dave.jiang@intel.com>
    Link: https://lore.kernel.org/r/20230307192655.874008-2-helgaas@kernel.org
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Stable-dep-of: 1b11b4ef6bd6 ("dmaengine: ioatdma: Fix leaking on version mismatch")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit d293db11cb9c177abe13b6fce306aa762d454796
Author: Qing Wang <wangqing@vivo.com>
Date:   Thu Oct 7 20:28:28 2021 -0700

    dmaengine: ioat: switch from 'pci_' to 'dma_' API
    
    [ Upstream commit 0c5afef7bf1fbda7e7883dc4b93f64f90003706f ]
    
    The wrappers in include/linux/pci-dma-compat.h should go away.
    
    pci_set_dma_mask()/pci_set_consistent_dma_mask() should be
    replaced with dma_set_mask()/dma_set_coherent_mask(),
    and use dma_set_mask_and_coherent() for both.
    
    Signed-off-by: Qing Wang <wangqing@vivo.com>
    Link: https://lore.kernel.org/r/1633663733-47199-3-git-send-email-wangqing@vivo.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Stable-dep-of: 1b11b4ef6bd6 ("dmaengine: ioatdma: Fix leaking on version mismatch")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 97509608b7e49298717112db2388d8452ebb2128
Author: Biju Das <biju.das.jz@bp.renesas.com>
Date:   Mon Jun 10 20:55:32 2024 +0100

    regulator: core: Fix modpost error "regulator_get_regmap" undefined
    
    [ Upstream commit 3f60497c658d2072714d097a177612d34b34aa3d ]
    
    Fix the modpost error "regulator_get_regmap" undefined by adding export
    symbol.
    
    Fixes: 04eca28cde52 ("regulator: Add helpers for low-level register access")
    Reported-by: kernel test robot <lkp@intel.com>
    Closes: https://lore.kernel.org/oe-kbuild-all/202406110117.mk5UR3VZ-lkp@intel.com
    Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
    Link: https://lore.kernel.org/r/20240610195532.175942-1-biju.das.jz@bp.renesas.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 6a0f5d540f0f9635b5ac6fc4bdb78d40302de32d
Author: Oliver Neukum <oneukum@suse.com>
Date:   Wed Jun 19 15:28:03 2024 +0200

    net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings
    
    [ Upstream commit fba383985354e83474f95f36d7c65feb75dba19d ]
    
    This functions retrieves values by passing a pointer. As the function
    that retrieves them can fail before touching the pointers, the variables
    must be initialized.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-by: syzbot+5186630949e3c55f0799@syzkaller.appspotmail.com
    Signed-off-by: Oliver Neukum <oneukum@suse.com>
    Link: https://lore.kernel.org/r/20240619132816.11526-1-oneukum@suse.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 72d9611968867cc4c5509e7708b1507d692b797a
Author: Jozsef Kadlecsik <kadlec@netfilter.org>
Date:   Mon Jun 17 11:18:15 2024 +0200

    netfilter: ipset: Fix suspicious rcu_dereference_protected()
    
    [ Upstream commit 8ecd06277a7664f4ef018abae3abd3451d64e7a6 ]
    
    When destroying all sets, we are either in pernet exit phase or
    are executing a "destroy all sets command" from userspace. The latter
    was taken into account in ip_set_dereference() (nfnetlink mutex is held),
    but the former was not. The patch adds the required check to
    rcu_dereference_protected() in ip_set_dereference().
    
    Fixes: 4e7aaa6b82d6 ("netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type")
    Reported-by: syzbot+b62c37cdd58103293a5a@syzkaller.appspotmail.com
    Reported-by: syzbot+cfbe1da5fdfc39efc293@syzkaller.appspotmail.com
    Reported-by: kernel test robot <oliver.sang@intel.com>
    Closes: https://lore.kernel.org/oe-lkp/202406141556.e0b6f17e-lkp@intel.com
    Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 333c0a1f7d5bb506d169d56005299e2b1c07ff8e
Author: Heng Qi <hengqi@linux.alibaba.com>
Date:   Mon Jun 17 21:15:23 2024 +0800

    virtio_net: checksum offloading handling fix
    
    [ Upstream commit 604141c036e1b636e2a71cf6e1aa09d1e45f40c2 ]
    
    In virtio spec 0.95, VIRTIO_NET_F_GUEST_CSUM was designed to handle
    partially checksummed packets, and the validation of fully checksummed
    packets by the device is independent of VIRTIO_NET_F_GUEST_CSUM
    negotiation. However, the specification erroneously stated:
    
      "If VIRTIO_NET_F_GUEST_CSUM is not negotiated, the device MUST set flags
       to zero and SHOULD supply a fully checksummed packet to the driver."
    
    This statement is inaccurate because even without VIRTIO_NET_F_GUEST_CSUM
    negotiation, the device can still set the VIRTIO_NET_HDR_F_DATA_VALID flag.
    Essentially, the device can facilitate the validation of these packets'
    checksums - a process known as RX checksum offloading - removing the need
    for the driver to do so.
    
    This scenario is currently not implemented in the driver and requires
    correction. The necessary specification correction[1] has been made and
    approved in the virtio TC vote.
    [1] https://lists.oasis-open.org/archives/virtio-comment/202401/msg00011.html
    
    Fixes: 4f49129be6fa ("virtio-net: Set RXCSUM feature if GUEST_CSUM is available")
    Signed-off-by: Heng Qi <hengqi@linux.alibaba.com>
    Reviewed-by: Jiri Pirko <jiri@nvidia.com>
    Acked-by: Jason Wang <jasowang@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b4bca4722fda928810d024350493990de39f1e40
Author: Xiaolei Wang <xiaolei.wang@windriver.com>
Date:   Mon Jun 17 09:39:22 2024 +0800

    net: stmmac: No need to calculate speed divider when offload is disabled
    
    [ Upstream commit b8c43360f6e424131fa81d3ba8792ad8ff25a09e ]
    
    commit be27b8965297 ("net: stmmac: replace priv->speed with
    the portTransmitRate from the tc-cbs parameters") introduced
    a problem. When deleting, it prompts "Invalid portTransmitRate
    0 (idleSlope - sendSlope)" and exits. Add judgment on cbs.enable.
    Only when offload is enabled, speed divider needs to be calculated.
    
    Fixes: be27b8965297 ("net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs parameters")
    Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://lore.kernel.org/r/20240617013922.1035854-1-xiaolei.wang@windriver.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 03f625505e27f709390a86c9b78d3707f4c23df8
Author: Xin Long <lucien.xin@gmail.com>
Date:   Sat Jun 15 17:47:30 2024 -0400

    sched: act_ct: add netns into the key of tcf_ct_flow_table
    
    [ Upstream commit 88c67aeb14070bab61d3dd8be96c8b42ebcaf53a ]
    
    zones_ht is a global hashtable for flow_table with zone as key. However,
    it does not consider netns when getting a flow_table from zones_ht in
    tcf_ct_init(), and it means an act_ct action in netns A may get a
    flow_table that belongs to netns B if it has the same zone value.
    
    In Shuang's test with the TOPO:
    
      tcf2_c <---> tcf2_sw1 <---> tcf2_sw2 <---> tcf2_s
    
    tcf2_sw1 and tcf2_sw2 saw the same flow and used the same flow table,
    which caused their ct entries entering unexpected states and the
    TCP connection not able to end normally.
    
    This patch fixes the issue simply by adding netns into the key of
    tcf_ct_flow_table so that an act_ct action gets a flow_table that
    belongs to its own netns in tcf_ct_init().
    
    Note that for easy coding we don't use tcf_ct_flow_table.nf_ft.net,
    as the ct_ft is initialized after inserting it to the hashtable in
    tcf_ct_flow_table_get() and also it requires to implement several
    functions in rhashtable_params including hashfn, obj_hashfn and
    obj_cmpfn.
    
    Fixes: 64ff70b80fd4 ("net/sched: act_ct: Offload established connections to flow table")
    Reported-by: Shuang Li <shuali@redhat.com>
    Signed-off-by: Xin Long <lucien.xin@gmail.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://lore.kernel.org/r/1db5b6cc6902c5fc6f8c6cbd85494a2008087be5.1718488050.git.lucien.xin@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b4899d75b8432d499ed9d1c3d0013f98e8f4f3c9
Author: Vlad Buslov <vladbu@nvidia.com>
Date:   Wed Jun 15 12:43:54 2022 +0200

    net/sched: act_ct: set 'net' pointer when creating new nf_flow_table
    
    [ Upstream commit fc54d9065f90dd25063883f404e6ff9a76913e73 ]
    
    Following patches in series use the pointer to access flow table offload
    debug variables.
    
    Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
    Signed-off-by: Oz Shlomo <ozsh@nvidia.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Stable-dep-of: 88c67aeb1407 ("sched: act_ct: add netns into the key of tcf_ct_flow_table")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3eb1b39627892c4e26cb0162b75725aa5fcc60c8
Author: Xin Long <lucien.xin@gmail.com>
Date:   Sat Jun 15 14:27:20 2024 -0400

    tipc: force a dst refcount before doing decryption
    
    [ Upstream commit 2ebe8f840c7450ecbfca9d18ac92e9ce9155e269 ]
    
    As it says in commit 3bc07321ccc2 ("xfrm: Force a dst refcount before
    entering the xfrm type handlers"):
    
    "Crypto requests might return asynchronous. In this case we leave the
     rcu protected region, so force a refcount on the skb's destination
     entry before we enter the xfrm type input/output handlers."
    
    On TIPC decryption path it has the same problem, and skb_dst_force()
    should be called before doing decryption to avoid a possible crash.
    
    Shuang reported this issue when this warning is triggered:
    
      [] WARNING: include/net/dst.h:337 tipc_sk_rcv+0x1055/0x1ea0 [tipc]
      [] Kdump: loaded Tainted: G W --------- - - 4.18.0-496.el8.x86_64+debug
      [] Workqueue: crypto cryptd_queue_worker
      [] RIP: 0010:tipc_sk_rcv+0x1055/0x1ea0 [tipc]
      [] Call Trace:
      [] tipc_sk_mcast_rcv+0x548/0xea0 [tipc]
      [] tipc_rcv+0xcf5/0x1060 [tipc]
      [] tipc_aead_decrypt_done+0x215/0x2e0 [tipc]
      [] cryptd_aead_crypt+0xdb/0x190
      [] cryptd_queue_worker+0xed/0x190
      [] process_one_work+0x93d/0x17e0
    
    Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication")
    Reported-by: Shuang Li <shuali@redhat.com>
    Signed-off-by: Xin Long <lucien.xin@gmail.com>
    Link: https://lore.kernel.org/r/fbe3195fad6997a4eec62d9bf076b2ad03ac336b.1718476040.git.lucien.xin@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit c6a7da65a296745535a964be1019ec7691b0cb90
Author: David Ruth <druth@chromium.org>
Date:   Fri Jun 14 19:03:26 2024 +0000

    net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
    
    [ Upstream commit d864319871b05fadd153e0aede4811ca7008f5d6 ]
    
    syzbot found hanging tasks waiting on rtnl_lock [1]
    
    A reproducer is available in the syzbot bug.
    
    When a request to add multiple actions with the same index is sent, the
    second request will block forever on the first request. This holds
    rtnl_lock, and causes tasks to hang.
    
    Return -EAGAIN to prevent infinite looping, while keeping documented
    behavior.
    
    [1]
    
    INFO: task kworker/1:0:5088 blocked for more than 143 seconds.
    Not tainted 6.9.0-rc4-syzkaller-00173-g3cdb45594619 #0
    "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    task:kworker/1:0 state:D stack:23744 pid:5088 tgid:5088 ppid:2 flags:0x00004000
    Workqueue: events_power_efficient reg_check_chans_work
    Call Trace:
    <TASK>
    context_switch kernel/sched/core.c:5409 [inline]
    __schedule+0xf15/0x5d00 kernel/sched/core.c:6746
    __schedule_loop kernel/sched/core.c:6823 [inline]
    schedule+0xe7/0x350 kernel/sched/core.c:6838
    schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6895
    __mutex_lock_common kernel/locking/mutex.c:684 [inline]
    __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752
    wiphy_lock include/net/cfg80211.h:5953 [inline]
    reg_leave_invalid_chans net/wireless/reg.c:2466 [inline]
    reg_check_chans_work+0x10a/0x10e0 net/wireless/reg.c:2481
    
    Fixes: 0190c1d452a9 ("net: sched: atomically check-allocate action")
    Reported-by: syzbot+b87c222546179f4513a7@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=b87c222546179f4513a7
    Signed-off-by: David Ruth <druth@chromium.org>
    Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Link: https://lore.kernel.org/r/20240614190326.1349786-1-druth@chromium.org
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 66c7aa157a38d93947b32c0d309889369a27e8e2
Author: Pedro Tammela <pctammela@mojatatu.com>
Date:   Mon Dec 11 15:18:06 2023 -0300

    net/sched: act_api: rely on rcu in tcf_idr_check_alloc
    
    [ Upstream commit 4b55e86736d5b492cf689125da2600f59c7d2c39 ]
    
    Instead of relying only on the idrinfo->lock mutex for
    bind/alloc logic, rely on a combination of rcu + mutex + atomics
    to better scale the case where multiple rtnl-less filters are
    binding to the same action object.
    
    Action binding happens when an action index is specified explicitly and
    an action exists which such index exists. Example:
      tc actions add action drop index 1
      tc filter add ... matchall action drop index 1
      tc filter add ... matchall action drop index 1
      tc filter add ... matchall action drop index 1
      tc filter ls ...
         filter protocol all pref 49150 matchall chain 0 filter protocol all pref 49150 matchall chain 0 handle 0x1
         not_in_hw
               action order 1: gact action drop
                random type none pass val 0
                index 1 ref 4 bind 3
    
       filter protocol all pref 49151 matchall chain 0 filter protocol all pref 49151 matchall chain 0 handle 0x1
         not_in_hw
               action order 1: gact action drop
                random type none pass val 0
                index 1 ref 4 bind 3
    
       filter protocol all pref 49152 matchall chain 0 filter protocol all pref 49152 matchall chain 0 handle 0x1
         not_in_hw
               action order 1: gact action drop
                random type none pass val 0
                index 1 ref 4 bind 3
    
    When no index is specified, as before, grab the mutex and allocate
    in the idr the next available id. In this version, as opposed to before,
    it's simplified to store the -EBUSY pointer instead of the previous
    alloc + replace combination.
    
    When an index is specified, rely on rcu to find if there's an object in
    such index. If there's none, fallback to the above, serializing on the
    mutex and reserving the specified id. If there's one, it can be an -EBUSY
    pointer, in which case we just try again until it's an action, or an action.
    Given the rcu guarantees, the action found could be dead and therefore
    we need to bump the refcount if it's not 0, handling the case it's
    in fact 0.
    
    As bind and the action refcount are already atomics, these increments can
    happen without the mutex protection while many tcf_idr_check_alloc race
    to bind to the same action instance.
    
    In case binding encounters a parallel delete or add, it will return
    -EAGAIN in order to try again. Both filter and action apis already
    have the retry machinery in-place. In case it's an unlocked filter it
    retries under the rtnl lock.
    
    Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
    Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Reviewed-by: Vlad Buslov <vladbu@nvidia.com>
    Link: https://lore.kernel.org/r/20231211181807.96028-2-pctammela@mojatatu.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Stable-dep-of: d864319871b0 ("net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit fb910ac2d3dafa750bdcec699b088dc99b8a0c17
Author: Stefan Wahren <wahrenst@gmx.net>
Date:   Fri Jun 14 16:50:30 2024 +0200

    qca_spi: Make interrupt remembering atomic
    
    [ Upstream commit 2d7198278ece01818cd95a3beffbdf8b2a353fa0 ]
    
    The whole mechanism to remember occurred SPI interrupts is not atomic,
    which could lead to unexpected behavior. So fix this by using atomic bit
    operations instead.
    
    Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000")
    Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
    Link: https://lore.kernel.org/r/20240614145030.7781-1-wahrenst@gmx.net
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 2b82028a1f5ee3a8e04090776b10c534144ae77b
Author: Yue Haibing <yuehaibing@huawei.com>
Date:   Fri Jun 14 21:13:02 2024 +0800

    netns: Make get_net_ns() handle zero refcount net
    
    [ Upstream commit ff960f9d3edbe08a736b5a224d91a305ccc946b0 ]
    
    Syzkaller hit a warning:
    refcount_t: addition on 0; use-after-free.
    WARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcount_warn_saturate+0xdf/0x1d0
    Modules linked in:
    CPU: 3 PID: 7890 Comm: tun Not tainted 6.10.0-rc3-00100-gcaa4f9578aba-dirty #310
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
    RIP: 0010:refcount_warn_saturate+0xdf/0x1d0
    Code: 41 49 04 31 ff 89 de e8 9f 1e cd fe 84 db 75 9c e8 76 26 cd fe c6 05 b6 41 49 04 01 90 48 c7 c7 b8 8e 25 86 e8 d2 05 b5 fe 90 <0f> 0b 90 90 e9 79 ff ff ff e8 53 26 cd fe 0f b6 1
    RSP: 0018:ffff8881067b7da0 EFLAGS: 00010286
    RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c72ac
    RDX: ffff8881026a2140 RSI: ffffffff811c72b5 RDI: 0000000000000001
    RBP: ffff8881067b7db0 R08: 0000000000000000 R09: 205b5d3730353139
    R10: 0000000000000000 R11: 205d303938375420 R12: ffff8881086500c4
    R13: ffff8881086500c4 R14: ffff8881086500b0 R15: ffff888108650040
    FS:  00007f5b2961a4c0(0000) GS:ffff88823bd00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 000055d7ed36fd18 CR3: 00000001482f6000 CR4: 00000000000006f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
     <TASK>
     ? show_regs+0xa3/0xc0
     ? __warn+0xa5/0x1c0
     ? refcount_warn_saturate+0xdf/0x1d0
     ? report_bug+0x1fc/0x2d0
     ? refcount_warn_saturate+0xdf/0x1d0
     ? handle_bug+0xa1/0x110
     ? exc_invalid_op+0x3c/0xb0
     ? asm_exc_invalid_op+0x1f/0x30
     ? __warn_printk+0xcc/0x140
     ? __warn_printk+0xd5/0x140
     ? refcount_warn_saturate+0xdf/0x1d0
     get_net_ns+0xa4/0xc0
     ? __pfx_get_net_ns+0x10/0x10
     open_related_ns+0x5a/0x130
     __tun_chr_ioctl+0x1616/0x2370
     ? __sanitizer_cov_trace_switch+0x58/0xa0
     ? __sanitizer_cov_trace_const_cmp2+0x1c/0x30
     ? __pfx_tun_chr_ioctl+0x10/0x10
     tun_chr_ioctl+0x2f/0x40
     __x64_sys_ioctl+0x11b/0x160
     x64_sys_call+0x1211/0x20d0
     do_syscall_64+0x9e/0x1d0
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    RIP: 0033:0x7f5b28f165d7
    Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 8
    RSP: 002b:00007ffc2b59c5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
    RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5b28f165d7
    RDX: 0000000000000000 RSI: 00000000000054e3 RDI: 0000000000000003
    RBP: 00007ffc2b59c650 R08: 00007f5b291ed8c0 R09: 00007f5b2961a4c0
    R10: 0000000029690010 R11: 0000000000000246 R12: 0000000000400730
    R13: 00007ffc2b59cf40 R14: 0000000000000000 R15: 0000000000000000
     </TASK>
    Kernel panic - not syncing: kernel: panic_on_warn set ...
    
    This is trigger as below:
              ns0                                    ns1
    tun_set_iff() //dev is tun0
       tun->dev = dev
    //ip link set tun0 netns ns1
                                           put_net() //ref is 0
    __tun_chr_ioctl() //TUNGETDEVNETNS
       net = dev_net(tun->dev);
       open_related_ns(&net->ns, get_net_ns); //ns1
         get_net_ns()
            get_net() //addition on 0
    
    Use maybe_get_net() in get_net_ns in case net's ref is zero to fix this
    
    Fixes: 0c3e0e3bb623 ("tun: Add ioctl() TUNGETDEVNETNS cmd to allow obtaining real net ns of tun device")
    Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
    Link: https://lore.kernel.org/r/20240614131302.2698509-1-yuehaibing@huawei.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 20427b85781aca0ad072851f6907a3d4b2fed8d1
Author: Eric Dumazet <edumazet@google.com>
Date:   Sat Jun 15 15:42:31 2024 +0000

    xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
    
    [ Upstream commit d46401052c2d5614da8efea5788532f0401cb164 ]
    
    ip6_dst_idev() can return NULL, xfrm6_get_saddr() must act accordingly.
    
    syzbot reported:
    
    Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
    KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
    CPU: 1 PID: 12 Comm: kworker/u8:1 Not tainted 6.10.0-rc2-syzkaller-00383-gb8481381d4e2 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
    Workqueue: wg-kex-wg1 wg_packet_handshake_send_worker
     RIP: 0010:xfrm6_get_saddr+0x93/0x130 net/ipv6/xfrm6_policy.c:64
    Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 97 00 00 00 4c 8b ab d8 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 86 00 00 00 4d 8b 6d 00 e8 ca 13 47 01 48 b8 00
    RSP: 0018:ffffc90000117378 EFLAGS: 00010246
    RAX: dffffc0000000000 RBX: ffff88807b079dc0 RCX: ffffffff89a0d6d7
    RDX: 0000000000000000 RSI: ffffffff89a0d6e9 RDI: ffff88807b079e98
    RBP: ffff88807ad73248 R08: 0000000000000007 R09: fffffffffffff000
    R10: ffff88807b079dc0 R11: 0000000000000007 R12: ffffc90000117480
    R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
    FS:  0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007f4586d00440 CR3: 0000000079042000 CR4: 00000000003506f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
     <TASK>
      xfrm_get_saddr net/xfrm/xfrm_policy.c:2452 [inline]
      xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2481 [inline]
      xfrm_tmpl_resolve+0xa26/0xf10 net/xfrm/xfrm_policy.c:2541
      xfrm_resolve_and_create_bundle+0x140/0x2570 net/xfrm/xfrm_policy.c:2835
      xfrm_bundle_lookup net/xfrm/xfrm_policy.c:3070 [inline]
      xfrm_lookup_with_ifid+0x4d1/0x1e60 net/xfrm/xfrm_policy.c:3201
      xfrm_lookup net/xfrm/xfrm_policy.c:3298 [inline]
      xfrm_lookup_route+0x3b/0x200 net/xfrm/xfrm_policy.c:3309
      ip6_dst_lookup_flow+0x15c/0x1d0 net/ipv6/ip6_output.c:1256
      send6+0x611/0xd20 drivers/net/wireguard/socket.c:139
      wg_socket_send_skb_to_peer+0xf9/0x220 drivers/net/wireguard/socket.c:178
      wg_socket_send_buffer_to_peer+0x12b/0x190 drivers/net/wireguard/socket.c:200
      wg_packet_send_handshake_initiation+0x227/0x360 drivers/net/wireguard/send.c:40
      wg_packet_handshake_send_worker+0x1c/0x30 drivers/net/wireguard/send.c:51
      process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
      process_scheduled_works kernel/workqueue.c:3312 [inline]
      worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
      kthread+0x2c1/0x3a0 kernel/kthread.c:389
      ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
      ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reviewed-by: David Ahern <dsahern@kernel.org>
    Link: https://lore.kernel.org/r/20240615154231.234442-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 1ed9849fdf9a1a617129346b11d2094ca26828dc
Author: Eric Dumazet <edumazet@google.com>
Date:   Sat Jun 15 15:14:54 2024 +0000

    ipv6: prevent possible NULL dereference in rt6_probe()
    
    [ Upstream commit b86762dbe19a62e785c189f313cda5b989931f37 ]
    
    syzbot caught a NULL dereference in rt6_probe() [1]
    
    Bail out if  __in6_dev_get() returns NULL.
    
    [1]
    Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cb: 0000 [#1] PREEMPT SMP KASAN PTI
    KASAN: null-ptr-deref in range [0x0000000000000658-0x000000000000065f]
    CPU: 1 PID: 22444 Comm: syz-executor.0 Not tainted 6.10.0-rc2-syzkaller-00383-gb8481381d4e2 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
     RIP: 0010:rt6_probe net/ipv6/route.c:656 [inline]
     RIP: 0010:find_match+0x8c4/0xf50 net/ipv6/route.c:758
    Code: 14 fd f7 48 8b 85 38 ff ff ff 48 c7 45 b0 00 00 00 00 48 8d b8 5c 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 19
    RSP: 0018:ffffc900034af070 EFLAGS: 00010203
    RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90004521000
    RDX: 00000000000000cb RSI: ffffffff8990d0cd RDI: 000000000000065c
    RBP: ffffc900034af150 R08: 0000000000000005 R09: 0000000000000000
    R10: 0000000000000001 R11: 0000000000000002 R12: 000000000000000a
    R13: 1ffff92000695e18 R14: ffff8880244a1d20 R15: 0000000000000000
    FS:  00007f4844a5a6c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000001b31b27000 CR3: 000000002d42c000 CR4: 00000000003506f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
     <TASK>
      rt6_nh_find_match+0xfa/0x1a0 net/ipv6/route.c:784
      nexthop_for_each_fib6_nh+0x26d/0x4a0 net/ipv4/nexthop.c:1496
      __find_rr_leaf+0x6e7/0xe00 net/ipv6/route.c:825
      find_rr_leaf net/ipv6/route.c:853 [inline]
      rt6_select net/ipv6/route.c:897 [inline]
      fib6_table_lookup+0x57e/0xa30 net/ipv6/route.c:2195
      ip6_pol_route+0x1cd/0x1150 net/ipv6/route.c:2231
      pol_lookup_func include/net/ip6_fib.h:616 [inline]
      fib6_rule_lookup+0x386/0x720 net/ipv6/fib6_rules.c:121
      ip6_route_output_flags_noref net/ipv6/route.c:2639 [inline]
      ip6_route_output_flags+0x1d0/0x640 net/ipv6/route.c:2651
      ip6_dst_lookup_tail.constprop.0+0x961/0x1760 net/ipv6/ip6_output.c:1147
      ip6_dst_lookup_flow+0x99/0x1d0 net/ipv6/ip6_output.c:1250
      rawv6_sendmsg+0xdab/0x4340 net/ipv6/raw.c:898
      inet_sendmsg+0x119/0x140 net/ipv4/af_inet.c:853
      sock_sendmsg_nosec net/socket.c:730 [inline]
      __sock_sendmsg net/socket.c:745 [inline]
      sock_write_iter+0x4b8/0x5c0 net/socket.c:1160
      new_sync_write fs/read_write.c:497 [inline]
      vfs_write+0x6b6/0x1140 fs/read_write.c:590
      ksys_write+0x1f8/0x260 fs/read_write.c:643
      do_syscall_x64 arch/x86/entry/common.c:52 [inline]
      do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    
    Fixes: 52e1635631b3 ("[IPV6]: ROUTE: Add router_probe_interval sysctl.")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
    Reviewed-by: David Ahern <dsahern@kernel.org>
    Link: https://lore.kernel.org/r/20240615151454.166404-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit de5ad4d45cd0128a2a37555f48ab69aa19d78adc
Author: Eric Dumazet <edumazet@google.com>
Date:   Fri Jun 14 08:20:02 2024 +0000

    ipv6: prevent possible NULL deref in fib6_nh_init()
    
    [ Upstream commit 2eab4543a2204092c3a7af81d7d6c506e59a03a6 ]
    
    syzbot reminds us that in6_dev_get() can return NULL.
    
    fib6_nh_init()
        ip6_validate_gw(  &idev  )
            ip6_route_check_nh(  idev  )
                *idev = in6_dev_get(dev); // can be NULL
    
    Oops: general protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTI
    KASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7]
    CPU: 0 PID: 11237 Comm: syz-executor.3 Not tainted 6.10.0-rc2-syzkaller-00249-gbe27b8965297 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
     RIP: 0010:fib6_nh_init+0x640/0x2160 net/ipv6/route.c:3606
    Code: 00 00 fc ff df 4c 8b 64 24 58 48 8b 44 24 28 4c 8b 74 24 30 48 89 c1 48 89 44 24 28 48 8d 98 e0 05 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 b3 17 00 00 8b 1b 31 ff 89 de e8 b8 8b
    RSP: 0018:ffffc900032775a0 EFLAGS: 00010202
    RAX: 00000000000000bc RBX: 00000000000005e0 RCX: 0000000000000000
    RDX: 0000000000000010 RSI: ffffc90003277a54 RDI: ffff88802b3a08d8
    RBP: ffffc900032778b0 R08: 00000000000002fc R09: 0000000000000000
    R10: 00000000000002fc R11: 0000000000000000 R12: ffff88802b3a08b8
    R13: 1ffff9200064eec8 R14: ffffc90003277a00 R15: dffffc0000000000
    FS:  00007f940feb06c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000000 CR3: 00000000245e8000 CR4: 00000000003506f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
     <TASK>
      ip6_route_info_create+0x99e/0x12b0 net/ipv6/route.c:3809
      ip6_route_add+0x28/0x160 net/ipv6/route.c:3853
      ipv6_route_ioctl+0x588/0x870 net/ipv6/route.c:4483
      inet6_ioctl+0x21a/0x280 net/ipv6/af_inet6.c:579
      sock_do_ioctl+0x158/0x460 net/socket.c:1222
      sock_ioctl+0x629/0x8e0 net/socket.c:1341
      vfs_ioctl fs/ioctl.c:51 [inline]
      __do_sys_ioctl fs/ioctl.c:907 [inline]
      __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
      do_syscall_x64 arch/x86/entry/common.c:52 [inline]
      do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    RIP: 0033:0x7f940f07cea9
    
    Fixes: 428604fb118f ("ipv6: do not set routes if disable_ipv6 has been enabled")
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
    Reviewed-by: David Ahern <dsahern@kernel.org>
    Link: https://lore.kernel.org/r/20240614082002.26407-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5391f9db2cab5ef1cb411be1ab7dbec728078fba
Author: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Date:   Thu Jun 13 08:23:00 2024 +0000

    netrom: Fix a memory leak in nr_heartbeat_expiry()
    
    [ Upstream commit 0b9130247f3b6a1122478471ff0e014ea96bb735 ]
    
    syzbot reported a memory leak in nr_create() [0].
    
