6.7.3-rc1 review

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pierre-Louis Bossart <[email protected]>

[ Upstream commit 6543ac13c623f906200dfd3f1c407d8d333b6995 ]

The existing SoundWire support misses a clear Controller/Manager hiearchical definition to deal with all variants across SOC vendors.

a) Intel platforms have one controller with 4 or more Managers.
b) AMD platforms have two controllers with one Manager each, but due to BIOS issues use two different link_id values within the scope of a single controller.
c) QCOM platforms have one or more controller with one Manager each.

This patch adds a 'controller_id' which can be set by higher levels. If assigned to -1, the controller_id will be set to the system-unique IDA-assigned bus->id.

The main change is that the bus->id is no longer used for any device name, which makes the definition completely predictable and not dependent on any enumeration order. The bus->id is only used to insert the Managers in the stream rt context.

Stable-dep-of: 8a8a9ac8a497 ("soundwire: fix initializing sysfs for same devices on different buses")

---
 drivers/soundwire/amd_manager.c     | 8 ++++++++
 drivers/soundwire/bus.c             | 4 ++++
 drivers/soundwire/debugfs.c         | 2 +-
 drivers/soundwire/intel_auxdevice.c | 3 +++
 drivers/soundwire/master.c          | 2 +-
 drivers/soundwire/qcom.c            | 3 +++
 include/linux/soundwire/sdw.h       | 4 +++-
 7 files changed, 23 insertions(+), 3 deletions(-)

index 3a99f6dcdfaf..a3b1f4e6f0f9 100644
@@ -927,6 +927,14 @@ static int amd_sdw_manager_probe(struct platform_device *pdev)
 	amd_manager->bus.clk_stop_timeout = 200;
 	amd_manager->bus.link_id = amd_manager->instance;
 
+	/*
+	 * Due to BIOS compatibility, the two links are exposed within
+	 * the scope of a single controller. If this changes, the
+	 * controller_id will have to be updated with drv_data
+	 * information.
+	 */
+	amd_manager->bus.controller_id = 0;
+
 	switch (amd_manager->instance) {
 	case ACP_SDW0:
 		amd_manager->num_dout_ports = AMD_SDW0_MAX_TX_PORTS;

index 41b0d9adf68e..f3fec15c3112 100644
@@ -22,6 +22,10 @@ static int sdw_get_id(struct sdw_bus *bus)
 		return rc;
 
 	bus->id = rc;
+
+	if (bus->controller_id == -1)
+		bus->controller_id = rc;
+
 	return 0;
 }
 

index d1553cb77187..67abd7e52f09 100644
@@ -20,7 +20,7 @@ void sdw_bus_debugfs_init(struct sdw_bus *bus)
 		return;
 
 	/* create the debugfs master-N */
-	snprintf(name, sizeof(name), "master-%d-%d", bus->id, bus->link_id);
+	snprintf(name, sizeof(name), "master-%d-%d", bus->controller_id, bus->link_id);
 	bus->debugfs = debugfs_create_dir(name, sdw_debugfs_root);
 }
 

index 7f15e3549e53..93698532deac 100644
@@ -234,6 +234,9 @@ static int intel_link_probe(struct auxiliary_device *auxdev,
 	cdns->instance = sdw->instance;
 	cdns->msg_count = 0;
 
+	/* single controller for all SoundWire links */
+	bus->controller_id = 0;
+
 	bus->link_id = auxdev->id;
 	bus->clk_stop_timeout = 1;
 

index 9b05c9e25ebe..51abedbbaa66 100644
@@ -145,7 +145,7 @@ int sdw_master_device_add(struct sdw_bus *bus, struct device *parent,
 	md->dev.fwnode = fwnode;
 	md->dev.dma_mask = parent->dma_mask;
 
-	dev_set_name(&md->dev, "sdw-master-%d", bus->id);
+	dev_set_name(&md->dev, "sdw-master-%d-%d", bus->controller_id, bus->link_id);
 
 	ret = device_register(&md->dev);
 	if (ret) {

index a1e2d6c98186..8e027eee8b73 100644
@@ -1624,6 +1624,9 @@ static int qcom_swrm_probe(struct platform_device *pdev)
 		}
 	}
 
+	/* FIXME: is there a DT-defined value to use ? */
+	ctrl->bus.controller_id = -1;
+
 	ret = sdw_bus_master_add(&ctrl->bus, dev, dev->fwnode);
 	if (ret) {
 		dev_err(dev, "Failed to register Soundwire controller (%d)\n",

index 4f3d14bb1538..c383579a008b 100644
@@ -886,7 +886,8 @@ struct sdw_master_ops {
  * struct sdw_bus - SoundWire bus
  * @dev: Shortcut to &bus->md->dev to avoid changing the entire code.
  * @md: Master device
- * @link_id: Link id number, can be 0 to N, unique for each Master
+ * @controller_id: system-unique controller ID. If set to -1, the bus @id will be used.
+ * @link_id: Link id number, can be 0 to N, unique for each Controller
  * @id: bus system-wide unique id
  * @slaves: list of Slaves on this bus
  * @assigned: Bitmap for Slave device numbers.

@@ -918,6 +919,7 @@ struct sdw_master_ops {
 struct sdw_bus {
 	struct device *dev;
 	struct sdw_master_device *md;
+	int controller_id;
 	unsigned int link_id;
 	int id;
 	struct list_head slaves;

2.43.0

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rafael J. Wysocki <[email protected]>

commit 7839d0078e0d5e6cc2fa0b0dfbee71de74f1e557 upstream.

It is reported that in low-memory situations the system-wide resume core code deadlocks, because async_schedule_dev() executes its argument function synchronously if it cannot allocate memory (and not only in that case) and that function attempts to acquire a mutex that is already held. Executing the argument function synchronously from within dpm_async_fn() may also be problematic for ordering reasons (it may cause a consumer device's resume callback to be invoked before a requisite supplier device's one, for example).

Address this by changing the code in question to use async_schedule_dev_nocall() for scheduling the asynchronous execution of device suspend and resume functions and to directly run them synchronously if async_schedule_dev_nocall() returns false.

---
 drivers/base/power/main.c |  148 +++++++++++++++++++++-------------------------
 1 file changed, 68 insertions(+), 80 deletions(-)

@@ -579,7 +579,7 @@ bool dev_pm_skip_resume(struct device *d
 }
 
 /**
- * device_resume_noirq - Execute a "noirq resume" callback for given device.
+ * __device_resume_noirq - Execute a "noirq resume" callback for given device.
  * @dev: Device to handle.
  * @state: PM transition of the system being carried out.
  * @async: If true, the device is being resumed asynchronously.

@@ -587,7 +587,7 @@ bool dev_pm_skip_resume(struct device *d
  * The driver of @dev will not receive interrupts while this function is being
  * executed.
  */
-static int device_resume_noirq(struct device *dev, pm_message_t state, bool async)
+static void __device_resume_noirq(struct device *dev, pm_message_t state, bool async)
 {
 	pm_callback_t callback = NULL;
 	const char *info = NULL;

@@ -655,7 +655,13 @@ Skip:
 Out:
 	complete_all(&dev->power.completion);
 	TRACE_RESUME(error);
-	return error;
+
+	if (error) {
+		suspend_stats.failed_resume_noirq++;
+		dpm_save_failed_step(SUSPEND_RESUME_NOIRQ);
+		dpm_save_failed_dev(dev_name(dev));
+		pm_dev_err(dev, state, async ? " async noirq" : " noirq", error);
+	}
 }
 
 static bool is_async(struct device *dev)

@@ -668,11 +674,15 @@ static bool dpm_async_fn(struct device *
 {
 	reinit_completion(&dev->power.completion);
 
-	if (is_async(dev)) {
-		get_device(dev);
-		async_schedule_dev(func, dev);
+	if (!is_async(dev))
+		return false;
+
+	get_device(dev);
+
+	if (async_schedule_dev_nocall(func, dev))
 		return true;
-	}
+
+	put_device(dev);
 
 	return false;
 }

@@ -680,15 +690,19 @@ static bool dpm_async_fn(struct device *
 static void async_resume_noirq(void *data, async_cookie_t cookie)
 {
 	struct device *dev = data;
-	int error;
-
-	error = device_resume_noirq(dev, pm_transition, true);
-	if (error)
-		pm_dev_err(dev, pm_transition, " async", error);
 
+	__device_resume_noirq(dev, pm_transition, true);
 	put_device(dev);
 }
 
+static void device_resume_noirq(struct device *dev)
+{
+	if (dpm_async_fn(dev, async_resume_noirq))
+		return;
+
+	__device_resume_noirq(dev, pm_transition, false);
+}
+
 static void dpm_noirq_resume_devices(pm_message_t state)
 {
 	struct device *dev;

@@ -698,14 +712,6 @@ static void dpm_noirq_resume_devices(pm_
 	mutex_lock(&dpm_list_mtx);
 	pm_transition = state;
 
-	/*
-	 * Advanced the async threads upfront,
-	 * in case the starting of async threads is
-	 * delayed by non-async resuming devices.
-	 */
-	list_for_each_entry(dev, &dpm_noirq_list, power.entry)
-		dpm_async_fn(dev, async_resume_noirq);
-
 	while (!list_empty(&dpm_noirq_list)) {
 		dev = to_device(dpm_noirq_list.next);
 		get_device(dev);

@@ -713,17 +719,7 @@ static void dpm_noirq_resume_devices(pm_
 
 		mutex_unlock(&dpm_list_mtx);
 
-		if (!is_async(dev)) {
-			int error;
-
-			error = device_resume_noirq(dev, state, false);
-			if (error) {
-				suspend_stats.failed_resume_noirq++;
-				dpm_save_failed_step(SUSPEND_RESUME_NOIRQ);
-				dpm_save_failed_dev(dev_name(dev));
-				pm_dev_err(dev, state, " noirq", error);
-			}
-		}
+		device_resume_noirq(dev);
 
 		put_device(dev);
 

@@ -751,14 +747,14 @@ void dpm_resume_noirq(pm_message_t state
 }
 
 /**
- * device_resume_early - Execute an "early resume" callback for given device.
+ * __device_resume_early - Execute an "early resume" callback for given device.
  * @dev: Device to handle.
  * @state: PM transition of the system being carried out.
  * @async: If true, the device is being resumed asynchronously.
  *
  * Runtime PM is disabled for @dev while this function is being executed.
  */
-static int device_resume_early(struct device *dev, pm_message_t state, bool async)
+static void __device_resume_early(struct device *dev, pm_message_t state, bool async)
 {
 	pm_callback_t callback = NULL;
 	const char *info = NULL;

@@ -811,21 +807,31 @@ Out:
 
 	pm_runtime_enable(dev);
 	complete_all(&dev->power.completion);
-	return error;
+
+	if (error) {
+		suspend_stats.failed_resume_early++;
+		dpm_save_failed_step(SUSPEND_RESUME_EARLY);
+		dpm_save_failed_dev(dev_name(dev));
+		pm_dev_err(dev, state, async ? " async early" : " early", error);
+	}
 }
 
 static void async_resume_early(void *data, async_cookie_t cookie)
 {
 	struct device *dev = data;
-	int error;
-
-	error = device_resume_early(dev, pm_transition, true);
-	if (error)
-		pm_dev_err(dev, pm_transition, " async", error);
 
+	__device_resume_early(dev, pm_transition, true);
 	put_device(dev);
 }
 
+static void device_resume_early(struct device *dev)
+{
+	if (dpm_async_fn(dev, async_resume_early))
+		return;
+
+	__device_resume_early(dev, pm_transition, false);
+}
+
 /**
  * dpm_resume_early - Execute "early resume" callbacks for all devices.
  * @state: PM transition of the system being carried out.

@@ -839,14 +845,6 @@ void dpm_resume_early(pm_message_t state
 	mutex_lock(&dpm_list_mtx);
 	pm_transition = state;
 
-	/*
-	 * Advanced the async threads upfront,
-	 * in case the starting of async threads is
-	 * delayed by non-async resuming devices.
-	 */
-	list_for_each_entry(dev, &dpm_late_early_list, power.entry)
-		dpm_async_fn(dev, async_resume_early);
-
 	while (!list_empty(&dpm_late_early_list)) {
 		dev = to_device(dpm_late_early_list.next);
 		get_device(dev);

@@ -854,17 +852,7 @@ void dpm_resume_early(pm_message_t state
 
 		mutex_unlock(&dpm_list_mtx);
 
-		if (!is_async(dev)) {
-			int error;
-
-			error = device_resume_early(dev, state, false);
-			if (error) {
-				suspend_stats.failed_resume_early++;
-				dpm_save_failed_step(SUSPEND_RESUME_EARLY);
-				dpm_save_failed_dev(dev_name(dev));
-				pm_dev_err(dev, state, " early", error);
-			}
-		}
+		device_resume_early(dev);
 
 		put_device(dev);
 

@@ -888,12 +876,12 @@ void dpm_resume_start(pm_message_t state
 EXPORT_SYMBOL_GPL(dpm_resume_start);
 
 /**
- * device_resume - Execute "resume" callbacks for given device.
+ * __device_resume - Execute "resume" callbacks for given device.
  * @dev: Device to handle.
  * @state: PM transition of the system being carried out.
  * @async: If true, the device is being resumed asynchronously.
  */
-static int device_resume(struct device *dev, pm_message_t state, bool async)
+static void __device_resume(struct device *dev, pm_message_t state, bool async)
 {
 	pm_callback_t callback = NULL;
 	const char *info = NULL;

@@ -975,20 +963,30 @@ static int device_resume(struct device *
 
 	TRACE_RESUME(error);
 
-	return error;
+	if (error) {
+		suspend_stats.failed_resume++;
+		dpm_save_failed_step(SUSPEND_RESUME);
+		dpm_save_failed_dev(dev_name(dev));
+		pm_dev_err(dev, state, async ? " async" : "", error);
+	}
 }
 
 static void async_resume(void *data, async_cookie_t cookie)
 {
 	struct device *dev = data;
-	int error;
 
-	error = device_resume(dev, pm_transition, true);
-	if (error)
-		pm_dev_err(dev, pm_transition, " async", error);
+	__device_resume(dev, pm_transition, true);
 	put_device(dev);
 }
 
+static void device_resume(struct device *dev)
+{
+	if (dpm_async_fn(dev, async_resume))
+		return;
+
+	__device_resume(dev, pm_transition, false);
+}
+
 /**
  * dpm_resume - Execute "resume" callbacks for non-sysdev devices.
  * @state: PM transition of the system being carried out.

@@ -1008,27 +1006,17 @@ void dpm_resume(pm_message_t state)
 	pm_transition = state;
 	async_error = 0;
 
-	list_for_each_entry(dev, &dpm_suspended_list, power.entry)
-		dpm_async_fn(dev, async_resume);
-
 	while (!list_empty(&dpm_suspended_list)) {
 		dev = to_device(dpm_suspended_list.next);
+
 		get_device(dev);
-		if (!is_async(dev)) {
-			int error;
 
-			mutex_unlock(&dpm_list_mtx);
+		mutex_unlock(&dpm_list_mtx);
 
-			error = device_resume(dev, state, false);
-			if (error) {
-				suspend_stats.failed_resume++;
-				dpm_save_failed_step(SUSPEND_RESUME);
-				dpm_save_failed_dev(dev_name(dev));
-				pm_dev_err(dev, state, "", error);
-			}
+		device_resume(dev);
+
+		mutex_lock(&dpm_list_mtx);
 
-			mutex_lock(&dpm_list_mtx);
-		}
 		if (!list_empty(&dev->power.entry))
 			list_move_tail(&dev->power.entry, &dpm_prepared_list);
 

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

commit 7b21ed7d119dc06b0ed2ba3e406a02cafe3a8d03 upstream.

If you select CONFIG_EFI_ZBOOT, we will generate vmlinuz.efi, and then when we go to install the kernel we'll install the vmlinux instead because install.sh only recognizes Image.gz as wanting the compressed install image. With CONFIG_EFI_ZBOOT we don't get the proper kernel installed, which means it doesn't boot, which makes for a very confused and subsequently angry kernel developer.

Fix this by properly installing our compressed kernel if we've enabled CONFIG_EFI_ZBOOT.

---
 arch/arm64/boot/install.sh |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -17,7 +17,8 @@
 #   $3 - kernel map file
 #   $4 - default install path (blank if root directory)
 
-if [ "$(basename $2)" = "Image.gz" ]; then
+if [ "$(basename $2)" = "Image.gz" ] || [ "$(basename $2)" = "vmlinuz.efi" ]
+then
 # Compressed install
   echo "Installing compressed kernel"
   base=vmlinuz

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Viresh Kumar <[email protected]>

commit 7269c250db1b89cda72ca419b7bd5e37997309d6 upstream.

The OPP core finds the eventual frequency to set with the help of clk_round_rate() and the same was earlier getting passed to _set_opp() and that's what would get configured.

The commit 1efae8d2e777 ("OPP: Make dev_pm_opp_set_opp() independent of frequency") mistakenly changed that. Fix it.

---
 drivers/opp/core.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

@@ -1378,12 +1378,12 @@ int dev_pm_opp_set_rate(struct device *d
 		 * value of the frequency. In such a case, do not abort but
 		 * configure the hardware to the desired frequency forcefully.
 		 */
-		forced = opp_table->rate_clk_single != target_freq;
+		forced = opp_table->rate_clk_single != freq;
 	}
 
-	ret = _set_opp(dev, opp_table, opp, &target_freq, forced);
+	ret = _set_opp(dev, opp_table, opp, &freq, forced);
 
-	if (target_freq)
+	if (freq)
 		dev_pm_opp_put(opp);
 
 put_opp_table:

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Disseldorp <[email protected]>

commit 2b0122aaa800b021e36027d7f29e206f87c761d6 upstream.

The value set as scrub_speed_max accepts size with suffixes (k/m/g/t/p/e) but we should still validate it for trailing characters, similar to what we do with chunk_size_store.

---
 fs/btrfs/sysfs.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -1783,6 +1783,10 @@ static ssize_t btrfs_devinfo_scrub_speed
 	unsigned long long limit;
 
 	limit = memparse(buf, &endptr);
+	/* There could be trailing '\n', also catch any typos after the value. */
+	endptr = skip_spaces(endptr);
+	if (*endptr != 0)
+		return -EINVAL;
 	WRITE_ONCE(device->scrub_speed_max, limit);
 	return len;
 }

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tianjia Zhang <[email protected]>

commit ba3c5574203034781ac4231acf117da917efcd2a upstream.

When the mpi_ec_ctx structure is initialized, some fields are not cleared, causing a crash when referencing the field when the structure was released. Initially, this issue was ignored because memory for mpi_ec_ctx is allocated with the __GFP_ZERO flag. For example, this error will be triggered when calculating the Za value for SM2 separately.

---
 lib/crypto/mpi/ec.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -584,6 +584,9 @@ void mpi_ec_init(struct mpi_ec_ctx *ctx,
 	ctx->a = mpi_copy(a);
 	ctx->b = mpi_copy(b);
 
+	ctx->d = NULL;
+	ctx->t.two_inv_p = NULL;
+
 	ctx->t.p_barrett = use_barrett > 0 ? mpi_barrett_init(ctx->p, 0) : NULL;
 
 	mpi_ec_get_reset(ctx);

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gao Xiang <[email protected]>

commit 3c12466b6b7bf1e56f9b32c366a3d83d87afb4de upstream.

Currently EROFS can map another compressed buffer for inplace decompression, that was used to handle the cases that some pages of compressed data are actually not in-place I/O.

However, like most simple LZ77 algorithms, LZ4 expects the compressed data is arranged at the end of the decompressed buffer and it explicitly uses memmove() to handle overlapping:
__________________________________________________________
|_ direction of decompression --> ____ |_ compressed data _|

Although EROFS arranges compressed data like this, it typically maps two individual virtual buffers so the relative order is uncertain. Previously, it was hardly observed since LZ4 only uses memmove() for short overlapped literals and x86/arm64 memmove implementations seem to completely cover it up and they don't have this issue. Juhyung reported that EROFS data corruption can be found on a new Intel x86 processor. After some analysis, it seems that recent x86 processors with the new FSRM feature expose this issue with "rep movsb".

Let's strictly use the decompressed buffer for lz4 inplace decompression for now. Later, as an useful improvement, we could try to tie up these two buffers together in the correct order.

---
 fs/erofs/decompressor.c |   31 ++++++++++++++++---------------
 1 file changed, 16 insertions(+), 15 deletions(-)

@@ -121,11 +121,11 @@ static int z_erofs_lz4_prepare_dstpages(
 }
 
 static void *z_erofs_lz4_handle_overlap(struct z_erofs_lz4_decompress_ctx *ctx,
-			void *inpage, unsigned int *inputmargin, int *maptype,
-			bool may_inplace)
+			void *inpage, void *out, unsigned int *inputmargin,
+			int *maptype, bool may_inplace)
 {
 	struct z_erofs_decompress_req *rq = ctx->rq;
-	unsigned int omargin, total, i, j;
+	unsigned int omargin, total, i;
 	struct page **in;
 	void *src, *tmp;
 

@@ -135,12 +135,13 @@ static void *z_erofs_lz4_handle_overlap(
 		    omargin < LZ4_DECOMPRESS_INPLACE_MARGIN(rq->inputsize))
 			goto docopy;
 
-		for (i = 0; i < ctx->inpages; ++i) {
-			DBG_BUGON(rq->in[i] == NULL);
-			for (j = 0; j < ctx->outpages - ctx->inpages + i; ++j)
-				if (rq->out[j] == rq->in[i])
-					goto docopy;
-		}
+		for (i = 0; i < ctx->inpages; ++i)
+			if (rq->out[ctx->outpages - ctx->inpages + i] !=
+			    rq->in[i])
+				goto docopy;
+		kunmap_local(inpage);
+		*maptype = 3;
+		return out + ((ctx->outpages - ctx->inpages) << PAGE_SHIFT);
 	}
 
 	if (ctx->inpages <= 1) {

@@ -148,7 +149,6 @@ static void *z_erofs_lz4_handle_overlap(
 		return inpage;
 	}
 	kunmap_local(inpage);
-	might_sleep();
 	src = erofs_vm_map_ram(rq->in, ctx->inpages);
 	if (!src)
 		return ERR_PTR(-ENOMEM);

@@ -204,12 +204,12 @@ int z_erofs_fixup_insize(struct z_erofs_
 }
 
 static int z_erofs_lz4_decompress_mem(struct z_erofs_lz4_decompress_ctx *ctx,
-				      u8 *out)
+				      u8 *dst)
 {
 	struct z_erofs_decompress_req *rq = ctx->rq;
 	bool support_0padding = false, may_inplace = false;
 	unsigned int inputmargin;
-	u8 *headpage, *src;
+	u8 *out, *headpage, *src;
 	int ret, maptype;
 
 	DBG_BUGON(*rq->in == NULL);

@@ -230,11 +230,12 @@ static int z_erofs_lz4_decompress_mem(st
 	}
 
 	inputmargin = rq->pageofs_in;
-	src = z_erofs_lz4_handle_overlap(ctx, headpage, &inputmargin,
+	src = z_erofs_lz4_handle_overlap(ctx, headpage, dst, &inputmargin,
 					 &maptype, may_inplace);
 	if (IS_ERR(src))
 		return PTR_ERR(src);
 
+	out = dst + rq->pageofs_out;
 	/* legacy format could compress extra data in a pcluster. */
 	if (rq->partial_decoding || !support_0padding)
 		ret = LZ4_decompress_safe_partial(src + inputmargin, out,

@@ -265,7 +266,7 @@ static int z_erofs_lz4_decompress_mem(st
 		vm_unmap_ram(src, ctx->inpages);
 	} else if (maptype == 2) {
 		erofs_put_pcpubuf(src);
-	} else {
+	} else if (maptype != 3) {
 		DBG_BUGON(1);
 		return -EFAULT;
 	}

@@ -308,7 +309,7 @@ static int z_erofs_lz4_decompress(struct
 	}
 
 dstmap_out:
-	ret = z_erofs_lz4_decompress_mem(&ctx, dst + rq->pageofs_out);
+	ret = z_erofs_lz4_decompress_mem(&ctx, dst);
 	if (!dst_maptype)
 		kunmap_local(dst);
 	else if (dst_maptype == 2)

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Herbert Xu <[email protected]>

commit 27016f75f5ed47e2d8e0ca75a8ff1f40bc1a5e27 upstream.

Disallow registration of two algorithms with identical driver names.

---
 crypto/algapi.c |    1 +
 1 file changed, 1 insertion(+)

@@ -341,6 +341,7 @@ __crypto_register_alg(struct crypto_alg
 		}
 
 		if (!strcmp(q->cra_driver_name, alg->cra_name) ||
+		    !strcmp(q->cra_driver_name, alg->cra_driver_name) ||
 		    !strcmp(q->cra_name, alg->cra_driver_name))
 			goto err;
 	}

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hongchen Zhang <[email protected]>

commit 71cd7e80cfde548959952eac7063aeaea1f2e1c6 upstream.

An S4 (suspend to disk) test on the LoongArch 3A6000 platform sometimes fails with the following error messaged in the dmesg log:

Invalid LZO compressed length

That happens because when compressing/decompressing the image, the synchronization between the control thread and the compress/decompress/crc thread is based on a relaxed ordering interface, which is unreliable, and the following situation may occur:

CPU 0 CPU 1
save_image_lzo lzo_compress_threadfn

					  atomic_set(&d->stop, 1);

atomic_read(&data[thr].stop)
data[thr].cmp = data[thr].cmp_len;
WRITE data[thr].cmp_len

Then CPU0 gets a stale cmp_len and writes it to disk. During resume from S4, wrong cmp_len is loaded.

To maintain data consistency between the two threads, use the acquire/release variants of atomic set and read operations.

---
 kernel/power/swap.c |   38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

@@ -606,11 +606,11 @@ static int crc32_threadfn(void *data)
 	unsigned i;
 
 	while (1) {
-		wait_event(d->go, atomic_read(&d->ready) ||
+		wait_event(d->go, atomic_read_acquire(&d->ready) ||
 		                  kthread_should_stop());
 		if (kthread_should_stop()) {
 			d->thr = NULL;
-			atomic_set(&d->stop, 1);
+			atomic_set_release(&d->stop, 1);
 			wake_up(&d->done);
 			break;
 		}

@@ -619,7 +619,7 @@ static int crc32_threadfn(void *data)
 		for (i = 0; i < d->run_threads; i++)
 			*d->crc32 = crc32_le(*d->crc32,
 			                     d->unc[i], *d->unc_len[i]);
-		atomic_set(&d->stop, 1);
+		atomic_set_release(&d->stop, 1);
 		wake_up(&d->done);
 	}
 	return 0;

@@ -649,12 +649,12 @@ static int lzo_compress_threadfn(void *d
 	struct cmp_data *d = data;
 
 	while (1) {
-		wait_event(d->go, atomic_read(&d->ready) ||
+		wait_event(d->go, atomic_read_acquire(&d->ready) ||
 		                  kthread_should_stop());
 		if (kthread_should_stop()) {
 			d->thr = NULL;
 			d->ret = -1;
-			atomic_set(&d->stop, 1);
+			atomic_set_release(&d->stop, 1);
 			wake_up(&d->done);
 			break;
 		}

@@ -663,7 +663,7 @@ static int lzo_compress_threadfn(void *d
 		d->ret = lzo1x_1_compress(d->unc, d->unc_len,
 		                          d->cmp + LZO_HEADER, &d->cmp_len,
 		                          d->wrk);
-		atomic_set(&d->stop, 1);
+		atomic_set_release(&d->stop, 1);
 		wake_up(&d->done);
 	}
 	return 0;

@@ -798,7 +798,7 @@ static int save_image_lzo(struct swap_ma
 
 			data[thr].unc_len = off;
 
-			atomic_set(&data[thr].ready, 1);
+			atomic_set_release(&data[thr].ready, 1);
 			wake_up(&data[thr].go);
 		}
 

@@ -806,12 +806,12 @@ static int save_image_lzo(struct swap_ma
 			break;
 
 		crc->run_threads = thr;
-		atomic_set(&crc->ready, 1);
+		atomic_set_release(&crc->ready, 1);
 		wake_up(&crc->go);
 
 		for (run_threads = thr, thr = 0; thr < run_threads; thr++) {
 			wait_event(data[thr].done,
-			           atomic_read(&data[thr].stop));
+				atomic_read_acquire(&data[thr].stop));
 			atomic_set(&data[thr].stop, 0);
 
 			ret = data[thr].ret;

@@ -850,7 +850,7 @@ static int save_image_lzo(struct swap_ma
 			}
 		}
 
-		wait_event(crc->done, atomic_read(&crc->stop));
+		wait_event(crc->done, atomic_read_acquire(&crc->stop));
 		atomic_set(&crc->stop, 0);
 	}
 

@@ -1132,12 +1132,12 @@ static int lzo_decompress_threadfn(void
 	struct dec_data *d = data;
 
 	while (1) {
-		wait_event(d->go, atomic_read(&d->ready) ||
+		wait_event(d->go, atomic_read_acquire(&d->ready) ||
 		                  kthread_should_stop());
 		if (kthread_should_stop()) {
 			d->thr = NULL;
 			d->ret = -1;
-			atomic_set(&d->stop, 1);
+			atomic_set_release(&d->stop, 1);
 			wake_up(&d->done);
 			break;
 		}

@@ -1150,7 +1150,7 @@ static int lzo_decompress_threadfn(void
 			flush_icache_range((unsigned long)d->unc,
 					   (unsigned long)d->unc + d->unc_len);
 
-		atomic_set(&d->stop, 1);
+		atomic_set_release(&d->stop, 1);
 		wake_up(&d->done);
 	}
 	return 0;

@@ -1335,7 +1335,7 @@ static int load_image_lzo(struct swap_ma
 		}
 
 		if (crc->run_threads) {
-			wait_event(crc->done, atomic_read(&crc->stop));
+			wait_event(crc->done, atomic_read_acquire(&crc->stop));
 			atomic_set(&crc->stop, 0);
 			crc->run_threads = 0;
 		}

@@ -1371,7 +1371,7 @@ static int load_image_lzo(struct swap_ma
 					pg = 0;
 			}
 
-			atomic_set(&data[thr].ready, 1);
+			atomic_set_release(&data[thr].ready, 1);
 			wake_up(&data[thr].go);
 		}
 

@@ -1390,7 +1390,7 @@ static int load_image_lzo(struct swap_ma
 
 		for (run_threads = thr, thr = 0; thr < run_threads; thr++) {
 			wait_event(data[thr].done,
-			           atomic_read(&data[thr].stop));
+				atomic_read_acquire(&data[thr].stop));
 			atomic_set(&data[thr].stop, 0);
 
 			ret = data[thr].ret;

@@ -1421,7 +1421,7 @@ static int load_image_lzo(struct swap_ma
 				ret = snapshot_write_next(snapshot);
 				if (ret <= 0) {
 					crc->run_threads = thr + 1;
-					atomic_set(&crc->ready, 1);
+					atomic_set_release(&crc->ready, 1);
 					wake_up(&crc->go);
 					goto out_finish;
 				}

@@ -1429,13 +1429,13 @@ static int load_image_lzo(struct swap_ma
 		}
 
 		crc->run_threads = thr;
-		atomic_set(&crc->ready, 1);
+		atomic_set_release(&crc->ready, 1);
 		wake_up(&crc->go);
 	}
 
 out_finish:
 	if (crc->run_threads) {
-		wait_event(crc->done, atomic_read(&crc->stop));
+		wait_event(crc->done, atomic_read_acquire(&crc->stop));
 		atomic_set(&crc->stop, 0);
 	}
 	stop = ktime_get();

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Herbert Xu <[email protected]>

commit 78aafb3884f6bc6636efcc1760c891c8500b9922 upstream.

There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks.

Fix this by using a stack buffer when calling copy_to_user.

---
 drivers/char/hw_random/core.c |   34 +++++++++++++++++++++-------------
 1 file changed, 21 insertions(+), 13 deletions(-)

@@ -23,10 +23,13 @@
 #include <linux/sched.h>
 #include <linux/sched/signal.h>
 #include <linux/slab.h>
+#include <linux/string.h>
 #include <linux/uaccess.h>
 
 #define RNG_MODULE_NAME		"hw_random"
 
+#define RNG_BUFFER_SIZE (SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES)
+
 static struct hwrng *current_rng;
 /* the current rng has been explicitly chosen by user via sysfs */
 static int cur_rng_set_by_user;

@@ -58,7 +61,7 @@ static inline int rng_get_data(struct hw
 
 static size_t rng_buffer_size(void)
 {
-	return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES;
+	return RNG_BUFFER_SIZE;
 }
 
 static void add_early_randomness(struct hwrng *rng)

@@ -209,6 +212,7 @@ static inline int rng_get_data(struct hw
 static ssize_t rng_dev_read(struct file *filp, char __user *buf,
 			    size_t size, loff_t *offp)
 {
+	u8 buffer[RNG_BUFFER_SIZE];
 	ssize_t ret = 0;
 	int err = 0;
 	int bytes_read, len;

@@ -236,34 +240,37 @@ static ssize_t rng_dev_read(struct file
 			if (bytes_read < 0) {
 				err = bytes_read;
 				goto out_unlock_reading;
+			} else if (bytes_read == 0 &&
+				   (filp->f_flags & O_NONBLOCK)) {
+				err = -EAGAIN;
+				goto out_unlock_reading;
 			}
+
 			data_avail = bytes_read;
 		}
 
-		if (!data_avail) {
-			if (filp->f_flags & O_NONBLOCK) {
-				err = -EAGAIN;
-				goto out_unlock_reading;
-			}
-		} else {
-			len = data_avail;
+		len = data_avail;
+		if (len) {
 			if (len > size)
 				len = size;
 
 			data_avail -= len;
 
-			if (copy_to_user(buf + ret, rng_buffer + data_avail,
-								len)) {
+			memcpy(buffer, rng_buffer + data_avail, len);
+		}
+		mutex_unlock(&reading_mutex);
+		put_rng(rng);
+
+		if (len) {
+			if (copy_to_user(buf + ret, buffer, len)) {
 				err = -EFAULT;
-				goto out_unlock_reading;
+				goto out;
 			}
 
 			size -= len;
 			ret += len;
 		}
 
-		mutex_unlock(&reading_mutex);
-		put_rng(rng);
 
 		if (need_resched())
 			schedule_timeout_interruptible(1);

@@ -274,6 +281,7 @@ static ssize_t rng_dev_read(struct file
 		}
 	}
 out:
+	memzero_explicit(buffer, sizeof(buffer));
 	return ret ? : err;
 
 out_unlock_reading:

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Herbert Xu <[email protected]>

commit d07f951903fa9922c375b8ab1ce81b18a0034e3b upstream.

When processing the last block, the s390 ctr code will always read a whole block, even if there isn't a whole block of data left. Fix this by using the actual length left and copy it into a buffer first for processing.

---
 arch/s390/crypto/aes_s390.c  |    4 +++-
 arch/s390/crypto/paes_s390.c |    4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

@@ -597,7 +597,9 @@ static int ctr_aes_crypt(struct skcipher
 	 * final block may be < AES_BLOCK_SIZE, copy only nbytes
 	 */
 	if (nbytes) {
-		cpacf_kmctr(sctx->fc, sctx->key, buf, walk.src.virt.addr,
+		memset(buf, 0, AES_BLOCK_SIZE);
+		memcpy(buf, walk.src.virt.addr, nbytes);
+		cpacf_kmctr(sctx->fc, sctx->key, buf, buf,
 			    AES_BLOCK_SIZE, walk.iv);
 		memcpy(walk.dst.virt.addr, buf, nbytes);
 		crypto_inc(walk.iv, AES_BLOCK_SIZE);

@@ -693,9 +693,11 @@ static int ctr_paes_crypt(struct skciphe
 	 * final block may be < AES_BLOCK_SIZE, copy only nbytes
 	 */
 	if (nbytes) {
+		memset(buf, 0, AES_BLOCK_SIZE);
+		memcpy(buf, walk.src.virt.addr, nbytes);
 		while (1) {
 			if (cpacf_kmctr(ctx->fc, &param, buf,
-					walk.src.virt.addr, AES_BLOCK_SIZE,
+					buf, AES_BLOCK_SIZE,
 					walk.iv) == AES_BLOCK_SIZE)
 				break;
 			if (__paes_convert_key(ctx))

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <[email protected]>

[ Upstream commit 8a8a9ac8a4972ee69d3dd3d1ae43963ae39cee18 ]

If same devices with same device IDs are present on different soundwire buses, the probe fails due to conflicting device names and sysfs entries:

sysfs: cannot create duplicate filename '/bus/soundwire/devices/sdw:0:0217:0204:00:0'

The link ID is 0 for both devices, so they should be differentiated by the controller ID. Add the controller ID so, the device names and sysfs entries look like:

sdw:1:0:0217:0204:00:0 -> ../../../devices/platform/soc@0/6ab0000.soundwire-controller/sdw-master-1-0/sdw:1:0:0217:0204:00:0 sdw:3:0:0217:0204:00:0 -> ../../../devices/platform/soc@0/6b10000.soundwire-controller/sdw-master-3-0/sdw:3:0:0217:0204:00:0

[PLB changes: use bus->controller_id instead of bus->id]

---
 drivers/soundwire/slave.c        | 12 ++++++------
 sound/soc/intel/boards/sof_sdw.c |  4 ++--
 2 files changed, 8 insertions(+), 8 deletions(-)

index c1c1a2ac293a..060c2982e26b 100644
@@ -39,14 +39,14 @@ int sdw_slave_add(struct sdw_bus *bus,
 	slave->dev.fwnode = fwnode;
 
 	if (id->unique_id == SDW_IGNORED_UNIQUE_ID) {
-		/* name shall be sdw:link:mfg:part:class */
-		dev_set_name(&slave->dev, "sdw:%01x:%04x:%04x:%02x",
-			     bus->link_id, id->mfg_id, id->part_id,
+		/* name shall be sdw:ctrl:link:mfg:part:class */
+		dev_set_name(&slave->dev, "sdw:%01x:%01x:%04x:%04x:%02x",
+			     bus->controller_id, bus->link_id, id->mfg_id, id->part_id,
 			     id->class_id);
 	} else {
-		/* name shall be sdw:link:mfg:part:class:unique */
-		dev_set_name(&slave->dev, "sdw:%01x:%04x:%04x:%02x:%01x",
-			     bus->link_id, id->mfg_id, id->part_id,
+		/* name shall be sdw:ctrl:link:mfg:part:class:unique */
+		dev_set_name(&slave->dev, "sdw:%01x:%01x:%04x:%04x:%02x:%01x",
+			     bus->controller_id, bus->link_id, id->mfg_id, id->part_id,
 			     id->class_id, id->unique_id);
 	}
 

index 4e4284729773..1e788859c863 100644
@@ -1232,11 +1232,11 @@ static int fill_sdw_codec_dlc(struct device *dev,
 	else if (is_unique_device(adr_link, sdw_version, mfg_id, part_id,
 				  class_id, adr_index))
 		codec->name = devm_kasprintf(dev, GFP_KERNEL,
-					     "sdw:%01x:%04x:%04x:%02x", link_id,
+					     "sdw:0:%01x:%04x:%04x:%02x", link_id,
 					     mfg_id, part_id, class_id);
 	else
 		codec->name = devm_kasprintf(dev, GFP_KERNEL,
-					     "sdw:%01x:%04x:%04x:%02x:%01x", link_id,
+					     "sdw:0:%01x:%04x:%04x:%02x:%01x", link_id,
 					     mfg_id, part_id, class_id, unique_id);
 
 	if (!codec->name)

2.43.0

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Anthony Krowiak <[email protected]>

commit 7b2d039da622daa9ba259ac6f38701d542b237c3 upstream.

In the vfio_ap_irq_enable function, after the page containing the notification indicator byte (NIB) is pinned, the function attempts to register the guest ISC. If registration fails, the function sets the status response code and returns without unpinning the page containing the NIB. In order to avoid a memory leak, the NIB should be unpinned before returning from the vfio_ap_irq_enable function.

---
 drivers/s390/crypto/vfio_ap_ops.c |    1 +
 1 file changed, 1 insertion(+)

@@ -457,6 +457,7 @@ static struct ap_queue_status vfio_ap_ir
 		VFIO_AP_DBF_WARN("%s: gisc registration failed: nisc=%d, isc=%d, apqn=%#04x\n",
 				 __func__, nisc, isc, q->apqn);
 
+		vfio_unpin_pages(&q->matrix_mdev->vdev, nib, 1);
 		status.response_code = AP_RESPONSE_INVALID_GISA;
 		return status;
 	}

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christian Marangi <[email protected]>

commit 08e23d05fa6dc4fc13da0ccf09defdd4bbc92ff4 upstream.

Fix buffer overflow in trans_stat_show().

Convert simple snprintf to the more secure scnprintf with size of PAGE_SIZE.

Add condition checking if we are exceeding PAGE_SIZE and exit early from loop. Also add at the end a warning that we exceeded PAGE_SIZE and that stats is disabled.

Return -EFBIG in the case where we don't have enough space to write the full transition table.

Also document in the ABI that this function can return -EFBIG error.

---
 Documentation/ABI/testing/sysfs-class-devfreq |    3 +
 drivers/devfreq/devfreq.c                     |   59 +++++++++++++++++---------
 2 files changed, 43 insertions(+), 19 deletions(-)

@@ -52,6 +52,9 @@ Description:
 
 			echo 0 > /sys/class/devfreq/.../trans_stat
 
+		If the transition table is bigger than PAGE_SIZE, reading
+		this will return an -EFBIG error.
+
 What:		/sys/class/devfreq/.../available_frequencies
 Date:		October 2012
 Contact:	Nishanth Menon <[email protected]>

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Miquel Raynal <[email protected]>

commit a7d84a2e7663bbe12394cc771107e04668ea313a upstream.

While switching to ref counters for track mtd devices use, the vmu-flash driver was forgotten. The reason for reading the ref counter seems debatable, but let's just fix the build for now.