    Commit 409db27e3a2e ("netrom: Fix use-after-free of a listening socket.")
    added sock_hold() to the nr_heartbeat_expiry() function, where
    a) a socket has a SOCK_DESTROY flag or
    b) a listening socket has a SOCK_DEAD flag.
    
    But in the case "a," when the SOCK_DESTROY flag is set, the file descriptor
    has already been closed and the nr_release() function has been called.
    So it makes no sense to hold the reference count because no one will
    call another nr_destroy_socket() and put it as in the case "b."
    
    nr_connect
      nr_establish_data_link
        nr_start_heartbeat
    
    nr_release
      switch (nr->state)
      case NR_STATE_3
        nr->state = NR_STATE_2
        sock_set_flag(sk, SOCK_DESTROY);
    
                            nr_rx_frame
                              nr_process_rx_frame
                                switch (nr->state)
                                case NR_STATE_2
                                  nr_state2_machine()
                                    nr_disconnect()
                                      nr_sk(sk)->state = NR_STATE_0
                                      sock_set_flag(sk, SOCK_DEAD)
    
                            nr_heartbeat_expiry
                              switch (nr->state)
                              case NR_STATE_0
                                if (sock_flag(sk, SOCK_DESTROY) ||
                                   (sk->sk_state == TCP_LISTEN
                                     && sock_flag(sk, SOCK_DEAD)))
                                   sock_hold()  // ( !!! )
                                   nr_destroy_socket()
    
    To fix the memory leak, let's call sock_hold() only for a listening socket.
    
    Found by InfoTeCS on behalf of Linux Verification Center
    (linuxtesting.org) with Syzkaller.
    
    [0]: https://syzkaller.appspot.com/bug?extid=d327a1f3b12e1e206c16
    
    Reported-by: syzbot+d327a1f3b12e1e206c16@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=d327a1f3b12e1e206c16
    Fixes: 409db27e3a2e ("netrom: Fix use-after-free of a listening socket.")
    Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 1aabe0f850ad446763383106d9b677094db9f930
Author: Ondrej Mosnacek <omosnace@redhat.com>
Date:   Fri Jun 7 18:07:52 2024 +0200

    cipso: fix total option length computation
    
    [ Upstream commit 9f36169912331fa035d7b73a91252d7c2512eb1a ]
    
    As evident from the definition of ip_options_get(), the IP option
    IPOPT_END is used to pad the IP option data array, not IPOPT_NOP. Yet
    the loop that walks the IP options to determine the total IP options
    length in cipso_v4_delopt() doesn't take IPOPT_END into account.
    
    Fix it by recognizing the IPOPT_END value as the end of actual options.
    
    Fixes: 014ab19a69c3 ("selinux: Set socket NetLabel based on connection endpoint")
    Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a85bae262ccecc52a40c466ec067f6c915e0839d
Author: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Date:   Tue Jun 11 22:30:37 2024 +0900

    tracing: Build event generation tests only as modules
    
    [ Upstream commit 3572bd5689b0812b161b40279e39ca5b66d73e88 ]
    
    The kprobes and synth event generation test modules add events and lock
    (get a reference) those event file reference in module init function,
    and unlock and delete it in module exit function. This is because those
    are designed for playing as modules.
    
    If we make those modules as built-in, those events are left locked in the
    kernel, and never be removed. This causes kprobe event self-test failure
    as below.
    
    [   97.349708] ------------[ cut here ]------------
    [   97.353453] WARNING: CPU: 3 PID: 1 at kernel/trace/trace_kprobe.c:2133 kprobe_trace_self_tests_init+0x3f1/0x480
    [   97.357106] Modules linked in:
    [   97.358488] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 6.9.0-g699646734ab5-dirty #14
    [   97.361556] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
    [   97.363880] RIP: 0010:kprobe_trace_self_tests_init+0x3f1/0x480
    [   97.365538] Code: a8 24 08 82 e9 ae fd ff ff 90 0f 0b 90 48 c7 c7 e5 aa 0b 82 e9 ee fc ff ff 90 0f 0b 90 48 c7 c7 2d 61 06 82 e9 8e fd ff ff 90 <0f> 0b 90 48 c7 c7 33 0b 0c 82 89 c6 e8 6e 03 1f ff 41 ff c7 e9 90
    [   97.370429] RSP: 0000:ffffc90000013b50 EFLAGS: 00010286
    [   97.371852] RAX: 00000000fffffff0 RBX: ffff888005919c00 RCX: 0000000000000000
    [   97.373829] RDX: ffff888003f40000 RSI: ffffffff8236a598 RDI: ffff888003f40a68
    [   97.375715] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
    [   97.377675] R10: ffffffff811c9ae5 R11: ffffffff8120c4e0 R12: 0000000000000000
    [   97.379591] R13: 0000000000000001 R14: 0000000000000015 R15: 0000000000000000
    [   97.381536] FS:  0000000000000000(0000) GS:ffff88807dcc0000(0000) knlGS:0000000000000000
    [   97.383813] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [   97.385449] CR2: 0000000000000000 CR3: 0000000002244000 CR4: 00000000000006b0
    [   97.387347] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [   97.389277] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    [   97.391196] Call Trace:
    [   97.391967]  <TASK>
    [   97.392647]  ? __warn+0xcc/0x180
    [   97.393640]  ? kprobe_trace_self_tests_init+0x3f1/0x480
    [   97.395181]  ? report_bug+0xbd/0x150
    [   97.396234]  ? handle_bug+0x3e/0x60
    [   97.397311]  ? exc_invalid_op+0x1a/0x50
    [   97.398434]  ? asm_exc_invalid_op+0x1a/0x20
    [   97.399652]  ? trace_kprobe_is_busy+0x20/0x20
    [   97.400904]  ? tracing_reset_all_online_cpus+0x15/0x90
    [   97.402304]  ? kprobe_trace_self_tests_init+0x3f1/0x480
    [   97.403773]  ? init_kprobe_trace+0x50/0x50
    [   97.404972]  do_one_initcall+0x112/0x240
    [   97.406113]  do_initcall_level+0x95/0xb0
    [   97.407286]  ? kernel_init+0x1a/0x1a0
    [   97.408401]  do_initcalls+0x3f/0x70
    [   97.409452]  kernel_init_freeable+0x16f/0x1e0
    [   97.410662]  ? rest_init+0x1f0/0x1f0
    [   97.411738]  kernel_init+0x1a/0x1a0
    [   97.412788]  ret_from_fork+0x39/0x50
    [   97.413817]  ? rest_init+0x1f0/0x1f0
    [   97.414844]  ret_from_fork_asm+0x11/0x20
    [   97.416285]  </TASK>
    [   97.417134] irq event stamp: 13437323
    [   97.418376] hardirqs last  enabled at (13437337): [<ffffffff8110bc0c>] console_unlock+0x11c/0x150
    [   97.421285] hardirqs last disabled at (13437370): [<ffffffff8110bbf1>] console_unlock+0x101/0x150
    [   97.423838] softirqs last  enabled at (13437366): [<ffffffff8108e17f>] handle_softirqs+0x23f/0x2a0
    [   97.426450] softirqs last disabled at (13437393): [<ffffffff8108e346>] __irq_exit_rcu+0x66/0xd0
    [   97.428850] ---[ end trace 0000000000000000 ]---
    
    And also, since we can not cleanup dynamic_event file, ftracetest are
    failed too.
    
    To avoid these issues, build these tests only as modules.
    
    Link: https://lore.kernel.org/all/171811263754.85078.5877446624311852525.stgit@devnote2/
    
    Fixes: 9fe41efaca08 ("tracing: Add synth event generation test module")
    Fixes: 64836248dda2 ("tracing: Add kprobe event command generation test module")
    Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
    Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 36d771ce6028b886e18a4a8956a5d23688e4e13d
Author: Christian Marangi <ansuelsmth@gmail.com>
Date:   Tue Jun 11 13:35:33 2024 +0200

    mips: bmips: BCM6358: make sure CBR is correctly set
    
    [ Upstream commit ce5cdd3b05216b704a704f466fb4c2dff3778caf ]
    
    It was discovered that some device have CBR address set to 0 causing
    kernel panic when arch_sync_dma_for_cpu_all is called.
    
    This was notice in situation where the system is booted from TP1 and
    BMIPS_GET_CBR() returns 0 instead of a valid address and
    !!(read_c0_brcm_cmt_local() & (1 << 31)); not failing.
    
    The current check whether RAC flush should be disabled or not are not
    enough hence lets check if CBR is a valid address or not.
    
    Fixes: ab327f8acdf8 ("mips: bmips: BCM6358: disable RAC flush for TP1")
    Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
    Acked-by: Florian Fainelli <florian.fainelli@broadcom.com>
    Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 7117969bff94b41a822c4d58f651bf73803d6dad
Author: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Date:   Wed May 8 15:07:00 2024 +0300

    MIPS: Routerboard 532: Fix vendor retry check code
    
    [ Upstream commit ae9daffd9028f2500c9ac1517e46d4f2b57efb80 ]
    
    read_config_dword() contains strange condition checking ret for a
    number of values. The ret variable, however, is always zero because
    config_access() never returns anything else. Thus, the retry is always
    taken until number of tries is exceeded.
    
    The code looks like it wants to check *val instead of ret to see if the
    read gave an error response.
    
    Fixes: 73b4390fb234 ("[MIPS] Routerboard 532: Support for base system")
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 15c8b2e1d6fc7ea66710c0431292b20630a24d6c
Author: Parker Newman <pnewman@connecttech.com>
Date:   Tue Apr 16 08:55:28 2024 -0400

    serial: exar: adding missing CTI and Exar PCI ids
    
    [ Upstream commit b86ae40ffcf5a16b9569b1016da4a08c4f352ca2 ]
    
    - Added Connect Tech and Exar IDs not already in pci_ids.h
    
    Signed-off-by: Parker Newman <pnewman@connecttech.com>
    Link: https://lore.kernel.org/r/7c3d8e795a864dd9b0a00353b722060dc27c4e09.1713270624.git.pnewman@connecttech.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 6c1b9fe148a4e03bbfa234267ebb89f35285814a
Author: Songyang Li <leesongyang@outlook.com>
Date:   Wed Mar 20 23:22:00 2024 +0800

    MIPS: Octeon: Add PCIe link status check
    
    [ Upstream commit 29b83a64df3b42c88c0338696feb6fdcd7f1f3b7 ]
    
    The standard PCIe configuration read-write interface is used to
    access the configuration space of the peripheral PCIe devices
    of the mips processor after the PCIe link surprise down, it can
    generate kernel panic caused by "Data bus error". So it is
    necessary to add PCIe link status check for system protection.
    When the PCIe link is down or in training, assigning a value
    of 0 to the configuration address can prevent read-write behavior
    to the configuration space of peripheral PCIe devices, thereby
    preventing kernel panic.
    
    Signed-off-by: Songyang Li <leesongyang@outlook.com>
    Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit c59f79e2b47763060abae208485b983f9eb52e0f
Author: Mario Limonciello <mario.limonciello@amd.com>
Date:   Thu Mar 7 10:37:09 2024 -0600

    PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
    
    [ Upstream commit 256df20c590bf0e4d63ac69330cf23faddac3e08 ]
    
    Hewlett-Packard HP Pavilion 17 Notebook PC/1972 is an Intel Ivy Bridge
    system with a muxless AMD Radeon dGPU.  Attempting to use the dGPU fails
    with the following sequence:
    
      ACPI Error: Aborting method \AMD3._ON due to previous error (AE_AML_LOOP_TIMEOUT) (20230628/psparse-529)
      radeon 0000:01:00.0: not ready 1023ms after resume; waiting
      radeon 0000:01:00.0: not ready 2047ms after resume; waiting
      radeon 0000:01:00.0: not ready 4095ms after resume; waiting
      radeon 0000:01:00.0: not ready 8191ms after resume; waiting
      radeon 0000:01:00.0: not ready 16383ms after resume; waiting
      radeon 0000:01:00.0: not ready 32767ms after resume; waiting
      radeon 0000:01:00.0: not ready 65535ms after resume; giving up
      radeon 0000:01:00.0: Unable to change power state from D3cold to D0, device inaccessible
    
    The issue is that the Root Port the dGPU is connected to can't handle the
    transition from D3cold to D0 so the dGPU can't properly exit runtime PM.
    
    The existing logic in pci_bridge_d3_possible() checks for systems that are
    newer than 2015 to decide that D3 is safe.  This would nominally work for
    an Ivy Bridge system (which was discontinued in 2015), but this system
    appears to have continued to receive BIOS updates until 2017 and so this
    existing logic doesn't appropriately capture it.
    
    Add the system to bridge_d3_blacklist to prevent D3cold from being used.
    
    Link: https://lore.kernel.org/r/20240307163709.323-1-mario.limonciello@amd.com
    Reported-by: Eric Heintzmann <heintzmann.eric@free.fr>
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3229
    Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Tested-by: Eric Heintzmann <heintzmann.eric@free.fr>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit bffff80d103c37d93916ff2ee616c4e17f9d79b5
Author: Roman Smirnov <r.smirnov@omp.ru>
Date:   Wed Mar 27 16:27:55 2024 +0300

    udf: udftime: prevent overflow in udf_disk_stamp_to_time()
    
    [ Upstream commit 3b84adf460381169c085e4bc09e7b57e9e16db0a ]
    
    An overflow can occur in a situation where src.centiseconds
    takes the value of 255. This situation is unlikely, but there
    is no validation check anywere in the code.
    
    Found by Linux Verification Center (linuxtesting.org) with Svace.
    
    Suggested-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Roman Smirnov <r.smirnov@omp.ru>
    Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Message-Id: <20240327132755.13945-1-r.smirnov@omp.ru>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 04736c1bc32197f7d859e01a96ae80a16659931d
Author: Alex Henrie <alexhenrie24@gmail.com>
Date:   Tue Mar 26 09:07:11 2024 -0600

    usb: misc: uss720: check for incompatible versions of the Belkin F5U002
    
    [ Upstream commit 3295f1b866bfbcabd625511968e8a5c541f9ab32 ]
    
    The incompatible device in my possession has a sticker that says
    "F5U002 Rev 2" and "P80453-B", and lsusb identifies it as
    "050d:0002 Belkin Components IEEE-1284 Controller". There is a bug
    report from 2007 from Michael Trausch who was seeing the exact same
    errors that I saw in 2024 trying to use this cable.
    
    Link: https://lore.kernel.org/all/46DE5830.9060401@trausch.us/
    Signed-off-by: Alex Henrie <alexhenrie24@gmail.com>
    Link: https://lore.kernel.org/r/20240326150723.99939-5-alexhenrie24@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 38a82c8d00638bb642bef787eb1d5e0e4d3b7d71
Author: Yunlei He <heyunlei@oppo.com>
Date:   Tue Mar 26 14:10:43 2024 +0800

    f2fs: remove clear SB_INLINECRYPT flag in default_options
    
    [ Upstream commit ac5eecf481c29942eb9a862e758c0c8b68090c33 ]
    
    In f2fs_remount, SB_INLINECRYPT flag will be clear and re-set.
    If create new file or open file during this gap, these files
    will not use inlinecrypt. Worse case, it may lead to data
    corruption if wrappedkey_v0 is enable.
    
    Thread A:                               Thread B:
    
    -f2fs_remount                           -f2fs_file_open or f2fs_new_inode
      -default_options
            <- clear SB_INLINECRYPT flag
    
                                              -fscrypt_select_encryption_impl
    
      -parse_options
            <- set SB_INLINECRYPT again
    
    Signed-off-by: Yunlei He <heyunlei@oppo.com>
    Reviewed-by: Chao Yu <chao@kernel.org>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit d8481016c295be548c43f77f0d4fbbd64c75191e
Author: Aleksandr Aprelkov <aaprelkov@usergate.com>
Date:   Wed Apr 3 12:37:59 2024 +0700

    iommu/arm-smmu-v3: Free MSIs in case of ENOMEM
    
    [ Upstream commit 80fea979dd9d48d67c5b48d2f690c5da3e543ebd ]
    
    If devm_add_action() returns -ENOMEM, then MSIs are allocated but not
    not freed on teardown. Use devm_add_action_or_reset() instead to keep
    the static analyser happy.
    
    Found by Linux Verification Center (linuxtesting.org) with SVACE.
    
    Signed-off-by: Aleksandr Aprelkov <aaprelkov@usergate.com>
    Link: https://lore.kernel.org/r/20240403053759.643164-1-aaprelkov@usergate.com
    [will: Tweak commit message, remove warning message]
    Signed-off-by: Will Deacon <will@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 449d55871cae6e8479408849fd8eb814e6ec8e82
Author: Tzung-Bi Shih <tzungbi@kernel.org>
Date:   Mon Apr 1 11:00:49 2024 +0800

    power: supply: cros_usbpd: provide ID table for avoiding fallback match
    
    [ Upstream commit 0f8678c34cbfdc63569a9b0ede1fe235ec6ec693 ]
    
    Instead of using fallback driver name match, provide ID table[1] for the
    primary match.
    
    [1]: https://elixir.bootlin.com/linux/v6.8/source/drivers/base/platform.c#L1353
    
    Reviewed-by: Benson Leung <bleung@chromium.org>
    Reviewed-by: Prashant Malani <pmalani@chromium.org>
    Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
    Link: https://lore.kernel.org/r/20240401030052.2887845-4-tzungbi@kernel.org
    Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 1939648b3aca1c81a955eec1fcafc533fddedee8
Author: Michael Ellerman <mpe@ellerman.id.au>
Date:   Fri May 3 17:56:18 2024 +1000

    powerpc/io: Avoid clang null pointer arithmetic warnings
    
    [ Upstream commit 03c0f2c2b2220fc9cf8785cd7b61d3e71e24a366 ]
    
    With -Wextra clang warns about pointer arithmetic using a null pointer.
    When building with CONFIG_PCI=n, that triggers a warning in the IO
    accessors, eg:
    
      In file included from linux/arch/powerpc/include/asm/io.h:672:
      linux/arch/powerpc/include/asm/io-defs.h:23:1: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
         23 | DEF_PCI_AC_RET(inb, u8, (unsigned long port), (port), pio, port)
            | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      ...
      linux/arch/powerpc/include/asm/io.h:591:53: note: expanded from macro '__do_inb'
        591 | #define __do_inb(port)          readb((PCI_IO_ADDR)_IO_BASE + port);
            |                                       ~~~~~~~~~~~~~~~~~~~~~ ^
    
    That is because when CONFIG_PCI=n, _IO_BASE is defined as 0.
    
    Although _IO_BASE is defined as plain 0, the cast (PCI_IO_ADDR) converts
    it to void * before the addition with port happens.
    
    Instead the addition can be done first, and then the cast. The resulting
    value will be the same, but avoids the warning, and also avoids void
    pointer arithmetic which is apparently non-standard.
    
    Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
    Closes: https://lore.kernel.org/all/CA+G9fYtEh8zmq8k8wE-8RZwW-Qr927RLTn+KqGnq1F=ptaaNsA@mail.gmail.com
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Link: https://msgid.link/20240503075619.394467-1-mpe@ellerman.id.au
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a8c988d752b3d98d5cc1e3929c519a55ef55426c
Author: Nathan Lynch <nathanl@linux.ibm.com>
Date:   Mon Apr 8 09:08:31 2024 -0500

    powerpc/pseries: Enforce hcall result buffer validity and size
    
    [ Upstream commit ff2e185cf73df480ec69675936c4ee75a445c3e4 ]
    
    plpar_hcall(), plpar_hcall9(), and related functions expect callers to
    provide valid result buffers of certain minimum size. Currently this
    is communicated only through comments in the code and the compiler has
    no idea.
    
    For example, if I write a bug like this:
    
      long retbuf[PLPAR_HCALL_BUFSIZE]; // should be PLPAR_HCALL9_BUFSIZE
      plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, ...);
    
    This compiles with no diagnostics emitted, but likely results in stack
    corruption at runtime when plpar_hcall9() stores results past the end
    of the array. (To be clear this is a contrived example and I have not
    found a real instance yet.)
    
    To make this class of error less likely, we can use explicitly-sized
    array parameters instead of pointers in the declarations for the hcall
    APIs. When compiled with -Warray-bounds[1], the code above now
    provokes a diagnostic like this:
    
    error: array argument is too small;
    is of size 32, callee requires at least 72 [-Werror,-Warray-bounds]
       60 |                 plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf,
          |                 ^                                   ~~~~~~
    
    [1] Enabled for LLVM builds but not GCC for now. See commit
        0da6e5fd6c37 ("gcc: disable '-Warray-bounds' for gcc-13 too") and
        related changes.
    
    Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Link: https://msgid.link/20240408-pseries-hvcall-retbuf-v1-1-ebc73d7253cf@linux.ibm.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 03e7b2f7ae4c0ae5fb8e4e2454ba4008877f196a
Author: Erico Nunes <nunes.erico@gmail.com>
Date:   Fri Apr 5 17:29:51 2024 +0200

    drm/lima: mask irqs in timeout path before hard reset
    
    [ Upstream commit a421cc7a6a001b70415aa4f66024fa6178885a14 ]
    
    There is a race condition in which a rendering job might take just long
    enough to trigger the drm sched job timeout handler but also still
    complete before the hard reset is done by the timeout handler.
    This runs into race conditions not expected by the timeout handler.
    In some very specific cases it currently may result in a refcount
    imbalance on lima_pm_idle, with a stack dump such as:
    
    [10136.669170] WARNING: CPU: 0 PID: 0 at drivers/gpu/drm/lima/lima_devfreq.c:205 lima_devfreq_record_idle+0xa0/0xb0
    ...
    [10136.669459] pc : lima_devfreq_record_idle+0xa0/0xb0
    ...
    [10136.669628] Call trace:
    [10136.669634]  lima_devfreq_record_idle+0xa0/0xb0
    [10136.669646]  lima_sched_pipe_task_done+0x5c/0xb0
    [10136.669656]  lima_gp_irq_handler+0xa8/0x120
    [10136.669666]  __handle_irq_event_percpu+0x48/0x160
    [10136.669679]  handle_irq_event+0x4c/0xc0
    
    We can prevent that race condition entirely by masking the irqs at the
    beginning of the timeout handler, at which point we give up on waiting
    for that job entirely.
    The irqs will be enabled again at the next hard reset which is already
    done as a recovery by the timeout handler.
    
    Signed-off-by: Erico Nunes <nunes.erico@gmail.com>
    Reviewed-by: Qiang Yu <yuq825@gmail.com>
    Signed-off-by: Qiang Yu <yuq825@gmail.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20240405152951.1531555-4-nunes.erico@gmail.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit e12c363cf5fdd0decef467ee2c0069dcad267679
Author: Erico Nunes <nunes.erico@gmail.com>
Date:   Fri Apr 5 17:29:49 2024 +0200

    drm/lima: add mask irq callback to gp and pp
    
    [ Upstream commit 49c13b4d2dd4a831225746e758893673f6ae961c ]
    
    This is needed because we want to reset those devices in device-agnostic
    code such as lima_sched.
    In particular, masking irqs will be useful before a hard reset to
    prevent race conditions.
    
    Signed-off-by: Erico Nunes <nunes.erico@gmail.com>
    Signed-off-by: Qiang Yu <yuq825@gmail.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20240405152951.1531555-2-nunes.erico@gmail.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 2db63bf7d87c88bc6863c640c96811c44551b481
Author: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Date:   Thu Apr 11 17:03:38 2024 -0500

    ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14
    
    [ Upstream commit 4fee07fbf47d2a5f1065d985459e5ce7bf7969f0 ]
    
    The default JD1 does not seem to work, use JD2 instead.
    
    Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    Link: https://lore.kernel.org/r/20240411220347.131267-4-pierre-louis.bossart@linux.intel.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b4291f58a9cfd232d378034e8207889b35d5ad99
Author: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Date:   Mon Feb 12 16:51:59 2024 -0500

    drm/amd/display: Exit idle optimizations before HDCP execution
    
    [ Upstream commit f30a3bea92bdab398531129d187629fb1d28f598 ]
    
    [WHY]
    PSP can access DCN registers during command submission and we need
    to ensure that DCN is not in PG before doing so.
    
    [HOW]
    Add a callback to DM to lock and notify DC for idle optimization exit.
    It can't be DC directly because of a potential race condition with the
    link protection thread and the rest of DM operation.
    
    Cc: Mario Limonciello <mario.limonciello@amd.com>
    Cc: Alex Deucher <alexander.deucher@amd.com>
    Reviewed-by: Charlene Liu <charlene.liu@amd.com>
    Acked-by: Alex Hung <alex.hung@amd.com>
    Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
    Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 52d4cfa56b5fc79345394a0f5ca4ba5f9b2e5e8c
Author: Uri Arev <me@wantyapps.xyz>
Date:   Sat Apr 6 00:42:24 2024 +0300

    Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
    
    [ Upstream commit 68aa21054ec3a1a313af90a5f95ade16c3326d20 ]
    
    This fixes some CHECKs reported by the checkpatch script.
    
    Issues reported in ath3k.c:
    -------
    ath3k.c
    -------
    CHECK: Please don't use multiple blank lines
    +
    +
    
    CHECK: Blank lines aren't necessary after an open brace '{'
    +static const struct usb_device_id ath3k_blist_tbl[] = {
    +
    
    CHECK: Alignment should match open parenthesis
    +static int ath3k_load_firmware(struct usb_device *udev,
    +                               const struct firmware *firmware)
    
    CHECK: Alignment should match open parenthesis
    +               err = usb_bulk_msg(udev, pipe, send_buf, size,
    +                                       &len, 3000);
    
    CHECK: Unnecessary parentheses around 'len != size'
    +               if (err || (len != size)) {
    
    CHECK: Alignment should match open parenthesis
    +static int ath3k_get_version(struct usb_device *udev,
    +                       struct ath3k_version *version)
    
    CHECK: Alignment should match open parenthesis
    +static int ath3k_load_fwfile(struct usb_device *udev,
    +               const struct firmware *firmware)
    
    CHECK: Alignment should match open parenthesis
    +               err = usb_bulk_msg(udev, pipe, send_buf, size,
    +                                       &len, 3000);
    
    CHECK: Unnecessary parentheses around 'len != size'
    +               if (err || (len != size)) {
    
    CHECK: Blank lines aren't necessary after an open brace '{'
    +       switch (fw_version.ref_clock) {
    +
    
    CHECK: Alignment should match open parenthesis
    +       snprintf(filename, ATH3K_NAME_LEN, "ar3k/ramps_0x%08x_%d%s",
    +               le32_to_cpu(fw_version.rom_version), clk_value, ".dfu");
    
    CHECK: Alignment should match open parenthesis
    +static int ath3k_probe(struct usb_interface *intf,
    +                       const struct usb_device_id *id)
    
    CHECK: Alignment should match open parenthesis
    +                       BT_ERR("Firmware file \"%s\" not found",
    +                                                       ATH3K_FIRMWARE);
    
    CHECK: Alignment should match open parenthesis
    +               BT_ERR("Firmware file \"%s\" request failed (err=%d)",
    +                                               ATH3K_FIRMWARE, ret);
    
    total: 0 errors, 0 warnings, 14 checks, 540 lines checked
    
    Signed-off-by: Uri Arev <me@wantyapps.xyz>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 6fdc98bcc66eafddff91d23d626f6a210242eda5
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon May 6 16:08:50 2024 +0200

    ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7
    
    [ Upstream commit c901f63dc142c48326931f164f787dfff69273d9 ]
    
    Lenovo Slim 7 16ARH7 is a machine with switchable graphics between AMD
    and Nvidia, and the backlight can't be adjusted properly unless
    acpi_backlight=native is passed.  Although nvidia-wmi-backlight is
    present and loaded, this doesn't work as expected at all.
    
    For making it working as default, add the corresponding quirk entry
    with a DMI matching "LENOVO" "82UX".
    
    Link: https://bugzilla.suse.com/show_bug.cgi?id=1217750
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 6f6cb07482430c1e7ebdb2ebbc0ededbef5f6872
Author: Sean O'Brien <seobrien@chromium.org>
Date:   Mon Apr 29 18:08:05 2024 +0000

    HID: Add quirk for Logitech Casa touchpad
    
    [ Upstream commit dd2c345a94cfa3873cc20db87387ee509c345c1b ]
    
    This device sometimes doesn't send touch release signals when moving
    from >=4 fingers to <4 fingers. Using MT_QUIRK_NOT_SEEN_MEANS_UP instead
    of MT_QUIRK_ALWAYS_VALID makes sure that no touches become stuck.
    
    MT_QUIRK_FORCE_MULTI_INPUT is not necessary for this device, but does no
    harm.
    
    Signed-off-by: Sean O'Brien <seobrien@chromium.org>
    Signed-off-by: Jiri Kosina <jkosina@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 43c0ca793a18578a0f5b305dd77fcf7ed99f1265
Author: Breno Leitao <leitao@debian.org>
Date:   Mon Apr 29 03:04:33 2024 -0700

    netpoll: Fix race condition in netpoll_owner_active
    
    [ Upstream commit c2e6a872bde9912f1a7579639c5ca3adf1003916 ]
    
    KCSAN detected a race condition in netpoll:
    
            BUG: KCSAN: data-race in net_rx_action / netpoll_send_skb
            write (marked) to 0xffff8881164168b0 of 4 bytes by interrupt on cpu 10:
            net_rx_action (./include/linux/netpoll.h:90 net/core/dev.c:6712 net/core/dev.c:6822)
    <snip>
            read to 0xffff8881164168b0 of 4 bytes by task 1 on cpu 2:
            netpoll_send_skb (net/core/netpoll.c:319 net/core/netpoll.c:345 net/core/netpoll.c:393)
            netpoll_send_udp (net/core/netpoll.c:?)
    <snip>
            value changed: 0x0000000a -> 0xffffffff
    
    This happens because netpoll_owner_active() needs to check if the
    current CPU is the owner of the lock, touching napi->poll_owner
    non atomically. The ->poll_owner field contains the current CPU holding
    the lock.
    
    Use an atomic read to check if the poll owner is the current CPU.
    
    Signed-off-by: Breno Leitao <leitao@debian.org>
    Link: https://lore.kernel.org/r/20240429100437.3487432-1-leitao@debian.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 1b577bb1cbe765afcc3840b3dcc8cce7dc8e27e9
Author: Kunwu Chan <chentao@kylinos.cn>
Date:   Tue Apr 23 16:21:02 2024 +0800

    kselftest: arm64: Add a null pointer check
    
    [ Upstream commit 80164282b3620a3cb73de6ffda5592743e448d0e ]
    
    There is a 'malloc' call, which can be unsuccessful.
    This patch will add the malloc failure checking
    to avoid possible null dereference and give more information
    about test fail reasons.
    
    Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
    Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
    Link: https://lore.kernel.org/r/20240423082102.2018886-1-chentao@kylinos.cn
    Signed-off-by: Will Deacon <will@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 144d76a676b630e321556965011b00e2de0b40a7
Author: Manish Rangankar <mrangankar@marvell.com>
Date:   Mon Apr 15 12:51:55 2024 +0530

    scsi: qedi: Fix crash while reading debugfs attribute
    
    [ Upstream commit 28027ec8e32ecbadcd67623edb290dad61e735b5 ]
    
    The qedi_dbg_do_not_recover_cmd_read() function invokes sprintf() directly
    on a __user pointer, which results into the crash.
    
    To fix this issue, use a small local stack buffer for sprintf() and then
    call simple_read_from_buffer(), which in turns make the copy_to_user()
    call.
    
    BUG: unable to handle page fault for address: 00007f4801111000
    PGD 8000000864df6067 P4D 8000000864df6067 PUD 864df7067 PMD 846028067 PTE 0
    Oops: 0002 [#1] PREEMPT SMP PTI
    Hardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 06/15/2023
    RIP: 0010:memcpy_orig+0xcd/0x130
    RSP: 0018:ffffb7a18c3ffc40 EFLAGS: 00010202
    RAX: 00007f4801111000 RBX: 00007f4801111000 RCX: 000000000000000f
    RDX: 000000000000000f RSI: ffffffffc0bfd7a0 RDI: 00007f4801111000
    RBP: ffffffffc0bfd7a0 R08: 725f746f6e5f6f64 R09: 3d7265766f636572
    R10: ffffb7a18c3ffd08 R11: 0000000000000000 R12: 00007f4881110fff
    R13: 000000007fffffff R14: ffffb7a18c3ffca0 R15: ffffffffc0bfd7af
    FS:  00007f480118a740(0000) GS:ffff98e38af00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007f4801111000 CR3: 0000000864b8e001 CR4: 00000000007706e0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    PKRU: 55555554
    Call Trace:
     <TASK>
     ? __die_body+0x1a/0x60
     ? page_fault_oops+0x183/0x510
     ? exc_page_fault+0x69/0x150
     ? asm_exc_page_fault+0x22/0x30
     ? memcpy_orig+0xcd/0x130
     vsnprintf+0x102/0x4c0
     sprintf+0x51/0x80
     qedi_dbg_do_not_recover_cmd_read+0x2f/0x50 [qedi 6bcfdeeecdea037da47069eca2ba717c84a77324]
     full_proxy_read+0x50/0x80
     vfs_read+0xa5/0x2e0
     ? folio_add_new_anon_rmap+0x44/0xa0
     ? set_pte_at+0x15/0x30
     ? do_pte_missing+0x426/0x7f0
     ksys_read+0xa5/0xe0
     do_syscall_64+0x58/0x80
     ? __count_memcg_events+0x46/0x90
     ? count_memcg_event_mm+0x3d/0x60
     ? handle_mm_fault+0x196/0x2f0
     ? do_user_addr_fault+0x267/0x890
     ? exc_page_fault+0x69/0x150
     entry_SYSCALL_64_after_hwframe+0x72/0xdc
    RIP: 0033:0x7f4800f20b4d
    
    Tested-by: Martin Hoyer <mhoyer@redhat.com>
    Reviewed-by: John Meneghini <jmeneghi@redhat.com>
    Signed-off-by: Manish Rangankar <mrangankar@marvell.com>
    Link: https://lore.kernel.org/r/20240415072155.30840-1-mrangankar@marvell.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 96941f29ebcc1e9cbf570dc903f30374909562f5
Author: Wander Lairson Costa <wander@redhat.com>
Date:   Thu Apr 11 11:13:46 2024 -0300

    drop_monitor: replace spin_lock by raw_spin_lock
    
    [ Upstream commit f1e197a665c2148ebc25fe09c53689e60afea195 ]
    
    trace_drop_common() is called with preemption disabled, and it acquires
    a spin_lock. This is problematic for RT kernels because spin_locks are
    sleeping locks in this configuration, which causes the following splat:
    
    BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
    in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 449, name: rcuc/47
    preempt_count: 1, expected: 0
    RCU nest depth: 2, expected: 2
    5 locks held by rcuc/47/449:
     #0: ff1100086ec30a60 ((softirq_ctrl.lock)){+.+.}-{2:2}, at: __local_bh_disable_ip+0x105/0x210
     #1: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: rt_spin_lock+0xbf/0x130
     #2: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: __local_bh_disable_ip+0x11c/0x210
     #3: ffffffffb394a160 (rcu_callback){....}-{0:0}, at: rcu_do_batch+0x360/0xc70
     #4: ff1100086ee07520 (&data->lock){+.+.}-{2:2}, at: trace_drop_common.constprop.0+0xb5/0x290
    irq event stamp: 139909
    hardirqs last  enabled at (139908): [<ffffffffb1df2b33>] _raw_spin_unlock_irqrestore+0x63/0x80
    hardirqs last disabled at (139909): [<ffffffffb19bd03d>] trace_drop_common.constprop.0+0x26d/0x290
    softirqs last  enabled at (139892): [<ffffffffb07a1083>] __local_bh_enable_ip+0x103/0x170
    softirqs last disabled at (139898): [<ffffffffb0909b33>] rcu_cpu_kthread+0x93/0x1f0
    Preemption disabled at:
    [<ffffffffb1de786b>] rt_mutex_slowunlock+0xab/0x2e0
    CPU: 47 PID: 449 Comm: rcuc/47 Not tainted 6.9.0-rc2-rt1+ #7
    Hardware name: Dell Inc. PowerEdge R650/0Y2G81, BIOS 1.6.5 04/15/2022
    Call Trace:
     <TASK>
     dump_stack_lvl+0x8c/0xd0
     dump_stack+0x14/0x20
     __might_resched+0x21e/0x2f0
     rt_spin_lock+0x5e/0x130
     ? trace_drop_common.constprop.0+0xb5/0x290
     ? skb_queue_purge_reason.part.0+0x1bf/0x230
     trace_drop_common.constprop.0+0xb5/0x290
     ? preempt_count_sub+0x1c/0xd0
     ? _raw_spin_unlock_irqrestore+0x4a/0x80
     ? __pfx_trace_drop_common.constprop.0+0x10/0x10
     ? rt_mutex_slowunlock+0x26a/0x2e0
     ? skb_queue_purge_reason.part.0+0x1bf/0x230
     ? __pfx_rt_mutex_slowunlock+0x10/0x10
     ? skb_queue_purge_reason.part.0+0x1bf/0x230
     trace_kfree_skb_hit+0x15/0x20
     trace_kfree_skb+0xe9/0x150
     kfree_skb_reason+0x7b/0x110
     skb_queue_purge_reason.part.0+0x1bf/0x230
     ? __pfx_skb_queue_purge_reason.part.0+0x10/0x10
     ? mark_lock.part.0+0x8a/0x520
    ...
    
    trace_drop_common() also disables interrupts, but this is a minor issue
    because we could easily replace it with a local_lock.
    
    Replace the spin_lock with raw_spin_lock to avoid sleeping in atomic
    context.
    
    Signed-off-by: Wander Lairson Costa <wander@redhat.com>
    Reported-by: Hu Chunyu <chuhu@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a720d71dd494320b4452b94221d05f498fe12d04
Author: Eric Dumazet <edumazet@google.com>
Date:   Fri Apr 5 11:49:39 2024 +0000

    af_packet: avoid a false positive warning in packet_setsockopt()
    
    [ Upstream commit 86d43e2bf93ccac88ef71cee36a23282ebd9e427 ]
    
    Although the code is correct, the following line
    
            copy_from_sockptr(&req_u.req, optval, len));
    
    triggers this warning :
    
    memcpy: detected field-spanning write (size 28) of single field "dst" at include/linux/sockptr.h:49 (size 16)
    
    Refactor the code to be more explicit.
    
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Reviewed-by: Willem de Bruijn <willemb@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b5a53d14dd83c174413da09f9a13c4c1cdf884d3
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Thu Apr 4 09:35:59 2024 +0300

    wifi: ath9k: work around memset overflow warning
    
    [ Upstream commit 61752ac69b69ed2e04444d090f6917c77ab36d42 ]
    
    gcc-9 and some other older versions produce a false-positive warning
    for zeroing two fields
    
    In file included from include/linux/string.h:369,
                     from drivers/net/wireless/ath/ath9k/main.c:18:
    In function 'fortify_memset_chk',
        inlined from 'ath9k_ps_wakeup' at drivers/net/wireless/ath/ath9k/main.c:140:3:
    include/linux/fortify-string.h:462:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
      462 |                         __write_overflow_field(p_size_field, size);
          |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    Using a struct_group seems to reliably avoid the warning and
    not make the code much uglier. The combined memset() should even
    save a couple of cpu cycles.
    
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
    Link: https://msgid.link/20240328135509.3755090-3-arnd@kernel.org
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 82cdea8f3af1e36543c937df963d108c60bea030
Author: Eric Dumazet <edumazet@google.com>
Date:   Sat Mar 30 15:54:38 2024 +0000

    batman-adv: bypass empty buckets in batadv_purge_orig_ref()
    
    [ Upstream commit 40dc8ab605894acae1473e434944924a22cfaaa0 ]
    
    Many syzbot reports are pointing to soft lockups in
    batadv_purge_orig_ref() [1]
    
    Root cause is unknown, but we can avoid spending too much
    time there and perhaps get more interesting reports.
    
    [1]
    
    watchdog: BUG: soft lockup - CPU#0 stuck for 27s! [kworker/u4:6:621]
    Modules linked in:
    irq event stamp: 6182794
     hardirqs last  enabled at (6182793): [<ffff8000801dae10>] __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386
     hardirqs last disabled at (6182794): [<ffff80008ad66a78>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]
     hardirqs last disabled at (6182794): [<ffff80008ad66a78>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551
     softirqs last  enabled at (6182792): [<ffff80008aab71c4>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
     softirqs last  enabled at (6182792): [<ffff80008aab71c4>] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287
     softirqs last disabled at (6182790): [<ffff80008aab61dc>] spin_lock_bh include/linux/spinlock.h:356 [inline]
     softirqs last disabled at (6182790): [<ffff80008aab61dc>] batadv_purge_orig_ref+0x164/0x1228 net/batman-adv/originator.c:1271
    CPU: 0 PID: 621 Comm: kworker/u4:6 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
    Workqueue: bat_events batadv_purge_orig
    pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
     pc : should_resched arch/arm64/include/asm/preempt.h:79 [inline]
     pc : __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:388
     lr : __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386
    sp : ffff800099007970
    x29: ffff800099007980 x28: 1fffe00018fce1bd x27: dfff800000000000
    x26: ffff0000d2620008 x25: ffff0000c7e70de8 x24: 0000000000000001
    x23: 1fffe00018e57781 x22: dfff800000000000 x21: ffff80008aab71c4
    x20: ffff0001b40136c0 x19: ffff0000c72bbc08 x18: 1fffe0001a817bb0
    x17: ffff800125414000 x16: ffff80008032116c x15: 0000000000000001
    x14: 1fffe0001ee9d610 x13: 0000000000000000 x12: 0000000000000003
    x11: 0000000000000000 x10: 0000000000ff0100 x9 : 0000000000000000
    x8 : 00000000005e5789 x7 : ffff80008aab61dc x6 : 0000000000000000
    x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
    x2 : 0000000000000006 x1 : 0000000000000080 x0 : ffff800125414000
    Call trace:
      __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline]
      arch_local_irq_enable arch/arm64/include/asm/irqflags.h:49 [inline]
      __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:386
      __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
      _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:210
      spin_unlock_bh include/linux/spinlock.h:396 [inline]
      batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287
      batadv_purge_orig+0x20/0x70 net/batman-adv/originator.c:1300
      process_one_work+0x694/0x1204 kernel/workqueue.c:2633
      process_scheduled_works kernel/workqueue.c:2706 [inline]
      worker_thread+0x938/0xef4 kernel/workqueue.c:2787
      kthread+0x288/0x310 kernel/kthread.c:388
      ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
    Sending NMI from CPU 0 to CPUs 1:
    NMI backtrace for cpu 1
    CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
    pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
     pc : arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:51
     lr : default_idle_call+0xf8/0x128 kernel/sched/idle.c:103
    sp : ffff800093a17d30
    x29: ffff800093a17d30 x28: dfff800000000000 x27: 1ffff00012742fb4
    x26: ffff80008ec9d000 x25: 0000000000000000 x24: 0000000000000002
    x23: 1ffff00011d93a74 x22: ffff80008ec9d3a0 x21: 0000000000000000
    x20: ffff0000c19dbc00 x19: ffff8000802d0fd8 x18: 1fffe00036804396
    x17: ffff80008ec9d000 x16: ffff8000802d089c x15: 0000000000000001
    x14: 1fffe00036805f10 x13: 0000000000000000 x12: 0000000000000003
    x11: 0000000000000001 x10: 0000000000000003 x9 : 0000000000000000
    x8 : 00000000000ce8d1 x7 : ffff8000804609e4 x6 : 0000000000000000
    x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008ad6aac0
    x2 : 0000000000000000 x1 : ffff80008aedea60 x0 : ffff800125436000
    Call trace:
      __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline]
      arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49
      cpuidle_idle_call kernel/sched/idle.c:170 [inline]
      do_idle+0x1f0/0x4e8 kernel/sched/idle.c:312
      cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:410
      secondary_start_kernel+0x198/0x1c0 arch/arm64/kernel/smp.c:272
      __secondary_switched+0xb8/0xbc arch/arm64/kernel/head.S:404
    
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: Sven Eckelmann <sven@narfation.org>
    Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit e1c3f5fb1be86304c253f189b8f2577708bfeda1
Author: Yonghong Song <yonghong.song@linux.dev>
Date:   Thu Mar 21 23:13:53 2024 -0700

    selftests/bpf: Fix flaky test btf_map_in_map/lookup_update
    
    [ Upstream commit 14bb1e8c8d4ad5d9d2febb7d19c70a3cf536e1e5 ]
    
    Recently, I frequently hit the following test failure:
    
      [root@arch-fb-vm1 bpf]# ./test_progs -n 33/1
      test_lookup_update:PASS:skel_open 0 nsec
      [...]
      test_lookup_update:PASS:sync_rcu 0 nsec
      test_lookup_update:FAIL:map1_leak inner_map1 leaked!
      #33/1    btf_map_in_map/lookup_update:FAIL
      #33      btf_map_in_map:FAIL
    
    In the test, after map is closed and then after two rcu grace periods,
    it is assumed that map_id is not available to user space.
    
    But the above assumption cannot be guaranteed. After zero or one
    or two rcu grace periods in different siturations, the actual
    freeing-map-work is put into a workqueue. Later on, when the work
    is dequeued, the map will be actually freed.
    See bpf_map_put() in kernel/bpf/syscall.c.
    
    By using workqueue, there is no ganrantee that map will be actually
    freed after a couple of rcu grace periods. This patch removed
    such map leak detection and then the test can pass consistently.
    
    Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Link: https://lore.kernel.org/bpf/20240322061353.632136-1-yonghong.song@linux.dev
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 973b32034ce1e10dc750a441f986ca52aed9bef6
Author: Alessandro Carminati (Red Hat) <alessandro.carminati@gmail.com>
Date:   Thu Mar 14 10:59:11 2024 +0000

    selftests/bpf: Prevent client connect before server bind in test_tc_tunnel.sh
    
    [ Upstream commit f803bcf9208a2540acb4c32bdc3616673169f490 ]
    
    In some systems, the netcat server can incur in delay to start listening.
    When this happens, the test can randomly fail in various points.
    This is an example error message:
    
       # ip gre none gso
       # encap 192.168.1.1 to 192.168.1.2, type gre, mac none len 2000
       # test basic connectivity
       # Ncat: Connection refused.
    
    The issue stems from a race condition between the netcat client and server.
    The test author had addressed this problem by implementing a sleep, which
    I have removed in this patch.
    This patch introduces a function capable of sleeping for up to two seconds.
    However, it can terminate the waiting period early if the port is reported
    to be listening.
    
    Signed-off-by: Alessandro Carminati (Red Hat) <alessandro.carminati@gmail.com>
    Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
    Link: https://lore.kernel.org/bpf/20240314105911.213411-1-alessandro.carminati@gmail.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 58706e482bf45c4db48b0c53aba2468c97adda24
Author: Justin Stitt <justinstitt@google.com>
Date:   Tue May 7 03:53:49 2024 +0000

    block/ioctl: prefer different overflow check
    
    [ Upstream commit ccb326b5f9e623eb7f130fbbf2505ec0e2dcaff9 ]
    
    Running syzkaller with the newly reintroduced signed integer overflow
    sanitizer shows this report:
    
    [   62.982337] ------------[ cut here ]------------
    [   62.985692] cgroup: Invalid name
    [   62.986211] UBSAN: signed-integer-overflow in ../block/ioctl.c:36:46
    [   62.989370] 9pnet_fd: p9_fd_create_tcp (7343): problem connecting socket to 127.0.0.1
    [   62.992992] 9223372036854775807 + 4095 cannot be represented in type 'long long'
    [   62.997827] 9pnet_fd: p9_fd_create_tcp (7345): problem connecting socket to 127.0.0.1
    [   62.999369] random: crng reseeded on system resumption
    [   63.000634] GUP no longer grows the stack in syz-executor.2 (7353): 20002000-20003000 (20001000)
    [   63.000668] CPU: 0 PID: 7353 Comm: syz-executor.2 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1
    [   63.000677] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    [   63.000682] Call Trace:
    [   63.000686]  <TASK>
    [   63.000731]  dump_stack_lvl+0x93/0xd0
    [   63.000919]  __get_user_pages+0x903/0xd30
    [   63.001030]  __gup_longterm_locked+0x153e/0x1ba0
    [   63.001041]  ? _raw_read_unlock_irqrestore+0x17/0x50
    [   63.001072]  ? try_get_folio+0x29c/0x2d0
    [   63.001083]  internal_get_user_pages_fast+0x1119/0x1530
    [   63.001109]  iov_iter_extract_pages+0x23b/0x580
    [   63.001206]  bio_iov_iter_get_pages+0x4de/0x1220
    [   63.001235]  iomap_dio_bio_iter+0x9b6/0x1410
    [   63.001297]  __iomap_dio_rw+0xab4/0x1810
    [   63.001316]  iomap_dio_rw+0x45/0xa0
    [   63.001328]  ext4_file_write_iter+0xdde/0x1390
    [   63.001372]  vfs_write+0x599/0xbd0
    [   63.001394]  ksys_write+0xc8/0x190
    [   63.001403]  do_syscall_64+0xd4/0x1b0
    [   63.001421]  ? arch_exit_to_user_mode_prepare+0x3a/0x60
    [   63.001479]  entry_SYSCALL_64_after_hwframe+0x6f/0x77
    [   63.001535] RIP: 0033:0x7f7fd3ebf539
    [   63.001551] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
    [   63.001562] RSP: 002b:00007f7fd32570c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
    [   63.001584] RAX: ffffffffffffffda RBX: 00007f7fd3ff3f80 RCX: 00007f7fd3ebf539
    [   63.001590] RDX: 4db6d1e4f7e43360 RSI: 0000000020000000 RDI: 0000000000000004
    [   63.001595] RBP: 00007f7fd3f1e496 R08: 0000000000000000 R09: 0000000000000000
    [   63.001599] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
    [   63.001604] R13: 0000000000000006 R14: 00007f7fd3ff3f80 R15: 00007ffd415ad2b8
    ...
    [   63.018142] ---[ end trace ]---
    
    Historically, the signed integer overflow sanitizer did not work in the
    kernel due to its interaction with `-fwrapv` but this has since been
    changed [1] in the newest version of Clang; It was re-enabled in the
    kernel with Commit 557f8c582a9ba8ab ("ubsan: Reintroduce signed overflow
    sanitizer").
    
    Let's rework this overflow checking logic to not actually perform an
    overflow during the check itself, thus avoiding the UBSAN splat.
    
    [1]: https://github.com/llvm/llvm-project/pull/82432
    
    Signed-off-by: Justin Stitt <justinstitt@google.com>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Link: https://lore.kernel.org/r/20240507-b4-sio-block-ioctl-v3-1-ba0c2b32275e@google.com
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit c15df6f49867f90b41b8e6043d8eb87943b05a07
Author: Zqiang <qiang.zhang1211@gmail.com>
Date:   Mon Mar 25 15:52:19 2024 +0800

    rcutorture: Fix invalid context warning when enable srcu barrier testing
    
    [ Upstream commit 668c0406d887467d53f8fe79261dda1d22d5b671 ]
    
    When the torture_type is set srcu or srcud and cb_barrier is
    non-zero, running the rcutorture test will trigger the
    following warning:
    
    [  163.910989][    C1] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
    [  163.910994][    C1] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1
    [  163.910999][    C1] preempt_count: 10001, expected: 0
    [  163.911002][    C1] RCU nest depth: 0, expected: 0
    [  163.911005][    C1] INFO: lockdep is turned off.
    [  163.911007][    C1] irq event stamp: 30964
    [  163.911010][    C1] hardirqs last  enabled at (30963): [<ffffffffabc7df52>] do_idle+0x362/0x500
    [  163.911018][    C1] hardirqs last disabled at (30964): [<ffffffffae616eff>] sysvec_call_function_single+0xf/0xd0
    [  163.911025][    C1] softirqs last  enabled at (0): [<ffffffffabb6475f>] copy_process+0x16ff/0x6580
    [  163.911033][    C1] softirqs last disabled at (0): [<0000000000000000>] 0x0
    [  163.911038][    C1] Preemption disabled at:
    [  163.911039][    C1] [<ffffffffacf1964b>] stack_depot_save_flags+0x24b/0x6c0
    [  163.911063][    C1] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G        W          6.8.0-rc4-rt4-yocto-preempt-rt+ #3 1e39aa9a737dd024a3275c4f835a872f673a7d3a
    [  163.911071][    C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014
    [  163.911075][    C1] Call Trace:
    [  163.911078][    C1]  <IRQ>
    [  163.911080][    C1]  dump_stack_lvl+0x88/0xd0
    [  163.911089][    C1]  dump_stack+0x10/0x20
    [  163.911095][    C1]  __might_resched+0x36f/0x530
    [  163.911105][    C1]  rt_spin_lock+0x82/0x1c0
    [  163.911112][    C1]  spin_lock_irqsave_ssp_contention+0xb8/0x100
    [  163.911121][    C1]  srcu_gp_start_if_needed+0x782/0xf00
    [  163.911128][    C1]  ? _raw_spin_unlock_irqrestore+0x46/0x70
    [  163.911136][    C1]  ? debug_object_active_state+0x336/0x470
    [  163.911148][    C1]  ? __pfx_srcu_gp_start_if_needed+0x10/0x10
    [  163.911156][    C1]  ? __pfx_lock_release+0x10/0x10
    [  163.911165][    C1]  ? __pfx_rcu_torture_barrier_cbf+0x10/0x10
    [  163.911188][    C1]  __call_srcu+0x9f/0xe0
    [  163.911196][    C1]  call_srcu+0x13/0x20
    [  163.911201][    C1]  srcu_torture_call+0x1b/0x30
    [  163.911224][    C1]  rcu_torture_barrier1cb+0x4a/0x60
    [  163.911247][    C1]  __flush_smp_call_function_queue+0x267/0xca0
    [  163.911256][    C1]  ? __pfx_rcu_torture_barrier1cb+0x10/0x10
    [  163.911281][    C1]  generic_smp_call_function_single_interrupt+0x13/0x20
    [  163.911288][    C1]  __sysvec_call_function_single+0x7d/0x280
    [  163.911295][    C1]  sysvec_call_function_single+0x93/0xd0
    [  163.911302][    C1]  </IRQ>
    [  163.911304][    C1]  <TASK>
    [  163.911308][    C1]  asm_sysvec_call_function_single+0x1b/0x20
    [  163.911313][    C1] RIP: 0010:default_idle+0x17/0x20
    [  163.911326][    C1] RSP: 0018:ffff888001997dc8 EFLAGS: 00000246
    [  163.911333][    C1] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffffae618b51
    [  163.911337][    C1] RDX: 0000000000000000 RSI: ffffffffaea80920 RDI: ffffffffaec2de80
    [  163.911342][    C1] RBP: ffff888001997dc8 R08: 0000000000000001 R09: ffffed100d740cad
    [  163.911346][    C1] R10: ffffed100d740cac R11: ffff88806ba06563 R12: 0000000000000001
    [  163.911350][    C1] R13: ffffffffafe460c0 R14: ffffffffafe460c0 R15: 0000000000000000
    [  163.911358][    C1]  ? ct_kernel_exit.constprop.3+0x121/0x160
    [  163.911369][    C1]  ? lockdep_hardirqs_on+0xc4/0x150
    [  163.911376][    C1]  arch_cpu_idle+0x9/0x10
    [  163.911383][    C1]  default_idle_call+0x7a/0xb0
    [  163.911390][    C1]  do_idle+0x362/0x500
    [  163.911398][    C1]  ? __pfx_do_idle+0x10/0x10
    [  163.911404][    C1]  ? complete_with_flags+0x8b/0xb0
    [  163.911416][    C1]  cpu_startup_entry+0x58/0x70
    [  163.911423][    C1]  start_secondary+0x221/0x280
    [  163.911430][    C1]  ? __pfx_start_secondary+0x10/0x10
    [  163.911440][    C1]  secondary_startup_64_no_verify+0x17f/0x18b
    [  163.911455][    C1]  </TASK>
    
    This commit therefore use smp_call_on_cpu() instead of
    smp_call_function_single(), make rcu_torture_barrier1cb() invoked
    happens on task-context.
    