---
 drivers/mtd/maps/vmu-flash.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -719,7 +719,7 @@ static int vmu_can_unload(struct maple_d
 	card = maple_get_drvdata(mdev);
 	for (x = 0; x < card->partitions; x++) {
 		mtd = &((card->mtd)[x]);
-		if (mtd->usecount > 0)
+		if (kref_read(&mtd->refcnt))
 			return 0;
 	}
 	return 1;

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Miquel Raynal <[email protected]>

commit bbcd80f53a5e8c27c2511f539fec8c373f500cf4 upstream.

The ONFI specification states that devices do not need to support sequential reads across LUN boundaries. In order to prevent such event from happening and possibly failing, let's introduce the concept of "pause" in the sequential read to handle these cases. The first/last pages remain the same but any time we cross a LUN boundary we will end and restart (if relevant) the sequential read operation.

---
 drivers/mtd/nand/raw/nand_base.c |   43 +++++++++++++++++++++++++++++++++------
 include/linux/mtd/rawnand.h      |    2 +
 2 files changed, 39 insertions(+), 6 deletions(-)

@@ -1207,6 +1207,23 @@ static int nand_lp_exec_read_page_op(str
 	return nand_exec_op(chip, &op);
 }
 
+static void rawnand_cap_cont_reads(struct nand_chip *chip)
+{
+	struct nand_memory_organization *memorg;
+	unsigned int pages_per_lun, first_lun, last_lun;
+
+	memorg = nanddev_get_memorg(&chip->base);
+	pages_per_lun = memorg->pages_per_eraseblock * memorg->eraseblocks_per_lun;
+	first_lun = chip->cont_read.first_page / pages_per_lun;
+	last_lun = chip->cont_read.last_page / pages_per_lun;
+
+	/* Prevent sequential cache reads across LUN boundaries */
+	if (first_lun != last_lun)
+		chip->cont_read.pause_page = first_lun * pages_per_lun + pages_per_lun - 1;
+	else
+		chip->cont_read.pause_page = chip->cont_read.last_page;
+}
+
 static int nand_lp_exec_cont_read_page_op(struct nand_chip *chip, unsigned int page,
 					  unsigned int offset_in_page, void *buf,
 					  unsigned int len, bool check_only)

@@ -1225,7 +1242,7 @@ static int nand_lp_exec_cont_read_page_o
 		NAND_OP_DATA_IN(len, buf, 0),
 	};
 	struct nand_op_instr cont_instrs[] = {
-		NAND_OP_CMD(page == chip->cont_read.last_page ?
+		NAND_OP_CMD(page == chip->cont_read.pause_page ?
 			    NAND_CMD_READCACHEEND : NAND_CMD_READCACHESEQ,
 			    NAND_COMMON_TIMING_NS(conf, tWB_max)),
 		NAND_OP_WAIT_RDY(NAND_COMMON_TIMING_MS(conf, tR_max),

@@ -1262,16 +1279,29 @@ static int nand_lp_exec_cont_read_page_o
 	}
 
 	if (page == chip->cont_read.first_page)
-		return nand_exec_op(chip, &start_op);
+		ret = nand_exec_op(chip, &start_op);
 	else
-		return nand_exec_op(chip, &cont_op);
+		ret = nand_exec_op(chip, &cont_op);
+	if (ret)
+		return ret;
+
+	if (!chip->cont_read.ongoing)
+		return 0;
+
+	if (page == chip->cont_read.pause_page &&
+	    page != chip->cont_read.last_page) {
+		chip->cont_read.first_page = chip->cont_read.pause_page + 1;
+		rawnand_cap_cont_reads(chip);
+	} else if (page == chip->cont_read.last_page) {
+		chip->cont_read.ongoing = false;
+	}
+
+	return 0;
 }
 
 static bool rawnand_cont_read_ongoing(struct nand_chip *chip, unsigned int page)
 {
-	return chip->cont_read.ongoing &&
-		page >= chip->cont_read.first_page &&
-		page <= chip->cont_read.last_page;
+	return chip->cont_read.ongoing && page >= chip->cont_read.first_page;
 }
 
 /**

@@ -3445,6 +3475,7 @@ static void rawnand_enable_cont_reads(st
 	if (col)
 		chip->cont_read.first_page++;
 	chip->cont_read.last_page = page + ((readlen >> chip->page_shift) & chip->pagemask);
+	rawnand_cap_cont_reads(chip);
 }
 
 /**

@@ -1265,6 +1265,7 @@ struct nand_secure_region {
  * @cont_read: Sequential page read internals
  * @cont_read.ongoing: Whether a continuous read is ongoing or not
  * @cont_read.first_page: Start of the continuous read operation
+ * @cont_read.pause_page: End of the current sequential cache read operation
  * @cont_read.last_page: End of the continuous read operation
  * @controller: The hardware controller	structure which is shared among multiple
  *              independent devices

@@ -1321,6 +1322,7 @@ struct nand_chip {
 	struct {
 		bool ongoing;
 		unsigned int first_page;
+		unsigned int pause_page;
 		unsigned int last_page;
 	} cont_read;
 

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Miquel Raynal <[email protected]>

commit 7c9414c870c027737d0f2ed7b0ed10f26edb1c61 upstream.

A couple of reports pointed at some strange failures happening a bit randomly since the introduction of sequential page reads support. After investigation it turned out the most likely reason for these issues was the fact that sometimes a (longer) read might happen, starting at the same page that was read previously. This is optimized by the raw NAND core, by not sending the READ_PAGE command to the NAND device and just reading out the data in a local cache. When this page is also flagged as being the starting point for a sequential read, it means the page right next will be accessed without the right instructions. The NAND chip will be confused and will not output correct data. In order to avoid such situation from happening anymore, we can however handle this case with a bit of additional logic, to postpone the initialization of the read sequence by one page.

---
 drivers/mtd/nand/raw/nand_base.c |   14 ++++++++++++++
 1 file changed, 14 insertions(+)

@@ -3478,6 +3478,18 @@ static void rawnand_enable_cont_reads(st
 	rawnand_cap_cont_reads(chip);
 }
 
+static void rawnand_cont_read_skip_first_page(struct nand_chip *chip, unsigned int page)
+{
+	if (!chip->cont_read.ongoing || page != chip->cont_read.first_page)
+		return;
+
+	chip->cont_read.first_page++;
+	if (chip->cont_read.first_page == chip->cont_read.pause_page)
+		chip->cont_read.first_page++;
+	if (chip->cont_read.first_page >= chip->cont_read.last_page)
+		chip->cont_read.ongoing = false;
+}
+
 /**
  * nand_setup_read_retry - [INTERN] Set the READ RETRY mode
  * @chip: NAND chip object

@@ -3652,6 +3664,8 @@ read_retry:
 			buf += bytes;
 			max_bitflips = max_t(unsigned int, max_bitflips,
 					     chip->pagecache.bitflips);
+
+			rawnand_cont_read_skip_first_page(chip, page);
 		}
 
 		readlen -= bytes;

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Miquel Raynal <[email protected]>

commit a62c4597953fe54c6af04166a5e2872efd0e1490 upstream.

Some devices support sequential reads when using the on-die ECC engines, some others do not. It is a bit hard to know which ones will break other than experimentally, so in order to avoid such a difficult and painful task, let's just pretend all devices should avoid using this optimization when configured like this.

---
 drivers/mtd/nand/raw/nand_base.c |    8 ++++++++
 1 file changed, 8 insertions(+)

@@ -5170,6 +5170,14 @@ static void rawnand_late_check_supported
 	/* The supported_op fields should not be set by individual drivers */
 	WARN_ON_ONCE(chip->controller->supported_op.cont_read);
 
+	/*
+	 * Too many devices do not support sequential cached reads with on-die
+	 * ECC correction enabled, so in this case refuse to perform the
+	 * automation.
+	 */
+	if (chip->ecc.engine_type == NAND_ECC_ENGINE_TYPE_ON_DIE)
+		return;
+
 	if (!nand_has_exec_op(chip))
 		return;
 

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Miquel Raynal <[email protected]>

commit 828f6df1bcba7f64729166efc7086ea657070445 upstream.

The current logic is probably fine but is a bit convoluted. Plus, we don't want partial pages to be part of the sequential operation just in case the core would optimize the page read with a subpage read (which would break the sequence). This may happen on the first and last page only, so if the start offset or the end offset is not aligned with a page boundary, better avoid them to prevent any risk.

---
 drivers/mtd/nand/raw/nand_base.c |   24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

@@ -3460,21 +3460,29 @@ static void rawnand_enable_cont_reads(st
 				      u32 readlen, int col)
 {
 	struct mtd_info *mtd = nand_to_mtd(chip);
+	unsigned int end_page, end_col;
+
+	chip->cont_read.ongoing = false;
 
 	if (!chip->controller->supported_op.cont_read)
 		return;
 
-	if ((col && col + readlen < (3 * mtd->writesize)) ||
-	    (!col && readlen < (2 * mtd->writesize))) {
-		chip->cont_read.ongoing = false;
+	end_page = DIV_ROUND_UP(col + readlen, mtd->writesize);
+	end_col = (col + readlen) % mtd->writesize;
+
+	if (col)
+		page++;
+
+	if (end_col && end_page)
+		end_page--;
+
+	if (page + 1 > end_page)
 		return;
-	}
 
-	chip->cont_read.ongoing = true;
 	chip->cont_read.first_page = page;
-	if (col)
-		chip->cont_read.first_page++;
-	chip->cont_read.last_page = page + ((readlen >> chip->page_shift) & chip->pagemask);
+	chip->cont_read.last_page = end_page;
+	chip->cont_read.ongoing = true;
+
 	rawnand_cap_cont_reads(chip);
 }
 

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

commit c4fb7d2eac9ff9bfc35a2e4d40c7169a332416e0 upstream.

The PMIC GLINK altmode driver currently supports at most two ports.

Fix the incomplete port sanity check on notifications to avoid accessing and corrupting memory beyond the port array if we ever get a notification for an unsupported port.

---
 drivers/soc/qcom/pmic_glink_altmode.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -285,7 +285,7 @@ static void pmic_glink_altmode_sc8180xp_
 
 	svid = mux == 2 ? USB_TYPEC_DP_SID : 0;
 
-	if (!altmode->ports[port].altmode) {
+	if (port >= ARRAY_SIZE(altmode->ports) || !altmode->ports[port].altmode) {
 		dev_dbg(altmode->dev, "notification on undefined port %d\n", port);
 		return;
 	}

@@ -328,7 +328,7 @@ static void pmic_glink_altmode_sc8280xp_
 	hpd_state = FIELD_GET(SC8280XP_HPD_STATE_MASK, notify->payload[8]);
 	hpd_irq = FIELD_GET(SC8280XP_HPD_IRQ_MASK, notify->payload[8]);
 
-	if (!altmode->ports[port].altmode) {
+	if (port >= ARRAY_SIZE(altmode->ports) || !altmode->ports[port].altmode) {
 		dev_dbg(altmode->dev, "notification on undefined port %d\n", port);
 		return;
 	}

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marcelo Schmitt <[email protected]>

[ Upstream commit 149694f5e79b0c7a36ceb76e7c0d590db8f151c1 ]

The ad7091r-base driver sets up an interrupt handler for firing events when inputs are either above or below a certain threshold. However, for the interrupt signal to come from the device it must be configured to enable the ALERT/BUSY/GPO pin to be used as ALERT, which was not being done until now.
Enable interrupt signals on the ALERT/BUSY/GPO pin by setting the proper bit in the configuration register.

Stable-dep-of: 020e71c7ffc2 ("iio: adc: ad7091r: Allow users to configure device events")

---
 drivers/iio/adc/ad7091r-base.c | 6 ++++++
 1 file changed, 6 insertions(+)

index 0e5d3d2e9c98..8aaa854f816f 100644
@@ -28,6 +28,7 @@
 #define AD7091R_REG_RESULT_CONV_RESULT(x)   ((x) & 0xfff)
 
 /* AD7091R_REG_CONF */
+#define AD7091R_REG_CONF_ALERT_EN   BIT(4)
 #define AD7091R_REG_CONF_AUTO   BIT(8)
 #define AD7091R_REG_CONF_CMD    BIT(10)
 

@@ -232,6 +233,11 @@ int ad7091r_probe(struct device *dev, const char *name,
 	iio_dev->channels = chip_info->channels;
 
 	if (irq) {
+		ret = regmap_update_bits(st->map, AD7091R_REG_CONF,
+					 AD7091R_REG_CONF_ALERT_EN, BIT(4));
+		if (ret)
+			return ret;
+
 		ret = devm_request_threaded_irq(dev, irq, NULL,
 				ad7091r_event_handler,
 				IRQF_TRIGGER_FALLING | IRQF_ONESHOT, name, iio_dev);

2.43.0

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marcelo Schmitt <[email protected]>

[ Upstream commit 020e71c7ffc25dfe29ed9be6c2d39af7bd7f661f ]

AD7091R-5 devices are supported by the ad7091r-5 driver together with the ad7091r-base driver. Those drivers declared iio events for notifying user space when ADC readings fall bellow the thresholds of low limit registers or above the values set in high limit registers. However, to configure iio events and their thresholds, a set of callback functions must be implemented and those were not present until now. The consequence of trying to configure ad7091r-5 events without the proper callback functions was a null pointer dereference in the kernel because the pointers to the callback functions were not set.

Implement event configuration callbacks allowing users to read/write event thresholds and enable/disable event generation.

Since the event spec structs are generic to AD7091R devices, also move those from the ad7091r-5 driver the base driver so they can be reused when support for ad7091r-2/-4/-8 be added.

---
 drivers/iio/adc/ad7091r-base.c | 156 +++++++++++++++++++++++++++++++++
 drivers/iio/adc/ad7091r-base.h |   6 ++
 drivers/iio/adc/ad7091r5.c     |  28 +-----
 3 files changed, 166 insertions(+), 24 deletions(-)

index 8aaa854f816f..3d36bcd26b0c 100644
@@ -6,6 +6,7 @@
  */
 
 #include <linux/bitops.h>
+#include <linux/bitfield.h>
 #include <linux/iio/events.h>
 #include <linux/iio/iio.h>
 #include <linux/interrupt.h>

@@ -50,6 +51,27 @@ struct ad7091r_state {
 	struct mutex lock; /*lock to prevent concurent reads */
 };
 
+const struct iio_event_spec ad7091r_events[] = {
+	{
+		.type = IIO_EV_TYPE_THRESH,
+		.dir = IIO_EV_DIR_RISING,
+		.mask_separate = BIT(IIO_EV_INFO_VALUE) |
+				 BIT(IIO_EV_INFO_ENABLE),
+	},
+	{
+		.type = IIO_EV_TYPE_THRESH,
+		.dir = IIO_EV_DIR_FALLING,
+		.mask_separate = BIT(IIO_EV_INFO_VALUE) |
+				 BIT(IIO_EV_INFO_ENABLE),
+	},
+	{
+		.type = IIO_EV_TYPE_THRESH,
+		.dir = IIO_EV_DIR_EITHER,
+		.mask_separate = BIT(IIO_EV_INFO_HYSTERESIS),
+	},
+};
+EXPORT_SYMBOL_NS_GPL(ad7091r_events, IIO_AD7091R);
+
 static int ad7091r_set_mode(struct ad7091r_state *st, enum ad7091r_mode mode)
 {
 	int ret, conf;

@@ -169,8 +191,142 @@ static int ad7091r_read_raw(struct iio_dev *iio_dev,
 	return ret;
 }
 
+static int ad7091r_read_event_config(struct iio_dev *indio_dev,
+				     const struct iio_chan_spec *chan,
+				     enum iio_event_type type,
+				     enum iio_event_direction dir)
+{
+	struct ad7091r_state *st = iio_priv(indio_dev);
+	int val, ret;
+
+	switch (dir) {
+	case IIO_EV_DIR_RISING:
+		ret = regmap_read(st->map,
+				  AD7091R_REG_CH_HIGH_LIMIT(chan->channel),
+				  &val);
+		if (ret)
+			return ret;
+		return val != AD7091R_HIGH_LIMIT;
+	case IIO_EV_DIR_FALLING:
+		ret = regmap_read(st->map,
+				  AD7091R_REG_CH_LOW_LIMIT(chan->channel),
+				  &val);
+		if (ret)
+			return ret;
+		return val != AD7091R_LOW_LIMIT;
+	default:
+		return -EINVAL;
+	}
+}
+
+static int ad7091r_write_event_config(struct iio_dev *indio_dev,
+				      const struct iio_chan_spec *chan,
+				      enum iio_event_type type,
+				      enum iio_event_direction dir, int state)
+{
+	struct ad7091r_state *st = iio_priv(indio_dev);
+
+	if (state) {
+		return regmap_set_bits(st->map, AD7091R_REG_CONF,
+				       AD7091R_REG_CONF_ALERT_EN);
+	} else {
+		/*
+		 * Set thresholds either to 0 or to 2^12 - 1 as appropriate to
+		 * prevent alerts and thus disable event generation.
+		 */
+		switch (dir) {
+		case IIO_EV_DIR_RISING:
+			return regmap_write(st->map,
+					    AD7091R_REG_CH_HIGH_LIMIT(chan->channel),
+					    AD7091R_HIGH_LIMIT);
+		case IIO_EV_DIR_FALLING:
+			return regmap_write(st->map,
+					    AD7091R_REG_CH_LOW_LIMIT(chan->channel),
+					    AD7091R_LOW_LIMIT);
+		default:
+			return -EINVAL;
+		}
+	}
+}
+
+static int ad7091r_read_event_value(struct iio_dev *indio_dev,
+				    const struct iio_chan_spec *chan,
+				    enum iio_event_type type,
+				    enum iio_event_direction dir,
+				    enum iio_event_info info, int *val, int *val2)
+{
+	struct ad7091r_state *st = iio_priv(indio_dev);
+	int ret;
+
+	switch (info) {
+	case IIO_EV_INFO_VALUE:
+		switch (dir) {
+		case IIO_EV_DIR_RISING:
+			ret = regmap_read(st->map,
+					  AD7091R_REG_CH_HIGH_LIMIT(chan->channel),
+					  val);
+			if (ret)
+				return ret;
+			return IIO_VAL_INT;
+		case IIO_EV_DIR_FALLING:
+			ret = regmap_read(st->map,
+					  AD7091R_REG_CH_LOW_LIMIT(chan->channel),
+					  val);
+			if (ret)
+				return ret;
+			return IIO_VAL_INT;
+		default:
+			return -EINVAL;
+		}
+	case IIO_EV_INFO_HYSTERESIS:
+		ret = regmap_read(st->map,
+				  AD7091R_REG_CH_HYSTERESIS(chan->channel),
+				  val);
+		if (ret)
+			return ret;
+		return IIO_VAL_INT;
+	default:
+		return -EINVAL;
+	}
+}
+
+static int ad7091r_write_event_value(struct iio_dev *indio_dev,
+				     const struct iio_chan_spec *chan,
+				     enum iio_event_type type,
+				     enum iio_event_direction dir,
+				     enum iio_event_info info, int val, int val2)
+{
+	struct ad7091r_state *st = iio_priv(indio_dev);
+
+	switch (info) {
+	case IIO_EV_INFO_VALUE:
+		switch (dir) {
+		case IIO_EV_DIR_RISING:
+			return regmap_write(st->map,
+					    AD7091R_REG_CH_HIGH_LIMIT(chan->channel),
+					    val);
+		case IIO_EV_DIR_FALLING:
+			return regmap_write(st->map,
+					    AD7091R_REG_CH_LOW_LIMIT(chan->channel),
+					    val);
+		default:
+			return -EINVAL;
+		}
+	case IIO_EV_INFO_HYSTERESIS:
+		return regmap_write(st->map,
+				    AD7091R_REG_CH_HYSTERESIS(chan->channel),
+				    val);
+	default:
+		return -EINVAL;
+	}
+}
+
 static const struct iio_info ad7091r_info = {
 	.read_raw = ad7091r_read_raw,
+	.read_event_config = &ad7091r_read_event_config,
+	.write_event_config = &ad7091r_write_event_config,
+	.read_event_value = &ad7091r_read_event_value,
+	.write_event_value = &ad7091r_write_event_value,
 };
 
 static irqreturn_t ad7091r_event_handler(int irq, void *private)

index 509748aef9b1..7a78976a2f80 100644
@@ -8,6 +8,10 @@
 #ifndef __DRIVERS_IIO_ADC_AD7091R_BASE_H__
 #define __DRIVERS_IIO_ADC_AD7091R_BASE_H__
 
+/* AD7091R_REG_CH_LIMIT */
+#define AD7091R_HIGH_LIMIT		0xFFF
+#define AD7091R_LOW_LIMIT		0x0
+
 struct device;
 struct ad7091r_state;
 

@@ -17,6 +21,8 @@ struct ad7091r_chip_info {
 	unsigned int vref_mV;
 };
 
+extern const struct iio_event_spec ad7091r_events[3];
+
 extern const struct regmap_config ad7091r_regmap_config;
 
 int ad7091r_probe(struct device *dev, const char *name,

index 2f048527b7b7..dae98c95ebb8 100644
@@ -12,26 +12,6 @@
 
 #include "ad7091r-base.h"
 
-static const struct iio_event_spec ad7091r5_events[] = {
-	{
-		.type = IIO_EV_TYPE_THRESH,
-		.dir = IIO_EV_DIR_RISING,
-		.mask_separate = BIT(IIO_EV_INFO_VALUE) |
-				 BIT(IIO_EV_INFO_ENABLE),
-	},
-	{
-		.type = IIO_EV_TYPE_THRESH,
-		.dir = IIO_EV_DIR_FALLING,
-		.mask_separate = BIT(IIO_EV_INFO_VALUE) |
-				 BIT(IIO_EV_INFO_ENABLE),
-	},
-	{
-		.type = IIO_EV_TYPE_THRESH,
-		.dir = IIO_EV_DIR_EITHER,
-		.mask_separate = BIT(IIO_EV_INFO_HYSTERESIS),
-	},
-};
-
 #define AD7091R_CHANNEL(idx, bits, ev, num_ev) { \
 	.type = IIO_VOLTAGE, \
 	.info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \

@@ -44,10 +24,10 @@ static const struct iio_event_spec ad7091r5_events[] = {
 	.scan_type.realbits = bits, \
 }
 static const struct iio_chan_spec ad7091r5_channels_irq[] = {
-	AD7091R_CHANNEL(0, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)),
-	AD7091R_CHANNEL(1, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)),
-	AD7091R_CHANNEL(2, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)),
-	AD7091R_CHANNEL(3, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)),
+	AD7091R_CHANNEL(0, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)),
+	AD7091R_CHANNEL(1, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)),
+	AD7091R_CHANNEL(2, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)),
+	AD7091R_CHANNEL(3, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)),
 };
 
 static const struct iio_chan_spec ad7091r5_channels_noirq[] = {

2.43.0

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lukas Schauer <[email protected]>

commit e95aada4cb93d42e25c30a0ef9eb2923d9711d4a upstream.