    Signed-off-by: Zqiang <qiang.zhang1211@gmail.com>
    Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
    Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit dd2cb39afc72d16daa13124be28691ff97baf050
Author: Paul E. McKenney <paulmck@kernel.org>
Date:   Wed Mar 6 19:21:47 2024 -0800

    rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment
    
    [ Upstream commit 8b9b443fa860276822b25057cb3ff3b28734dec0 ]
    
    The "pipe_count > RCU_TORTURE_PIPE_LEN" check has a comment saying "Should
    not happen, but...".  This is only true when testing an RCU whose grace
    periods are always long enough.  This commit therefore fixes this comment.
    
    Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
    Closes: https://lore.kernel.org/lkml/CAHk-=wi7rJ-eGq+xaxVfzFEgbL9tdf6Kc8Z89rCpfcQOKm74Tw@mail.gmail.com/
    Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
    Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit ec58e6ff29b78616ced062e46b9635b97407ffb4
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Wed Apr 3 17:36:18 2024 +0800

    padata: Disable BH when taking works lock on MT path
    
    [ Upstream commit 58329c4312031603bb1786b44265c26d5065fe72 ]
    
    As the old padata code can execute in softirq context, disable
    softirqs for the new padata_do_mutithreaded code too as otherwise
    lockdep will get antsy.
    
    Reported-by: syzbot+0cb5bb0f4bf9e79db3b3@syzkaller.appspotmail.com
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Acked-by: Daniel Jordan <daniel.m.jordan@oracle.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 82c7acf9a12c9b4e4b0aba531de82b4e39a345c8
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Sat Jun 8 14:06:16 2024 +0200

    zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
    
    [ Upstream commit 7fea700e04bd3f424c2d836e98425782f97b494e ]
    
    kernel_wait4() doesn't sleep and returns -EINTR if there is no
    eligible child and signal_pending() is true.
    
    That is why zap_pid_ns_processes() clears TIF_SIGPENDING but this is not
    enough, it should also clear TIF_NOTIFY_SIGNAL to make signal_pending()
    return false and avoid a busy-wait loop.
    
    Link: https://lkml.kernel.org/r/20240608120616.GB7947@redhat.com
    Fixes: 12db8b690010 ("entry: Add support for TIF_NOTIFY_SIGNAL")
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Reported-by: Rachel Menge <rachelmenge@linux.microsoft.com>
    Closes: https://lore.kernel.org/all/1386cd49-36d0-4a5c-85e9-bc42056a5a38@linux.microsoft.com/
    Reviewed-by: Boqun Feng <boqun.feng@gmail.com>
    Tested-by: Wei Fu <fuweid89@gmail.com>
    Reviewed-by: Jens Axboe <axboe@kernel.dk>
    Cc: Allen Pais <apais@linux.microsoft.com>
    Cc: Christian Brauner <brauner@kernel.org>
    Cc: Frederic Weisbecker <frederic@kernel.org>
    Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
    Cc: Joel Granados <j.granados@samsung.com>
    Cc: Josh Triplett <josh@joshtriplett.org>
    Cc: Lai Jiangshan <jiangshanlai@gmail.com>
    Cc: Mateusz Guzik <mjguzik@gmail.com>
    Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Cc: Mike Christie <michael.christie@oracle.com>
    Cc: Neeraj Upadhyay <neeraj.upadhyay@kernel.org>
    Cc: Paul E. McKenney <paulmck@kernel.org>
    Cc: Steven Rostedt (Google) <rostedt@goodmis.org>
    Cc: Zqiang <qiang.zhang1211@gmail.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 864963d2692ecd4357e9da3d27f5e5bb2acf2212
Author: Jean Delvare <jdelvare@suse.de>
Date:   Fri May 31 11:17:48 2024 +0200

    i2c: designware: Fix the functionality flags of the slave-only interface
    
    [ Upstream commit cbf3fb5b29e99e3689d63a88c3cddbffa1b8de99 ]
    
    When an I2C adapter acts only as a slave, it should not claim to
    support I2C master capabilities.
    
    Fixes: 5b6d721b266a ("i2c: designware: enable SLAVE in platform module")
    Signed-off-by: Jean Delvare <jdelvare@suse.de>
    Cc: Luis Oliveira <lolivei@synopsys.com>
    Cc: Jarkko Nikula <jarkko.nikula@linux.intel.com>
    Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
    Cc: Jan Dabros <jsd@semihalf.com>
    Cc: Andi Shyti <andi.shyti@kernel.org>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
    Tested-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
    Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 0f37d22a6215c37a5280315a82ac2907e1ac298b
Author: Jean Delvare <jdelvare@suse.de>
Date:   Fri May 31 11:19:14 2024 +0200

    i2c: at91: Fix the functionality flags of the slave-only interface
    
    [ Upstream commit d6d5645e5fc1233a7ba950de4a72981c394a2557 ]
    
    When an I2C adapter acts only as a slave, it should not claim to
    support I2C master capabilities.
    
    Fixes: 9d3ca54b550c ("i2c: at91: added slave mode support")
    Signed-off-by: Jean Delvare <jdelvare@suse.de>
    Cc: Juergen Fitschen <me@jue.yt>
    Cc: Ludovic Desroches <ludovic.desroches@microchip.com>
    Cc: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
    Cc: Andi Shyti <andi.shyti@kernel.org>
    Cc: Nicolas Ferre <nicolas.ferre@microchip.com>
    Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
    Cc: Claudiu Beznea <claudiu.beznea@tuxon.dev>
    Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f68820f1256b21466ff094dd97f243b7e708f9c1
Author: Shichao Lai <shichaorai@gmail.com>
Date:   Sun May 26 09:27:45 2024 +0800

    usb-storage: alauda: Check whether the media is initialized
    
    [ Upstream commit 16637fea001ab3c8df528a8995b3211906165a30 ]
    
    The member "uzonesize" of struct alauda_info will remain 0
    if alauda_init_media() fails, potentially causing divide errors
    in alauda_read_data() and alauda_write_lba().
    - Add a member "media_initialized" to struct alauda_info.
    - Change a condition in alauda_check_media() to ensure the
      first initialization.
    - Add an error check for the return value of alauda_init_media().
    
    Fixes: e80b0fade09e ("[PATCH] USB Storage: add alauda support")
    Reported-by: xingwei lee <xrivendell7@gmail.com>
    Reported-by: yue sun <samsun1006219@gmail.com>
    Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Shichao Lai <shichaorai@gmail.com>
    Link: https://lore.kernel.org/r/20240526012745.2852061-1-shichaorai@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 2b6bb0b4abfd79b8698ee161bb73c0936a2aaf83
Author: Sicong Huang <congei42@163.com>
Date:   Tue Apr 16 16:03:13 2024 +0800

    greybus: Fix use-after-free bug in gb_interface_release due to race condition.
    
    commit 5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce upstream.
    
    In gb_interface_create, &intf->mode_switch_completion is bound with
    gb_interface_mode_switch_work. Then it will be started by
    gb_interface_request_mode_switch. Here is the relevant code.
    if (!queue_work(system_long_wq, &intf->mode_switch_work)) {
            ...
    }
    
    If we call gb_interface_release to make cleanup, there may be an
    unfinished work. This function will call kfree to free the object
    "intf". However, if gb_interface_mode_switch_work is scheduled to
    run after kfree, it may cause use-after-free error as
    gb_interface_mode_switch_work will use the object "intf".
    The possible execution flow that may lead to the issue is as follows:
    
    CPU0                            CPU1
    
                                |   gb_interface_create
                                |   gb_interface_request_mode_switch
    gb_interface_release        |
    kfree(intf) (free)          |
                                |   gb_interface_mode_switch_work
                                |   mutex_lock(&intf->mutex) (use)
    
    Fix it by canceling the work before kfree.
    
    Signed-off-by: Sicong Huang <congei42@163.com>
    Link: https://lore.kernel.org/r/20240416080313.92306-1-congei42@163.com
    Cc: Ronnie Sahlberg <rsahlberg@ciq.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d6c26a59e633b5cc81bad7db231ba54a0a1cca1d
Author: Beleswar Padhi <b-padhi@ti.com>
Date:   Mon May 6 19:48:49 2024 +0530

    remoteproc: k3-r5: Jump to error handling labels in start/stop errors
    
    commit 1dc7242f6ee0c99852cb90676d7fe201cf5de422 upstream.
    
    In case of errors during core start operation from sysfs, the driver
    directly returns with the -EPERM error code. Fix this to ensure that
    mailbox channels are freed on error before returning by jumping to the
    'put_mbox' error handling label. Similarly, jump to the 'out' error
    handling label to return with required -EPERM error code during the
    core stop operation from sysfs.
    
    Fixes: 3c8a9066d584 ("remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs")
    Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
    Link: https://lore.kernel.org/r/20240506141849.1735679-1-b-padhi@ti.com
    Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 990d0710108df3cea4321cbb32fe0aabc5cc320f
Author: YonglongLi <liyonglong@chinatelecom.cn>
Date:   Tue Jun 18 14:25:32 2024 +0200

    mptcp: pm: update add_addr counters after connect
    
    commit 40eec1795cc27b076d49236649a29507c7ed8c2d upstream.
    
    The creation of new subflows can fail for different reasons. If no
    subflow have been created using the received ADD_ADDR, the related
    counters should not be updated, otherwise they will never be decremented
    for events related to this ID later on.
    
    For the moment, the number of accepted ADD_ADDR is only decremented upon
    the reception of a related RM_ADDR, and only if the remote address ID is
    currently being used by at least one subflow. In other words, if no
    subflow can be created with the received address, the counter will not
    be decremented. In this case, it is then important not to increment
    pm.add_addr_accepted counter, and not to modify pm.accept_addr bit.
    
    Note that this patch does not modify the behaviour in case of failures
    later on, e.g. if the MP Join is dropped or rejected.
    
    The "remove invalid addresses" MP Join subtest has been modified to
    validate this case. The broadcast IP address is added before the "valid"
    address that will be used to successfully create a subflow, and the
    limit is decreased by one: without this patch, it was not possible to
    create the last subflow, because:
    
    - the broadcast address would have been accepted even if it was not
      usable: the creation of a subflow to this address results in an error,
    
    - the limit of 2 accepted ADD_ADDR would have then been reached.
    
    Fixes: 01cacb00b35c ("mptcp: add netlink-based PM")
    Cc: stable@vger.kernel.org
    Co-developed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: YonglongLi <liyonglong@chinatelecom.cn>
    Reviewed-by: Mat Martineau <martineau@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://lore.kernel.org/r/20240607-upstream-net-20240607-misc-fixes-v1-3-1ab9ddfa3d00@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    [ Conflicts in pm_netlink.c because commit 1a0d6136c5f0 ("mptcp: local
      addresses fullmesh") is not present in this version (+ others changing
      the context). To resolve the conflicts, the same block is moved later,
      and under the condition that the call to __mptcp_subflow_connect()
      didn't fail.
      The selftest modification has been dropped, because the modified test
      is not in this version. That's fine, we can test with selftests from a
      newer version. ]
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5a4efafcf843ed56686406b79765358b75401db2
Author: YonglongLi <liyonglong@chinatelecom.cn>
Date:   Tue Jun 18 14:25:12 2024 +0200

    mptcp: pm: inc RmAddr MIB counter once per RM_ADDR ID
    
    commit 6a09788c1a66e3d8b04b3b3e7618cc817bb60ae9 upstream.
    
    The RmAddr MIB counter is supposed to be incremented once when a valid
    RM_ADDR has been received. Before this patch, it could have been
    incremented as many times as the number of subflows connected to the
    linked address ID, so it could have been 0, 1 or more than 1.
    
    The "RmSubflow" is incremented after a local operation. In this case,
    it is normal to tied it with the number of subflows that have been
    actually removed.
    
    The "remove invalid addresses" MP Join subtest has been modified to
    validate this case. A broadcast IP address is now used instead: the
    client will not be able to create a subflow to this address. The
    consequence is that when receiving the RM_ADDR with the ID attached to
    this broadcast IP address, no subflow linked to this ID will be found.
    
    Fixes: 7a7e52e38a40 ("mptcp: add RM_ADDR related mibs")
    Cc: stable@vger.kernel.org
    Co-developed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: YonglongLi <liyonglong@chinatelecom.cn>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://lore.kernel.org/r/20240607-upstream-net-20240607-misc-fixes-v1-2-1ab9ddfa3d00@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    [ Conflicts in pm_netlink.c because the commit 9f12e97bf16c ("mptcp:
      unify RM_ADDR and RM_SUBFLOW receiving"), and commit d0b698ca9a27
      ("mptcp: remove multi addresses in PM") are not in this version. To
      fix the issue, the incrementation should be done outside the loop: the
      same resolution has been applied here.
      The selftest modification has been dropped, because the modified test
      is not in this version. That's fine, we can test with selftests from a
      newer version. ]
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 208cd22ef5e57f82d38ec11c1a1703f9401d6dde
Author: Paolo Abeni <pabeni@redhat.com>
Date:   Tue Jun 18 14:24:45 2024 +0200

    mptcp: ensure snd_una is properly initialized on connect
    
    commit 8031b58c3a9b1db3ef68b3bd749fbee2e1e1aaa3 upstream.
    
    This is strictly related to commit fb7a0d334894 ("mptcp: ensure snd_nxt
    is properly initialized on connect"). It turns out that syzkaller can
    trigger the retransmit after fallback and before processing any other
    incoming packet - so that snd_una is still left uninitialized.
    
    Address the issue explicitly initializing snd_una together with snd_nxt
    and write_seq.
    
    Suggested-by: Mat Martineau <martineau@kernel.org>
    Fixes: 8fd738049ac3 ("mptcp: fallback in case of simultaneous connect")
    Cc: stable@vger.kernel.org
    Reported-by: Christoph Paasch <cpaasch@apple.com>
    Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/485
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Reviewed-by: Mat Martineau <martineau@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://lore.kernel.org/r/20240607-upstream-net-20240607-misc-fixes-v1-1-1ab9ddfa3d00@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    [ Conflicts in protocol.c, similar to the ones from commit 99951b62bf20
      ("mptcp: ensure snd_nxt is properly initialized on connect"), with the
      same resolution. Note that in this version, 'snd_una' is an atomic64
      type, so use atomic64_set() instead, as it is done everywhere else. ]
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 73014c77ec2aabb68b0660d0bf3c461fd8addc88
Author: Matthias Goergens <matthias.goergens@gmail.com>
Date:   Mon Sep 5 11:19:04 2022 +0800

    hugetlb_encode.h: fix undefined behaviour (34 << 26)
    
    commit 710bb68c2e3a24512e2d2bae470960d7488e97b1 upstream.
    
    Left-shifting past the size of your datatype is undefined behaviour in C.
    The literal 34 gets the type `int`, and that one is not big enough to be
    left shifted by 26 bits.
    
    An `unsigned` is long enough (on any machine that has at least 32 bits for
    their ints.)
    
    For uniformity, we mark all the literals as unsigned.  But it's only
    really needed for HUGETLB_FLAG_ENCODE_16GB.
    
    Thanks to Randy Dunlap for an initial review and suggestion.
    
    Link: https://lkml.kernel.org/r/20220905031904.150925-1-matthias.goergens@gmail.com
    Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
    Acked-by: Randy Dunlap <rdunlap@infradead.org>
    Cc: Mike Kravetz <mike.kravetz@oracle.com>
    Cc: Muchun Song <songmuchun@bytedance.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    [cmllamas: fix trivial conflict due to missing page encondigs]
    Signed-off-by: Carlos Llamas <cmllamas@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0047568dbd9c4ef0c3d5e483d70e55e8f743e680
Author: Doug Brown <doug@schmorgal.com>
Date:   Sun May 19 12:19:30 2024 -0700

    serial: 8250_pxa: Configure tx_loadsz to match FIFO IRQ level
    
    commit 5208e7ced520a813b4f4774451fbac4e517e78b2 upstream.
    
    The FIFO is 64 bytes, but the FCR is configured to fire the TX interrupt
    when the FIFO is half empty (bit 3 = 0). Thus, we should only write 32
    bytes when a TX interrupt occurs.
    
    This fixes a problem observed on the PXA168 that dropped a bunch of TX
    bytes during large transmissions.
    
    Fixes: ab28f51c77cd ("serial: rewrite pxa2xx-uart to use 8250_core")
    Signed-off-by: Doug Brown <doug@schmorgal.com>
    Link: https://lore.kernel.org/r/20240519191929.122202-1-doug@schmorgal.com
    Cc: stable <stable@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 33eae51f656976895552bfdcb611131591e5abed
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Tue May 28 14:20:19 2024 +0200

    tick/nohz_full: Don't abuse smp_call_function_single() in tick_setup_device()
    
    commit 07c54cc5988f19c9642fd463c2dbdac7fc52f777 upstream.
    
    After the recent commit 5097cbcb38e6 ("sched/isolation: Prevent boot crash
    when the boot CPU is nohz_full") the kernel no longer crashes, but there is
    another problem.
    
    In this case tick_setup_device() calls tick_take_do_timer_from_boot() to
    update tick_do_timer_cpu and this triggers the WARN_ON_ONCE(irqs_disabled)
    in smp_call_function_single().
    
    Kill tick_take_do_timer_from_boot() and just use WRITE_ONCE(), the new
    comment explains why this is safe (thanks Thomas!).
    
    Fixes: 08ae95f4fd3b ("nohz_full: Allow the boot CPU to be nohz_full")
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20240528122019.GA28794@redhat.com
    Link: https://lore.kernel.org/all/20240522151742.GA10400@redhat.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0ecfe3a92869a59668d27228dabbd7965e83567f
Author: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Date:   Thu May 30 23:15:56 2024 +0900

    nilfs2: fix potential kernel bug due to lack of writeback flag waiting
    
    commit a4ca369ca221bb7e06c725792ac107f0e48e82e7 upstream.
    
    Destructive writes to a block device on which nilfs2 is mounted can cause
    a kernel bug in the folio/page writeback start routine or writeback end
    routine (__folio_start_writeback in the log below):
    
     kernel BUG at mm/page-writeback.c:3070!
     Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
     ...
     RIP: 0010:__folio_start_writeback+0xbaa/0x10e0
     Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff
      e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 <0f>
      0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00
     ...
     Call Trace:
      <TASK>
      nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2]
      nilfs_segctor_construct+0x181/0x6b0 [nilfs2]
      nilfs_segctor_thread+0x548/0x11c0 [nilfs2]
      kthread+0x2f0/0x390
      ret_from_fork+0x4b/0x80
      ret_from_fork_asm+0x1a/0x30
      </TASK>
    
    This is because when the log writer starts a writeback for segment summary
    blocks or a super root block that use the backing device's page cache, it
    does not wait for the ongoing folio/page writeback, resulting in an
    inconsistent writeback state.
    
    Fix this issue by waiting for ongoing writebacks when putting
    folios/pages on the backing device into writeback state.
    
    Link: https://lkml.kernel.org/r/20240530141556.4411-1-konishi.ryusuke@gmail.com
    Fixes: 9ff05123e3bf ("nilfs2: segment constructor")
    Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
    Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f699f9f8b2ea7c67f85812d8812e71d45a6345b9
Author: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Date:   Mon Apr 29 16:01:19 2024 +0300

    intel_th: pci: Add Lunar Lake support
    
    commit f866b65322bfbc8fcca13c25f49e1a5c5a93ae4d upstream.
    
    Add support for the Trace Hub in Lunar Lake.
    
    Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Cc: stable@kernel.org
    Link: https://lore.kernel.org/r/20240429130119.1518073-16-alexander.shishkin@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 31f3136fd6fcd83b2a7ab35ceefb6083b31e71af
Author: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Date:   Mon Apr 29 16:01:17 2024 +0300

    intel_th: pci: Add Meteor Lake-S support
    
    commit c4a30def564d75e84718b059d1a62cc79b137cf9 upstream.
    
    Add support for the Trace Hub in Meteor Lake-S.
    
    Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Cc: stable@kernel.org
    Link: https://lore.kernel.org/r/20240429130119.1518073-14-alexander.shishkin@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c02003a97a888d1452fdb3824a8c4eeed5b18907
Author: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Date:   Mon Apr 29 16:01:16 2024 +0300

    intel_th: pci: Add Sapphire Rapids SOC support
    
    commit 2e1da7efabe05cb0cf0b358883b2bc89080ed0eb upstream.
    
    Add support for the Trace Hub in Sapphire Rapids SOC.
    
    Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Cc: stable@kernel.org
    Link: https://lore.kernel.org/r/20240429130119.1518073-13-alexander.shishkin@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dbfe50b50eb9993f50826092ce308a80def98ac2
Author: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Date:   Mon Apr 29 16:01:15 2024 +0300

    intel_th: pci: Add Granite Rapids SOC support
    
    commit 854afe461b009801a171b3a49c5f75ea43e4c04c upstream.
    
    Add support for the Trace Hub in Granite Rapids SOC.
    
    Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Cc: stable@kernel.org
    Link: https://lore.kernel.org/r/20240429130119.1518073-12-alexander.shishkin@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 78a41b1614c3168778ffe9c87c4b415a9ca5cb38
Author: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Date:   Mon Apr 29 16:01:14 2024 +0300

    intel_th: pci: Add Granite Rapids support
    
    commit e44937889bdf4ecd1f0c25762b7226406b9b7a69 upstream.
    
    Add support for the Trace Hub in Granite Rapids.
    
    Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Cc: stable@kernel.org
    Link: https://lore.kernel.org/r/20240429130119.1518073-11-alexander.shishkin@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 02d3b5e48d247d3daad381e761eb4ce7add7d561
Author: Beleswar Padhi <b-padhi@ti.com>
Date:   Tue Apr 30 16:23:07 2024 +0530

    remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs
    
    commit 3c8a9066d584f5010b6f4ba03bf6b19d28973d52 upstream.
    
    PSC controller has a limitation that it can only power-up the second
    core when the first core is in ON state. Power-state for core0 should be
    equal to or higher than core1.
    
    Therefore, prevent core1 from powering up before core0 during the start
    process from sysfs. Similarly, prevent core0 from shutting down before
    core1 has been shut down from sysfs.
    
    Fixes: 6dedbd1d5443 ("remoteproc: k3-r5: Add a remoteproc driver for R5F subsystem")
    Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20240430105307.1190615-3-b-padhi@ti.com
    Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fe5b53c60217a585933c050da6c9db6ed27fdedd
Author: Nuno Sa <nuno.sa@analog.com>
Date:   Thu Mar 28 14:58:50 2024 +0100

    dmaengine: axi-dmac: fix possible race in remove()
    
    commit 1bc31444209c8efae98cb78818131950d9a6f4d6 upstream.
    
    We need to first free the IRQ before calling of_dma_controller_free().
    Otherwise we could get an interrupt and schedule a tasklet while
    removing the DMA controller.
    
    Fixes: 0e3b67b348b8 ("dmaengine: Add support for the Analog Devices AXI-DMAC DMA controller")
    Cc: stable@kernel.org
    Signed-off-by: Nuno Sa <nuno.sa@analog.com>
    Link: https://lore.kernel.org/r/20240328-axi-dmac-devm-probe-v3-1-523c0176df70@analog.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 42ed6bfc2ddb2b7a956c1d70e907a4353f32291b
Author: Rick Wertenbroek <rick.wertenbroek@gmail.com>
Date:   Wed Apr 3 16:45:08 2024 +0200

    PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id
    
    commit 2dba285caba53f309d6060fca911b43d63f41697 upstream.
    
    Remove wrong mask on subsys_vendor_id. Both the Vendor ID and Subsystem
    Vendor ID are u16 variables and are written to a u32 register of the
    controller. The Subsystem Vendor ID was always 0 because the u16 value
    was masked incorrectly with GENMASK(31,16) resulting in all lower 16
    bits being set to 0 prior to the shift.
    
    Remove both masks as they are unnecessary and set the register correctly
    i.e., the lower 16-bits are the Vendor ID and the upper 16-bits are the
    Subsystem Vendor ID.
    
    This is documented in the RK3399 TRM section 17.6.7.1.17
    
    [kwilczynski: removed unnecesary newline]
    Fixes: cf590b078391 ("PCI: rockchip: Add EP driver for Rockchip PCIe controller")
    Link: https://lore.kernel.org/linux-pci/20240403144508.489835-1-rick.wertenbroek@gmail.com
    Signed-off-by: Rick Wertenbroek <rick.wertenbroek@gmail.com>
    Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 050ce8af6838c71e872e982b50d3f1bec21da40e
Author: Su Yue <glass.su@suse.com>
Date:   Mon Apr 8 16:20:39 2024 +0800

    ocfs2: fix races between hole punching and AIO+DIO
    
    commit 952b023f06a24b2ad6ba67304c4c84d45bea2f18 upstream.
    
    After commit "ocfs2: return real error code in ocfs2_dio_wr_get_block",
    fstests/generic/300 become from always failed to sometimes failed:
    
    ========================================================================
    [  473.293420 ] run fstests generic/300
    
    [  475.296983 ] JBD2: Ignoring recovery information on journal
    [  475.302473 ] ocfs2: Mounting device (253,1) on (node local, slot 0) with ordered data mode.
    [  494.290998 ] OCFS2: ERROR (device dm-1): ocfs2_change_extent_flag: Owner 5668 has an extent at cpos 78723 which can no longer be found
    [  494.291609 ] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
    [  494.292018 ] OCFS2: File system is now read-only.
    [  494.292224 ] (kworker/19:11,2628,19):ocfs2_mark_extent_written:5272 ERROR: status = -30
    [  494.292602 ] (kworker/19:11,2628,19):ocfs2_dio_end_io_write:2374 ERROR: status = -3
    fio: io_u error on file /mnt/scratch/racer: Read-only file system: write offset=460849152, buflen=131072
    =========================================================================
    
    In __blockdev_direct_IO, ocfs2_dio_wr_get_block is called to add unwritten
    extents to a list.  extents are also inserted into extent tree in
    ocfs2_write_begin_nolock.  Then another thread call fallocate to puch a
    hole at one of the unwritten extent.  The extent at cpos was removed by
    ocfs2_remove_extent().  At end io worker thread, ocfs2_search_extent_list
    found there is no such extent at the cpos.
    
        T1                        T2                T3
                                  inode lock
                                    ...
                                    insert extents
                                    ...
                                  inode unlock
    ocfs2_fallocate
     __ocfs2_change_file_space
      inode lock
      lock ip_alloc_sem
      ocfs2_remove_inode_range inode
       ocfs2_remove_btree_range
        ocfs2_remove_extent
        ^---remove the extent at cpos 78723
      ...
      unlock ip_alloc_sem
      inode unlock
                                           ocfs2_dio_end_io
                                            ocfs2_dio_end_io_write
                                             lock ip_alloc_sem
                                             ocfs2_mark_extent_written
                                              ocfs2_change_extent_flag
                                               ocfs2_search_extent_list
                                               ^---failed to find extent
                                              ...
                                              unlock ip_alloc_sem
    
    In most filesystems, fallocate is not compatible with racing with AIO+DIO,
    so fix it by adding to wait for all dio before fallocate/punch_hole like
    ext4.
    
    Link: https://lkml.kernel.org/r/20240408082041.20925-3-glass.su@suse.com
    Fixes: b25801038da5 ("ocfs2: Support xfs style space reservation ioctls")
    Signed-off-by: Su Yue <glass.su@suse.com>
    Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
    Cc: Changwei Ge <gechangwei@live.cn>
    Cc: Gang He <ghe@suse.com>
    Cc: Joel Becker <jlbec@evilplan.org>
    Cc: Jun Piao <piaojun@huawei.com>
    Cc: Junxiao Bi <junxiao.bi@oracle.com>
    Cc: Mark Fasheh <mark@fasheh.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 11a075a1c8c75f7bb7a05139d64decab2420dca1
Author: Su Yue <glass.su@suse.com>
Date:   Mon Apr 8 16:20:41 2024 +0800

    ocfs2: use coarse time for new created files
    
    commit b8cb324277ee16f3eca3055b96fce4735a5a41c6 upstream.
    
    The default atime related mount option is '-o realtime' which means file
    atime should be updated if atime <= ctime or atime <= mtime.  atime should
    be updated in the following scenario, but it is not:
    ==========================================================
    $ rm /mnt/testfile;
    $ echo test > /mnt/testfile
    $ stat -c "%X %Y %Z" /mnt/testfile
    1711881646 1711881646 1711881646
    $ sleep 5
    $ cat /mnt/testfile > /dev/null
    $ stat -c "%X %Y %Z" /mnt/testfile
    1711881646 1711881646 1711881646
    ==========================================================
    
    And the reason the atime in the test is not updated is that ocfs2 calls
    ktime_get_real_ts64() in __ocfs2_mknod_locked during file creation.  Then
    inode_set_ctime_current() is called in inode_set_ctime_current() calls
    ktime_get_coarse_real_ts64() to get current time.
    
    ktime_get_real_ts64() is more accurate than ktime_get_coarse_real_ts64().
    In my test box, I saw ctime set by ktime_get_coarse_real_ts64() is less
    than ktime_get_real_ts64() even ctime is set later.  The ctime of the new
    inode is smaller than atime.
    
    The call trace is like:
    
    ocfs2_create
      ocfs2_mknod
        __ocfs2_mknod_locked
        ....
    
          ktime_get_real_ts64 <------- set atime,ctime,mtime, more accurate
          ocfs2_populate_inode
        ...
        ocfs2_init_acl
          ocfs2_acl_set_mode
            inode_set_ctime_current
              current_time
                ktime_get_coarse_real_ts64 <-------less accurate
    
    ocfs2_file_read_iter
      ocfs2_inode_lock_atime
        ocfs2_should_update_atime
          atime <= ctime ? <-------- false, ctime < atime due to accuracy
    
    So here call ktime_get_coarse_real_ts64 to set inode time coarser while
    creating new files.  It may lower the accuracy of file times.  But it's
    not a big deal since we already use coarse time in other places like
    ocfs2_update_inode_atime and inode_set_ctime_current.
    
    Link: https://lkml.kernel.org/r/20240408082041.20925-5-glass.su@suse.com
    Fixes: c62c38f6b91b ("ocfs2: replace CURRENT_TIME macro")
    Signed-off-by: Su Yue <glass.su@suse.com>
    Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
    Cc: Mark Fasheh <mark@fasheh.com>
    Cc: Joel Becker <jlbec@evilplan.org>
    Cc: Junxiao Bi <junxiao.bi@oracle.com>
    Cc: Changwei Ge <gechangwei@live.cn>
    Cc: Gang He <ghe@suse.com>
    Cc: Jun Piao <piaojun@huawei.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 70c1835e776c8447c1aca87ddb38cfe764fe756a
Author: Rik van Riel <riel@surriel.com>
Date:   Tue May 7 09:18:58 2024 -0400

    fs/proc: fix softlockup in __read_vmcore
    
    commit 5cbcb62dddf5346077feb82b7b0c9254222d3445 upstream.
    
    While taking a kernel core dump with makedumpfile on a larger system,
    softlockup messages often appear.
    
    While softlockup warnings can be harmless, they can also interfere with
    things like RCU freeing memory, which can be problematic when the kdump
    kexec image is configured with as little memory as possible.
    
    Avoid the softlockup, and give things like work items and RCU a chance to
    do their thing during __read_vmcore by adding a cond_resched.
    
    Link: https://lkml.kernel.org/r/20240507091858.36ff767f@imladris.surriel.com
    Signed-off-by: Rik van Riel <riel@surriel.com>
    Acked-by: Baoquan He <bhe@redhat.com>
    Cc: Dave Young <dyoung@redhat.com>
    Cc: Vivek Goyal <vgoyal@redhat.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f70ff737346744633e7b655c1fb23e1578491ff3
Author: Hagar Gamal Halim Hemdan <hagarhem@amazon.com>
Date:   Tue Apr 30 08:59:16 2024 +0000

    vmci: prevent speculation leaks by sanitizing event in event_deliver()
    
    commit 8003f00d895310d409b2bf9ef907c56b42a4e0f4 upstream.
    
    Coverity spotted that event_msg is controlled by user-space,
    event_msg->event_data.event is passed to event_deliver() and used
    as an index without sanitization.
    
    This change ensures that the event index is sanitized to mitigate any
    possibility of speculative information leaks.
    
    This bug was discovered and resolved using Coverity Static Analysis
    Security Testing (SAST) by Synopsys, Inc.
    
    Only compile tested, no access to HW.
    
    Fixes: 1d990201f9bb ("VMCI: event handling implementation.")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Hagar Gamal Halim Hemdan <hagarhem@amazon.com>
    Link: https://lore.kernel.org/stable/20231127193533.46174-1-hagarhem%40amazon.com
    Link: https://lore.kernel.org/r/20240430085916.4753-1-hagarhem@amazon.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4dfffb50316c761c59386c9b002a10ac6d7bb6c9
Author: Marek Szyprowski <m.szyprowski@samsung.com>
Date:   Thu Apr 25 11:48:51 2024 +0200

    drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found
    
    commit 799d4b392417ed6889030a5b2335ccb6dcf030ab upstream.
    
    When reading EDID fails and driver reports no modes available, the DRM
    core adds an artificial 1024x786 mode to the connector. Unfortunately
    some variants of the Exynos HDMI (like the one in Exynos4 SoCs) are not
    able to drive such mode, so report a safe 640x480 mode instead of nothing
    in case of the EDID reading failure.
    
    This fixes the following issue observed on Trats2 board since commit
    13d5b040363c ("drm/exynos: do not return negative values from .get_modes()"):
    
    [drm] Exynos DRM: using 11c00000.fimd device for DMA mapping operations
    exynos-drm exynos-drm: bound 11c00000.fimd (ops fimd_component_ops)
    exynos-drm exynos-drm: bound 12c10000.mixer (ops mixer_component_ops)
    exynos-dsi 11c80000.dsi: [drm:samsung_dsim_host_attach] Attached s6e8aa0 device (lanes:4 bpp:24 mode-flags:0x10b)
    exynos-drm exynos-drm: bound 11c80000.dsi (ops exynos_dsi_component_ops)
    exynos-drm exynos-drm: bound 12d00000.hdmi (ops hdmi_component_ops)
    [drm] Initialized exynos 1.1.0 20180330 for exynos-drm on minor 1
    exynos-hdmi 12d00000.hdmi: [drm:hdmiphy_enable.part.0] *ERROR* PLL could not reach steady state
    panel-samsung-s6e8aa0 11c80000.dsi.0: ID: 0xa2, 0x20, 0x8c
    exynos-mixer 12c10000.mixer: timeout waiting for VSYNC
    ------------[ cut here ]------------
    WARNING: CPU: 1 PID: 11 at drivers/gpu/drm/drm_atomic_helper.c:1682 drm_atomic_helper_wait_for_vblanks.part.0+0x2b0/0x2b8
    [CRTC:70:crtc-1] vblank wait timed out
    Modules linked in:
    CPU: 1 PID: 11 Comm: kworker/u16:0 Not tainted 6.9.0-rc5-next-20240424 #14913
    Hardware name: Samsung Exynos (Flattened Device Tree)
    Workqueue: events_unbound deferred_probe_work_func
    Call trace:
     unwind_backtrace from show_stack+0x10/0x14
     show_stack from dump_stack_lvl+0x68/0x88
     dump_stack_lvl from __warn+0x7c/0x1c4
     __warn from warn_slowpath_fmt+0x11c/0x1a8
     warn_slowpath_fmt from drm_atomic_helper_wait_for_vblanks.part.0+0x2b0/0x2b8
     drm_atomic_helper_wait_for_vblanks.part.0 from drm_atomic_helper_commit_tail_rpm+0x7c/0x8c
     drm_atomic_helper_commit_tail_rpm from commit_tail+0x9c/0x184
     commit_tail from drm_atomic_helper_commit+0x168/0x190
     drm_atomic_helper_commit from drm_atomic_commit+0xb4/0xe0
     drm_atomic_commit from drm_client_modeset_commit_atomic+0x23c/0x27c
     drm_client_modeset_commit_atomic from drm_client_modeset_commit_locked+0x60/0x1cc
     drm_client_modeset_commit_locked from drm_client_modeset_commit+0x24/0x40
     drm_client_modeset_commit from __drm_fb_helper_restore_fbdev_mode_unlocked+0x9c/0xc4
     __drm_fb_helper_restore_fbdev_mode_unlocked from drm_fb_helper_set_par+0x2c/0x3c
     drm_fb_helper_set_par from fbcon_init+0x3d8/0x550
     fbcon_init from visual_init+0xc0/0x108
     visual_init from do_bind_con_driver+0x1b8/0x3a4
     do_bind_con_driver from do_take_over_console+0x140/0x1ec
     do_take_over_console from do_fbcon_takeover+0x70/0xd0
     do_fbcon_takeover from fbcon_fb_registered+0x19c/0x1ac
     fbcon_fb_registered from register_framebuffer+0x190/0x21c
     register_framebuffer from __drm_fb_helper_initial_config_and_unlock+0x350/0x574
     __drm_fb_helper_initial_config_and_unlock from exynos_drm_fbdev_client_hotplug+0x6c/0xb0
     exynos_drm_fbdev_client_hotplug from drm_client_register+0x58/0x94
     drm_client_register from exynos_drm_bind+0x160/0x190
     exynos_drm_bind from try_to_bring_up_aggregate_device+0x200/0x2d8
     try_to_bring_up_aggregate_device from __component_add+0xb0/0x170
     __component_add from mixer_probe+0x74/0xcc
     mixer_probe from platform_probe+0x5c/0xb8
     platform_probe from really_probe+0xe0/0x3d8
     really_probe from __driver_probe_device+0x9c/0x1e4
     __driver_probe_device from driver_probe_device+0x30/0xc0
     driver_probe_device from __device_attach_driver+0xa8/0x120
     __device_attach_driver from bus_for_each_drv+0x80/0xcc
     bus_for_each_drv from __device_attach+0xac/0x1fc
     __device_attach from bus_probe_device+0x8c/0x90
     bus_probe_device from deferred_probe_work_func+0x98/0xe0
     deferred_probe_work_func from process_one_work+0x240/0x6d0
     process_one_work from worker_thread+0x1a0/0x3f4
     worker_thread from kthread+0x104/0x138
     kthread from ret_from_fork+0x14/0x28
    Exception stack(0xf0895fb0 to 0xf0895ff8)
    ...
    irq event stamp: 82357
    hardirqs last  enabled at (82363): [<c01a96e8>] vprintk_emit+0x308/0x33c
    hardirqs last disabled at (82368): [<c01a969c>] vprintk_emit+0x2bc/0x33c
    softirqs last  enabled at (81614): [<c0101644>] __do_softirq+0x320/0x500
    softirqs last disabled at (81609): [<c012dfe0>] __irq_exit_rcu+0x130/0x184
    ---[ end trace 0000000000000000 ]---
    exynos-drm exynos-drm: [drm] *ERROR* flip_done timed out
    exynos-drm exynos-drm: [drm] *ERROR* [CRTC:70:crtc-1] commit wait timed out
    exynos-drm exynos-drm: [drm] *ERROR* flip_done timed out
    exynos-drm exynos-drm: [drm] *ERROR* [CONNECTOR:74:HDMI-A-1] commit wait timed out
    exynos-drm exynos-drm: [drm] *ERROR* flip_done timed out
    exynos-drm exynos-drm: [drm] *ERROR* [PLANE:56:plane-5] commit wait timed out
    exynos-mixer 12c10000.mixer: timeout waiting for VSYNC
    
    Cc: stable@vger.kernel.org
    Fixes: 13d5b040363c ("drm/exynos: do not return negative values from .get_modes()")
    Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
    Signed-off-by: Inki Dae <inki.dae@samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0acc356da8546b5c55aabfc2e2c5caa0ac9b0003
Author: Jani Nikula <jani.nikula@intel.com>
Date:   Thu May 30 13:01:51 2024 +0300

    drm/exynos/vidi: fix memory leak in .get_modes()
    
    commit 38e3825631b1f314b21e3ade00b5a4d737eb054e upstream.
    
    The duplicated EDID is never freed. Fix it.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Signed-off-by: Inki Dae <inki.dae@samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 760603e30bf19d7b4c28e9d81f18b54fa3b745ad
Author: Dirk Behme <dirk.behme@de.bosch.com>
Date:   Mon May 13 07:06:34 2024 +0200

    drivers: core: synchronize really_probe() and dev_uevent()
    
    commit c0a40097f0bc81deafc15f9195d1fb54595cd6d0 upstream.
    
    Synchronize the dev->driver usage in really_probe() and dev_uevent().
    These can run in different threads, what can result in the following
    race condition for dev->driver uninitialization:
    
    Thread #1:
    ==========
    
    really_probe() {
    ...
    probe_failed:
    ...
    device_unbind_cleanup(dev) {
        ...
        dev->driver = NULL;   // <= Failed probe sets dev->driver to NULL
        ...
        }
    ...
    }
    
    Thread #2:
    ==========
    
    dev_uevent() {
    ...
    if (dev->driver)
          // If dev->driver is NULLed from really_probe() from here on,
          // after above check, the system crashes
          add_uevent_var(env, "DRIVER=%s", dev->driver->name);
    ...
    }
    
    really_probe() holds the lock, already. So nothing needs to be done
    there. dev_uevent() is called with lock held, often, too. But not
    always. What implies that we can't add any locking in dev_uevent()
    itself. So fix this race by adding the lock to the non-protected
    path. This is the path where above race is observed:
    
     dev_uevent+0x235/0x380
     uevent_show+0x10c/0x1f0  <= Add lock here
     dev_attr_show+0x3a/0xa0
     sysfs_kf_seq_show+0x17c/0x250
     kernfs_seq_show+0x7c/0x90
     seq_read_iter+0x2d7/0x940
     kernfs_fop_read_iter+0xc6/0x310
     vfs_read+0x5bc/0x6b0
     ksys_read+0xeb/0x1b0
     __x64_sys_read+0x42/0x50
     x64_sys_call+0x27ad/0x2d30
     do_syscall_64+0xcd/0x1d0
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    
    Similar cases are reported by syzkaller in
    
    https://syzkaller.appspot.com/bug?extid=ffa8143439596313a85a
    
    But these are regarding the *initialization* of dev->driver
    
    dev->driver = drv;
    
    As this switches dev->driver to non-NULL these reports can be considered
    to be false-positives (which should be "fixed" by this commit, as well,
    though).
    
    The same issue was reported and tried to be fixed back in 2015 in
    
    https://lore.kernel.org/lkml/1421259054-2574-1-git-send-email-a.sangwan@samsung.com/
    
    already.
    
    Fixes: 239378f16aa1 ("Driver core: add uevent vars for devices of a class")
    Cc: stable <stable@kernel.org>
    Cc: syzbot+ffa8143439596313a85a@syzkaller.appspotmail.com
    Cc: Ashish Sangwan <a.sangwan@samsung.com>
    Cc: Namjae Jeon <namjae.jeon@samsung.com>
    Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>
    Link: https://lore.kernel.org/r/20240513050634.3964461-1-dirk.behme@de.bosch.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fd45d6f1949481b6a6f50d1d505ba8dd2579f0e6
Author: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Date:   Mon May 27 21:00:08 2024 +0000

    iio: imu: inv_icm42600: delete unneeded update watermark call
    
    commit 245f3b149e6cc3ac6ee612cdb7042263bfc9e73c upstream.
    
    Update watermark will be done inside the hwfifo_set_watermark callback
    just after the update_scan_mode. It is useless to do it here.
    
    Fixes: 7f85e42a6c54 ("iio: imu: inv_icm42600: add buffer support in iio devices")
    Cc: stable@vger.kernel.org
    Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
    Link: https://lore.kernel.org/r/20240527210008.612932-1-inv.git-commit@tdk.com
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9d4dce5870816ba7a85ba590d22ff60d1dcc6595
Author: Marc Ferland <marc.ferland@sonatest.com>
Date:   Wed May 1 11:05:54 2024 -0400

    iio: dac: ad5592r: fix temperature channel scaling value
    
    commit 279428df888319bf68f2686934897301a250bb84 upstream.
    
    The scale value for the temperature channel is (assuming Vref=2.5 and
    the datasheet):
    
        376.7897513
    
    When calculating both val and val2 for the temperature scale we
    use (3767897513/25) and multiply it by Vref (here I assume 2500mV) to
    obtain:
    
      2500 * (3767897513/25) ==> 376789751300
    
    Finally we divide with remainder by 10^9 to get:
    
        val = 376
        val2 = 789751300
    
    However, we return IIO_VAL_INT_PLUS_MICRO (should have been NANO) as
    the scale type. So when converting the raw temperature value to the
    'processed' temperature value we will get (assuming raw=810,
    offset=-753):
    
        processed = (raw + offset) * scale_val
                  = (810 + -753) * 376
                  = 21432
    
        processed += div((raw + offset) * scale_val2, 10^6)
                  += div((810 + -753) * 789751300, 10^6)
                  += 45015
        ==> 66447
        ==> 66.4 Celcius
    
    instead of the expected 21.5 Celsius.
    
    Fix this issue by changing IIO_VAL_INT_PLUS_MICRO to
    IIO_VAL_INT_PLUS_NANO.
    
    Fixes: 56ca9db862bf ("iio: dac: Add support for the AD5592R/AD5593R ADCs/DACs")
    Signed-off-by: Marc Ferland <marc.ferland@sonatest.com>
    Link: https://lore.kernel.org/r/20240501150554.1871390-1-marc.ferland@sonatest.com
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e4ce76890e5e7accccd9eebcb1a56b3c3c3eb4a1
Author: David Lechner <dlechner@baylibre.com>
Date:   Fri May 3 14:45:05 2024 -0500

    iio: adc: ad9467: fix scan type sign
    
    commit 8a01ef749b0a632f0e1f4ead0f08b3310d99fcb1 upstream.
    
    According to the IIO documentation, the sign in the scan type should be
    lower case. The ad9467 driver was incorrectly using upper case.
    
    Fix by changing to lower case.
    
    Fixes: 4606d0f4b05f ("iio: adc: ad9467: add support for AD9434 high-speed ADC")
    Fixes: ad6797120238 ("iio: adc: ad9467: add support AD9467 ADC")
    Signed-off-by: David Lechner <dlechner@baylibre.com>
    Link: https://lore.kernel.org/r/20240503-ad9467-fix-scan-type-sign-v1-1-c7a1a066ebb9@baylibre.com
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ff9c2a9426ecf5b9631e9fd74993b357262387d6
Author: Taehee Yoo <ap420073@gmail.com>
Date:   Wed Jun 12 06:04:46 2024 +0000

    ionic: fix use after netif_napi_del()
    
    [ Upstream commit 79f18a41dd056115d685f3b0a419c7cd40055e13 ]
    
    When queues are started, netif_napi_add() and napi_enable() are called.
    If there are 4 queues and only 3 queues are used for the current
    configuration, only 3 queues' napi should be registered and enabled.
    The ionic_qcq_enable() checks whether the .poll pointer is not NULL for
    enabling only the using queue' napi. Unused queues' napi will not be
    registered by netif_napi_add(), so the .poll pointer indicates NULL.
    But it couldn't distinguish whether the napi was unregistered or not
    because netif_napi_del() doesn't reset the .poll pointer to NULL.
    So, ionic_qcq_enable() calls napi_enable() for the queue, which was
    unregistered by netif_napi_del().
    
    Reproducer:
       ethtool -L <interface name> rx 1 tx 1 combined 0
       ethtool -L <interface name> rx 0 tx 0 combined 1
       ethtool -L <interface name> rx 0 tx 0 combined 4
    
    Splat looks like:
    kernel BUG at net/core/dev.c:6666!
    Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
    CPU: 3 PID: 1057 Comm: kworker/3:3 Not tainted 6.10.0-rc2+ #16
    Workqueue: events ionic_lif_deferred_work [ionic]
    RIP: 0010:napi_enable+0x3b/0x40
    Code: 48 89 c2 48 83 e2 f6 80 b9 61 09 00 00 00 74 0d 48 83 bf 60 01 00 00 00 74 03 80 ce 01 f0 4f
    RSP: 0018:ffffb6ed83227d48 EFLAGS: 00010246
    RAX: 0000000000000000 RBX: ffff97560cda0828 RCX: 0000000000000029
    RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff97560cda0a28
    RBP: ffffb6ed83227d50 R08: 0000000000000400 R09: 0000000000000001
    R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000
    R13: ffff97560ce3c1a0 R14: 0000000000000000 R15: ffff975613ba0a20
    FS:  0000000000000000(0000) GS:ffff975d5f780000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007f8f734ee200 CR3: 0000000103e50000 CR4: 00000000007506f0
    PKRU: 55555554
    Call Trace:
     <TASK>
     ? die+0x33/0x90
     ? do_trap+0xd9/0x100
     ? napi_enable+0x3b/0x40
     ? do_error_trap+0x83/0xb0
     ? napi_enable+0x3b/0x40
     ? napi_enable+0x3b/0x40
     ? exc_invalid_op+0x4e/0x70
     ? napi_enable+0x3b/0x40
     ? asm_exc_invalid_op+0x16/0x20
     ? napi_enable+0x3b/0x40
     ionic_qcq_enable+0xb7/0x180 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8]
     ionic_start_queues+0xc4/0x290 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8]
     ionic_link_status_check+0x11c/0x170 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8]
     ionic_lif_deferred_work+0x129/0x280 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8]
     process_one_work+0x145/0x360
     worker_thread+0x2bb/0x3d0
     ? __pfx_worker_thread+0x10/0x10
     kthread+0xcc/0x100
     ? __pfx_kthread+0x10/0x10
     ret_from_fork+0x2d/0x50
     ? __pfx_kthread+0x10/0x10
     ret_from_fork_asm+0x1a/0x30
    
    Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling")
    Signed-off-by: Taehee Yoo <ap420073@gmail.com>
    Reviewed-by: Brett Creeley <brett.creeley@amd.com>
    Reviewed-by: Shannon Nelson <shannon.nelson@amd.com>
    Link: https://lore.kernel.org/r/20240612060446.1754392-1-ap420073@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b278f9b458faef200dba5466b719cf14b641df74
Author: Petr Pavlu <petr.pavlu@suse.com>
Date:   Fri Jun 7 13:28:28 2024 +0200

    net/ipv6: Fix the RT cache flush via sysctl using a previous delay
    
    [ Upstream commit 14a20e5b4ad998793c5f43b0330d9e1388446cf3 ]
    
    The net.ipv6.route.flush system parameter takes a value which specifies
    a delay used during the flush operation for aging exception routes. The
    written value is however not used in the currently requested flush and
    instead utilized only in the next one.
    
    A problem is that ipv6_sysctl_rtcache_flush() first reads the old value
    of net->ipv6.sysctl.flush_delay into a local delay variable and then
    calls proc_dointvec() which actually updates the sysctl based on the
    provided input.
    
    Fix the problem by switching the order of the two operations.
    
    Fixes: 4990509f19e8 ("[NETNS][IPV6]: Make sysctls route per namespace.")
    Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
    Reviewed-by: David Ahern <dsahern@kernel.org>
    Link: https://lore.kernel.org/r/20240607112828.30285-1-petr.pavlu@suse.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 01ce5bdfdf8426a83bae16014c6545a2f3a8e5a6
Author: Xiaolei Wang <xiaolei.wang@windriver.com>
Date:   Sat Jun 8 22:35:24 2024 +0800

    net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs parameters
    
    [ Upstream commit be27b896529787e23a35ae4befb6337ce73fcca0 ]
    
    The current cbs parameter depends on speed after uplinking,
    which is not needed and will report a configuration error
    if the port is not initially connected. The UAPI exposed by
    tc-cbs requires userspace to recalculate the send slope anyway,
    because the formula depends on port_transmit_rate (see man tc-cbs),
    which is not an invariant from tc's perspective. Therefore, we
    use offload->sendslope and offload->idleslope to derive the
    original port_transmit_rate from the CBS formula.
    
    Fixes: 1f705bc61aee ("net: stmmac: Add support for CBS QDISC")
    Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
    Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
    Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
    Link: https://lore.kernel.org/r/20240608143524.2065736-1-xiaolei.wang@windriver.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 93b53c202b51a69e42ca57f5a183f7e008e19f83
Author: Jozsef Kadlecsik <kadlec@netfilter.org>
Date:   Tue Jun 4 15:58:03 2024 +0200

    netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
    
    [ Upstream commit 4e7aaa6b82d63e8ddcbfb56b4fd3d014ca586f10 ]
    
    Lion Ackermann reported that there is a race condition between namespace cleanup
    in ipset and the garbage collection of the list:set type. The namespace
    cleanup can destroy the list:set type of sets while the gc of the set type is
    waiting to run in rcu cleanup. The latter uses data from the destroyed set which
    thus leads use after free. The patch contains the following parts:
    
    - When destroying all sets, first remove the garbage collectors, then wait
      if needed and then destroy the sets.
    - Fix the badly ordered "wait then remove gc" for the destroy a single set
      case.
    - Fix the missing rcu locking in the list:set type in the userspace test
      case.
    - Use proper RCU list handlings in the list:set type.
    
    The patch depends on c1193d9bbbd3 (netfilter: ipset: Add list flush to cancel_gc).
    