Commit c73be61cede5 ("pipe: Add general notification queue support") a regression was introduced that would lock up resized pipes under certain conditions. See the reproducer in [1].

The commit resizing the pipe ring size was moved to a different function, doing that moved the wakeup for pipe->wr_wait before actually raising pipe->max_usage. If a pipe was full before the resize occured it would result in the wakeup never actually triggering pipe_write.

Set @max_usage and @nr_accounted before waking writers if this isn't a watch queue.

---
 fs/pipe.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

@@ -1324,6 +1324,11 @@ int pipe_resize_ring(struct pipe_inode_i
 	pipe->tail = tail;
 	pipe->head = head;
 
+	if (!pipe_has_watch_queue(pipe)) {
+		pipe->max_usage = nr_slots;
+		pipe->nr_accounted = nr_slots;
+	}
+
 	spin_unlock_irq(&pipe->rd_wait.lock);
 
 	/* This might have made more room for writers */

@@ -1375,8 +1380,6 @@ static long pipe_set_size(struct pipe_in
 	if (ret < 0)
 		goto out_revert_acct;
 
-	pipe->max_usage = nr_slots;
-	pipe->nr_accounted = nr_slots;
 	return pipe->max_usage * PAGE_SIZE;
 
 out_revert_acct:

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Geoff Levand <[email protected]>

commit 482b718a84f08b6fc84879c3e90cc57dba11c115 upstream.

Commit 8c5fa3b5c4df ("powerpc/64: Make ELFv2 the default for big-endian builds"), merged in Linux-6.5-rc1 changes the calling ABI in a way that is incompatible with the current code for the PS3's LV1 hypervisor calls.

This change just adds the line '# CONFIG_PPC64_BIG_ENDIAN_ELF_ABI_V2 is not set' to the ps3_defconfig file so that the PPC64_ELF_ABI_V1 is used.

Fixes run time errors like these:

  BUG: Kernel NULL pointer dereference at 0x00000000
  Faulting instruction address: 0xc000000000047cf0
  Oops: Kernel access of bad area, sig: 11 [#1]
  Call Trace:
  [c0000000023039e0] [c00000000100ebfc] ps3_create_spu+0xc4/0x2b0 (unreliable)
  [c000000002303ab0] [c00000000100d4c4] create_spu+0xcc/0x3c4
  [c000000002303b40] [c00000000100eae4] ps3_enumerate_spus+0xa4/0xf8

---
 arch/powerpc/configs/ps3_defconfig |    1 +
 1 file changed, 1 insertion(+)

@@ -24,6 +24,7 @@ CONFIG_PS3_VRAM=m
 CONFIG_PS3_LPM=m
 # CONFIG_PPC_OF_BOOT_TRAMPOLINE is not set
 CONFIG_KEXEC=y
+# CONFIG_PPC64_BIG_ENDIAN_ELF_ABI_V2 is not set
 CONFIG_PPC_4K_PAGES=y
 CONFIG_SCHED_SMT=y
 CONFIG_PM=y

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Suraj Jitindar Singh <[email protected]>

commit 7c784d624819acbeefb0018bac89e632467cca5a upstream.

The ext4 filesystem tracks the trim status of blocks at the group level. When an entire group has been trimmed then it is marked as such and subsequent trim invocations with the same minimum trim size will not be attempted on that group unless it is marked as able to be trimmed again such as when a block is freed.

Currently the last group can't be marked as trimmed due to incorrect logic in ext4_last_grp_cluster(). ext4_last_grp_cluster() is supposed to return the zero based index of the last cluster in a group. This is then used by ext4_try_to_trim_range() to determine if the trim operation spans the entire group and as such if the trim status of the group should be recorded.

ext4_last_grp_cluster() takes a 0 based group index, thus the valid values for grp are 0..(ext4_get_groups_count - 1). Any group index less than (ext4_get_groups_count - 1) is not the last group and must have EXT4_CLUSTERS_PER_GROUP(sb) clusters. For the last group we need to calculate the number of clusters based on the number of blocks in the group. Finally subtract 1 from the number of clusters as zero based indexing is expected. Rearrange the function slightly to make it clear what we are calculating and returning.

Reproducer:
// Create file system where the last group has fewer blocks than // blocks per group

$ mkfs.ext4 -b 4096 -g 8192 /dev/nvme0n1 8191
$ mount /dev/nvme0n1 /mnt

Before Patch:

$ fstrim -v /mnt
/mnt: 25.9 MiB (27156480 bytes) trimmed
// Group not marked as trimmed so second invocation still discards blocks
$ fstrim -v /mnt
/mnt: 25.9 MiB (27156480 bytes) trimmed

After Patch:
fstrim -v /mnt
/mnt: 25.9 MiB (27156480 bytes) trimmed
// Group marked as trimmed so second invocation DOESN'T discard any blocks fstrim -v /mnt
/mnt: 0 B (0 bytes) trimmed

---
 fs/ext4/mballoc.c |   15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

@@ -6735,11 +6735,16 @@ __acquires(bitlock)
 static ext4_grpblk_t ext4_last_grp_cluster(struct super_block *sb,
 					   ext4_group_t grp)
 {
-	if (grp < ext4_get_groups_count(sb))
-		return EXT4_CLUSTERS_PER_GROUP(sb) - 1;
-	return (ext4_blocks_count(EXT4_SB(sb)->s_es) -
-		ext4_group_first_block_no(sb, grp) - 1) >>
-					EXT4_CLUSTER_BITS(sb);
+	unsigned long nr_clusters_in_group;
+
+	if (grp < (ext4_get_groups_count(sb) - 1))
+		nr_clusters_in_group = EXT4_CLUSTERS_PER_GROUP(sb);
+	else
+		nr_clusters_in_group = (ext4_blocks_count(EXT4_SB(sb)->s_es) -
+					ext4_group_first_block_no(sb, grp))
+				       >> EXT4_CLUSTER_BITS(sb);
+
+	return nr_clusters_in_group - 1;
 }
 
 static bool ext4_trim_interrupted(void)

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rafael J. Wysocki <[email protected]>

commit 6aa09a5bccd8e224d917afdb4c278fc66aacde4d upstream.

In preparation for subsequent changes, split async_schedule_node_domain() in two pieces so as to allow the bottom part of it to be called from a somewhat different code path.

No functional impact.

---
 kernel/async.c |   56 ++++++++++++++++++++++++++++++++++----------------------
 1 file changed, 34 insertions(+), 22 deletions(-)

@@ -145,6 +145,39 @@ static void async_run_entry_fn(struct wo
 	wake_up(&async_done);
 }
 
+static async_cookie_t __async_schedule_node_domain(async_func_t func,
+						   void *data, int node,
+						   struct async_domain *domain,
+						   struct async_entry *entry)
+{
+	async_cookie_t newcookie;
+	unsigned long flags;
+
+	INIT_LIST_HEAD(&entry->domain_list);
+	INIT_LIST_HEAD(&entry->global_list);
+	INIT_WORK(&entry->work, async_run_entry_fn);
+	entry->func = func;
+	entry->data = data;
+	entry->domain = domain;
+
+	spin_lock_irqsave(&async_lock, flags);
+
+	/* allocate cookie and queue */
+	newcookie = entry->cookie = next_cookie++;
+
+	list_add_tail(&entry->domain_list, &domain->pending);
+	if (domain->registered)
+		list_add_tail(&entry->global_list, &async_global_pending);
+
+	atomic_inc(&entry_count);
+	spin_unlock_irqrestore(&async_lock, flags);
+
+	/* schedule for execution */
+	queue_work_node(node, system_unbound_wq, &entry->work);
+
+	return newcookie;
+}
+
 /**
  * async_schedule_node_domain - NUMA specific version of async_schedule_domain
  * @func: function to execute asynchronously

@@ -186,29 +219,8 @@ async_cookie_t async_schedule_node_domai
 		func(data, newcookie);
 		return newcookie;
 	}
-	INIT_LIST_HEAD(&entry->domain_list);
-	INIT_LIST_HEAD(&entry->global_list);
-	INIT_WORK(&entry->work, async_run_entry_fn);
-	entry->func = func;
-	entry->data = data;
-	entry->domain = domain;
-
-	spin_lock_irqsave(&async_lock, flags);
 
-	/* allocate cookie and queue */
-	newcookie = entry->cookie = next_cookie++;
-
-	list_add_tail(&entry->domain_list, &domain->pending);
-	if (domain->registered)
-		list_add_tail(&entry->global_list, &async_global_pending);
-
-	atomic_inc(&entry_count);
-	spin_unlock_irqrestore(&async_lock, flags);
-
-	/* schedule for execution */
-	queue_work_node(node, system_unbound_wq, &entry->work);
-
-	return newcookie;
+	return __async_schedule_node_domain(func, data, node, domain, entry);
 }
 EXPORT_SYMBOL_GPL(async_schedule_node_domain);
 

This is the start of the stable review cycle for the 6.7.3 release. There are 346 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Wed, 31 Jan 2024 16:59:28 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.7.3-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.7.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.7.3-rc1

Richard Palethorpe <[email protected]>
x86/entry/ia32: Ensure s32 is sign extended to s64

Tim Chen <[email protected]>
tick/sched: Preserve number of idle sleeps across CPU hotplug events

Jiri Wiesner <[email protected]>
clocksource: Skip watchdog check for large watchdog intervals

Dawei Li <[email protected]>
genirq: Initialize resend_node hlist for all interrupt descriptors

Xi Ruoyao <[email protected]>
mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan

Quanquan Cao <[email protected]>
cxl/region：Fix overflow issue in alloc_hpa()

Jithu Joseph <[email protected]>
platform/x86/intel/ifs: Call release_firmware() when handling errors.

Michael Walle <[email protected]>
drm: bridge: samsung-dsim: Don't use FORCE_STOP_STATE

Inochi Amaoto <[email protected]>
riscv: dts: sophgo: separate sg2042 mtime and mtimecmp to fit aclint format

Aleksander Jan Bajkowski <[email protected]>
MIPS: lantiq: register smp_ops on non-smp platforms

Huacai Chen <[email protected]>
LoongArch/smp: Call rcutree_report_cpu_starting() at tlb_init()

David Lechner <[email protected]>
spi: fix finalize message on error return

Shyam Prasad N <[email protected]>
cifs: fix stray unlock in cifs_chan_skip_or_disable

Amit Kumar Mahapatra <[email protected]>
spi: spi-cadence: Reverse the order of interleaved write and read operations

Kamal Dasu <[email protected]>
spi: bcm-qspi: fix SFDP BFPT read by usig mspi read

Mario Limonciello <[email protected]>
cpufreq/amd-pstate: Fix setting scaling max/min freq values

Hsin-Yi Wang <[email protected]>
drm/bridge: anx7625: Ensure bridge is suspended in disable()

Li Lingfeng <[email protected]>
block: Move checking GENHD_FL_NO_PART to bdev_add_partition()

Mika Westerberg <[email protected]>
spi: intel-pci: Remove Meteor Lake-S SoC PCI ID from the list

Shravan Kumar Ramani <[email protected]>
platform/mellanox: mlxbf-pmc: Fix offset calculation for crspace events

Artur Weber <[email protected]>
ARM: dts: exynos4212-tab3: add samsung,invert-vclk flag to fimd

Wenhua Lin <[email protected]>
gpio: eic-sprd: Clear interrupt after set the interrupt type

Armin Wolf <[email protected]>
platform/x86: wmi: Fix error handling in legacy WMI notify handler functions

Cristian Marussi <[email protected]>
firmware: arm_ffa: Check xa_load() return value

Cristian Marussi <[email protected]>
firmware: arm_ffa: Add missing rwlock_init() for the driver partition

Cristian Marussi <[email protected]>
firmware: arm_ffa: Add missing rwlock_init() in ffa_setup_partitions()

Cristian Marussi <[email protected]>
firmware: arm_scmi: Fix the clock protocol version for v3.2

Cristian Marussi <[email protected]>
firmware: arm_scmi: Use xa_insert() when saving raw queues

Cristian Marussi <[email protected]>
firmware: arm_scmi: Use xa_insert() to store opps

Fedor Pchelkin <[email protected]>
drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume

Arnd Bergmann <[email protected]>
drm/exynos: fix accidental on-stack copy of exynos_drm_plane

Sebastian Andrzej Siewior <[email protected]>
futex: Prevent the reuse of stale pi_state

Yajun Deng <[email protected]>
memblock: fix crash when reserved memory is not added to memory

Douglas Anderson <[email protected]>
drm/bridge: parade-ps8640: Make sure we drop the AUX mutex in the error case

Pin-yen Lin <[email protected]>
drm/bridge: parade-ps8640: Ensure bridge is suspended in .post_disable()

Tomi Valkeinen <[email protected]>
drm/bridge: sii902x: Fix audio codec unregistration

Tomi Valkeinen <[email protected]>
drm/bridge: sii902x: Fix probing race issue

Arnd Bergmann <[email protected]>
drm/panel/raydium-rm692e5: select CONFIG_DRM_DISPLAY_DP_HELPER

Artur Weber <[email protected]>
drm/panel: samsung-s6d7aa0: drop DRM_BUS_FLAG_DE_HIGH for lsl080al02

Markus Niebel <[email protected]>
drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33]

Douglas Anderson <[email protected]>
drm/bridge: parade-ps8640: Wait for HPD when doing an AUX transfer

Alex Deucher <[email protected]>
drm/amdgpu/gfx11: set UNORD_DISPATCH in compute MQDs

Alex Deucher <[email protected]>
drm/amdgpu/gfx10: set UNORD_DISPATCH in compute MQDs

Friedrich Vock <[email protected]>
drm/amdgpu: Enable tunneling on high-priority compute queues

Dillon Varone <[email protected]>
drm/amd/display: Init link enc resources in dc_state only if res_pool presents

Wenjing Liu <[email protected]>
drm/amd/display: update pixel clock params after stream slice count change in context

Charlene Liu <[email protected]>
drm/amd/display: Add logging resource checks

Ilya Bakoulin <[email protected]>
drm/amd/display: Clear OPTC mem select on disable

George Shen <[email protected]>
drm/amd/display: Disconnect phantom pipe OPP from OPTC being disabled

Ilya Bakoulin <[email protected]>
drm/amd/display: Fix hang/underflow when transitioning to ODM4:1

Hsin-Yi Wang <[email protected]>
drm/panel-edp: drm/panel-edp: Fix AUO B116XTN02 name

Hsin-Yi Wang <[email protected]>
drm/panel-edp: drm/panel-edp: Fix AUO B116XAK01 name and timing

Sheng-Liang Pan <[email protected]>

    drm/panel-edp: Add AUO B116XTN02, BOE NT116WHM-N21,836X2, NV116WHM-N49 V8.0

Taimur Hassan <[email protected]>
drm/amd/display: Fix conversions between bytes and KB

Nicholas Kazlauskas <[email protected]>
drm/amd/display: Wake DMCUB before executing GPINT commands

Nicholas Kazlauskas <[email protected]>
drm/amd/display: Wake DMCUB before sending a command

Nicholas Kazlauskas <[email protected]>
drm/amd/display: Refactor DMCUB enter/exit idle interface

Samson Tam <[email protected]>
drm/amd/display: do not send commands to DMUB if DMUB is inactive from S3

Naohiro Aota <[email protected]>
btrfs: zoned: optimize hint byte for zoned allocator

Naohiro Aota <[email protected]>
btrfs: zoned: factor out prepare_allocation_zoned()

Alexander Stein <[email protected]>
media: i2c: imx290: Properly encode registers as little-endian

Alexander Stein <[email protected]>
media: v4l2-cci: Add support for little-endian encoded registers

Sakari Ailus <[email protected]>
media: v4l: cci: Add macros to obtain register width and address

Sakari Ailus <[email protected]>
media: v4l: cci: Include linux/bits.h

Ricardo Neri <[email protected]>
thermal: intel: hfi: Add syscore callbacks for system-wide PM

Ricardo Neri <[email protected]>
thermal: intel: hfi: Disable an HFI instance when all its CPUs go offline

Ricardo Neri <[email protected]>
thermal: intel: hfi: Refactor enabling code into helper functions

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix uninitialized variable usage in core_link_ 'read_dpcd() & write_dpcd()' functions

Ma Jun <[email protected]>
drm/amdgpu/pm: Fix the power source flag error

Kenneth Feng <[email protected]>
drm/amd/pm: update the power cap setting

Lijo Lazar <[email protected]>
drm/amdgpu: Show vram vendor only if available

Lijo Lazar <[email protected]>
drm/amdgpu: Avoid fetching vram vendor information

Lijo Lazar <[email protected]>
drm/amd/pm: Fetch current power limit from FW

Tom St Denis <[email protected]>
drm/amd/amdgpu: Assign GART pages to AMD device mapping

Christophe JAILLET <[email protected]>
drm/amd/display: Fix a switch statement in populate_dml_output_cfg_from_stream_state()

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix late derefrence 'dsc' check in 'link_set_dsc_pps_packet()'

Wayne Lin <[email protected]>
drm/amd/display: Align the returned error code with legacy DP

Nicholas Kazlauskas <[email protected]>
drm/amd/display: Port DENTIST hang and TDR fixes to OTG disable W/A

Ovidiu Bunea <[email protected]>
drm/amd/display: Fix DML2 watermark calculation

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix variable deferencing before NULL check in edp_setup_replay()

Lijo Lazar <[email protected]>
drm/amd/pm: Add error log for smu v13.0.6 reset

Lijo Lazar <[email protected]>
drm/amd/pm: Fix smuv13.0.6 current clock reporting

Likun Gao <[email protected]>
drm/amdgpu: correct the cu count for gfx v11

Yifan Zhang <[email protected]>
drm/amdgpu: update regGL2C_CTRL4 value in golden setting

Alex Deucher <[email protected]>
drm/amdgpu: drop exp hw support check for GC 9.4.3

Ori Messinger <[email protected]>
drm/amdgpu: Enable GFXOFF for Compute on GFX11

Aurabindo Pillai <[email protected]>
drm/amd/display: Fix a debugfs null pointer error

Dan Carpenter <[email protected]>
drm/bridge: nxp-ptn3460: simplify some error checking

Ivan Lipski <[email protected]>
Revert "drm/amd/display: fix bandwidth validation failure on DCN 2.1"

Mario Limonciello <[email protected]>
drm/amd/display: Disable PSR-SU on Parade 0803 TCON again

Melissa Wen <[email protected]>
drm/amd/display: fix bandwidth validation failure on DCN 2.1

Javier Martinez Canillas <[email protected]>
drm: Allow drivers to indicate the damage helpers to ignore damage clips

Javier Martinez Canillas <[email protected]>
drm/virtio: Disable damage clipping if FB changed since last page-flip

Zack Rusin <[email protected]>
drm: Disable the cursor plane on atomic contexts with virtualized drivers

Tomi Valkeinen <[email protected]>
drm/tidss: Fix atomic_flush check

Thomas Zimmermann <[email protected]>
drm: Fix TODO list mentioning non-KMS drivers

Dan Carpenter <[email protected]>
drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking

Ville Syrjälä <[email protected]>
drm/i915/psr: Only allow PSR in LPSP mode on HSW non-ULT

Ville Syrjälä <[email protected]>
drm: Don't unref the same fb many times by mistake due to deadlock handling