    Fixes: 97f7cf1cd80e (netfilter: ipset: fix performance regression in swap operation)
    Reported-by: Lion Ackermann <nnamrec@gmail.com>
    Tested-by: Lion Ackermann <nnamrec@gmail.com>
    Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit ea1a98c9a3678148cf1484d8c0534fa3e5693bc0
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date:   Mon May 20 16:03:07 2024 -0400

    Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
    
    [ Upstream commit 806a5198c05987b748b50f3d0c0cfb3d417381a4 ]
    
    This removes the bogus check for max > hcon->le_conn_max_interval since
    the later is just the initial maximum conn interval not the maximum the
    stack could support which is really 3200=4000ms.
    
    In order to pass GAP/CONN/CPUP/BV-05-C one shall probably enter values
    of the following fields in IXIT that would cause hci_check_conn_params
    to fail:
    
    TSPX_conn_update_int_min
    TSPX_conn_update_int_max
    TSPX_conn_update_peripheral_latency
    TSPX_conn_update_supervision_timeout
    
    Link: https://github.com/bluez/bluez/issues/847
    Fixes: e4b019515f95 ("Bluetooth: Enforce validation on max value of connection interval")
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit dfd7f4670723fa79542e67fc6222ef94780d77f0
Author: Gal Pressman <gal@nvidia.com>
Date:   Thu Jun 6 23:32:49 2024 +0300

    net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets
    
    [ Upstream commit 791b4089e326271424b78f2fae778b20e53d071b ]
    
    Move the vxlan_features_check() call to after we verified the packet is
    a tunneled VXLAN packet.
    
    Without this, tunneled UDP non-VXLAN packets (for ex. GENENVE) might
    wrongly not get offloaded.
    In some cases, it worked by chance as GENEVE header is the same size as
    VXLAN, but it is obviously incorrect.
    
    Fixes: e3cfc7e6b7bd ("net/mlx5e: TX, Add geneve tunnel stateless offload support")
    Signed-off-by: Gal Pressman <gal@nvidia.com>
    Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
    Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
    Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 330c8661c993a2e59179ab22c65fd2650c47c8c7
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Jun 6 15:46:51 2024 +0000

    tcp: fix race in tcp_v6_syn_recv_sock()
    
    [ Upstream commit d37fe4255abe8e7b419b90c5847e8ec2b8debb08 ]
    
    tcp_v6_syn_recv_sock() calls ip6_dst_store() before
    inet_sk(newsk)->pinet6 has been set up.
    
    This means ip6_dst_store() writes over the parent (listener)
    np->dst_cookie.
    
    This is racy because multiple threads could share the same
    parent and their final np->dst_cookie could be wrong.
    
    Move ip6_dst_store() call after inet_sk(newsk)->pinet6
    has been changed and after the copy of parent ipv6_pinfo.
    
    Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 9b164605c115d953a7b44c12504a0f797f7da2d6
Author: Adam Miotk <adam.miotk@arm.com>
Date:   Mon Jun 10 11:27:39 2024 +0100

    drm/bridge/panel: Fix runtime warning on panel bridge release
    
    [ Upstream commit ce62600c4dbee8d43b02277669dd91785a9b81d9 ]
    
    Device managed panel bridge wrappers are created by calling to
    drm_panel_bridge_add_typed() and registering a release handler for
    clean-up when the device gets unbound.
    
    Since the memory for this bridge is also managed and linked to the panel
    device, the release function should not try to free that memory.
    Moreover, the call to devm_kfree() inside drm_panel_bridge_remove() will
    fail in this case and emit a warning because the panel bridge resource
    is no longer on the device resources list (it has been removed from
    there before the call to release handlers).
    
    Fixes: 67022227ffb1 ("drm/bridge: Add a devm_ allocator for panel bridge.")
    Signed-off-by: Adam Miotk <adam.miotk@arm.com>
    Signed-off-by: Maxime Ripard <mripard@kernel.org>
    Link: https://patchwork.freedesktop.org/patch/msgid/20240610102739.139852-1-adam.miotk@arm.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit bda7cdaeebf57e46c1a488ae7a15f6f264691f59
Author: Amjad Ouled-Ameur <amjad.ouled-ameur@arm.com>
Date:   Mon Jun 10 11:20:56 2024 +0100

    drm/komeda: check for error-valued pointer
    
    [ Upstream commit b880018edd3a577e50366338194dee9b899947e0 ]
    
    komeda_pipeline_get_state() may return an error-valued pointer, thus
    check the pointer for negative or null value before dereferencing.
    
    Fixes: 502932a03fce ("drm/komeda: Add the initial scaler support for CORE")
    Signed-off-by: Amjad Ouled-Ameur <amjad.ouled-ameur@arm.com>
    Signed-off-by: Maxime Ripard <mripard@kernel.org>
    Link: https://patchwork.freedesktop.org/patch/msgid/20240610102056.40406-1-amjad.ouled-ameur@arm.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit cbf18d8128a753cb632bef39470d19befd9c7347
Author: Aleksandr Mishin <amishin@t-argos.ru>
Date:   Wed Jun 5 13:11:35 2024 +0300

    liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
    
    [ Upstream commit c44711b78608c98a3e6b49ce91678cd0917d5349 ]
    
    In lio_vf_rep_copy_packet() pg_info->page is compared to a NULL value,
    but then it is unconditionally passed to skb_add_rx_frag() which looks
    strange and could lead to null pointer dereference.
    
    lio_vf_rep_copy_packet() call trace looks like:
            octeon_droq_process_packets
             octeon_droq_fast_process_packets
              octeon_droq_dispatch_pkt
               octeon_create_recv_info
                ...search in the dispatch_list...
                 ->disp_fn(rdisp->rinfo, ...)
                  lio_vf_rep_pkt_recv(struct octeon_recv_info *recv_info, ...)
    In this path there is no code which sets pg_info->page to NULL.
    So this check looks unneeded and doesn't solve potential problem.
    But I guess the author had reason to add a check and I have no such card
    and can't do real test.
    In addition, the code in the function liquidio_push_packet() in
    liquidio/lio_core.c does exactly the same.
    
    Based on this, I consider the most acceptable compromise solution to
    adjust this issue by moving skb_add_rx_frag() into conditional scope.
    
    Found by Linux Verification Center (linuxtesting.org) with SVACE.
    
    Fixes: 1f233f327913 ("liquidio: switchdev support for LiquidIO NIC")
    Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 187e293c82607c08c719f050385776fb9b565d85
Author: Jie Wang <wangjie125@huawei.com>
Date:   Wed Jun 5 15:20:58 2024 +0800

    net: hns3: add cond_resched() to hns3 ring buffer init process
    
    [ Upstream commit 968fde83841a8c23558dfbd0a0c69d636db52b55 ]
    
    Currently hns3 ring buffer init process would hold cpu too long with big
    Tx/Rx ring depth. This could cause soft lockup.
    
    So this patch adds cond_resched() to the process. Then cpu can break to
    run other tasks instead of busy looping.
    
    Fixes: a723fb8efe29 ("net: hns3: refine for set ring parameters")
    Signed-off-by: Jie Wang <wangjie125@huawei.com>
    Signed-off-by: Jijie Shao <shaojijie@huawei.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit bd8e1e6af6d9e29edaeaa86ab51c41123760ebc2
Author: Csókás, Bence <csokas.bence@prolan.hu>
Date:   Wed Jun 5 10:42:51 2024 +0200

    net: sfp: Always call `sfp_sm_mod_remove()` on remove
    
    [ Upstream commit e96b2933152fd87b6a41765b2f58b158fde855b6 ]
    
    If the module is in SFP_MOD_ERROR, `sfp_sm_mod_remove()` will
    not be run. As a consequence, `sfp_hwmon_remove()` is not getting
    run either, leaving a stale `hwmon` device behind. `sfp_sm_mod_remove()`
    itself checks `sfp->sm_mod_state` anyways, so this check was not
    really needed in the first place.
    
    Fixes: d2e816c0293f ("net: sfp: handle module remove outside state machine")
    Signed-off-by: "Csókás, Bence" <csokas.bence@prolan.hu>
    Reviewed-by: Andrew Lunn <andrew@lunn.ch>
    Link: https://lore.kernel.org/r/20240605084251.63502-1-csokas.bence@prolan.hu
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit abc55e738b4337f26d16ec70159fb8288767fd5e
Author: Ian Forbes <ian.forbes@broadcom.com>
Date:   Tue May 21 13:47:18 2024 -0500

    drm/vmwgfx: 3D disabled should not effect STDU memory limits
    
    [ Upstream commit fb5e19d2dd03eb995ccd468d599b2337f7f66555 ]
    
    This limit became a hard cap starting with the change referenced below.
    Surface creation on the device will fail if the requested size is larger
    than this limit so altering the value arbitrarily will expose modes that
    are too large for the device's hard limits.
    
    Fixes: 7ebb47c9f9ab ("drm/vmwgfx: Read new register for GB memory when available")
    
    Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
    Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20240521184720.767-3-ian.forbes@broadcom.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit caa9c9acb93db7ad7b74b157cf101579bac9596d
Author: José Expósito <jose.exposito89@gmail.com>
Date:   Fri May 24 15:05:39 2024 +0200

    HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()
    
    [ Upstream commit ce3af2ee95170b7d9e15fff6e500d67deab1e7b3 ]
    
    Fix a memory leak on logi_dj_recv_send_report() error path.
    
    Fixes: 6f20d3261265 ("HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode()")
    Signed-off-by: José Expósito <jose.exposito89@gmail.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit cf34f8f66982a36e5cba0d05781b21ec9606b91e
Author: Lu Baolu <baolu.lu@linux.intel.com>
Date:   Tue May 28 12:25:28 2024 +0800

    iommu: Return right value in iommu_sva_bind_device()
    
    [ Upstream commit 89e8a2366e3bce584b6c01549d5019c5cda1205e ]
    
    iommu_sva_bind_device() should return either a sva bond handle or an
    ERR_PTR value in error cases. Existing drivers (idxd and uacce) only
    check the return value with IS_ERR(). This could potentially lead to
    a kernel NULL pointer dereference issue if the function returns NULL
    instead of an error pointer.
    
    In reality, this doesn't cause any problems because iommu_sva_bind_device()
    only returns NULL when the kernel is not configured with CONFIG_IOMMU_SVA.
    In this case, iommu_dev_enable_feature(dev, IOMMU_DEV_FEAT_SVA) will
    return an error, and the device drivers won't call iommu_sva_bind_device()
    at all.
    
    Fixes: 26b25a2b98e4 ("iommu: Bind process address spaces to devices")
    Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
    Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
    Reviewed-by: Kevin Tian <kevin.tian@intel.com>
    Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
    Link: https://lore.kernel.org/r/20240528042528.71396-1-baolu.lu@linux.intel.com
    Signed-off-by: Joerg Roedel <jroedel@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit d4673a34d8fd7254b16e6e707a0bf9e866b69ac7
Author: Kun(llfl) <llfl@linux.alibaba.com>
Date:   Thu May 9 08:42:20 2024 +0800

    iommu/amd: Fix sysfs leak in iommu init
    
    [ Upstream commit a295ec52c8624883885396fde7b4df1a179627c3 ]
    
    During the iommu initialization, iommu_init_pci() adds sysfs nodes.
    However, these nodes aren't remove in free_iommu_resources() subsequently.
    
    Fixes: 39ab9555c241 ("iommu: Add sysfs bindings for struct iommu_device")
    Signed-off-by: Kun(llfl) <llfl@linux.alibaba.com>
    Reviewed-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
    Link: https://lore.kernel.org/r/c8e0d11c6ab1ee48299c288009cf9c5dae07b42d.1715215003.git.llfl@linux.alibaba.com
    Signed-off-by: Joerg Roedel <jroedel@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit c0f1bd317b3a539546739aef47fa5d384fa88d83
Author: Vasant Hegde <vasant.hegde@amd.com>
Date:   Wed Jul 6 17:07:52 2022 +0530

    iommu/amd: Introduce pci segment structure
    
    [ Upstream commit 404ec4e4c169fb64da6b2a38b471c13ac0897c76 ]
    
    Newer AMD systems can support multiple PCI segments, where each segment
    contains one or more IOMMU instances. However, an IOMMU instance can only
    support a single PCI segment.
    
    Current code assumes that system contains only one pci segment (segment 0)
    and creates global data structures such as device table, rlookup table,
    etc.
    
    Introducing per PCI segment data structure, which contains segment
    specific data structures. This will eventually replace the global
    data structures.
    
    Also update `amd_iommu->pci_seg` variable to point to PCI segment
    structure instead of PCI segment ID.
    
    Co-developed-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
    Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
    Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
    Link: https://lore.kernel.org/r/20220706113825.25582-3-vasant.hegde@amd.com
    Signed-off-by: Joerg Roedel <jroedel@suse.de>
    Stable-dep-of: a295ec52c862 ("iommu/amd: Fix sysfs leak in iommu init")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a843c0e9da326482f079285f58a727db9a43d5b5
Author: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
Date:   Thu May 30 12:20:01 2024 +0200

    gpio: tqmx86: store IRQ trigger type and unmask status separately
    
    commit 08af509efdf8dad08e972b48de0e2c2a7919ea8b upstream.
    
    irq_set_type() should not implicitly unmask the IRQ.
    
    All accesses to the interrupt configuration register are moved to a new
    helper tqmx86_gpio_irq_config(). We also introduce the new rule that
    accessing irq_type must happen while locked, which will become
    significant for fixing EDGE_BOTH handling.
    
    Fixes: b868db94a6a7 ("gpio: tqmx86: Add GPIO from for this IO controller")
    Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
    Link: https://lore.kernel.org/r/6aa4f207f77cb58ef64ffb947e91949b0f753ccd.1717063994.git.matthias.schiffer@ew.tq-group.com
    Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 33f6832798dd3297317901cc1db556ac3ae80c24
Author: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Date:   Fri May 17 07:19:14 2024 -0700

    HID: core: remove unnecessary WARN_ON() in implement()
    
    [ Upstream commit 4aa2dcfbad538adf7becd0034a3754e1bd01b2b5 ]
    
    Syzkaller hit a warning [1] in a call to implement() when trying
    to write a value into a field of smaller size in an output report.
    
    Since implement() already has a warn message printed out with the
    help of hid_warn() and value in question gets trimmed with:
            ...
            value &= m;
            ...
    WARN_ON may be considered superfluous. Remove it to suppress future
    syzkaller triggers.
    
    [1]
    WARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 implement drivers/hid/hid-core.c:1451 [inline]
    WARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863
    Modules linked in:
    CPU: 0 PID: 5084 Comm: syz-executor424 Not tainted 6.9.0-rc7-syzkaller-00183-gcf87f46fd34d #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
    RIP: 0010:implement drivers/hid/hid-core.c:1451 [inline]
    RIP: 0010:hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863
    ...
    Call Trace:
     <TASK>
     __usbhid_submit_report drivers/hid/usbhid/hid-core.c:591 [inline]
     usbhid_submit_report+0x43d/0x9e0 drivers/hid/usbhid/hid-core.c:636
     hiddev_ioctl+0x138b/0x1f00 drivers/hid/usbhid/hiddev.c:726
     vfs_ioctl fs/ioctl.c:51 [inline]
     __do_sys_ioctl fs/ioctl.c:904 [inline]
     __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    ...
    
    Fixes: 95d1c8951e5b ("HID: simplify implement() a bit")
    Reported-by: <syzbot+5186630949e3c55f0799@syzkaller.appspotmail.com>
    Suggested-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
    Signed-off-by: Jiri Kosina <jkosina@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 544015b94589fd8a3cfe0870ed9b11539cf354a0
Author: Gregor Herburger <gregor.herburger@tq-group.com>
Date:   Thu May 30 12:19:59 2024 +0200

    gpio: tqmx86: fix typo in Kconfig label
    
    [ Upstream commit 8c219e52ca4d9a67cd6a7074e91bf29b55edc075 ]
    
    Fix description for GPIO_TQMX86 from QTMX86 to TQMx86.
    
    Fixes: b868db94a6a7 ("gpio: tqmx86: Add GPIO from for this IO controller")
    Signed-off-by: Gregor Herburger <gregor.herburger@tq-group.com>
    Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
    Reviewed-by: Andrew Lunn <andrew@lunn.ch>
    Link: https://lore.kernel.org/r/e0e38c9944ad6d281d9a662a45d289b88edc808e.1717063994.git.matthias.schiffer@ew.tq-group.com
    Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 66c79c5acc5c6cc9fdb1e2977c03cdb7905badae
Author: Chen Hanxiao <chenhx.fnst@fujitsu.com>
Date:   Thu May 23 16:47:16 2024 +0800

    SUNRPC: return proper error from gss_wrap_req_priv
    
    [ Upstream commit 33c94d7e3cb84f6d130678d6d59ba475a6c489cf ]
    
    don't return 0 if snd_buf->len really greater than snd_buf->buflen
    
    Signed-off-by: Chen Hanxiao <chenhx.fnst@fujitsu.com>
    Fixes: 0c77668ddb4e ("SUNRPC: Introduce trace points in rpc_auth_gss.ko")
    Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
    Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b6a204f937e6372bfbff681f992bc226d5db5169
Author: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date:   Mon Apr 29 14:50:41 2024 -0700

    Input: try trimming too long modalias strings
    
    commit 0774d19038c496f0c3602fb505c43e1b2d8eed85 upstream.
    
    If an input device declares too many capability bits then modalias
    string for such device may become too long and not fit into uevent
    buffer, resulting in failure of sending said uevent. This, in turn,
    may prevent userspace from recognizing existence of such devices.
    
    This is typically not a concern for real hardware devices as they have
    limited number of keys, but happen with synthetic devices such as
    ones created by xen-kbdfront driver, which creates devices as being
    capable of delivering all possible keys, since it doesn't know what
    keys the backend may produce.
    
    To deal with such devices input core will attempt to trim key data,
    in the hope that the rest of modalias string will fit in the given
    buffer. When trimming key data it will indicate that it is not
    complete by placing "+," sign, resulting in conversions like this:
    
    old: k71,72,73,74,78,7A,7B,7C,7D,8E,9E,A4,AD,E0,E1,E4,F8,174,
    new: k71,72,73,74,78,7A,7B,7C,+,
    
    This should allow existing udev rules continue to work with existing
    devices, and will also allow writing more complex rules that would
    recognize trimmed modalias and check input device characteristics by
    other means (for example by parsing KEY= data in uevent or parsing
    input device sysfs attributes).
    
    Note that the driver core may try adding more uevent environment
    variables once input core is done adding its own, so when forming
    modalias we can not use the entire available buffer, so we reduce
    it by somewhat an arbitrary amount (96 bytes).
    
    Reported-by: Jason Andryuk <jandryuk@gmail.com>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Tested-by: Jason Andryuk <jandryuk@gmail.com>
    Link: https://lore.kernel.org/r/ZjAWMQCJdrxZkvkB@google.com
    Cc: stable@vger.kernel.org
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>

commit 20b3f435b7c1bb74f2d68ed67c37cbe39fcb06d3
Author: Michael Ellerman <mpe@ellerman.id.au>
Date:   Wed May 29 22:30:28 2024 +1000

    powerpc/uaccess: Fix build errors seen with GCC 13/14
    
    commit 2d43cc701b96f910f50915ac4c2a0cae5deb734c upstream.
    
    Building ppc64le_defconfig with GCC 14 fails with assembler errors:
    
        CC      fs/readdir.o
      /tmp/ccdQn0mD.s: Assembler messages:
      /tmp/ccdQn0mD.s:212: Error: operand out of domain (18 is not a multiple of 4)
      /tmp/ccdQn0mD.s:226: Error: operand out of domain (18 is not a multiple of 4)
      ... [6 lines]
      /tmp/ccdQn0mD.s:1699: Error: operand out of domain (18 is not a multiple of 4)
    
    A snippet of the asm shows:
    
      # ../fs/readdir.c:210:         unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault_end);
             ld 9,0(29)       # MEM[(u64 *)name_38(D) + _88 * 1], MEM[(u64 *)name_38(D) + _88 * 1]
      # 210 "../fs/readdir.c" 1
             1:      std 9,18(8)     # put_user       # *__pus_addr_52, MEM[(u64 *)name_38(D) + _88 * 1]
    
    The 'std' instruction requires a 4-byte aligned displacement because
    it is a DS-form instruction, and as the assembler says, 18 is not a
    multiple of 4.
    
    A similar error is seen with GCC 13 and CONFIG_UBSAN_SIGNED_WRAP=y.
    
    The fix is to change the constraint on the memory operand to put_user(),
    from "m" which is a general memory reference to "YZ".
    
    The "Z" constraint is documented in the GCC manual PowerPC machine
    constraints, and specifies a "memory operand accessed with indexed or
    indirect addressing". "Y" is not documented in the manual but specifies
    a "memory operand for a DS-form instruction". Using both allows the
    compiler to generate a DS-form "std" or X-form "stdx" as appropriate.
    
    The change has to be conditional on CONFIG_PPC_KERNEL_PREFIXED because
    the "Y" constraint does not guarantee 4-byte alignment when prefixed
    instructions are enabled.
    
    Unfortunately clang doesn't support the "Y" constraint so that has to be
    behind an ifdef.
    
    Although the build error is only seen with GCC 13/14, that appears
    to just be luck. The constraint has been incorrect since it was first
    added.
    
    Fixes: c20beffeec3c ("powerpc/uaccess: Use flexible addressing with __put_user()/__get_user()")
    Cc: stable@vger.kernel.org # v5.10+
    Suggested-by: Kewen Lin <linkw@gcc.gnu.org>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Link: https://msgid.link/20240529123029.146953-1-mpe@ellerman.id.au
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0081d2b3ae0a17a86b8cc0fa3c8bdc54e233ba16
Author: Breno Leitao <leitao@debian.org>
Date:   Wed Jun 5 01:55:29 2024 -0700

    scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
    
    commit 4254dfeda82f20844299dca6c38cbffcfd499f41 upstream.
    
    There is a potential out-of-bounds access when using test_bit() on a single
    word. The test_bit() and set_bit() functions operate on long values, and
    when testing or setting a single word, they can exceed the word
    boundary. KASAN detects this issue and produces a dump:
    
             BUG: KASAN: slab-out-of-bounds in _scsih_add_device.constprop.0 (./arch/x86/include/asm/bitops.h:60 ./include/asm-generic/bitops/instrumented-atomic.h:29 drivers/scsi/mpt3sas/mpt3sas_scsih.c:7331) mpt3sas
    
             Write of size 8 at addr ffff8881d26e3c60 by task kworker/u1536:2/2965
    
    For full log, please look at [1].
    
    Make the allocation at least the size of sizeof(unsigned long) so that
    set_bit() and test_bit() have sufficient room for read/write operations
    without overwriting unallocated memory.
    
    [1] Link: https://lore.kernel.org/all/ZkNcALr3W3KGYYJG@gmail.com/
    
    Fixes: c696f7b83ede ("scsi: mpt3sas: Implement device_remove_in_progress check in IOCTL path")
    Cc: stable@vger.kernel.org
    Suggested-by: Keith Busch <kbusch@kernel.org>
    Signed-off-by: Breno Leitao <leitao@debian.org>
    Link: https://lore.kernel.org/r/20240605085530.499432-1-leitao@debian.org
    Reviewed-by: Keith Busch <kbusch@kernel.org>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit baeae72258ad68674aca94e8b84478ca169014df
Author: Kuangyi Chiang <ki.chiang65@gmail.com>
Date:   Tue Jun 11 15:06:09 2024 +0300

    xhci: Apply broken streams quirk to Etron EJ188 xHCI host
    
    commit 91f7a1524a92c70ffe264db8bdfa075f15bbbeb9 upstream.
    
    As described in commit 8f873c1ff4ca ("xhci: Blacklist using streams on the
    Etron EJ168 controller"), EJ188 have the same issue as EJ168, where Streams
    do not work reliable on EJ188. So apply XHCI_BROKEN_STREAMS quirk to EJ188
    as well.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Kuangyi Chiang <ki.chiang65@gmail.com>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Link: https://lore.kernel.org/r/20240611120610.3264502-4-mathias.nyman@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0b05b12e2d03c617e8581d95cad36777b8572df0
Author: Kuangyi Chiang <ki.chiang65@gmail.com>
Date:   Tue Jun 11 15:06:08 2024 +0300

    xhci: Apply reset resume quirk to Etron EJ188 xHCI host
    
    commit 17bd54555c2aaecfdb38e2734149f684a73fa584 upstream.
    
    As described in commit c877b3b2ad5c ("xhci: Add reset on resume quirk for
    asrock p67 host"), EJ188 have the same issue as EJ168, where completely
    dies on resume. So apply XHCI_RESET_ON_RESUME quirk to EJ188 as well.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Kuangyi Chiang <ki.chiang65@gmail.com>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Link: https://lore.kernel.org/r/20240611120610.3264502-3-mathias.nyman@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 22de7c9cba6fd1ddbe967a1992477f184af3321d
Author: Mathias Nyman <mathias.nyman@linux.intel.com>
Date:   Tue Jun 11 15:06:07 2024 +0300

    xhci: Set correct transferred length for cancelled bulk transfers
    
    commit f0260589b439e2637ad54a2b25f00a516ef28a57 upstream.
    
    The transferred length is set incorrectly for cancelled bulk
    transfer TDs in case the bulk transfer ring stops on the last transfer
    block with a 'Stop - Length Invalid' completion code.
    
    length essentially ends up being set to the requested length:
    urb->actual_length = urb->transfer_buffer_length
    
    Length for 'Stop - Length Invalid' cases should be the sum of all
    TRB transfer block lengths up to the one the ring stopped on,
    _excluding_ the one stopped on.
    
    Fix this by always summing up TRB lengths for 'Stop - Length Invalid'
    bulk cases.
    
    This issue was discovered by Alan Stern while debugging
    https://bugzilla.kernel.org/show_bug.cgi?id=218890, but does not
    solve that bug. Issue is older than 4.10 kernel but fix won't apply
    to those due to major reworks in that area.
    
    Tested-by: Pierre Tomon <pierretom+12@ik.me>
    Cc: stable@vger.kernel.org # v4.10+
    Cc: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Link: https://lore.kernel.org/r/20240611120610.3264502-2-mathias.nyman@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fc745f6e83cb650f9a5f2c864158e3a5ea76dad0
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Tue May 14 12:06:34 2024 +0200

    jfs: xattr: fix buffer overflow for invalid xattr
    
    commit 7c55b78818cfb732680c4a72ab270cc2d2ee3d0f upstream.
    
    When an xattr size is not what is expected, it is printed out to the
    kernel log in hex format as a form of debugging.  But when that xattr
    size is bigger than the expected size, printing it out can cause an
    access off the end of the buffer.
    
    Fix this all up by properly restricting the size of the debug hex dump
    in the kernel log.
    
    Reported-by: syzbot+9dfe490c8176301c1d06@syzkaller.appspotmail.com
    Cc: Dave Kleikamp <shaggy@kernel.org>
    Link: https://lore.kernel.org/r/2024051433-slider-cloning-98f9@gregkh
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 498ff29800a6e1a6d11e49251ae122354691afff
Author: Tomas Winkler <tomas.winkler@intel.com>
Date:   Tue Jun 4 12:07:28 2024 +0300

    mei: me: release irq in mei_me_pci_resume error path
    
    commit 283cb234ef95d94c61f59e1cd070cd9499b51292 upstream.
    
    The mei_me_pci_resume doesn't release irq on the error path,
    in case mei_start() fails.
    
    Cc: <stable@kernel.org>
    Fixes: 33ec08263147 ("mei: revamp mei reset state machine")
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Link: https://lore.kernel.org/r/20240604090728.1027307-1-tomas.winkler@intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c0747d76eb05542b5d49f67069b64ef5ff732c6c
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Thu Jun 13 21:30:43 2024 -0400

    USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
    
    commit 22f00812862564b314784167a89f27b444f82a46 upstream.
    
    The syzbot fuzzer found that the interrupt-URB completion callback in
    the cdc-wdm driver was taking too long, and the driver's immediate
    resubmission of interrupt URBs with -EPROTO status combined with the
    dummy-hcd emulation to cause a CPU lockup:
    
    cdc_wdm 1-1:1.0: nonzero urb status received: -71
    cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes
    watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [syz-executor782:6625]
    CPU#0 Utilization every 4s during lockup:
            #1:  98% system,          0% softirq,     3% hardirq,     0% idle
            #2:  98% system,          0% softirq,     3% hardirq,     0% idle
            #3:  98% system,          0% softirq,     3% hardirq,     0% idle
            #4:  98% system,          0% softirq,     3% hardirq,     0% idle
            #5:  98% system,          1% softirq,     3% hardirq,     0% idle
    Modules linked in:
    irq event stamp: 73096
    hardirqs last  enabled at (73095): [<ffff80008037bc00>] console_emit_next_record kernel/printk/printk.c:2935 [inline]
    hardirqs last  enabled at (73095): [<ffff80008037bc00>] console_flush_all+0x650/0xb74 kernel/printk/printk.c:2994
    hardirqs last disabled at (73096): [<ffff80008af10b00>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]
    hardirqs last disabled at (73096): [<ffff80008af10b00>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551
    softirqs last  enabled at (73048): [<ffff8000801ea530>] softirq_handle_end kernel/softirq.c:400 [inline]
    softirqs last  enabled at (73048): [<ffff8000801ea530>] handle_softirqs+0xa60/0xc34 kernel/softirq.c:582
    softirqs last disabled at (73043): [<ffff800080020de8>] __do_softirq+0x14/0x20 kernel/softirq.c:588
    CPU: 0 PID: 6625 Comm: syz-executor782 Tainted: G        W          6.10.0-rc2-syzkaller-g8867bbd4a056 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
    
    Testing showed that the problem did not occur if the two error
    messages -- the first two lines above -- were removed; apparently adding
    material to the kernel log takes a surprisingly large amount of time.
    
    In any case, the best approach for preventing these lockups and to
    avoid spamming the log with thousands of error messages per second is
    to ratelimit the two dev_err() calls.  Therefore we replace them with
    dev_err_ratelimited().
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Suggested-by: Greg KH <gregkh@linuxfoundation.org>
    Reported-and-tested-by: syzbot+5f996b83575ef4058638@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/linux-usb/00000000000073d54b061a6a1c65@google.com/
    Reported-and-tested-by: syzbot+1b2abad17596ad03dcff@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/linux-usb/000000000000f45085061aa9b37e@google.com/
    Fixes: 9908a32e94de ("USB: remove err() macro from usb class drivers")
    Link: https://lore.kernel.org/linux-usb/40dfa45b-5f21-4eef-a8c1-51a2f320e267@rowland.harvard.edu/
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/29855215-52f5-4385-b058-91f42c2bee18@rowland.harvard.edu
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c77ad608df6c091fe64ecb91f41ef7cb465587f1
Author: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Date:   Tue Jun 4 22:42:55 2024 +0900

    nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
    
    [ Upstream commit 7373a51e7998b508af7136530f3a997b286ce81c ]
    
    The error handling in nilfs_empty_dir() when a directory folio/page read
    fails is incorrect, as in the old ext2 implementation, and if the
    folio/page cannot be read or nilfs_check_folio() fails, it will falsely
    determine the directory as empty and corrupt the file system.
    
    In addition, since nilfs_empty_dir() does not immediately return on a
    failed folio/page read, but continues to loop, this can cause a long loop
    with I/O if i_size of the directory's inode is also corrupted, causing the
    log writer thread to wait and hang, as reported by syzbot.
    
    Fix these issues by making nilfs_empty_dir() immediately return a false
    value (0) if it fails to get a directory folio/page.
    
    Link: https://lkml.kernel.org/r/20240604134255.7165-1-konishi.ryusuke@gmail.com
    Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
    Reported-by: syzbot+c8166c541d3971bf6c87@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=c8166c541d3971bf6c87
    Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations")
    Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit adf1b931d50b929c197dcbda47caa7469f6b0a26
Author: Matthew Wilcox (Oracle) <willy@infradead.org>
Date:   Mon Nov 27 23:30:25 2023 +0900

    nilfs2: return the mapped address from nilfs_get_page()
    
    [ Upstream commit 09a46acb3697e50548bb265afa1d79163659dd85 ]
    
    In prepartion for switching from kmap() to kmap_local(), return the kmap
    address from nilfs_get_page() instead of having the caller look up
    page_address().
    
    [konishi.ryusuke: fixed a missing blank line after declaration]
    Link: https://lkml.kernel.org/r/20231127143036.2425-7-konishi.ryusuke@gmail.com
    Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
    Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Stable-dep-of: 7373a51e7998 ("nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8b56df81b369eb4eb3ded759a96fa2bff55605c2
Author: Matthew Wilcox (Oracle) <willy@infradead.org>
Date:   Tue May 17 18:12:25 2022 -0400

    nilfs2: Remove check for PageError
    
    [ Upstream commit 79ea65563ad8aaab309d61eeb4d5019dd6cf5fa0 ]
    
    If read_mapping_page() encounters an error, it returns an errno, not a
    page with PageError set, so this test is not needed.
    
    Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
    Stable-dep-of: 7373a51e7998 ("nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 05544fd3f18a66e6d34fc1d4b580de59861a6f8b
Author: Filipe Manana <fdmanana@suse.com>
Date:   Mon Jun 3 12:49:08 2024 +0100

    btrfs: fix leak of qgroup extent records after transaction abort
    
    [ Upstream commit fb33eb2ef0d88e75564983ef057b44c5b7e4fded ]
    
    Qgroup extent records are created when delayed ref heads are created and
    then released after accounting extents at btrfs_qgroup_account_extents(),
    called during the transaction commit path.
    
    If a transaction is aborted we free the qgroup records by calling
    btrfs_qgroup_destroy_extent_records() at btrfs_destroy_delayed_refs(),
    unless we don't have delayed references. We are incorrectly assuming
    that no delayed references means we don't have qgroup extents records.
    
    We can currently have no delayed references because we ran them all
    during a transaction commit and the transaction was aborted after that
    due to some error in the commit path.
    
    So fix this by ensuring we btrfs_qgroup_destroy_extent_records() at
    btrfs_destroy_delayed_refs() even if we don't have any delayed references.
    
    Reported-by: syzbot+0fecc032fa134afd49df@syzkaller.appspotmail.com
    Link: https://lore.kernel.org/linux-btrfs/0000000000004e7f980619f91835@google.com/
    Fixes: 81f7eb00ff5b ("btrfs: destroy qgroup extent records on transaction abort")
    CC: stable@vger.kernel.org # 6.1+
    Reviewed-by: Josef Bacik <josef@toxicpanda.com>
    Reviewed-by: Qu Wenruo <wqu@suse.com>
    Signed-off-by: Filipe Manana <fdmanana@suse.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 79bf1ea0d52233a1e80e8f2bcebeca7f9bc7218c
Author: Dev Jain <dev.jain@arm.com>
Date:   Tue May 21 13:13:56 2024 +0530

    selftests/mm: compaction_test: fix bogus test success on Aarch64
    
    [ Upstream commit d4202e66a4b1fe6968f17f9f09bbc30d08f028a1 ]
    
    Patch series "Fixes for compaction_test", v2.
    
    The compaction_test memory selftest introduces fragmentation in memory
    and then tries to allocate as many hugepages as possible. This series
    addresses some problems.
    
    On Aarch64, if nr_hugepages == 0, then the test trivially succeeds since
    compaction_index becomes 0, which is less than 3, due to no division by
    zero exception being raised. We fix that by checking for division by
    zero.
    
    Secondly, correctly set the number of hugepages to zero before trying
    to set a large number of them.
    
    Now, consider a situation in which, at the start of the test, a non-zero
    number of hugepages have been already set (while running the entire
    selftests/mm suite, or manually by the admin). The test operates on 80%
    of memory to avoid OOM-killer invocation, and because some memory is
    already blocked by hugepages, it would increase the chance of OOM-killing.
    Also, since mem_free used in check_compaction() is the value before we
    set nr_hugepages to zero, the chance that the compaction_index will
    be small is very high if the preset nr_hugepages was high, leading to a
    bogus test success.
    
    This patch (of 3):
    
    Currently, if at runtime we are not able to allocate a huge page, the test
    will trivially pass on Aarch64 due to no exception being raised on
    division by zero while computing compaction_index.  Fix that by checking
    for nr_hugepages == 0.  Anyways, in general, avoid a division by zero by
    exiting the program beforehand.  While at it, fix a typo, and handle the
    case where the number of hugepages may overflow an integer.
    
    Link: https://lkml.kernel.org/r/20240521074358.675031-1-dev.jain@arm.com
    Link: https://lkml.kernel.org/r/20240521074358.675031-2-dev.jain@arm.com
    Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory")
    Signed-off-by: Dev Jain <dev.jain@arm.com>
    Cc: Anshuman Khandual <anshuman.khandual@arm.com>
    Cc: Shuah Khan <shuah@kernel.org>
    Cc: Sri Jayaramappa <sjayaram@akamai.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7c1cc0a5d43f0ace5fded23ddc2d01ae5bffedca
Author: Muhammad Usama Anjum <usama.anjum@collabora.com>
Date:   Mon Jan 1 13:36:12 2024 +0500

    selftests/mm: conform test to TAP format output
    
    [ Upstream commit 9a21701edc41465de56f97914741bfb7bfc2517d ]
    
    Conform the layout, informational and status messages to TAP.  No
    functional change is intended other than the layout of output messages.
    
    Link: https://lkml.kernel.org/r/20240101083614.1076768-1-usama.anjum@collabora.com
    Signed-off-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
    Cc: Shuah Khan <shuah@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Stable-dep-of: d4202e66a4b1 ("selftests/mm: compaction_test: fix bogus test success on Aarch64")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 9d3886a1604b84e780d56c01367a4a536b937114
Author: Dev Jain <dev.jain@arm.com>
Date:   Tue May 21 13:13:57 2024 +0530

    selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages
    
    [ Upstream commit 9ad665ef55eaad1ead1406a58a34f615a7c18b5e ]
    
    Currently, the test tries to set nr_hugepages to zero, but that is not
    actually done because the file offset is not reset after read().  Fix that
    using lseek().
    
    Link: https://lkml.kernel.org/r/20240521074358.675031-3-dev.jain@arm.com
    Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory")
    Signed-off-by: Dev Jain <dev.jain@arm.com>
    Cc: <stable@vger.kernel.org>
    Cc: Anshuman Khandual <anshuman.khandual@arm.com>
    Cc: Shuah Khan <shuah@kernel.org>
    Cc: Sri Jayaramappa <sjayaram@akamai.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 6ff7cfa02baabec907f6f29ea76634e6256d2ec4
Author: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Date:   Sun Mar 24 12:40:17 2024 +0100

    mmc: davinci: Don't strip remove function when driver is builtin
    
    [ Upstream commit 55c421b364482b61c4c45313a535e61ed5ae4ea3 ]
    
    Using __exit for the remove function results in the remove callback being
    discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g.
    using sysfs or hotplug), the driver is just removed without the cleanup
    being performed. This results in resource leaks. Fix it by compiling in the
    remove callback unconditionally.
    
    This also fixes a W=1 modpost warning:
    
    WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in
    reference: davinci_mmcsd_driver+0x10 (section: .data) ->
    davinci_mmcsd_remove (section: .exit.text)
    
    Fixes: b4cff4549b7a ("DaVinci: MMC: MMC/SD controller driver for DaVinci family")
    Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20240324114017.231936-2-u.kleine-koenig@pengutronix.de
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b5a2a6908109c54b5f4b20eed29bcdffb8854c70
Author: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Date:   Tue Apr 30 16:04:30 2024 -0400

    serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler
    
    [ Upstream commit 8492bd91aa055907c67ef04f2b56f6dadd1f44bf ]
    
    When using a high speed clock with a low baud rate, the 4x prescaler is
    automatically selected if required. In that case, sc16is7xx_set_baud()
    properly configures the chip registers, but returns an incorrect baud
    rate by not taking into account the prescaler value. This incorrect baud
    rate is then fed to uart_update_timeout().
    
    For example, with an input clock of 80MHz, and a selected baud rate of 50,
    sc16is7xx_set_baud() will return 200 instead of 50.
    
    Fix this by first changing the prescaler variable to hold the selected
    prescaler value instead of the MCR bitfield. Then properly take into
    account the selected prescaler value in the return value computation.
    
    Also add better documentation about the divisor value computation.
    
    Fixes: dfeae619d781 ("serial: sc16is7xx")
    Cc: stable@vger.kernel.org
    Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
    Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
    Link: https://lore.kernel.org/r/20240430200431.4102923-1-hugo@hugovil.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 9a2e0aa9a80941b450a78ff074ee08cbb58abf53
Author: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Date:   Thu Dec 21 18:18:19 2023 -0500

    serial: sc16is7xx: replace hardcoded divisor value with BIT() macro
    
    [ Upstream commit 2e57cefc4477659527f7adab1f87cdbf60ef1ae6 ]
    
    To better show why the limit is what it is, since we have only 16 bits for
    the divisor.
    
    Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
    Suggested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
    Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
    Link: https://lore.kernel.org/r/20231221231823.2327894-13-hugo@hugovil.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Stable-dep-of: 8492bd91aa05 ("serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit e8b8054f5ef4d626f8904ea901f81b9d9fd2360b
Author: George Shen <george.shen@amd.com>
Date:   Thu Sep 16 19:55:39 2021 -0400

    drm/amd/display: Handle Y carry-over in VCP X.Y calculation
    
    [ Upstream commit 3626a6aebe62ce7067cdc460c0c644e9445386bb ]
    
    [Why/How]
    Theoretically rare corner case where ceil(Y) results in rounding
    up to an integer. If this happens, the 1 should be carried over to
    the X value.
    
    Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
    Acked-by: Anson Jacob <Anson.Jacob@amd.com>
    Signed-off-by: George Shen <george.shen@amd.com>
    Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit e500b1c4e29ad0bd1c1332a1eaea2913627a92dd
Author: Wesley Cheng <quic_wcheng@quicinc.com>
Date:   Mon Apr 8 18:40:59 2024 -0700

    usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
    
    [ Upstream commit 24729b307eefcd7c476065cd7351c1a018082c19 ]
    
    FFS based applications can utilize the aio_cancel() callback to dequeue
    pending USB requests submitted to the UDC.  There is a scenario where the
    FFS application issues an AIO cancel call, while the UDC is handling a
    soft disconnect.  For a DWC3 based implementation, the callstack looks
    like the following:
    
        DWC3 Gadget                               FFS Application
    dwc3_gadget_soft_disconnect()              ...
      --> dwc3_stop_active_transfers()
        --> dwc3_gadget_giveback(-ESHUTDOWN)
          --> ffs_epfile_async_io_complete()   ffs_aio_cancel()
            --> usb_ep_free_request()            --> usb_ep_dequeue()
    
    There is currently no locking implemented between the AIO completion
    handler and AIO cancel, so the issue occurs if the completion routine is
    running in parallel to an AIO cancel call coming from the FFS application.
    As the completion call frees the USB request (io_data->req) the FFS
    application is also referencing it for the usb_ep_dequeue() call.  This can
    lead to accessing a stale/hanging pointer.
    
    commit b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently")
    relocated the usb_ep_free_request() into ffs_epfile_async_io_complete().
    However, in order to properly implement locking to mitigate this issue, the
    spinlock can't be added to ffs_epfile_async_io_complete(), as
    usb_ep_dequeue() (if successfully dequeuing a USB request) will call the
    function driver's completion handler in the same context.  Hence, leading
    into a deadlock.
    
    Fix this issue by moving the usb_ep_free_request() back to
    ffs_user_copy_worker(), and ensuring that it explicitly sets io_data->req
    to NULL after freeing it within the ffs->eps_lock.  This resolves the race
    condition above, as the ffs_aio_cancel() routine will not continue
    attempting to dequeue a request that has already been freed, or the
    ffs_user_copy_work() not freeing the USB request until the AIO cancel is
    done referencing it.
    
    This fix depends on
      commit b566d38857fc ("usb: gadget: f_fs: use io_data->status
      consistently")
    
    Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support")
    Cc: stable <stable@kernel.org>  # b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently")
    Signed-off-by: Wesley Cheng <quic_wcheng@quicinc.com>
    Link: https://lore.kernel.org/r/20240409014059.6740-1-quic_wcheng@quicinc.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit c693698787660c97950bc1f93a8dd19d8307153d
Author: Eric Dumazet <edumazet@google.com>
Date:   Tue Jun 4 19:35:49 2024 +0000

    ipv6: fix possible race in __fib6_drop_pcpu_from()
    
    [ Upstream commit b01e1c030770ff3b4fe37fc7cc6bca03f594133f ]
    
    syzbot found a race in __fib6_drop_pcpu_from() [1]
    
    If compiler reads more than once (*ppcpu_rt),
    second read could read NULL, if another cpu clears
    the value in rt6_get_pcpu_route().
    
    Add a READ_ONCE() to prevent this race.
    
    Also add rcu_read_lock()/rcu_read_unlock() because
    we rely on RCU protection while dereferencing pcpu_rt.
    
    [1]
    
    Oops: general protection fault, probably for non-canonical address 0xdffffc0000000012: 0000 [#1] PREEMPT SMP KASAN PTI
    KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]
    CPU: 0 PID: 7543 Comm: kworker/u8:17 Not tainted 6.10.0-rc1-syzkaller-00013-g2bfcfd584ff5 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
    Workqueue: netns cleanup_net
     RIP: 0010:__fib6_drop_pcpu_from.part.0+0x10a/0x370 net/ipv6/ip6_fib.c:984
    Code: f8 48 c1 e8 03 80 3c 28 00 0f 85 16 02 00 00 4d 8b 3f 4d 85 ff 74 31 e8 74 a7 fa f7 49 8d bf 90 00 00 00 48 89 f8 48 c1 e8 03 <80> 3c 28 00 0f 85 1e 02 00 00 49 8b 87 90 00 00 00 48 8b 0c 24 48
    RSP: 0018:ffffc900040df070 EFLAGS: 00010206
    RAX: 0000000000000012 RBX: 0000000000000001 RCX: ffffffff89932e16
    RDX: ffff888049dd1e00 RSI: ffffffff89932d7c RDI: 0000000000000091
    RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000007
    R10: 0000000000000001 R11: 0000000000000006 R12: ffff88807fa080b8
    R13: fffffbfff1a9a07d R14: ffffed100ff41022 R15: 0000000000000001
    FS:  0000000000000000(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000001b32c26000 CR3: 000000005d56e000 CR4: 00000000003526f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
     <TASK>
      __fib6_drop_pcpu_from net/ipv6/ip6_fib.c:966 [inline]
      fib6_drop_pcpu_from net/ipv6/ip6_fib.c:1027 [inline]
      fib6_purge_rt+0x7f2/0x9f0 net/ipv6/ip6_fib.c:1038
      fib6_del_route net/ipv6/ip6_fib.c:1998 [inline]
      fib6_del+0xa70/0x17b0 net/ipv6/ip6_fib.c:2043
      fib6_clean_node+0x426/0x5b0 net/ipv6/ip6_fib.c:2205
      fib6_walk_continue+0x44f/0x8d0 net/ipv6/ip6_fib.c:2127
      fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2175
      fib6_clean_tree+0xd7/0x120 net/ipv6/ip6_fib.c:2255
      __fib6_clean_all+0x100/0x2d0 net/ipv6/ip6_fib.c:2271
      rt6_sync_down_dev net/ipv6/route.c:4906 [inline]
      rt6_disable_ip+0x7ed/0xa00 net/ipv6/route.c:4911
      addrconf_ifdown.isra.0+0x117/0x1b40 net/ipv6/addrconf.c:3855
      addrconf_notify+0x223/0x19e0 net/ipv6/addrconf.c:3778
      notifier_call_chain+0xb9/0x410 kernel/notifier.c:93
      call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1992
      call_netdevice_notifiers_extack net/core/dev.c:2030 [inline]
      call_netdevice_notifiers net/core/dev.c:2044 [inline]
      dev_close_many+0x333/0x6a0 net/core/dev.c:1585
      unregister_netdevice_many_notify+0x46d/0x19f0 net/core/dev.c:11193
      unregister_netdevice_many net/core/dev.c:11276 [inline]
      default_device_exit_batch+0x85b/0xae0 net/core/dev.c:11759
      ops_exit_list+0x128/0x180 net/core/net_namespace.c:178
      cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:640
      process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
      process_scheduled_works kernel/workqueue.c:3312 [inline]
      worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
      kthread+0x2c1/0x3a0 kernel/kthread.c:389
      ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
      ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
    
    Fixes: d52d3997f843 ("ipv6: Create percpu rt6_info")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Martin KaFai Lau <kafai@fb.com>
    Link: https://lore.kernel.org/r/20240604193549.981839-1-edumazet@google.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 74c97c80034f649b14e142287a2e51bc4aae8686
Author: Kuniyuki Iwashima <kuniyu@amazon.com>
Date:   Tue Jun 4 09:52:41 2024 -0700

    af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().
    
    [ Upstream commit efaf24e30ec39ebbea9112227485805a48b0ceb1 ]
    
    While dumping sockets via UNIX_DIAG, we do not hold unix_state_lock().
    
    Let's use READ_ONCE() to read sk->sk_shutdown.
    
    Fixes: e4e541a84863 ("sock-diag: Report shutdown for inet and unix sockets (v2)")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 35a69f9e5db848de37569be6ac674339a0089f91
Author: Kuniyuki Iwashima <kuniyu@amazon.com>
Date:   Tue Jun 4 09:52:40 2024 -0700

    af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen().
    
    [ Upstream commit 5d915e584d8408211d4567c22685aae8820bfc55 ]
    
    We can dump the socket queue length via UNIX_DIAG by specifying
    UDIAG_SHOW_RQLEN.
    
    If sk->sk_state is TCP_LISTEN, we return the recv queue length,
    but here we do not hold recvq lock.
    
    Let's use skb_queue_len_lockless() in sk_diag_show_rqlen().
    
    Fixes: c9da99e6475f ("unix_diag: Fixup RQLEN extension report")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a64e4b8f9bf6ff21beb111df36e4a70529cd52aa
Author: Kuniyuki Iwashima <kuniyu@amazon.com>
Date:   Tue Jun 4 09:52:38 2024 -0700

    af_unix: Use unix_recvq_full_lockless() in unix_stream_connect().
    
    [ Upstream commit 45d872f0e65593176d880ec148f41ad7c02e40a7 ]
    
    Once sk->sk_state is changed to TCP_LISTEN, it never changes.
    
    unix_accept() takes advantage of this characteristics; it does not
    hold the listener's unix_state_lock() and only acquires recvq lock
    to pop one skb.
    
    It means unix_state_lock() does not prevent the queue length from
    changing in unix_stream_connect().
    
    Thus, we need to use unix_recvq_full_lockless() to avoid data-race.
    
    Now we remove unix_recvq_full() as no one uses it.
    
    Note that we can remove READ_ONCE() for sk->sk_max_ack_backlog in
    unix_recvq_full_lockless() because of the following reasons:
    
      (1) For SOCK_DGRAM, it is a written-once field in unix_create1()
    
      (2) For SOCK_STREAM and SOCK_SEQPACKET, it is changed under the
          listener's unix_state_lock() in unix_listen(), and we hold
          the lock in unix_stream_connect()
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f70ef84b821e485617b77f29e462c265fe890d28
Author: Kuniyuki Iwashima <kuniyu@amazon.com>
Date:   Tue Jun 4 09:52:37 2024 -0700

    af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen.
    
    [ Upstream commit bd9f2d05731f6a112d0c7391a0d537bfc588dbe6 ]
    
    net->unx.sysctl_max_dgram_qlen is exposed as a sysctl knob and can be
    changed concurrently.
    
    Let's use READ_ONCE() in unix_create1().
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 44a2437c60b151c53a5fcabac4f873fe8d9a0a16
Author: Kuniyuki Iwashima <kuniyu@amazon.com>
Date:   Tue Jun 4 09:52:35 2024 -0700

    af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG.
    
    [ Upstream commit 0aa3be7b3e1f8f997312cc4705f8165e02806f8f ]
    
    While dumping AF_UNIX sockets via UNIX_DIAG, sk->sk_state is read
    locklessly.
    
    Let's use READ_ONCE() there.
    
    Note that the result could be inconsistent if the socket is dumped
    during the state change.  This is common for other SOCK_DIAG and
    similar interfaces.
    
    Fixes: c9da99e6475f ("unix_diag: Fixup RQLEN extension report")
    Fixes: 2aac7a2cb0d9 ("unix_diag: Pending connections IDs NLA")
    Fixes: 45a96b9be6ec ("unix_diag: Dumping all sockets core")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b5a6507c6196ec33bfc2f679a1e4fe0f06c93aed
Author: Kuniyuki Iwashima <kuniyu@amazon.com>
Date:   Tue Jun 4 09:52:33 2024 -0700

    af_unix: Annotate data-races around sk->sk_state in sendmsg() and recvmsg().
    
    [ Upstream commit 8a34d4e8d9742a24f74998f45a6a98edd923319b ]
    
    The following functions read sk->sk_state locklessly and proceed only if
    the state is TCP_ESTABLISHED.
    
      * unix_stream_sendmsg
      * unix_stream_read_generic
      * unix_seqpacket_sendmsg
      * unix_seqpacket_recvmsg
    
    Let's use READ_ONCE() there.
    
    Fixes: a05d2ad1c1f3 ("af_unix: Only allow recv on connected seqpacket sockets.")
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit cc5d123ce4aeed76554b831204420c1577709901
Author: Kuniyuki Iwashima <kuniyu@amazon.com>
Date:   Tue Jun 4 09:52:30 2024 -0700

    af_unix: Annotate data-races around sk->sk_state in unix_write_space() and poll().
    
    [ Upstream commit eb0718fb3e97ad0d6f4529b810103451c90adf94 ]
    
    unix_poll() and unix_dgram_poll() read sk->sk_state locklessly and
    calls unix_writable() which also reads sk->sk_state without holding
    unix_state_lock().
    
    Let's use READ_ONCE() in unix_poll() and unix_dgram_poll() and pass
    it to unix_writable().
    
    While at it, we remove TCP_SYN_SENT check in unix_dgram_poll() as
    that state does not exist for AF_UNIX socket since the code was added.
    
    Fixes: 1586a5877db9 ("af_unix: do not report POLLOUT on listeners")
    Fixes: 3c73419c09a5 ("af_unix: fix 'poll for write'/ connected DGRAM sockets")
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit d2c53bedeb96b5a39bdce267462401e9910f350d
Author: Kuniyuki Iwashima <kuniyu@amazon.com>
Date:   Tue Jun 4 09:52:29 2024 -0700

    af_unix: Annotate data-race of sk->sk_state in unix_inq_len().
    
    [ Upstream commit 3a0f38eb285c8c2eead4b3230c7ac2983707599d ]
    
    ioctl(SIOCINQ) calls unix_inq_len() that checks sk->sk_state first
    and returns -EINVAL if it's TCP_LISTEN.
    
    Then, for SOCK_STREAM sockets, unix_inq_len() returns the number of
    bytes in recvq.
    
    However, unix_inq_len() does not hold unix_state_lock(), and the
    concurrent listen() might change the state after checking sk->sk_state.
    
    If the race occurs, 0 is returned for the listener, instead of -EINVAL,
    because the length of skb with embryo is 0.
    
    We could hold unix_state_lock() in unix_inq_len(), but it's overkill
    given the result is true for pre-listen() TCP_CLOSE state.
    
    So, let's use READ_ONCE() for sk->sk_state in unix_inq_len().
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 13f61e503ec1fd6d031ea42f0805c434cff9895f
Author: Karol Kolacinski <karol.kolacinski@intel.com>
Date:   Tue Jun 4 14:05:27 2024 +0200

    ptp: Fix error message on failed pin verification
    
    [ Upstream commit 323a359f9b077f382f4483023d096a4d316fd135 ]
    
    On failed verification of PTP clock pin, error message prints channel
    number instead of pin index after "pin", which is incorrect.
    