Ville Syrjälä <[email protected]>
Revert "drm/i915/dsi: Do display on sequence later on icl+"

Dave Airlie <[email protected]>
Revert "nouveau: push event block/allowing out of the fence context"

Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Refine computation of P-state for given frequency

Mario Limonciello <[email protected]>
gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04

Dave Chinner <[email protected]>
xfs: read only mounts with fsopen mount API are busted

Ma Jun <[email protected]>
drm/amdgpu: Fix the null pointer when load rlc firmware

Thomas Zimmermann <[email protected]>
Revert "drivers/firmware: Move sysfb_init() from device_initcall to subsys_initcall_sync"

Cristian Marussi <[email protected]>
firmware: arm_scmi: Check mailbox/SMT channel for consistency

Lin Ma <[email protected]>
ksmbd: fix global oob in ksmbd_nl_policy

Shin'ichiro Kawasaki <[email protected]>
platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe

Nathan Chancellor <[email protected]>
platform/x86: intel-uncore-freq: Fix types in sysfs callbacks

Florian Westphal <[email protected]>
netfilter: nf_tables: reject QUEUE/DROP verdict parameters

Pablo Neira Ayuso <[email protected]>
netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain

Michael Kelley <[email protected]>
hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes

Amir Goldstein <[email protected]>
ovl: mark xwhiteouts directory with overlay.opaque='x'

NeilBrown <[email protected]>
nfsd: fix RELEASE_LOCKOWNER

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: fix a memory corruption

Bernd Edlinger <[email protected]>
exec: Fix error handling in begin_new_exec()

Ilya Dryomov <[email protected]>
rbd: don't move requests to the running list on errors

Omar Sandoval <[email protected]>
btrfs: don't abort filesystem when attempting to snapshot deleted subvolume

Qu Wenruo <[email protected]>
btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args

David Sterba <[email protected]>
btrfs: don't warn if discard range is not aligned to sector

Chung-Chiang Cheng <[email protected]>
btrfs: tree-checker: fix inline ref size in error messages

Fedor Pchelkin <[email protected]>
btrfs: ref-verify: free ref cache before clearing mount opt

Omar Sandoval <[email protected]>
btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume being deleted

Naohiro Aota <[email protected]>
btrfs: zoned: fix lock ordering in btrfs_zone_activate()

Gerhard Engleder <[email protected]>
tsnep: Fix XDP_RING_NEED_WAKEUP for empty fill ring

Gerhard Engleder <[email protected]>
tsnep: Remove FCS for XDP data path

Shenwei Wang <[email protected]>
net: fec: fix the unhandled context fault from smmu

Hangbin Liu <[email protected]>
selftests: bonding: do not test arp/ns target with mode balance-alb/tlb

Zhipeng Lu <[email protected]>
fjes: fix memleaks in fjes_hw_setup

Maciej Fijalkowski <[email protected]>
i40e: update xdp_rxq_info::frag_size for ZC enabled Rx queue

Maciej Fijalkowski <[email protected]>
i40e: set xdp_rxq_info::frag_size

Maciej Fijalkowski <[email protected]>
xdp: reflect tail increase for MEM_TYPE_XSK_BUFF_POOL

Maciej Fijalkowski <[email protected]>
ice: update xdp_rxq_info::frag_size for ZC enabled Rx queue

Maciej Fijalkowski <[email protected]>
intel: xsk: initialize skb_frag_t::bv_offset in ZC drivers

Maciej Fijalkowski <[email protected]>
ice: remove redundant xdp_rxq_info registration

Tirthendu Sarkar <[email protected]>
i40e: handle multi-buffer packets that are shrunk by xdp prog

Maciej Fijalkowski <[email protected]>
ice: work on pre-XDP prog frag count

Maciej Fijalkowski <[email protected]>
xsk: fix usage of multi-buffer BPF helpers for ZC XDP

Maciej Fijalkowski <[email protected]>
xsk: make xsk_buff_pool responsible for clearing xdp_buff::flags

Maciej Fijalkowski <[email protected]>
xsk: recycle buffer in case Rx queue was full

Jakub Kicinski <[email protected]>
selftests: netdevsim: fix the udp_tunnel_nic test

Jakub Kicinski <[email protected]>
selftests: net: fix rps_default_mask with >32 CPUs

Jenishkumar Maheshbhai Patel <[email protected]>
net: mvpp2: clear BM pool before initialization

Bernd Edlinger <[email protected]>
net: stmmac: Wait a bit for the reset to take effect

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: validate NFPROTO_* family

Florian Westphal <[email protected]>
netfilter: nf_tables: restrict anonymous set and map names to 16 bytes

Florian Westphal <[email protected]>
netfilter: nft_limit: reject configurations that cause integer overflow

Frederic Weisbecker <[email protected]>
rcu: Defer RCU kthreads wakeup when CPU is dying

Dinghao Liu <[email protected]>
net/mlx5e: fix a potential double-free in fs_any_create_groups

Zhipeng Lu <[email protected]>
net/mlx5e: fix a double-free in arfs_create_groups

Leon Romanovsky <[email protected]>
net/mlx5e: Ignore IPsec replay window values on sender side

Leon Romanovsky <[email protected]>
net/mlx5e: Allow software parsing when IPsec crypto is enabled

Rahul Rameshbabu <[email protected]>
net/mlx5: Use mlx5 device constant for selecting CQ period mode for ASO

Yevgeny Kliteynik <[email protected]>
net/mlx5: DR, Can't go to uplink vport on RX rule

Yevgeny Kliteynik <[email protected]>
net/mlx5: DR, Use the right GVMI number for drop action

Moshe Shemesh <[email protected]>
net/mlx5: Bridge, fix multicast packets sent to uplink

Yishai Hadas <[email protected]>
net/mlx5: Fix a WARN upon a callback command failure

Vlad Buslov <[email protected]>
net/mlx5e: Fix peer flow lists handling

Tariq Toukan <[email protected]>
net/mlx5e: Fix inconsistent hairpin RQT sizes

Rahul Rameshbabu <[email protected]>
net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context

Ido Schimmel <[email protected]>
net/sched: flower: Fix chain template offload

Jakub Kicinski <[email protected]>
selftests: fill in some missing configs for net

Zhengchao Shao <[email protected]>
ipv6: init the accept_queue's spinlocks in inet6_create

Zhengchao Shao <[email protected]>
netlink: fix potential sleeping issue in mqueue_flush_file

Kuniyuki Iwashima <[email protected]>
selftest: Don't reuse port for SO_INCOMING_CPU test.

Salvatore Dipietro <[email protected]>
tcp: Add memory barrier to tcp_push()

David Howells <[email protected]>
afs: Fix error handling with lookup via FS.InlineBulkStatus

David Howells <[email protected]>
afs: Simplify error handling

David Howells <[email protected]>
afs: Don't put afs_call in afs_wait_for_call_to_complete()

David Howells <[email protected]>

    afs: Wrap most op->error accesses with inline funcs

David Howells <[email protected]>

    afs: Use op->nr_iterations=-1 to indicate to begin fileserver iteration

David Howells <[email protected]>
afs: Handle the VIO and UAEIO aborts explicitly

David Howells <[email protected]>
rxrpc, afs: Allow afs to pin rxrpc_peer objects

David Howells <[email protected]>
afs: Turn the afs_addr_list address array into an array of structs

David Howells <[email protected]>
afs: Add comments on abort handling

Oleg Nesterov <[email protected]>
afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()

David Howells <[email protected]>
afs: Hide silly-rename files from userspace

Petr Pavlu <[email protected]>
tracing: Ensure visibility when inserting an element into tracing_map

Dan Carpenter <[email protected]>
netfs, fscache: Prevent Oops in fscache_put_cache()

Sharath Srinivasan <[email protected]>
net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv

Horatiu Vultur <[email protected]>
net: micrel: Fix PTP frame parsing for lan8814

Arkadiusz Kubalewski <[email protected]>
dpll: fix register pin with unregistered parent pin

Arkadiusz Kubalewski <[email protected]>
dpll: fix userspace availability of pins

Arkadiusz Kubalewski <[email protected]>
dpll: fix pin dump crash for rebound module

Arkadiusz Kubalewski <[email protected]>
dpll: fix broken error path in dpll_pin_alloc(..)

Yunjian Wang <[email protected]>
tun: add missing rx stats accounting in tun_xdp_act

Yunjian Wang <[email protected]>
tun: fix missing dropped counter in tun_xdp_act

Jakub Kicinski <[email protected]>
net: fix removing a namespace with conflicting altnames

Michal Schmidt <[email protected]>
idpf: distinguish vports by the dev_port attribute

Eric Dumazet <[email protected]>
udp: fix busy polling

Kuniyuki Iwashima <[email protected]>

    llc: Drop support for ETH_P_TR_802_2.

Eric Dumazet <[email protected]>
llc: make llc_ui_sendmsg() more robust against bonding changes

Lin Ma <[email protected]>
vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING

Michael Chan <[email protected]>
bnxt_en: Prevent kernel warning when running offline self test

Michael Chan <[email protected]>
bnxt_en: Wait for FLR to complete during probe

Zhengchao Shao <[email protected]>
tcp: make sure init the accept_queue's spinlocks once

Benjamin Poirier <[email protected]>
selftests: bonding: Increase timeout to 1200s

Wen Gu <[email protected]>
net/smc: fix illegal rmb_desc access in SMC-D connection dump

Qu Wenruo <[email protected]>
btrfs: scrub: avoid use-after-free when chunk length is not 64K aligned

Johannes Berg <[email protected]>
wifi: mac80211: fix potential sta-link leak

Lucas Stach <[email protected]>
SUNRPC: use request size to initialize bio_vec in svc_udp_sendto()

Namjae Jeon <[email protected]>
ksmbd: Add missing set_freezable() for freezable kthread

Namjae Jeon <[email protected]>
ksmbd: send lease break notification on FILE_RENAME_INFORMATION

Namjae Jeon <[email protected]>
ksmbd: don't increment epoch if current state and request state are same

Namjae Jeon <[email protected]>
ksmbd: fix potential circular locking issue in smb2_set_ea()

Jonathan Gray <[email protected]>
Revert "drm/amd: Enable PCIe PME from D3"

Benjamin Berg <[email protected]>
wifi: ath11k: rely on mac80211 debugfs handling for vif

Namjae Jeon <[email protected]>
ksmbd: set v2 lease version on lease upgrade

Charan Teja Kalla <[email protected]>
mm: page_alloc: unreserve highatomic page blocks before oom

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: improve do/while loop in sc16is7xx_irq()

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: remove obsolete loop in sc16is7xx_port_irq()

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: fix invalid sc16is7xx_lines bitfield in case of probe error

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: fix unconditional activation of THRI interrupt

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: change EFR lock to operate on each channels

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: remove unused line structure member

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: remove global regmap from struct sc16is7xx_port

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: remove wasteful static buffer in sc16is7xx_regmap_name()

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: improve regmap debugfs by using one regmap per port

Al Viro <[email protected]>
rename(): fix the locking of subdirectories

Charan Teja Kalla <[email protected]>

    mm/sparsemem: fix race in accessing memory_section->usage

Baolin Wang <[email protected]>
mm: migrate: fix getting incorrect page mapping during page migration

Steven Rostedt (Google) <[email protected]>
mm/rmap: fix misplaced parenthesis of a likely()

Donet Tom <[email protected]>
selftests: mm: hugepage-vmemmap fails on 64K page size systems

James Gowans <[email protected]>
kexec: do syscore_shutdown() in kernel_kexec

Muhammad Usama Anjum <[email protected]>
fs/proc/task_mmu: move mmu notification mechanism inside mm lock

Di Shen <[email protected]>
thermal: gov_power_allocator: avoid inability to reset a cdev

Zhihao Cheng <[email protected]>

    ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path

Huacai Chen <[email protected]>
kdump: defer the insertion of crashkernel resources

Ma Wupeng <[email protected]>
efi: disable mirror feature during crashkernel

Dave Airlie <[email protected]>
nouveau/gsp: handle engines in runl without nonstall interrupts.

Dave Airlie <[email protected]>
nouveau/vmm: don't set addr on the fail path to avoid warning

Mario Limonciello <[email protected]>
rtc: Extend timeout for waiting for UIP to clear to 1s

Mario Limonciello <[email protected]>
rtc: Add support for configuring the UIP timeout for RTC reads

Mario Limonciello <[email protected]>

    rtc: mc146818-lib: Adjust failure return code for mc146818_get_time()

Mario Limonciello <[email protected]>
rtc: Adjust failure return code for cmos_set_alarm()

Mario Limonciello <[email protected]>
rtc: cmos: Use ACPI alarm for non-Intel x86 systems too

Mark Rutland <[email protected]>
arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD

Mark Brown <[email protected]>
arm64/sme: Always exit sme_alloc() early with existing storage

Rob Herring <[email protected]>
arm64: errata: Add Cortex-A510 speculative unprivileged load workaround

Rob Herring <[email protected]>

    arm64: Rename ARM64_WORKAROUND_2966298

Andrew Jones <[email protected]>
RISC-V: selftests: cbo: Ensure asm operands match constraints

Guo Ren <[email protected]>
riscv: mm: Fixup compat mode boot failure

Guo Ren <[email protected]>
riscv: mm: Fixup compat arch_get_mmap_end

Zheng Wang <[email protected]>
media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run

Zheng Wang <[email protected]>
media: mtk-jpeg: Fix timeout schedule error in mtk_jpegdec_worker.

Alain Volmat <[email protected]>
media: i2c: st-mipid02: correct format propagation

Andy Shevchenko <[email protected]>
mmc: mmc_spi: remove custom DMA mapped buffers

Avri Altman <[email protected]>
mmc: core: Use mrq.sbc in close-ended ffu

Michael Grzeschik <[email protected]>
media: videobuf2-dma-sg: fix vmap callback

Vegard Nossum <[email protected]>
scripts/get_abi: fix source path leak

Vegard Nossum <[email protected]>
docs: kernel_abi.py: fix command injection

Jordan Rife <[email protected]>
dlm: use kernel_connect() and kernel_bind()

Alfred Piccioni <[email protected]>
lsm: new security_file_ioctl_compat() hook

Johan Hovold <[email protected]>
ARM: dts: qcom: sdx55: fix USB SS wakeup

Johan Hovold <[email protected]>
arm64: dts: qcom: sdm670: fix USB SS wakeup

Johan Hovold <[email protected]>
arm64: dts: qcom: sdm670: fix USB DP/DM HS PHY interrupts

Johan Hovold <[email protected]>

    arm64: dts: qcom: sc8180x: fix USB SS wakeup

Johan Hovold <[email protected]>

    arm64: dts: qcom: sc8180x: fix USB DP/DM HS PHY interrupts

Johan Hovold <[email protected]>
arm64: dts: qcom: sm8150: fix USB SS wakeup

Johan Hovold <[email protected]>
arm64: dts: qcom: sm8150: fix USB DP/DM HS PHY interrupts

Johan Hovold <[email protected]>
arm64: dts: qcom: sdm845: fix USB SS wakeup

Johan Hovold <[email protected]>
arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts

Johan Hovold <[email protected]>
ARM: dts: qcom: sdx55: fix USB DP/DM HS PHY interrupts

Stephan Gerhold <[email protected]>
arm64: dts: qcom: Add missing vio-supply for AW2013

Johan Hovold <[email protected]>
arm64: dts: qcom: sc7280: fix usb_1 wakeup interrupt types

Johan Hovold <[email protected]>

    arm64: dts: qcom: sc8180x: fix USB wakeup interrupt types

Johan Hovold <[email protected]>
arm64: dts: qcom: sm8150: fix USB wakeup interrupt types

Johan Hovold <[email protected]>
arm64: dts: qcom: sdm670: fix USB wakeup interrupt types

Johan Hovold <[email protected]>
arm64: dts: qcom: sdm845: fix USB wakeup interrupt types

Johan Hovold <[email protected]>
arm64: dts: qcom: sc7180: fix USB wakeup interrupt types

Stephan Gerhold <[email protected]>
arm64: dts: qcom: msm8939: Make blsp_dma controlled-remotely

Stephan Gerhold <[email protected]>
arm64: dts: qcom: msm8916: Make blsp_dma controlled-remotely

Sam Edwards <[email protected]>
arm64: dts: rockchip: Fix rk3588 USB power-domain clocks

Tianling Shen <[email protected]>
arm64: dts: rockchip: configure eth pad driver strength for orangepi r1 plus lts

Cixi Geng <[email protected]>
arm64: dts: sprd: fix the cpu node for UMS512

Johan Hovold <[email protected]>
ARM: dts: qcom: sdx55: fix pdc '#interrupt-cells'

Paul Cercueil <[email protected]>
ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12

Johan Hovold <[email protected]>
ARM: dts: qcom: sdx55: fix USB wakeup interrupt types

Johan Hovold <[email protected]>

    arm64: dts: qcom: sc8280xp-crd: fix eDP phy compatible

Andrejs Cainikovs <[email protected]>
ARM: dts: imx6q-apalis: add can power-up delay on ixora board

Shyam Prasad N <[email protected]>
cifs: update iface_last_update on each query-and-update

Shyam Prasad N <[email protected]>
cifs: handle servers that still advertise multichannel after disabling

Paulo Alcantara <[email protected]>
smb: client: fix parsing of SMB3.1.1 POSIX create context

Geert Uytterhoeven <[email protected]>
sh: ecovec24: Rename missed backlight field from fbdev to dev

Niklas Cassel <[email protected]>
scsi: core: Kick the requeue list after inserting when flushing

Christophe JAILLET <[email protected]>
riscv: Fix an off-by-one in get_early_cmdline()

Charlie Jenkins <[email protected]>
riscv: Fix relocation_hashtable size

Charlie Jenkins <[email protected]>
riscv: Correctly free relocation hashtable on error

Charlie Jenkins <[email protected]>
riscv: Fix module loading free order

Bart Van Assche <[email protected]>
scsi: ufs: core: Remove the ufshcd_hba_exit() call from ufshcd_async_scan()

Miquel Raynal <[email protected]>
dmaengine: xilinx: xdma: Fix the count of elapsed periods in cyclic mode

Rex Zhang <[email protected]>
dmaengine: idxd: Move dma_free_coherent() out of spinlocked context

Amelie Delaunay <[email protected]>
dmaengine: fix NULL pointer in channel unregistration function

Frank Li <[email protected]>
dmaengine: fsl-edma: fix eDMAv4 channel allocation issue

Marcelo Schmitt <[email protected]>
iio: adc: ad7091r: Enable internal vref if external vref is not supplied

Helge Deller <[email protected]>
parisc/power: Fix power soft-off button emulation on qemu

Helge Deller <[email protected]>
parisc/firmware: Fix F-extend for PDC addresses

Bhaumik Bhatt <[email protected]>
bus: mhi: host: Add spinlock to protect WP access when queueing TREs

Qiang Yu <[email protected]>
bus: mhi: host: Drop chan lock before queuing buffers

Krishna chaitanya chundru <[email protected]>
bus: mhi: host: Add alignment check for event ring read pointer

Serge Semin <[email protected]>
mips: Fix max_mapnr being uninitialized on early stages

Eric Dumazet <[email protected]>
nbd: always initialize struct msghdr completely

Nathan Lynch <[email protected]>
seq_buf: Make DECLARE_SEQ_BUF() usable

Tony Krowiak <[email protected]>
s390/vfio-ap: do not reset queue removed from host config

Tony Krowiak <[email protected]>
s390/vfio-ap: reset queues associated with adapter for queue unbound from driver

Tony Krowiak <[email protected]>
s390/vfio-ap: reset queues filtered from the guest's AP config

Tony Krowiak <[email protected]>
s390/vfio-ap: let on_scan_complete() callback filter matrix and update guest's APCB

Tony Krowiak <[email protected]>
s390/vfio-ap: loop over the shadow APCB when filtering guest's AP configuration

Tony Krowiak <[email protected]>
s390/vfio-ap: always filter entire AP matrix

Herve Codina <[email protected]>
soc: fsl: cpm1: qmc: Fix rx channel reset

Herve Codina <[email protected]>
soc: fsl: cpm1: qmc: Fix __iomem addresses declaration

Herve Codina <[email protected]>
soc: fsl: cpm1: tsa: Fix __iomem addresses declaration

Bingbu Cao <[email protected]>
media: ov01a10: Enable runtime PM before registering async sub-device

Bingbu Cao <[email protected]>
media: ov13b10: Enable runtime PM before registering async sub-device

Bingbu Cao <[email protected]>
media: ov9734: Enable runtime PM before registering async sub-device

Xiaolei Wang <[email protected]>
rpmsg: virtio: Free driver_override when rpmsg_remove()

Bingbu Cao <[email protected]>
media: imx355: Enable runtime PM before registering async sub-device

Johan Hovold <[email protected]>
soc: qcom: pmic_glink_altmode: fix port sanity check

Miquel Raynal <[email protected]>
mtd: rawnand: Clarify conditions to enable continuous reads

Miquel Raynal <[email protected]>
mtd: rawnand: Prevent sequential reads with on-die ECC engines