    Fix error message by adding channel number to the message and printing
    pin number instead of channel number.
    
    Fixes: 6092315dfdec ("ptp: introduce programmable pins.")
    Signed-off-by: Karol Kolacinski <karol.kolacinski@intel.com>
    Acked-by: Richard Cochran <richardcochran@gmail.com>
    Link: https://lore.kernel.org/r/20240604120555.16643-1-karol.kolacinski@intel.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 6db4af09987cc5d5f0136bd46148b0e0460dae5b
Author: Eric Dumazet <edumazet@google.com>
Date:   Tue Jun 4 18:15:11 2024 +0000

    net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
    
    [ Upstream commit f921a58ae20852d188f70842431ce6519c4fdc36 ]
    
    If one TCA_TAPRIO_ATTR_PRIOMAP attribute has been provided,
    taprio_parse_mqprio_opt() must validate it, or userspace
    can inject arbitrary data to the kernel, the second time
    taprio_change() is called.
    
    First call (with valid attributes) sets dev->num_tc
    to a non zero value.
    
    Second call (with arbitrary mqprio attributes)
    returns early from taprio_parse_mqprio_opt()
    and bad things can happen.
    
    Fixes: a3d43c0d56f1 ("taprio: Add support adding an admin schedule")
    Reported-by: Noam Rathaus <noamr@ssd-disclosure.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
    Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
    Link: https://lore.kernel.org/r/20240604181511.769870-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit d8c79ae03ee12137ef9404833e0dd893e2364ed4
Author: Jason Xing <kernelxing@tencent.com>
Date:   Tue Jun 4 01:02:16 2024 +0800

    tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB
    
    [ Upstream commit a46d0ea5c94205f40ecf912d1bb7806a8a64704f ]
    
    According to RFC 1213, we should also take CLOSE-WAIT sockets into
    consideration:
    
      "tcpCurrEstab OBJECT-TYPE
       ...
       The number of TCP connections for which the current state
       is either ESTABLISHED or CLOSE- WAIT."
    
    After this, CurrEstab counter will display the total number of
    ESTABLISHED and CLOSE-WAIT sockets.
    
    The logic of counting
    When we increment the counter?
    a) if we change the state to ESTABLISHED.
    b) if we change the state from SYN-RECEIVED to CLOSE-WAIT.
    
    When we decrement the counter?
    a) if the socket leaves ESTABLISHED and will never go into CLOSE-WAIT,
    say, on the client side, changing from ESTABLISHED to FIN-WAIT-1.
    b) if the socket leaves CLOSE-WAIT, say, on the server side, changing
    from CLOSE-WAIT to LAST-ACK.
    
    Please note: there are two chances that old state of socket can be changed
    to CLOSE-WAIT in tcp_fin(). One is SYN-RECV, the other is ESTABLISHED.
    So we have to take care of the former case.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Jason Xing <kernelxing@tencent.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit dd254cde571580ba0822be571660be4c17dba903
Author: Daniel Borkmann <daniel@iogearbox.net>
Date:   Mon Jun 3 10:59:26 2024 +0200

    vxlan: Fix regression when dropping packets due to invalid src addresses
    
    [ Upstream commit 1cd4bc987abb2823836cbb8f887026011ccddc8a ]
    
    Commit f58f45c1e5b9 ("vxlan: drop packets from invalid src-address")
    has recently been added to vxlan mainly in the context of source
    address snooping/learning so that when it is enabled, an entry in the
    FDB is not being created for an invalid address for the corresponding
    tunnel endpoint.
    
    Before commit f58f45c1e5b9 vxlan was similarly behaving as geneve in
    that it passed through whichever macs were set in the L2 header. It
    turns out that this change in behavior breaks setups, for example,
    Cilium with netkit in L3 mode for Pods as well as tunnel mode has been
    passing before the change in f58f45c1e5b9 for both vxlan and geneve.
    After mentioned change it is only passing for geneve as in case of
    vxlan packets are dropped due to vxlan_set_mac() returning false as
    source and destination macs are zero which for E/W traffic via tunnel
    is totally fine.
    
    Fix it by only opting into the is_valid_ether_addr() check in
    vxlan_set_mac() when in fact source address snooping/learning is
    actually enabled in vxlan. This is done by moving the check into
    vxlan_snoop(). With this change, the Cilium connectivity test suite
    passes again for both tunnel flavors.
    
    Fixes: f58f45c1e5b9 ("vxlan: drop packets from invalid src-address")
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Cc: David Bauer <mail@david-bauer.net>
    Cc: Ido Schimmel <idosch@nvidia.com>
    Cc: Nikolay Aleksandrov <razor@blackwall.org>
    Cc: Martin KaFai Lau <martin.lau@kernel.org>
    Reviewed-by: Ido Schimmel <idosch@nvidia.com>
    Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
    Reviewed-by: David Bauer <mail@david-bauer.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 52b1aa07cda6a199cd6754d3798c7759023bc70f
Author: Hangyu Hua <hbh25y@gmail.com>
Date:   Mon Jun 3 15:13:03 2024 +0800

    net: sched: sch_multiq: fix possible OOB write in multiq_tune()
    
    [ Upstream commit affc18fdc694190ca7575b9a86632a73b9fe043d ]
    
    q->bands will be assigned to qopt->bands to execute subsequent code logic
    after kmalloc. So the old q->bands should not be used in kmalloc.
    Otherwise, an out-of-bounds write will occur.
    
    Fixes: c2999f7fb05b ("net: sched: multiq: don't call qdisc_put() while holding tree lock")
    Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
    Acked-by: Cong Wang <cong.wang@bytedance.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f9f69e3f698916370e0271b2c326957acaf5e9dc
Author: Eric Dumazet <edumazet@google.com>
Date:   Fri May 31 13:26:34 2024 +0000

    ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
    
    [ Upstream commit c0b98ac1cc104f48763cdb27b1e9ac25fd81fc90 ]
    
    As explained in commit 1378817486d6 ("tipc: block BH
    before using dst_cache"), net/core/dst_cache.c
    helpers need to be called with BH disabled.
    
    Disabling preemption in seg6_output_core() is not good enough,
    because seg6_output_core() is called from process context,
    lwtunnel_output() only uses rcu_read_lock().
    
    We might be interrupted by a softirq, re-enter seg6_output_core()
    and corrupt dst_cache data structures.
    
    Fix the race by using local_bh_disable() instead of
    preempt_disable().
    
    Apply a similar change in seg6_input_core().
    
    Fixes: fa79581ea66c ("ipv6: sr: fix several BUGs when preemption is enabled")
    Fixes: 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: David Lebrun <dlebrun@google.com>
    Acked-by: Paolo Abeni <pabeni@redhat.com>
    Link: https://lore.kernel.org/r/20240531132636.2637995-4-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3cbb2ba0a0d90a97ff55560d37e27d3a6d922369
Author: DelphineCCChiu <delphine_cc_chiu@wiwynn.com>
Date:   Wed May 29 14:58:55 2024 +0800

    net/ncsi: Fix the multi thread manner of NCSI driver
    
    [ Upstream commit e85e271dec0270982afed84f70dc37703fcc1d52 ]
    
    Currently NCSI driver will send several NCSI commands back to back without
    waiting the response of previous NCSI command or timeout in some state
    when NIC have multi channel. This operation against the single thread
    manner defined by NCSI SPEC(section 6.3.2.3 in DSP0222_1.1.1)
    
    According to NCSI SPEC(section 6.2.13.1 in DSP0222_1.1.1), we should probe
    one channel at a time by sending NCSI commands (Clear initial state, Get
    version ID, Get capabilities...), than repeat this steps until the max
    number of channels which we got from NCSI command (Get capabilities) has
    been probed.
    
    Fixes: e6f44ed6d04d ("net/ncsi: Package and channel management")
    Signed-off-by: DelphineCCChiu <delphine_cc_chiu@wiwynn.com>
    Link: https://lore.kernel.org/r/20240529065856.825241-1-delphine_cc_chiu@wiwynn.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 7329bc66b4a03e63d8c191eeb7c342a1c13f96fa
Author: Peter Delevoryas <peter@pjd.dev>
Date:   Tue Nov 14 10:07:33 2023 -0600

    net/ncsi: Simplify Kconfig/dts control flow
    
    [ Upstream commit c797ce168930ce3d62a9b7fc4d7040963ee6a01e ]
    
    Background:
    
    1. CONFIG_NCSI_OEM_CMD_KEEP_PHY
    
    If this is enabled, we send an extra OEM Intel command in the probe
    sequence immediately after discovering a channel (e.g. after "Clear
    Initial State").
    
    2. CONFIG_NCSI_OEM_CMD_GET_MAC
    
    If this is enabled, we send one of 3 OEM "Get MAC Address" commands from
    Broadcom, Mellanox (Nvidida), and Intel in the *configuration* sequence
    for a channel.
    
    3. mellanox,multi-host (or mlx,multi-host)
    
    Introduced by this patch:
    
    https://lore.kernel.org/all/20200108234341.2590674-1-vijaykhemka@fb.com/
    
    Which was actually originally from cosmo.chou@quantatw.com:
    
    https://github.com/facebook/openbmc-linux/commit/9f132a10ec48db84613519258cd8a317fb9c8f1b
    
    Cosmo claimed that the Nvidia ConnectX-4 and ConnectX-6 NIC's don't
    respond to Get Version ID, et. al in the probe sequence unless you send
    the Set MC Affinity command first.
    
    Problem Statement:
    
    We've been using a combination of #ifdef code blocks and IS_ENABLED()
    conditions to conditionally send these OEM commands.
    
    It makes adding any new code around these commands hard to understand.
    
    Solution:
    
    In this patch, I just want to remove the conditionally compiled blocks
    of code, and always use IS_ENABLED(...) to do dynamic control flow.
    
    I don't think the small amount of code this adds to non-users of the OEM
    Kconfigs is a big deal.
    
    Signed-off-by: Peter Delevoryas <peter@pjd.dev>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Stable-dep-of: e85e271dec02 ("net/ncsi: Fix the multi thread manner of NCSI driver")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f40cac4e708365aeb15585cb50c57961b51a5d1c
Author: Ivan Mikhaylov <i.mikhaylov@yadro.com>
Date:   Thu Jul 8 15:27:53 2021 +0300

    net/ncsi: add NCSI Intel OEM command to keep PHY up
    
    [ Upstream commit abd2fddc94a619b96bf41c60429d4c32bd118e17 ]
    
    This allows to keep PHY link up and prevents any channel resets during
    the host load.
    
    It is KEEP_PHY_LINK_UP option(Veto bit) in i210 datasheet which
    block PHY reset and power state changes.
    
    Signed-off-by: Ivan Mikhaylov <i.mikhaylov@yadro.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Stable-dep-of: e85e271dec02 ("net/ncsi: Fix the multi thread manner of NCSI driver")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 7c9b9f822eaa2689a8f41887e6be56434e3f0f9d
Author: Lingbo Kong <quic_lingbok@quicinc.com>
Date:   Thu May 16 10:18:54 2024 +0800

    wifi: mac80211: correctly parse Spatial Reuse Parameter Set element
    
    [ Upstream commit a26d8dc5227f449a54518a8b40733a54c6600a8b ]
    
    Currently, the way of parsing Spatial Reuse Parameter Set element is
    incorrect and some members of struct ieee80211_he_obss_pd are not assigned.
    
    To address this issue, it must be parsed in the order of the elements of
    Spatial Reuse Parameter Set defined in the IEEE Std 802.11ax specification.
    
    The diagram of the Spatial Reuse Parameter Set element (IEEE Std 802.11ax
    -2021-9.4.2.252).
    
    -------------------------------------------------------------------------
    |       |      |         |       |Non-SRG|  SRG  | SRG   | SRG  | SRG   |
    |Element|Length| Element |  SR   |OBSS PD|OBSS PD|OBSS PD| BSS  |Partial|
    |   ID  |      |   ID    |Control|  Max  |  Min  | Max   |Color | BSSID |
    |       |      |Extension|       | Offset| Offset|Offset |Bitmap|Bitmap |
    -------------------------------------------------------------------------
    
    Fixes: 1ced169cc1c2 ("mac80211: allow setting spatial reuse parameters from bss_conf")
    Signed-off-by: Lingbo Kong <quic_lingbok@quicinc.com>
    Link: https://msgid.link/20240516021854.5682-3-quic_lingbok@quicinc.com
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 46c59a25337049a2a230ce7f7c3b9f21d0aaaad7
Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date:   Mon May 13 13:27:14 2024 +0300

    wifi: iwlwifi: mvm: don't read past the mfuart notifcation
    
    [ Upstream commit 4bb95f4535489ed830cf9b34b0a891e384d1aee4 ]
    
    In case the firmware sends a notification that claims it has more data
    than it has, we will read past that was allocated for the notification.
    Remove the print of the buffer, we won't see it by default. If needed,
    we can see the content with tracing.
    
    This was reported by KFENCE.
    
    Fixes: bdccdb854f2f ("iwlwifi: mvm: support MFUART dump in case of MFUART assert")
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Reviewed-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
    Link: https://msgid.link/20240513132416.ba82a01a559e.Ia91dd20f5e1ca1ad380b95e68aebf2794f553d9b@changeid
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3c4771091ea8016c8601399078916f722dd8833b
Author: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Date:   Mon May 13 13:27:12 2024 +0300

    wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
    
    [ Upstream commit 60d62757df30b74bf397a2847a6db7385c6ee281 ]
    
    In some versions of cfg80211, the ssids poinet might be a valid one even
    though n_ssids is 0. Accessing the pointer in this case will cuase an
    out-of-bound access. Fix this by checking n_ssids first.
    
    Fixes: c1a7515393e4 ("iwlwifi: mvm: add adaptive dwell support")
    Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
    Reviewed-by: Ilan Peer <ilan.peer@intel.com>
    Reviewed-by: Johannes Berg <johannes.berg@intel.com>
    Link: https://msgid.link/20240513132416.6e4d1762bf0d.I5a0e6cc8f02050a766db704d15594c61fe583d45@changeid
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 2c80bd07c11ca3bb9c4c150f573d123d96fab9e7
Author: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Date:   Fri May 10 17:06:39 2024 +0300

    wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef
    
    [ Upstream commit 87821b67dea87addbc4ab093ba752753b002176a ]
    
    The driver should call iwl_dbg_tlv_free even if debugfs is not defined
    since ini mode does not depend on debugfs ifdef.
    
    Fixes: 68f6f492c4fa ("iwlwifi: trans: support loading ini TLVs from external file")
    Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
    Reviewed-by: Luciano Coelho <luciano.coelho@intel.com>
    Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
    Link: https://msgid.link/20240510170500.c8e3723f55b0.I5e805732b0be31ee6b83c642ec652a34e974ff10@changeid
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 99c4903dcee30a760ba4328d3907e03bfcd0c7f2
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Fri May 10 17:06:33 2024 +0300

    wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64
    
    [ Upstream commit 4a7aace2899711592327463c1a29ffee44fcc66e ]
    
    We don't actually support >64 even for HE devices, so revert
    back to 64. This fixes an issue where the session is refused
    because the queue is configured differently from the actual
    session later.
    
    Fixes: 514c30696fbc ("iwlwifi: add support for IEEE802.11ax")
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Reviewed-by: Liad Kaufman <liad.kaufman@intel.com>
    Reviewed-by: Luciano Coelho <luciano.coelho@intel.com>
    Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
    Link: https://msgid.link/20240510170500.52f7b4cf83aa.If47e43adddf7fe250ed7f5571fbb35d8221c7c47@changeid
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8d5c7d7bfd72efc7b9aa1dd9ceb6647480580e99
Author: Lin Ma <linma@zju.edu.cn>
Date:   Tue May 21 15:50:59 2024 +0800

    wifi: cfg80211: pmsr: use correct nla_get_uX functions
    
    [ Upstream commit ab904521f4de52fef4f179d2dfc1877645ef5f5c ]
    
    The commit 9bb7e0f24e7e ("cfg80211: add peer measurement with FTM
    initiator API") defines four attributes NL80211_PMSR_FTM_REQ_ATTR_
    {NUM_BURSTS_EXP}/{BURST_PERIOD}/{BURST_DURATION}/{FTMS_PER_BURST} in
    following ways.
    
    static const struct nla_policy
    nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
        ...
        [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
            NLA_POLICY_MAX(NLA_U8, 15),
        [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
        [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
            NLA_POLICY_MAX(NLA_U8, 15),
        [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
            NLA_POLICY_MAX(NLA_U8, 31),
        ...
    };
    
    That is, those attributes are expected to be NLA_U8 and NLA_U16 types.
    However, the consumers of these attributes in `pmsr_parse_ftm` blindly
    all use `nla_get_u32`, which is incorrect and causes functionality issues
    on little-endian platforms. Hence, fix them with the correct `nla_get_u8`
    and `nla_get_u16` functions.
    
    Fixes: 9bb7e0f24e7e ("cfg80211: add peer measurement with FTM initiator API")
    Signed-off-by: Lin Ma <linma@zju.edu.cn>
    Link: https://msgid.link/20240521075059.47999-1-linma@zju.edu.cn
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit e7e916d693dcb5a297f40312600a82475f2e63bc
Author: Remi Pommarel <repk@triplefau.lt>
Date:   Wed May 29 08:57:53 2024 +0200

    wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
    
    [ Upstream commit 44c06bbde6443de206b30f513100b5670b23fc5e ]
    
    The ieee80211_sta_ps_deliver_wakeup() function takes sta->ps_lock to
    synchronizes with ieee80211_tx_h_unicast_ps_buf() which is called from
    softirq context. However using only spin_lock() to get sta->ps_lock in
    ieee80211_sta_ps_deliver_wakeup() does not prevent softirq to execute
    on this same CPU, to run ieee80211_tx_h_unicast_ps_buf() and try to
    take this same lock ending in deadlock. Below is an example of rcu stall
    that arises in such situation.
    
     rcu: INFO: rcu_sched self-detected stall on CPU
     rcu:    2-....: (42413413 ticks this GP) idle=b154/1/0x4000000000000000 softirq=1763/1765 fqs=21206996
     rcu:    (t=42586894 jiffies g=2057 q=362405 ncpus=4)
     CPU: 2 PID: 719 Comm: wpa_supplicant Tainted: G        W          6.4.0-02158-g1b062f552873 #742
     Hardware name: RPT (r1) (DT)
     pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
     pc : queued_spin_lock_slowpath+0x58/0x2d0
     lr : invoke_tx_handlers_early+0x5b4/0x5c0
     sp : ffff00001ef64660
     x29: ffff00001ef64660 x28: ffff000009bc1070 x27: ffff000009bc0ad8
     x26: ffff000009bc0900 x25: ffff00001ef647a8 x24: 0000000000000000
     x23: ffff000009bc0900 x22: ffff000009bc0900 x21: ffff00000ac0e000
     x20: ffff00000a279e00 x19: ffff00001ef646e8 x18: 0000000000000000
     x17: ffff800016468000 x16: ffff00001ef608c0 x15: 0010533c93f64f80
     x14: 0010395c9faa3946 x13: 0000000000000000 x12: 00000000fa83b2da
     x11: 000000012edeceea x10: ffff0000010fbe00 x9 : 0000000000895440
     x8 : 000000000010533c x7 : ffff00000ad8b740 x6 : ffff00000c350880
     x5 : 0000000000000007 x4 : 0000000000000001 x3 : 0000000000000000
     x2 : 0000000000000000 x1 : 0000000000000001 x0 : ffff00000ac0e0e8
     Call trace:
      queued_spin_lock_slowpath+0x58/0x2d0
      ieee80211_tx+0x80/0x12c
      ieee80211_tx_pending+0x110/0x278
      tasklet_action_common.constprop.0+0x10c/0x144
      tasklet_action+0x20/0x28
      _stext+0x11c/0x284
      ____do_softirq+0xc/0x14
      call_on_irq_stack+0x24/0x34
      do_softirq_own_stack+0x18/0x20
      do_softirq+0x74/0x7c
      __local_bh_enable_ip+0xa0/0xa4
      _ieee80211_wake_txqs+0x3b0/0x4b8
      __ieee80211_wake_queue+0x12c/0x168
      ieee80211_add_pending_skbs+0xec/0x138
      ieee80211_sta_ps_deliver_wakeup+0x2a4/0x480
      ieee80211_mps_sta_status_update.part.0+0xd8/0x11c
      ieee80211_mps_sta_status_update+0x18/0x24
      sta_apply_parameters+0x3bc/0x4c0
      ieee80211_change_station+0x1b8/0x2dc
      nl80211_set_station+0x444/0x49c
      genl_family_rcv_msg_doit.isra.0+0xa4/0xfc
      genl_rcv_msg+0x1b0/0x244
      netlink_rcv_skb+0x38/0x10c
      genl_rcv+0x34/0x48
      netlink_unicast+0x254/0x2bc
      netlink_sendmsg+0x190/0x3b4
      ____sys_sendmsg+0x1e8/0x218
      ___sys_sendmsg+0x68/0x8c
      __sys_sendmsg+0x44/0x84
      __arm64_sys_sendmsg+0x20/0x28
      do_el0_svc+0x6c/0xe8
      el0_svc+0x14/0x48
      el0t_64_sync_handler+0xb0/0xb4
      el0t_64_sync+0x14c/0x150
    
    Using spin_lock_bh()/spin_unlock_bh() instead prevents softirq to raise
    on the same CPU that is holding the lock.
    
    Fixes: 1d147bfa6429 ("mac80211: fix AP powersave TX vs. wakeup race")
    Signed-off-by: Remi Pommarel <repk@triplefau.lt>
    Link: https://msgid.link/8e36fe07d0fbc146f89196cd47a53c8a0afe84aa.1716910344.git.repk@triplefau.lt
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 7518e20a189f8659b8b83969db4d33a4068fcfc3
Author: Nicolas Escande <nico.escande@gmail.com>
Date:   Tue May 28 16:26:05 2024 +0200

    wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
    
    [ Upstream commit b7d7f11a291830fdf69d3301075dd0fb347ced84 ]
    
    The hwmp code use objects of type mesh_preq_queue, added to a list in
    ieee80211_if_mesh, to keep track of mpath we need to resolve. If the mpath
    gets deleted, ex mesh interface is removed, the entries in that list will
    never get cleaned. Fix this by flushing all corresponding items of the
    preq_queue in mesh_path_flush_pending().
    
    This should take care of KASAN reports like this:
    
    unreferenced object 0xffff00000668d800 (size 128):
      comm "kworker/u8:4", pid 67, jiffies 4295419552 (age 1836.444s)
      hex dump (first 32 bytes):
        00 1f 05 09 00 00 ff ff 00 d5 68 06 00 00 ff ff  ..........h.....
        8e 97 ea eb 3e b8 01 00 00 00 00 00 00 00 00 00  ....>...........
      backtrace:
        [<000000007302a0b6>] __kmem_cache_alloc_node+0x1e0/0x35c
        [<00000000049bd418>] kmalloc_trace+0x34/0x80
        [<0000000000d792bb>] mesh_queue_preq+0x44/0x2a8
        [<00000000c99c3696>] mesh_nexthop_resolve+0x198/0x19c
        [<00000000926bf598>] ieee80211_xmit+0x1d0/0x1f4
        [<00000000fc8c2284>] __ieee80211_subif_start_xmit+0x30c/0x764
        [<000000005926ee38>] ieee80211_subif_start_xmit+0x9c/0x7a4
        [<000000004c86e916>] dev_hard_start_xmit+0x174/0x440
        [<0000000023495647>] __dev_queue_xmit+0xe24/0x111c
        [<00000000cfe9ca78>] batadv_send_skb_packet+0x180/0x1e4
        [<000000007bacc5d5>] batadv_v_elp_periodic_work+0x2f4/0x508
        [<00000000adc3cd94>] process_one_work+0x4b8/0xa1c
        [<00000000b36425d1>] worker_thread+0x9c/0x634
        [<0000000005852dd5>] kthread+0x1bc/0x1c4
        [<000000005fccd770>] ret_from_fork+0x10/0x20
    unreferenced object 0xffff000009051f00 (size 128):
      comm "kworker/u8:4", pid 67, jiffies 4295419553 (age 1836.440s)
      hex dump (first 32 bytes):
        90 d6 92 0d 00 00 ff ff 00 d8 68 06 00 00 ff ff  ..........h.....
        36 27 92 e4 02 e0 01 00 00 58 79 06 00 00 ff ff  6'.......Xy.....
      backtrace:
        [<000000007302a0b6>] __kmem_cache_alloc_node+0x1e0/0x35c
        [<00000000049bd418>] kmalloc_trace+0x34/0x80
        [<0000000000d792bb>] mesh_queue_preq+0x44/0x2a8
        [<00000000c99c3696>] mesh_nexthop_resolve+0x198/0x19c
        [<00000000926bf598>] ieee80211_xmit+0x1d0/0x1f4
        [<00000000fc8c2284>] __ieee80211_subif_start_xmit+0x30c/0x764
        [<000000005926ee38>] ieee80211_subif_start_xmit+0x9c/0x7a4
        [<000000004c86e916>] dev_hard_start_xmit+0x174/0x440
        [<0000000023495647>] __dev_queue_xmit+0xe24/0x111c
        [<00000000cfe9ca78>] batadv_send_skb_packet+0x180/0x1e4
        [<000000007bacc5d5>] batadv_v_elp_periodic_work+0x2f4/0x508
        [<00000000adc3cd94>] process_one_work+0x4b8/0xa1c
        [<00000000b36425d1>] worker_thread+0x9c/0x634
        [<0000000005852dd5>] kthread+0x1bc/0x1c4
        [<000000005fccd770>] ret_from_fork+0x10/0x20
    
    Fixes: 050ac52cbe1f ("mac80211: code for on-demand Hybrid Wireless Mesh Protocol")
    Signed-off-by: Nicolas Escande <nico.escande@gmail.com>
    Link: https://msgid.link/20240528142605.1060566-1-nico.escande@gmail.com
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f64d566f4332f782e3e060d377a93d8b34591522
Author: Damien Le Moal <dlemoal@kernel.org>
Date:   Tue May 28 15:28:52 2024 +0900

    null_blk: Print correct max open zones limit in null_init_zoned_dev()
    
    commit 233e27b4d21c3e44eb863f03e566d3a22e81a7ae upstream.
    
    When changing the maximum number of open zones, print that number
    instead of the total number of zones.
    
    Fixes: dc4d137ee3b7 ("null_blk: add support for max open/active zone limit for zoned devices")
    Cc: stable@vger.kernel.org
    Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
    Reviewed-by: Niklas Cassel <cassel@kernel.org>
    Link: https://lore.kernel.org/r/20240528062852.437599-1-dlemoal@kernel.org
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8f48a7f8b929b346b6a23212dec5a0e14d5999fe
Author: Steven Rostedt (Google) <rostedt@goodmis.org>
Date:   Mon May 20 20:57:37 2024 -0400

    tracing/selftests: Fix kprobe event name test for .isra. functions
    
    commit 23a4b108accc29a6125ed14de4a044689ffeda78 upstream.
    
    The kprobe_eventname.tc test checks if a function with .isra. can have a
    kprobe attached to it. It loops through the kallsyms file for all the
    functions that have the .isra. name, and checks if it exists in the
    available_filter_functions file, and if it does, it uses it to attach a
    kprobe to it.
    
    The issue is that kprobes can not attach to functions that are listed more
    than once in available_filter_functions. With the latest kernel, the
    function that is found is: rapl_event_update.isra.0
    
      # grep rapl_event_update.isra.0 /sys/kernel/tracing/available_filter_functions
      rapl_event_update.isra.0
      rapl_event_update.isra.0
    
    It is listed twice. This causes the attached kprobe to it to fail which in
    turn fails the test. Instead of just picking the function function that is
    found in available_filter_functions, pick the first one that is listed
    only once in available_filter_functions.
    
    Cc: stable@vger.kernel.org
    Fixes: 604e3548236d ("selftests/ftrace: Select an existing function in kprobe_eventname test")
    Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
    Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>