Miquel Raynal <[email protected]>
mtd: rawnand: Fix core interference with sequential reads

Miquel Raynal <[email protected]>
mtd: rawnand: Prevent crossing LUN boundaries during sequential reads

Miquel Raynal <[email protected]>
mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters

Christian Marangi <[email protected]>
PM / devfreq: Fix buffer overflow in trans_stat_show

Anthony Krowiak <[email protected]>
s390/vfio-ap: unpin pages on gisc registration failure

Herbert Xu <[email protected]>
crypto: s390/aes - Fix buffer overread in CTR mode

Herbert Xu <[email protected]>
hwrng: core - Fix page fault dead lock on mmap-ed hwrng

Hongchen Zhang <[email protected]>
PM: hibernate: Enforce ordering during image compression/decompression

Herbert Xu <[email protected]>
crypto: api - Disallow identical driver names

Gao Xiang <[email protected]>
erofs: fix lz4 inplace decompression

Tianjia Zhang <[email protected]>
crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init

David Disseldorp <[email protected]>
btrfs: sysfs: validate scrub_speed_max value

Viresh Kumar <[email protected]>
OPP: Pass rounded rate to _set_opp()

Josef Bacik <[email protected]>
arm64: properly install vmlinuz.efi

Rafael J. Wysocki <[email protected]>
PM: sleep: Fix possible deadlocks in core system-wide PM code

Rafael J. Wysocki <[email protected]>
async: Introduce async_schedule_dev_nocall()

Rafael J. Wysocki <[email protected]>
async: Split async_schedule_node_domain()

Suraj Jitindar Singh <[email protected]>
ext4: allow for the last group to be marked as trimmed

Geoff Levand <[email protected]>
powerpc/ps3_defconfig: Disable PPC64_BIG_ENDIAN_ELF_ABI_V2

Lukas Schauer <[email protected]>
pipe: wakeup wr_wait after setting max_usage

Marcelo Schmitt <[email protected]>
iio: adc: ad7091r: Allow users to configure device events

Marcelo Schmitt <[email protected]>
iio: adc: ad7091r: Set alert bit in config register

Krzysztof Kozlowski <[email protected]>
soundwire: fix initializing sysfs for same devices on different buses

Pierre-Louis Bossart <[email protected]>
soundwire: bus: introduce controller_id

-------------

Diffstat:

 Documentation/ABI/testing/sysfs-class-devfreq      |   3 +
 Documentation/admin-guide/abi-obsolete.rst         |   2 +-
 Documentation/admin-guide/abi-removed.rst          |   2 +-
 Documentation/admin-guide/abi-stable.rst           |   2 +-
 Documentation/admin-guide/abi-testing.rst          |   2 +-
 Documentation/arch/arm64/silicon-errata.rst        |   2 +
 Documentation/filesystems/directory-locking.rst    |  29 +-
 Documentation/filesystems/locking.rst              |   5 +-
 Documentation/filesystems/overlayfs.rst            |  16 +-
 Documentation/filesystems/porting.rst              |  18 ++
 Documentation/gpu/drm-kms.rst                      |   2 +
 Documentation/gpu/todo.rst                         |   7 +-
 Documentation/sphinx/kernel_abi.py                 |  56 +---
 Makefile                                           |   4 +-
 arch/alpha/kernel/rtc.c                            |   2 +-
 .../boot/dts/nxp/imx/imx6q-apalis-ixora-v1.2.dts   |   2 +
 arch/arm/boot/dts/qcom/qcom-sdx55.dtsi             |  10 +-
 arch/arm/boot/dts/samsung/exynos4210-i9100.dts     |   8 +
 arch/arm/boot/dts/samsung/exynos4212-tab3.dtsi     |   1 +
 arch/arm64/Kconfig                                 |  18 ++
 .../boot/dts/qcom/msm8916-longcheer-l8150.dts      |   1 +
 .../boot/dts/qcom/msm8916-wingtech-wt88047.dts     |   1 +
 arch/arm64/boot/dts/qcom/msm8916.dtsi              |   1 +
 arch/arm64/boot/dts/qcom/msm8939.dtsi              |   1 +
 arch/arm64/boot/dts/qcom/msm8953-xiaomi-mido.dts   |   1 +
 arch/arm64/boot/dts/qcom/msm8953-xiaomi-tissot.dts |   1 +
 arch/arm64/boot/dts/qcom/msm8953-xiaomi-vince.dts  |   1 +
 arch/arm64/boot/dts/qcom/sc7180.dtsi               |   4 +-
 arch/arm64/boot/dts/qcom/sc7280.dtsi               |   4 +-
 arch/arm64/boot/dts/qcom/sc8180x.dtsi              |  16 +-
 arch/arm64/boot/dts/qcom/sc8280xp-crd.dts          |   2 +
 arch/arm64/boot/dts/qcom/sdm670.dtsi               |   8 +-
 arch/arm64/boot/dts/qcom/sdm845.dtsi               |  16 +-
 arch/arm64/boot/dts/qcom/sm8150.dtsi               |  16 +-
 .../dts/rockchip/rk3328-orangepi-r1-plus-lts.dts   |   4 +-
 arch/arm64/boot/dts/rockchip/rk3588s.dtsi          |   1 +
 arch/arm64/boot/dts/sprd/ums512.dtsi               |   4 +-
 arch/arm64/boot/install.sh                         |   3 +-
 arch/arm64/kernel/cpu_errata.c                     |  21 +-
 arch/arm64/kernel/entry.S                          |  22 +-
 arch/arm64/kernel/fpsimd.c                         |   6 +-
 arch/arm64/tools/cpucaps                           |   2 +-
 arch/loongarch/kernel/smp.c                        |   1 -
 arch/loongarch/mm/tlb.c                            |  16 +-
 arch/mips/kernel/elf.c                             |   6 +
 arch/mips/lantiq/prom.c                            |   7 +-
 arch/mips/mm/init.c                                |  12 +-
 arch/parisc/kernel/firmware.c                      |   4 +-
 arch/powerpc/configs/ps3_defconfig                 |   1 +
 arch/riscv/boot/dts/sophgo/sg2042.dtsi             |  80 +++--
 arch/riscv/include/asm/pgtable.h                   |   2 +-
 arch/riscv/include/asm/processor.h                 |   2 +-
 arch/riscv/kernel/module.c                         |  14 +-
 arch/riscv/kernel/pi/cmdline_early.c               |   3 +-
 arch/s390/crypto/aes_s390.c                        |   4 +-
 arch/s390/crypto/paes_s390.c                       |   4 +-
 arch/sh/boards/mach-ecovec24/setup.c               |   2 +-
 arch/x86/include/asm/syscall_wrapper.h             |  25 +-
 arch/x86/kernel/hpet.c                             |   2 +-
 arch/x86/kernel/rtc.c                              |   2 +-
 block/ioctl.c                                      |   2 -
 block/partitions/core.c                            |   5 +
 crypto/algapi.c                                    |   1 +
 drivers/base/power/main.c                          | 148 ++++-----
 drivers/base/power/trace.c                         |   2 +-
 drivers/block/nbd.c                                |   6 +-
 drivers/block/rbd.c                                |  22 +-
 drivers/bus/mhi/host/main.c                        |  29 +-
 drivers/char/hw_random/core.c                      |  34 +-
 drivers/cpufreq/amd-pstate.c                       |   7 +-
 drivers/cpufreq/intel_pstate.c                     |  55 ++--
 drivers/cxl/core/region.c                          |   4 +-
 drivers/devfreq/devfreq.c                          |  57 ++--
 drivers/dma/dmaengine.c                            |   3 +
 drivers/dma/fsl-edma-main.c                        |   8 +
 drivers/dma/idxd/device.c                          |   9 +-
 drivers/dma/xilinx/xdma.c                          |   6 +-
 drivers/dpll/dpll_core.c                           |  68 +++-
 drivers/dpll/dpll_core.h                           |   4 +-
 drivers/dpll/dpll_netlink.c                        |  57 +++-
 drivers/firmware/arm_ffa/driver.c                  |  12 +
 drivers/firmware/arm_scmi/clock.c                  |   3 +-
 drivers/firmware/arm_scmi/common.h                 |   1 +
 drivers/firmware/arm_scmi/mailbox.c                |  14 +
 drivers/firmware/arm_scmi/perf.c                   |  23 +-
 drivers/firmware/arm_scmi/raw_mode.c               |  12 +-
 drivers/firmware/arm_scmi/shmem.c                  |   6 +
 drivers/firmware/sysfb.c                           |   2 +-
 drivers/gpio/gpio-eic-sprd.c                       |  32 +-
 drivers/gpio/gpiolib-acpi.c                        |  14 +
 drivers/gpu/drm/amd/amdgpu/amdgpu.h                |   1 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c         |   6 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c      |   2 -
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c            |   5 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c           |   8 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c           |  10 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c       |  17 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c             |  20 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c             |  10 +-
 drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c              |   3 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c   |   1 +
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c   |   1 +
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |   9 +-
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c  |   6 +-
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c  |   5 +
 .../gpu/drm/amd/display/dc/bios/command_table2.c   |  12 +-
 .../amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c   |   2 +-
 .../amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c |  23 +-
 .../amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c |   2 +-
 .../amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c |   2 +-
 .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c   |   2 +-
 drivers/gpu/drm/amd/display/dc/core/dc.c           |  16 +-
 .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c  |   2 +-
 drivers/gpu/drm/amd/display/dc/core/dc_resource.c  |  19 +-
 drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c       | 176 ++++++++--
 drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h       |  59 +++-
 drivers/gpu/drm/amd/display/dc/dc_helper.c         |   6 +-
 drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c  |  14 +-
 .../gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c  |   2 +-
 drivers/gpu/drm/amd/display/dc/dce/dmub_outbox.c   |   2 +-
 drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c      |  33 +-
 .../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c  |  16 +-
 .../gpu/drm/amd/display/dc/dcn20/dcn20_resource.h  |   1 +
 drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c  |   2 +-
 .../amd/display/dc/dcn31/dcn31_dio_link_encoder.c  |   4 +-
 .../drm/amd/display/dc/dcn31/dcn31_panel_cntl.c    |   4 +-
 drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c  |  17 +
 .../gpu/drm/amd/display/dc/dcn32/dcn32_resource.c  |   1 +
 .../drm/amd/display/dc/dcn321/dcn321_resource.c    |   1 +
 drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.c  |  10 +
 .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c   |   6 +-
 .../drm/amd/display/dc/dml2/display_mode_core.c    |  30 +-
 .../amd/display/dc/dml2/dml2_translation_helper.c  |   2 +-
 .../drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c    |   4 +-
 .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c    |   8 +-
 .../drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c    |   4 +-
 .../drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c    |   6 +-
 .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c    |   8 +-
 drivers/gpu/drm/amd/display/dc/inc/core_types.h    |   1 +
 drivers/gpu/drm/amd/display/dc/link/link_dpms.c    |   8 +-
 .../display/dc/link/protocols/link_dp_capability.c |   2 +-
 .../amd/display/dc/link/protocols/link_dp_dpia.c   |   3 +-
 .../drm/amd/display/dc/link/protocols/link_dpcd.c  |   4 +-
 .../dc/link/protocols/link_edp_panel_control.c     |  11 +-
 drivers/gpu/drm/amd/display/dmub/dmub_srv.h        |  21 ++
 drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c    |  15 +
 .../drm/amd/display/modules/power/power_helpers.c  |   2 +
 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c          |  14 +-
 drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c     |   2 +
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c     |   2 +
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c   |  54 +++-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c   |  15 +-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c   |  54 +++-
 drivers/gpu/drm/bridge/analogix/anx7625.c          |   7 +-
 drivers/gpu/drm/bridge/analogix/anx7625.h          |   2 +
 drivers/gpu/drm/bridge/nxp-ptn3460.c               |   6 +-
 drivers/gpu/drm/bridge/parade-ps8640.c             |  23 ++
 drivers/gpu/drm/bridge/samsung-dsim.c              |  32 +-
 drivers/gpu/drm/bridge/sii902x.c                   |  42 ++-
 drivers/gpu/drm/drm_damage_helper.c                |   3 +-
 drivers/gpu/drm/drm_plane.c                        |  14 +
 drivers/gpu/drm/exynos/exynos5433_drm_decon.c      |   4 +-
 drivers/gpu/drm/exynos/exynos_drm_fimd.c           |   4 +-
 drivers/gpu/drm/exynos/exynos_drm_gsc.c            |   2 +-
 drivers/gpu/drm/i915/display/icl_dsi.c             |   3 +-
 drivers/gpu/drm/i915/display/intel_psr.c           |  14 +-
 drivers/gpu/drm/nouveau/nouveau_fence.c            |  28 +-
 drivers/gpu/drm/nouveau/nouveau_fence.h            |   5 +-
 drivers/gpu/drm/nouveau/nouveau_vmm.c              |   3 +
 drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c   |   4 +
 drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c    |   2 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c     |   8 +-
 drivers/gpu/drm/panel/Kconfig                      |   2 +
 drivers/gpu/drm/panel/panel-edp.c                  |   7 +-
 drivers/gpu/drm/panel/panel-samsung-s6d7aa0.c      |   2 +-
 drivers/gpu/drm/panel/panel-simple.c               |   2 +
 drivers/gpu/drm/qxl/qxl_drv.c                      |   2 +-
 drivers/gpu/drm/tidss/tidss_crtc.c                 |  10 +-
 drivers/gpu/drm/vboxvideo/vbox_drv.c               |   2 +-
 drivers/gpu/drm/virtio/virtgpu_drv.c               |   2 +-
 drivers/gpu/drm/virtio/virtgpu_plane.c             |  10 +
 drivers/gpu/drm/vmwgfx/vmwgfx_drv.c                |   2 +-
 drivers/iio/adc/ad7091r-base.c                     | 169 ++++++++++
 drivers/iio/adc/ad7091r-base.h                     |   8 +
 drivers/iio/adc/ad7091r5.c                         |  28 +-
 drivers/media/common/videobuf2/videobuf2-dma-sg.c  |  10 +-
 drivers/media/i2c/imx290.c                         |  42 +--
 drivers/media/i2c/imx355.c                         |  12 +-
 drivers/media/i2c/ov01a10.c                        |  18 +-
 drivers/media/i2c/ov13b10.c                        |  14 +-
 drivers/media/i2c/ov9734.c                         |  19 +-
 drivers/media/i2c/st-mipid02.c                     |   9 +-
 .../media/platform/mediatek/jpeg/mtk_jpeg_core.c   |  12 +-
 drivers/media/v4l2-core/v4l2-cci.c                 |  52 ++-
 drivers/mmc/core/block.c                           |  46 ++-
 drivers/mmc/host/mmc_spi.c                         | 186 +----------
 drivers/mtd/maps/vmu-flash.c                       |   2 +-
 drivers/mtd/nand/raw/nand_base.c                   |  87 ++++-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |   8 +
 drivers/net/ethernet/engleder/tsnep_main.c         |  17 +-
 drivers/net/ethernet/freescale/fec_main.c          |   2 +
 drivers/net/ethernet/intel/i40e/i40e_main.c        |  47 ++-
 drivers/net/ethernet/intel/i40e/i40e_txrx.c        |  49 ++-
 drivers/net/ethernet/intel/i40e/i40e_xsk.c         |   4 +-
 drivers/net/ethernet/intel/ice/ice_base.c          |  37 ++-
 drivers/net/ethernet/intel/ice/ice_txrx.c          |  19 +-
 drivers/net/ethernet/intel/ice/ice_txrx.h          |   1 +
 drivers/net/ethernet/intel/ice/ice_txrx_lib.h      |  31 +-
 drivers/net/ethernet/intel/ice/ice_xsk.c           |   4 +-
 drivers/net/ethernet/intel/idpf/idpf_lib.c         |   2 +
 drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c    |  27 +-
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c      |   5 +-
 .../mellanox/mlx5/core/en/fs_tt_redirect.c         |   1 +
 .../net/ethernet/mellanox/mlx5/core/en/params.c    |   4 +-
 drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c   |   2 +-
 .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c   |  10 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c  |  26 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c    |   5 +-
 .../ethernet/mellanox/mlx5/core/esw/bridge_mcast.c |   3 +
 drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c   |   2 +
 drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c  |   2 +-
 .../mellanox/mlx5/core/steering/dr_action.c        |  17 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |   3 +
 drivers/net/fjes/fjes_hw.c                         |  37 ++-
 drivers/net/hyperv/netvsc_drv.c                    |   4 +-
 drivers/net/phy/micrel.c                           |  11 +
 drivers/net/tun.c                                  |  10 +-
 drivers/net/wireless/ath/ath11k/core.h             |   4 -
 drivers/net/wireless/ath/ath11k/debugfs.c          |  25 +-
 drivers/net/wireless/ath/ath11k/debugfs.h          |  12 +-
 drivers/net/wireless/ath/ath11k/mac.c              |  12 +-
 drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c   |   4 +-
 drivers/opp/core.c                                 |   6 +-
 drivers/parisc/power.c                             |   2 +-
 drivers/platform/mellanox/mlxbf-pmc.c              |   4 +-
 drivers/platform/x86/intel/ifs/load.c              |   3 +-
 .../uncore-frequency/uncore-frequency-common.c     |  82 ++---
 .../uncore-frequency/uncore-frequency-common.h     |  32 +-
 drivers/platform/x86/p2sb.c                        | 180 ++++++++---
 drivers/platform/x86/wmi.c                         |  16 +-
 drivers/rpmsg/virtio_rpmsg_bus.c                   |   1 +
 drivers/rtc/rtc-cmos.c                             |  28 +-
 drivers/rtc/rtc-mc146818-lib.c                     |  39 ++-
 drivers/s390/crypto/vfio_ap_ops.c                  | 269 ++++++++++------
 drivers/s390/crypto/vfio_ap_private.h              |   3 +
 drivers/scsi/scsi_error.c                          |   9 +-
 drivers/soc/fsl/qe/qmc.c                           |  35 +-
 drivers/soc/fsl/qe/tsa.c                           |  22 +-
 drivers/soc/qcom/pmic_glink_altmode.c              |   4 +-
 drivers/soundwire/amd_manager.c                    |   8 +
 drivers/soundwire/bus.c                            |   4 +
 drivers/soundwire/debugfs.c                        |   2 +-
 drivers/soundwire/intel_auxdevice.c                |   3 +
 drivers/soundwire/master.c                         |   2 +-
 drivers/soundwire/qcom.c                           |   3 +
 drivers/soundwire/slave.c                          |  12 +-
 drivers/spi/spi-bcm-qspi.c                         |   4 +-
 drivers/spi/spi-cadence.c                          |  17 +-
 drivers/spi/spi-intel-pci.c                        |   1 -
 drivers/spi/spi.c                                  |   4 +
 drivers/thermal/gov_power_allocator.c              |   2 +-
 drivers/thermal/intel/intel_hfi.c                  | 106 +++++--
 drivers/tty/serial/sc16is7xx.c                     | 353 +++++++++++----------
 drivers/ufs/core/ufshcd.c                          |   7 +-
 fs/afs/addr_list.c                                 | 133 ++++----
 fs/afs/cmservice.c                                 |   5 +-
 fs/afs/dir.c                                       |  70 ++--
 fs/afs/dir_silly.c                                 |   2 +-
 fs/afs/file.c                                      |   7 +-
 fs/afs/fs_operation.c                              |  54 ++--
 fs/afs/fs_probe.c                                  |  11 +-
 fs/afs/fsclient.c                                  |   8 +-
 fs/afs/inode.c                                     |   2 +-
 fs/afs/internal.h                                  |  88 +++--
 fs/afs/misc.c                                      |  10 +-
 fs/afs/proc.c                                      |   9 +-
 fs/afs/rotate.c                                    | 224 +++++++++----
 fs/afs/rxrpc.c                                     | 100 +++---
 fs/afs/server.c                                    |  53 +---
 fs/afs/vl_alias.c                                  |  57 +---
 fs/afs/vl_list.c                                   |  15 +-
 fs/afs/vl_probe.c                                  |  19 +-
 fs/afs/vl_rotate.c                                 |  98 +++---
 fs/afs/vlclient.c                                  |  98 ++++--
 fs/afs/write.c                                     |   6 +-
 fs/btrfs/extent-tree.c                             |  53 +++-
 fs/btrfs/inode.c                                   |  22 +-
 fs/btrfs/ioctl.c                                   |   7 +
 fs/btrfs/ref-verify.c                              |   6 +-
 fs/btrfs/scrub.c                                   |  29 +-
 fs/btrfs/sysfs.c                                   |   4 +
 fs/btrfs/tree-checker.c                            |   2 +-
 fs/btrfs/zoned.c                                   |   8 +-
 fs/dlm/lowcomms.c                                  |  14 +-
 fs/erofs/decompressor.c                            |  31 +-
 fs/exec.c                                          |   3 +
 fs/ext4/mballoc.c                                  |  15 +-
 fs/fscache/cache.c                                 |   3 +-
 fs/ioctl.c                                         |   3 +-
 fs/namei.c                                         |  60 ++--
 fs/nfsd/nfs4state.c                                |  26 +-
 fs/overlayfs/namei.c                               |  43 ++-
 fs/overlayfs/overlayfs.h                           |  23 +-
 fs/overlayfs/ovl_entry.h                           |   4 +-
 fs/overlayfs/readdir.c                             |   7 +-
 fs/overlayfs/super.c                               |  15 +
 fs/overlayfs/util.c                                |  53 ++--
 fs/pipe.c                                          |   7 +-
 fs/proc/task_mmu.c                                 |  24 +-
 fs/smb/client/smb2ops.c                            |  10 +-
 fs/smb/client/smb2pdu.c                            | 108 ++++---
 fs/smb/server/connection.c                         |   1 +
 fs/smb/server/ksmbd_netlink.h                      |   3 +-
 fs/smb/server/oplock.c                             |  16 +-
 fs/smb/server/smb2pdu.c                            |   8 +-
 fs/smb/server/transport_ipc.c                      |   4 +-
 fs/ubifs/dir.c                                     |   2 +
 fs/xfs/xfs_super.c                                 |  27 +-
 include/drm/drm_drv.h                              |   9 +
 include/drm/drm_file.h                             |  12 +
 include/drm/drm_plane.h                            |  10 +
 include/linux/async.h                              |   2 +
 include/linux/lsm_hook_defs.h                      |   2 +
 include/linux/mc146818rtc.h                        |   3 +-
 include/linux/mlx5/fs.h                            |   1 +
 include/linux/mlx5/mlx5_ifc.h                      |   2 +-
 include/linux/mmzone.h                             |  14 +-
 include/linux/mtd/rawnand.h                        |   2 +
 include/linux/rmap.h                               |   4 +-
 include/linux/security.h                           |   9 +
 include/linux/seq_buf.h                            |   3 +-
 include/linux/skmsg.h                              |   6 -
 include/linux/soundwire/sdw.h                      |   4 +-
 include/linux/syscalls.h                           |   1 +
 include/media/v4l2-cci.h                           |  11 +
 include/net/af_rxrpc.h                             |  15 +-
 include/net/inet_connection_sock.h                 |   8 +
 include/net/inet_sock.h                            |   5 -
 include/net/llc_pdu.h                              |   6 +-
 include/net/sch_generic.h                          |   4 +
 include/net/sock.h                                 |  18 +-
 include/net/xdp_sock_drv.h                         |  27 ++
 include/trace/events/afs.h                         |  25 ++
 include/trace/events/rxrpc.h                       |   3 +
 include/uapi/linux/btrfs.h                         |   3 +
 kernel/async.c                                     |  85 +++--
 kernel/crash_core.c                                |  14 +-
 kernel/futex/core.c                                |  15 +-
 kernel/futex/pi.c                                  |  11 +-
 kernel/irq/irqdesc.c                               |   2 +-
 kernel/kexec_core.c                                |   1 +
 kernel/power/swap.c                                |  38 +--
 kernel/rcu/tree.c                                  |  34 +-
 kernel/rcu/tree_exp.h                              |   3 +-
 kernel/time/clocksource.c                          |  25 +-
 kernel/time/tick-sched.c                           |   5 +
 kernel/trace/tracing_map.c                         |   7 +-
 lib/crypto/mpi/ec.c                                |   3 +
 mm/memblock.c                                      |   3 +
 mm/migrate.c                                       |  27 +-
 mm/mm_init.c                                       |   6 +
 mm/page_alloc.c                                    |  16 +-
 mm/sparse.c                                        |  17 +-
 net/8021q/vlan_netlink.c                           |   4 +
 net/core/dev.c                                     |   9 +
 net/core/dev.h                                     |   3 +
 net/core/filter.c                                  |  44 ++-
 net/core/request_sock.c                            |   3 -
 net/core/sock.c                                    |  11 +-
 net/ipv4/af_inet.c                                 |   3 +
 net/ipv4/inet_connection_sock.c                    |   4 +
 net/ipv4/tcp.c                                     |   1 +
 net/ipv6/af_inet6.c                                |   3 +
 net/llc/af_llc.c                                   |  24 +-
 net/llc/llc_core.c                                 |   7 -
 net/mac80211/sta_info.c                            |   5 +-
 net/netfilter/nf_tables_api.c                      |  20 +-
 net/netfilter/nft_chain_filter.c                   |  11 +-
 net/netfilter/nft_compat.c                         |  12 +
 net/netfilter/nft_flow_offload.c                   |   5 +
 net/netfilter/nft_limit.c                          |  23 +-
 net/netfilter/nft_nat.c                            |   5 +
 net/netfilter/nft_rt.c                             |   5 +
 net/netfilter/nft_socket.c                         |   5 +
 net/netfilter/nft_synproxy.c                       |   7 +-
 net/netfilter/nft_tproxy.c                         |   5 +
 net/netfilter/nft_xfrm.c                           |   5 +
 net/netlink/af_netlink.c                           |   2 +-
 net/rds/af_rds.c                                   |   2 +-
 net/rxrpc/af_rxrpc.c                               |  62 +++-
 net/rxrpc/ar-internal.h                            |   2 +-
 net/rxrpc/call_object.c                            |  17 +-
 net/rxrpc/peer_object.c                            |  58 ++--
 net/rxrpc/sendmsg.c                                |  11 +-
 net/sched/cls_api.c                                |   9 +-
 net/sched/cls_flower.c                             |  23 ++
 net/smc/smc_diag.c                                 |   2 +-
 net/sunrpc/svcsock.c                               |   4 +-
 net/xdp/xsk.c                                      |  12 +-
 net/xdp/xsk_buff_pool.c                            |   1 +
 scripts/get_abi.pl                                 |   2 +-
 security/security.c                                |  18 ++
 security/selinux/hooks.c                           |  28 ++
 security/smack/smack_lsm.c                         |   1 +
 security/tomoyo/tomoyo.c                           |   1 +
 sound/soc/intel/boards/sof_sdw.c                   |   4 +-
 .../selftests/drivers/net/bonding/bond_options.sh  |   8 +-
 .../testing/selftests/drivers/net/bonding/settings |   2 +-
 .../drivers/net/netdevsim/udp_tunnel_nic.sh        |   9 +
 tools/testing/selftests/mm/hugepage-vmemmap.c      |  29 +-
 tools/testing/selftests/net/config                 |  28 ++
 tools/testing/selftests/net/rps_default_mask.sh    |   6 +-
 tools/testing/selftests/net/so_incoming_cpu.c      |  68 ++--
 tools/testing/selftests/riscv/hwprobe/cbo.c        |  18 +-
 414 files changed, 4903 insertions(+), 2618 deletions(-)

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rafael J. Wysocki <[email protected]>

commit 7d4b5d7a37bdd63a5a3371b988744b060d5bb86f upstream.

In preparation for subsequent changes, introduce a specialized variant of async_schedule_dev() that will not invoke the argument function synchronously when it cannot be scheduled for asynchronous execution.

The new function, async_schedule_dev_nocall(), will be used for fixing possible deadlocks in the system-wide power management core code.

---
 include/linux/async.h |    2 ++
 kernel/async.c        |   29 +++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)

@@ -90,6 +90,8 @@ async_schedule_dev(async_func_t func, st
 	return async_schedule_node(func, dev, dev_to_node(dev));
 }
 
+bool async_schedule_dev_nocall(async_func_t func, struct device *dev);
+
 /**
  * async_schedule_dev_domain - A device specific version of async_schedule_domain
  * @func: function to execute asynchronously

@@ -244,6 +244,35 @@ async_cookie_t async_schedule_node(async
 EXPORT_SYMBOL_GPL(async_schedule_node);
 
 /**
+ * async_schedule_dev_nocall - A simplified variant of async_schedule_dev()
+ * @func: function to execute asynchronously
+ * @dev: device argument to be passed to function
+ *
+ * @dev is used as both the argument for the function and to provide NUMA
+ * context for where to run the function.
+ *
+ * If the asynchronous execution of @func is scheduled successfully, return
+ * true. Otherwise, do nothing and return false, unlike async_schedule_dev()
+ * that will run the function synchronously then.
+ */
+bool async_schedule_dev_nocall(async_func_t func, struct device *dev)
+{
+	struct async_entry *entry;
+
+	entry = kzalloc(sizeof(struct async_entry), GFP_KERNEL);
+
+	/* Give up if there is no memory or too much work. */
+	if (!entry || atomic_read(&entry_count) > MAX_WORK) {
+		kfree(entry);
+		return false;
+	}
+
+	__async_schedule_node_domain(func, dev, dev_to_node(dev),
+				     &async_dfl_domain, entry);
+	return true;
+}
+
+/**
  * async_synchronize_full - synchronize all asynchronous function calls
  *
  * This function waits until all asynchronous function calls have been done.

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xiaolei Wang <[email protected]>

commit d5362c37e1f8a40096452fc201c30e705750e687 upstream.

Free driver_override when rpmsg_remove(), otherwise the following memory leak will occur:

unreferenced object 0xffff0000d55d7080 (size 128):
comm "kworker/u8:2", pid 56, jiffies 4294893188 (age 214.272s) hex dump (first 32 bytes):

    72 70 6d 73 67 5f 6e 73 00 00 00 00 00 00 00 00  rpmsg_ns........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<000000009c94c9c1>] __kmem_cache_alloc_node+0x1f8/0x320
    [<000000002300d89b>] __kmalloc_node_track_caller+0x44/0x70
    [<00000000228a60c3>] kstrndup+0x4c/0x90
    [<0000000077158695>] driver_set_override+0xd0/0x164
    [<000000003e9c4ea5>] rpmsg_register_device_override+0x98/0x170
    [<000000001c0c89a8>] rpmsg_ns_register_device+0x24/0x30
    [<000000008bbf8fa2>] rpmsg_probe+0x2e0/0x3ec
    [<00000000e65a68df>] virtio_dev_probe+0x1c0/0x280
    [<00000000443331cc>] really_probe+0xbc/0x2dc
    [<00000000391064b1>] __driver_probe_device+0x78/0xe0
    [<00000000a41c9a5b>] driver_probe_device+0xd8/0x160
    [<000000009c3bd5df>] __device_attach_driver+0xb8/0x140
    [<0000000043cd7614>] bus_for_each_drv+0x7c/0xd4
    [<000000003b929a36>] __device_attach+0x9c/0x19c
    [<00000000a94e0ba8>] device_initial_probe+0x14/0x20
    [<000000003c999637>] bus_probe_device+0xa0/0xac

---
 drivers/rpmsg/virtio_rpmsg_bus.c |    1 +
 1 file changed, 1 insertion(+)

@@ -378,6 +378,7 @@ static void virtio_rpmsg_release_device(
 	struct rpmsg_device *rpdev = to_rpmsg_device(dev);
 	struct virtio_rpmsg_channel *vch = to_virtio_rpmsg_channel(rpdev);
 
+	kfree(rpdev->driver_override);
 	kfree(vch);
 }
 

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tony Krowiak <[email protected]>

commit 774d10196e648e2c0b78da817f631edfb3dfa557 upstream.

When adapters and/or domains are added to the host's AP configuration, this may result in multiple queue devices getting created and probed by the vfio_ap device driver. For each queue device probed, the matrix of adapters and domains assigned to a matrix mdev will be filtered to update the guest's APCB. If any adapters or domains get added to or removed from the APCB, the guest's AP configuration will be dynamically updated (i.e., hot plug/unplug). To dynamically update the guest's configuration, its VCPUs must be taken out of SIE for the period of time it takes to make the update. This is disruptive to the guest's operation and if there are many queues probed due to a change in the host's AP configuration, this could be troublesome. The problem is exacerbated by the fact that the 'on_scan_complete' callback also filters the mdev's matrix and updates the guest's AP configuration.

In order to reduce the potential amount of disruption to the guest that may result from a change to the host's AP configuration, let's bypass the filtering of the matrix and updating of the guest's AP configuration in the probe callback - if due to a host config change - and defer it until the 'on_scan_complete' callback is invoked after the AP bus finishes its device scan operation. This way the filtering and updating will be performed only once regardless of the number of queues added.

---
 drivers/s390/crypto/vfio_ap_ops.c |   13 +++++++++++++
 1 file changed, 13 insertions(+)

@@ -2084,9 +2084,22 @@ int vfio_ap_mdev_probe_queue(struct ap_d
 	if (matrix_mdev) {
 		vfio_ap_mdev_link_queue(matrix_mdev, q);
 
+		/*
+		 * If we're in the process of handling the adding of adapters or
+		 * domains to the host's AP configuration, then let the
+		 * vfio_ap device driver's on_scan_complete callback filter the
+		 * matrix and update the guest's AP configuration after all of
+		 * the new queue devices are probed.
+		 */
+		if (!bitmap_empty(matrix_mdev->apm_add, AP_DEVICES) ||
+		    !bitmap_empty(matrix_mdev->aqm_add, AP_DOMAINS))
+			goto done;
+
 		if (vfio_ap_mdev_filter_matrix(matrix_mdev))
 			vfio_ap_mdev_update_guest_apcb(matrix_mdev);
 	}
+
+done:
 	dev_set_drvdata(&apdev->device, q);
 	release_update_locks_for_mdev(matrix_mdev);
 

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tony Krowiak <[email protected]>

commit f848cba767e59f8d5c54984b1d45451aae040d50 upstream.

When filtering the adapters from the configuration profile for a guest to create or update a guest's AP configuration, if the APID of an adapter and the APQI of a domain identify a queue device that is not bound to the vfio_ap device driver, the APID of the adapter will be filtered because an individual APQN can not be filtered due to the fact the APQNs are assigned to an AP configuration as a matrix of APIDs and APQIs. Consequently, a guest will not have access to all of the queues associated with the filtered adapter. If the queues are subsequently made available again to the guest, they should re-appear in a reset state; so, let's make sure all queues associated with an adapter unplugged from the guest are reset.

In order to identify the set of queues that need to be reset, let's allow a vfio_ap_queue object to be simultaneously stored in both a hashtable and a
list: A hashtable used to store all of the queues assigned
to a matrix mdev; and/or, a list used to store a subset of the queues that need to be reset. For example, when an adapter is hot unplugged from a guest, all guest queues associated with that adapter must be reset. Since that may be a subset of those assigned to the matrix mdev, they can be stored in a list that can be passed to the vfio_ap_mdev_reset_queues function.

---
 drivers/s390/crypto/vfio_ap_ops.c     |  171 +++++++++++++++++++++++++---------
 drivers/s390/crypto/vfio_ap_private.h |    3 
 2 files changed, 129 insertions(+), 45 deletions(-)

@@ -32,7 +32,8 @@
 
 #define AP_RESET_INTERVAL		20	/* Reset sleep interval (20ms)		*/
 
-static int vfio_ap_mdev_reset_queues(struct ap_queue_table *qtable);
+static int vfio_ap_mdev_reset_queues(struct ap_matrix_mdev *matrix_mdev);
+static int vfio_ap_mdev_reset_qlist(struct list_head *qlist);
 static struct vfio_ap_queue *vfio_ap_find_queue(int apqn);
 static const struct vfio_device_ops vfio_ap_matrix_dev_ops;
 static void vfio_ap_mdev_reset_queue(struct vfio_ap_queue *q);

@@ -662,16 +663,23 @@ static bool vfio_ap_mdev_filter_cdoms(st
  *				device driver.
  *
  * @matrix_mdev: the matrix mdev whose matrix is to be filtered.
+ * @apm_filtered: a 256-bit bitmap for storing the APIDs filtered from the
+ *		  guest's AP configuration that are still in the host's AP
+ *		  configuration.
  *
  * Note: If an APQN referencing a queue device that is not bound to the vfio_ap
  *	 driver, its APID will be filtered from the guest's APCB. The matrix
  *	 structure precludes filtering an individual APQN, so its APID will be
- *	 filtered.
+ *	 filtered. Consequently, all queues associated with the adapter that
+ *	 are in the host's AP configuration must be reset. If queues are
+ *	 subsequently made available again to the guest, they should re-appear
+ *	 in a reset state
  *
  * Return: a boolean value indicating whether the KVM guest's APCB was changed
  *	   by the filtering or not.
  */
-static bool vfio_ap_mdev_filter_matrix(struct ap_matrix_mdev *matrix_mdev)
+static bool vfio_ap_mdev_filter_matrix(struct ap_matrix_mdev *matrix_mdev,
+				       unsigned long *apm_filtered)
 {
 	unsigned long apid, apqi, apqn;
 	DECLARE_BITMAP(prev_shadow_apm, AP_DEVICES);

@@ -681,6 +689,7 @@ static bool vfio_ap_mdev_filter_matrix(s
 	bitmap_copy(prev_shadow_apm, matrix_mdev->shadow_apcb.apm, AP_DEVICES);
 	bitmap_copy(prev_shadow_aqm, matrix_mdev->shadow_apcb.aqm, AP_DOMAINS);
 	vfio_ap_matrix_init(&matrix_dev->info, &matrix_mdev->shadow_apcb);
+	bitmap_clear(apm_filtered, 0, AP_DEVICES);
 
 	/*
 	 * Copy the adapters, domains and control domains to the shadow_apcb

@@ -706,8 +715,16 @@ static bool vfio_ap_mdev_filter_matrix(s
 			apqn = AP_MKQID(apid, apqi);
 			q = vfio_ap_mdev_get_queue(matrix_mdev, apqn);
 			if (!q || q->reset_status.response_code) {
-				clear_bit_inv(apid,
-					      matrix_mdev->shadow_apcb.apm);
+				clear_bit_inv(apid, matrix_mdev->shadow_apcb.apm);
+
+				/*
+				 * If the adapter was previously plugged into
+				 * the guest, let's let the caller know that
+				 * the APID was filtered.
+				 */
+				if (test_bit_inv(apid, prev_shadow_apm))
+					set_bit_inv(apid, apm_filtered);
+
 				break;
 			}
 		}

@@ -809,7 +826,7 @@ static void vfio_ap_mdev_remove(struct m
 
 	mutex_lock(&matrix_dev->guests_lock);
 	mutex_lock(&matrix_dev->mdevs_lock);
-	vfio_ap_mdev_reset_queues(&matrix_mdev->qtable);
+	vfio_ap_mdev_reset_queues(matrix_mdev);
 	vfio_ap_mdev_unlink_fr_queues(matrix_mdev);
 	list_del(&matrix_mdev->node);
 	mutex_unlock(&matrix_dev->mdevs_lock);

@@ -919,6 +936,47 @@ static void vfio_ap_mdev_link_adapter(st
 				       AP_MKQID(apid, apqi));
 }
 
+static int reset_queues_for_apids(struct ap_matrix_mdev *matrix_mdev,
+				  unsigned long *apm_reset)
+{
+	struct vfio_ap_queue *q, *tmpq;
+	struct list_head qlist;
+	unsigned long apid, apqi;
+	int apqn, ret = 0;
+
+	if (bitmap_empty(apm_reset, AP_DEVICES))
+		return 0;
+
+	INIT_LIST_HEAD(&qlist);
+
+	for_each_set_bit_inv(apid, apm_reset, AP_DEVICES) {
+		for_each_set_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm,
+				     AP_DOMAINS) {
+			/*
+			 * If the domain is not in the host's AP configuration,
+			 * then resetting it will fail with response code 01
+			 * (APQN not valid).
+			 */
+			if (!test_bit_inv(apqi,
+					  (unsigned long *)matrix_dev->info.aqm))
+				continue;
+
+			apqn = AP_MKQID(apid, apqi);
+			q = vfio_ap_mdev_get_queue(matrix_mdev, apqn);
+
+			if (q)
+				list_add_tail(&q->reset_qnode, &qlist);
+		}
+	}
+
+	ret = vfio_ap_mdev_reset_qlist(&qlist);
+
+	list_for_each_entry_safe(q, tmpq, &qlist, reset_qnode)
+		list_del(&q->reset_qnode);
+
+	return ret;
+}
+
 /**
  * assign_adapter_store - parses the APID from @buf and sets the
  * corresponding bit in the mediated matrix device's APM

@@ -959,6 +1017,7 @@ static ssize_t assign_adapter_store(stru
 {
 	int ret;
 	unsigned long apid;
+	DECLARE_BITMAP(apm_filtered, AP_DEVICES);
 	struct ap_matrix_mdev *matrix_mdev = dev_get_drvdata(dev);
 
 	mutex_lock(&ap_perms_mutex);

@@ -988,8 +1047,10 @@ static ssize_t assign_adapter_store(stru
 
 	vfio_ap_mdev_link_adapter(matrix_mdev, apid);
 
-	if (vfio_ap_mdev_filter_matrix(matrix_mdev))
+	if (vfio_ap_mdev_filter_matrix(matrix_mdev, apm_filtered)) {
 		vfio_ap_mdev_update_guest_apcb(matrix_mdev);
+		reset_queues_for_apids(matrix_mdev, apm_filtered);
+	}
 
 	ret = count;
 done:

@@ -1020,11 +1081,12 @@ static struct vfio_ap_queue
  *				 adapter was assigned.
  * @matrix_mdev: the matrix mediated device to which the adapter was assigned.
  * @apid: the APID of the unassigned adapter.
- * @qtable: table for storing queues associated with unassigned adapter.
+ * @qlist: list for storing queues associated with unassigned adapter that
+ *	   need to be reset.
  */
 static void vfio_ap_mdev_unlink_adapter(struct ap_matrix_mdev *matrix_mdev,
 					unsigned long apid,
-					struct ap_queue_table *qtable)
+					struct list_head *qlist)
 {
 	unsigned long apqi;
 	struct vfio_ap_queue *q;

@@ -1032,11 +1094,10 @@ static void vfio_ap_mdev_unlink_adapter(
 	for_each_set_bit_inv(apqi, matrix_mdev->matrix.aqm, AP_DOMAINS) {
 		q = vfio_ap_unlink_apqn_fr_mdev(matrix_mdev, apid, apqi);
 
-		if (q && qtable) {
+		if (q && qlist) {
 			if (test_bit_inv(apid, matrix_mdev->shadow_apcb.apm) &&
 			    test_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm))
-				hash_add(qtable->queues, &q->mdev_qnode,
-					 q->apqn);
+				list_add_tail(&q->reset_qnode, qlist);
 		}
 	}
 }

@@ -1044,26 +1105,23 @@ static void vfio_ap_mdev_unlink_adapter(
 static void vfio_ap_mdev_hot_unplug_adapter(struct ap_matrix_mdev *matrix_mdev,
 					    unsigned long apid)
 {
-	int loop_cursor;
-	struct vfio_ap_queue *q;
-	struct ap_queue_table *qtable = kzalloc(sizeof(*qtable), GFP_KERNEL);
+	struct vfio_ap_queue *q, *tmpq;
+	struct list_head qlist;
 
-	hash_init(qtable->queues);
-	vfio_ap_mdev_unlink_adapter(matrix_mdev, apid, qtable);
+	INIT_LIST_HEAD(&qlist);
+	vfio_ap_mdev_unlink_adapter(matrix_mdev, apid, &qlist);
 
 	if (test_bit_inv(apid, matrix_mdev->shadow_apcb.apm)) {
 		clear_bit_inv(apid, matrix_mdev->shadow_apcb.apm);
 		vfio_ap_mdev_update_guest_apcb(matrix_mdev);
 	}
 
-	vfio_ap_mdev_reset_queues(qtable);
+	vfio_ap_mdev_reset_qlist(&qlist);
 
-	hash_for_each(qtable->queues, loop_cursor, q, mdev_qnode) {
+	list_for_each_entry_safe(q, tmpq, &qlist, reset_qnode) {
 		vfio_ap_unlink_mdev_fr_queue(q);
-		hash_del(&q->mdev_qnode);
+		list_del(&q->reset_qnode);
 	}
-
-	kfree(qtable);
 }
 
 /**

@@ -1164,6 +1222,7 @@ static ssize_t assign_domain_store(struc
 {
 	int ret;
 	unsigned long apqi;
+	DECLARE_BITMAP(apm_filtered, AP_DEVICES);
 	struct ap_matrix_mdev *matrix_mdev = dev_get_drvdata(dev);
 
 	mutex_lock(&ap_perms_mutex);

@@ -1193,8 +1252,10 @@ static ssize_t assign_domain_store(struc
 
 	vfio_ap_mdev_link_domain(matrix_mdev, apqi);
 
-	if (vfio_ap_mdev_filter_matrix(matrix_mdev))
+	if (vfio_ap_mdev_filter_matrix(matrix_mdev, apm_filtered)) {
 		vfio_ap_mdev_update_guest_apcb(matrix_mdev);
+		reset_queues_for_apids(matrix_mdev, apm_filtered);
+	}
 
 	ret = count;
 done:

@@ -1207,7 +1268,7 @@ static DEVICE_ATTR_WO(assign_domain);
 
 static void vfio_ap_mdev_unlink_domain(struct ap_matrix_mdev *matrix_mdev,
 				       unsigned long apqi,
-				       struct ap_queue_table *qtable)
+				       struct list_head *qlist)
 {
 	unsigned long apid;
 	struct vfio_ap_queue *q;

@@ -1215,11 +1276,10 @@ static void vfio_ap_mdev_unlink_domain(s
 	for_each_set_bit_inv(apid, matrix_mdev->matrix.apm, AP_DEVICES) {
 		q = vfio_ap_unlink_apqn_fr_mdev(matrix_mdev, apid, apqi);
 
-		if (q && qtable) {
+		if (q && qlist) {
 			if (test_bit_inv(apid, matrix_mdev->shadow_apcb.apm) &&
 			    test_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm))
-				hash_add(qtable->queues, &q->mdev_qnode,
-					 q->apqn);
+				list_add_tail(&q->reset_qnode, qlist);
 		}
 	}
 }

@@ -1227,26 +1287,23 @@ static void vfio_ap_mdev_unlink_domain(s
 static void vfio_ap_mdev_hot_unplug_domain(struct ap_matrix_mdev *matrix_mdev,
 					   unsigned long apqi)
 {
-	int loop_cursor;
-	struct vfio_ap_queue *q;
-	struct ap_queue_table *qtable = kzalloc(sizeof(*qtable), GFP_KERNEL);
+	struct vfio_ap_queue *q, *tmpq;
+	struct list_head qlist;
 
-	hash_init(qtable->queues);
-	vfio_ap_mdev_unlink_domain(matrix_mdev, apqi, qtable);
+	INIT_LIST_HEAD(&qlist);
+	vfio_ap_mdev_unlink_domain(matrix_mdev, apqi, &qlist);
 
 	if (test_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm)) {
 		clear_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm);
 		vfio_ap_mdev_update_guest_apcb(matrix_mdev);
 	}
 
-	vfio_ap_mdev_reset_queues(qtable);
+	vfio_ap_mdev_reset_qlist(&qlist);
 
-	hash_for_each(qtable->queues, loop_cursor, q, mdev_qnode) {
+	list_for_each_entry_safe(q, tmpq, &qlist, reset_qnode) {
 		vfio_ap_unlink_mdev_fr_queue(q);
-		hash_del(&q->mdev_qnode);
+		list_del(&q->reset_qnode);
 	}
-
-	kfree(qtable);
 }
 
 /**

@@ -1601,7 +1658,7 @@ static void vfio_ap_mdev_unset_kvm(struc
 		get_update_locks_for_kvm(kvm);
 
 		kvm_arch_crypto_clear_masks(kvm);
-		vfio_ap_mdev_reset_queues(&matrix_mdev->qtable);
+		vfio_ap_mdev_reset_queues(matrix_mdev);
 		kvm_put_kvm(kvm);
 		matrix_mdev->kvm = NULL;
 

@@ -1737,15 +1794,33 @@ static void vfio_ap_mdev_reset_queue(str
 	}
 }
 
-static int vfio_ap_mdev_reset_queues(struct ap_queue_table *qtable)
+static int vfio_ap_mdev_reset_queues(struct ap_matrix_mdev *matrix_mdev)
 {
 	int ret = 0, loop_cursor;
 	struct vfio_ap_queue *q;
 
-	hash_for_each(qtable->queues, loop_cursor, q, mdev_qnode)
+	hash_for_each(matrix_mdev->qtable.queues, loop_cursor, q, mdev_qnode)
 		vfio_ap_mdev_reset_queue(q);
 
-	hash_for_each(qtable->queues, loop_cursor, q, mdev_qnode) {
+	hash_for_each(matrix_mdev->qtable.queues, loop_cursor, q, mdev_qnode) {
+		flush_work(&q->reset_work);
+
+		if (q->reset_status.response_code)
+			ret = -EIO;
+	}
+
+	return ret;
+}
+
+static int vfio_ap_mdev_reset_qlist(struct list_head *qlist)
+{
+	int ret = 0;
+	struct vfio_ap_queue *q;
+
+	list_for_each_entry(q, qlist, reset_qnode)
+		vfio_ap_mdev_reset_queue(q);
+
+	list_for_each_entry(q, qlist, reset_qnode) {
 		flush_work(&q->reset_work);
 
 		if (q->reset_status.response_code)

@@ -1931,7 +2006,7 @@ static ssize_t vfio_ap_mdev_ioctl(struct
 		ret = vfio_ap_mdev_get_device_info(arg);
 		break;
 	case VFIO_DEVICE_RESET:
-		ret = vfio_ap_mdev_reset_queues(&matrix_mdev->qtable);
+		ret = vfio_ap_mdev_reset_queues(matrix_mdev);
 		break;
 	case VFIO_DEVICE_GET_IRQ_INFO:
 			ret = vfio_ap_get_irq_info(arg);

@@ -2063,6 +2138,7 @@ int vfio_ap_mdev_probe_queue(struct ap_d
 {
 	int ret;
 	struct vfio_ap_queue *q;
+	DECLARE_BITMAP(apm_filtered, AP_DEVICES);
 	struct ap_matrix_mdev *matrix_mdev;
 
 	ret = sysfs_create_group(&apdev->device.kobj, &vfio_queue_attr_group);

@@ -2095,15 +2171,17 @@ int vfio_ap_mdev_probe_queue(struct ap_d
 		    !bitmap_empty(matrix_mdev->aqm_add, AP_DOMAINS))
 			goto done;
 
-		if (vfio_ap_mdev_filter_matrix(matrix_mdev))
+		if (vfio_ap_mdev_filter_matrix(matrix_mdev, apm_filtered)) {
 			vfio_ap_mdev_update_guest_apcb(matrix_mdev);
+			reset_queues_for_apids(matrix_mdev, apm_filtered);
+		}
 	}
 
 done:
 	dev_set_drvdata(&apdev->device, q);
 	release_update_locks_for_mdev(matrix_mdev);
 
-	return 0;
+	return ret;
 
 err_remove_group:
 	sysfs_remove_group(&apdev->device.kobj, &vfio_queue_attr_group);

@@ -2447,6 +2525,7 @@ void vfio_ap_on_cfg_changed(struct ap_co
 
 static void vfio_ap_mdev_hot_plug_cfg(struct ap_matrix_mdev *matrix_mdev)
 {
+	DECLARE_BITMAP(apm_filtered, AP_DEVICES);
 	bool filter_domains, filter_adapters, filter_cdoms, do_hotplug = false;
 
 	mutex_lock(&matrix_mdev->kvm->lock);

@@ -2460,7 +2539,7 @@ static void vfio_ap_mdev_hot_plug_cfg(st
 					 matrix_mdev->adm_add, AP_DOMAINS);
 
 	if (filter_adapters || filter_domains)
-		do_hotplug = vfio_ap_mdev_filter_matrix(matrix_mdev);
+		do_hotplug = vfio_ap_mdev_filter_matrix(matrix_mdev, apm_filtered);
 
 	if (filter_cdoms)
 		do_hotplug |= vfio_ap_mdev_filter_cdoms(matrix_mdev);

@@ -2468,6 +2547,8 @@ static void vfio_ap_mdev_hot_plug_cfg(st
 	if (do_hotplug)
 		vfio_ap_mdev_update_guest_apcb(matrix_mdev);
 
+	reset_queues_for_apids(matrix_mdev, apm_filtered);
+
 	mutex_unlock(&matrix_dev->mdevs_lock);
 	mutex_unlock(&matrix_mdev->kvm->lock);
 }

@@ -133,6 +133,8 @@ struct ap_matrix_mdev {
  * @apqn: the APQN of the AP queue device
  * @saved_isc: the guest ISC registered with the GIB interface
  * @mdev_qnode: allows the vfio_ap_queue struct to be added to a hashtable
+ * @reset_qnode: allows the vfio_ap_queue struct to be added to a list of queues
+ *		 that need to be reset
  * @reset_status: the status from the last reset of the queue
  * @reset_work: work to wait for queue reset to complete
  */

@@ -143,6 +145,7 @@ struct vfio_ap_queue {
 #define VFIO_AP_ISC_INVALID 0xff
 	unsigned char saved_isc;
 	struct hlist_node mdev_qnode;
+	struct list_head reset_qnode;
 	struct ap_queue_status reset_status;
 	struct work_struct reset_work;
 };

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tony Krowiak <[email protected]>

commit f009cfa466558b7dfe97f167ba1875d6f9ea4c07 upstream.

When a queue is unbound from the vfio_ap device driver, if that queue is assigned to a guest's AP configuration, its associated adapter is removed because queues are defined to a guest via a matrix of adapters and domains; so, it is not possible to remove a single queue.

If an adapter is removed from the guest's AP configuration, all associated queues must be reset to prevent leaking crypto data should any of them be assigned to a different guest or device driver. The one caveat is that if the queue is being removed because the adapter or domain has been removed from the host's AP configuration, then an attempt to reset the queue will fail with response code 01, AP-queue number not valid; so resetting these queues should be skipped.

---
 drivers/s390/crypto/vfio_ap_ops.c |   76 ++++++++++++++++++++------------------
 1 file changed, 41 insertions(+), 35 deletions(-)

@@ -936,45 +936,45 @@ static void vfio_ap_mdev_link_adapter(st
 				       AP_MKQID(apid, apqi));
 }
 
+static void collect_queues_to_reset(struct ap_matrix_mdev *matrix_mdev,
+				    unsigned long apid,
+				    struct list_head *qlist)
+{
+	struct vfio_ap_queue *q;
+	unsigned long  apqi;
+
+	for_each_set_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm, AP_DOMAINS) {
+		q = vfio_ap_mdev_get_queue(matrix_mdev, AP_MKQID(apid, apqi));
+		if (q)
+			list_add_tail(&q->reset_qnode, qlist);
+	}
+}
+
+static void reset_queues_for_apid(struct ap_matrix_mdev *matrix_mdev,
+				  unsigned long apid)
+{
+	struct list_head qlist;
+
+	INIT_LIST_HEAD(&qlist);
+	collect_queues_to_reset(matrix_mdev, apid, &qlist);
+	vfio_ap_mdev_reset_qlist(&qlist);
+}
+
 static int reset_queues_for_apids(struct ap_matrix_mdev *matrix_mdev,
 				  unsigned long *apm_reset)
 {
-	struct vfio_ap_queue *q, *tmpq;
 	struct list_head qlist;
-	unsigned long apid, apqi;
-	int apqn, ret = 0;
+	unsigned long apid;
 
 	if (bitmap_empty(apm_reset, AP_DEVICES))
 		return 0;
 
 	INIT_LIST_HEAD(&qlist);
 
-	for_each_set_bit_inv(apid, apm_reset, AP_DEVICES) {
-		for_each_set_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm,
-				     AP_DOMAINS) {
-			/*
-			 * If the domain is not in the host's AP configuration,
-			 * then resetting it will fail with response code 01
-			 * (APQN not valid).
-			 */
-			if (!test_bit_inv(apqi,
-					  (unsigned long *)matrix_dev->info.aqm))
-				continue;
-
-			apqn = AP_MKQID(apid, apqi);
-			q = vfio_ap_mdev_get_queue(matrix_mdev, apqn);
+	for_each_set_bit_inv(apid, apm_reset, AP_DEVICES)
+		collect_queues_to_reset(matrix_mdev, apid, &qlist);
 
-			if (q)
-				list_add_tail(&q->reset_qnode, &qlist);
-		}
-	}
-
-	ret = vfio_ap_mdev_reset_qlist(&qlist);
-
-	list_for_each_entry_safe(q, tmpq, &qlist, reset_qnode)
-		list_del(&q->reset_qnode);
-
-	return ret;
+	return vfio_ap_mdev_reset_qlist(&qlist);
 }
 
 /**

@@ -2200,24 +2200,30 @@ void vfio_ap_mdev_remove_queue(struct ap
 	matrix_mdev = q->matrix_mdev;
 
 	if (matrix_mdev) {
-		vfio_ap_unlink_queue_fr_mdev(q);
-
 		apid = AP_QID_CARD(q->apqn);
 		apqi = AP_QID_QUEUE(q->apqn);
-
-		/*
-		 * If the queue is assigned to the guest's APCB, then remove
-		 * the adapter's APID from the APCB and hot it into the guest.
-		 */
+		/* If the queue is assigned to the guest's AP configuration */
 		if (test_bit_inv(apid, matrix_mdev->shadow_apcb.apm) &&
 		    test_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm)) {
+			/*
+			 * Since the queues are defined via a matrix of adapters
+			 * and domains, it is not possible to hot unplug a
+			 * single queue; so, let's unplug the adapter.
+			 */
 			clear_bit_inv(apid, matrix_mdev->shadow_apcb.apm);
 			vfio_ap_mdev_update_guest_apcb(matrix_mdev);
+			reset_queues_for_apid(matrix_mdev, apid);
+			goto done;
 		}
 	}
 
 	vfio_ap_mdev_reset_queue(q);
 	flush_work(&q->reset_work);
+
+done:
+	if (matrix_mdev)
+		vfio_ap_unlink_queue_fr_mdev(q);
+
 	dev_set_drvdata(&apdev->device, NULL);
 	kfree(q);
 	release_update_locks_for_mdev(matrix_mdev);

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tony Krowiak <[email protected]>

commit b9bd10c43456d16abd97b717446f51afb3b88411 upstream.

When a queue is unbound from the vfio_ap device driver, it is reset to ensure its crypto data is not leaked when it is bound to another device driver. If the queue is unbound due to the fact that the adapter or domain was removed from the host's AP configuration, then attempting to reset it will fail with response code 01 (APID not valid) getting returned from the reset command. Let's ensure that the queue is assigned to the host's configuration before resetting it.

---
 drivers/s390/crypto/vfio_ap_ops.c |   16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

@@ -2198,10 +2198,10 @@ void vfio_ap_mdev_remove_queue(struct ap
 	q = dev_get_drvdata(&apdev->device);
 	get_update_locks_for_queue(q);
 	matrix_mdev = q->matrix_mdev;
+	apid = AP_QID_CARD(q->apqn);
+	apqi = AP_QID_QUEUE(q->apqn);
 
 	if (matrix_mdev) {
-		apid = AP_QID_CARD(q->apqn);
-		apqi = AP_QID_QUEUE(q->apqn);
 		/* If the queue is assigned to the guest's AP configuration */
 		if (test_bit_inv(apid, matrix_mdev->shadow_apcb.apm) &&
 		    test_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm)) {

@@ -2217,8 +2217,16 @@ void vfio_ap_mdev_remove_queue(struct ap
 		}
 	}
 
-	vfio_ap_mdev_reset_queue(q);
-	flush_work(&q->reset_work);
+	/*
+	 * If the queue is not in the host's AP configuration, then resetting
+	 * it will fail with response code 01, (APQN not valid); so, let's make
+	 * sure it is in the host's config.
+	 */
+	if (test_bit_inv(apid, (unsigned long *)matrix_dev->info.apm) &&
+	    test_bit_inv(apqi, (unsigned long *)matrix_dev->info.aqm)) {
+		vfio_ap_mdev_reset_queue(q);
+		flush_work(&q->reset_work);
+	}
 
 done:
 	if (matrix_mdev)

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nathan Lynch <[email protected]>

commit 7a8e9cdf9405819105ae7405cd91e482bf574b01 upstream.

Using the address operator on the array doesn't work:

./include/linux/seq_buf.h:27:27: error: initialization of ‘char *’
from incompatible pointer type ‘char (*)[128]’ [-Werror=incompatible-pointer-types]
27 | .buffer = &__ ## NAME ## _buffer, \
| ^

Apart from fixing that, we can improve DECLARE_SEQ_BUF() by using a compound literal to define the buffer array without attaching a name to it. This makes the macro a single statement, allowing constructs such as:

  static DECLARE_SEQ_BUF(my_seq_buf, MYSB_SIZE);

to work as intended.

---
 include/linux/seq_buf.h |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

@@ -22,9 +22,8 @@ struct seq_buf {
 };
 
 #define DECLARE_SEQ_BUF(NAME, SIZE)			\
-	char __ ## NAME ## _buffer[SIZE] = "";		\
 	struct seq_buf NAME = {				\
-		.buffer = &__ ## NAME ## _buffer,	\
+		.buffer = (char[SIZE]) { 0 },		\
 		.size = SIZE,				\
 	}
 

6.7-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email protected]>

commit 78fbb92af27d0982634116c7a31065f24d092826 upstream.

syzbot complains that msg->msg_get_inq value can be uninitialized [1]

struct msghdr got many new fields recently, we should always make sure their values is zero by default.

[1]

 BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571
  tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571
  inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879
  sock_recvmsg_nosec net/socket.c:1044 [inline]
  sock_recvmsg+0x12b/0x1e0 net/socket.c:1066
  __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538
  nbd_read_reply drivers/block/nbd.c:732 [inline]
  recv_work+0x262/0x3100 drivers/block/nbd.c:863
  process_one_work kernel/workqueue.c:2627 [inline]
  process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700
  worker_thread+0xf45/0x1490 kernel/workqueue.c:2781
  kthread+0x3ed/0x540 kernel/kthread.c:388
  ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147
  ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242

Local variable msg created at:

  __sock_xmit+0x4c/0x5c0 drivers/block/nbd.c:513
  nbd_read_reply drivers/block/nbd.c:732 [inline]
  recv_work+0x262/0x3100 drivers/block/nbd.c:863

CPU: 1 PID: 7465 Comm: kworker/u5:1 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Workqueue: nbd5-recv recv_work