6.13.4-rc1 review

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stuart Hayhurst <[email protected]>

commit c098363828f7006ef5c5121b673bc5e26571e6c8 upstream.

power_supply_config psy_cfg was missing its initialiser, add it in.

---
 drivers/hid/hid-corsair-void.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index bd8f3d849b58..56e858066c3c 100644
@@ -553,7 +553,7 @@ static void corsair_void_battery_remove_work_handler(struct work_struct *work)
 static void corsair_void_battery_add_work_handler(struct work_struct *work)
 {
 	struct corsair_void_drvdata *drvdata;
-	struct power_supply_config psy_cfg;
+	struct power_supply_config psy_cfg = {};
 	struct power_supply *new_supply;
 
 	drvdata = container_of(work, struct corsair_void_drvdata,

2.48.1

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Shevchenko <[email protected]>

[ Upstream commit 0a7404fc5399e1100b14e7e2a4af2e4fd5e3b602 ]

There are two registers in the hardware, one, "Select PWM", is per-port configuration enabling PWM function instead of GPIO. The other one is "PWM Select" is per-PWM selector to configure PWM itself. Original code uses abbreviation of the latter to describe the former. Rename it to follow the datasheet.

---
 drivers/pinctrl/pinctrl-cy8c95x0.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

index bfa16f70e29ce..75100a9fb8e4c 100644
@@ -42,7 +42,7 @@
 #define CY8C95X0_PORTSEL	0x18
 /* Port settings, write PORTSEL first */
 #define CY8C95X0_INTMASK	0x19
-#define CY8C95X0_PWMSEL		0x1A
+#define CY8C95X0_SELPWM		0x1A
 #define CY8C95X0_INVERT		0x1B
 #define CY8C95X0_DIRECTION	0x1C
 /* Drive mode register change state on writing '1' */

@@ -369,8 +369,8 @@ static bool cy8c95x0_volatile_register(struct device *dev, unsigned int reg)
 	case CY8C95X0_INPUT_(0) ... CY8C95X0_INPUT_(7):
 	case CY8C95X0_INTSTATUS_(0) ... CY8C95X0_INTSTATUS_(7):
 	case CY8C95X0_INTMASK:
+	case CY8C95X0_SELPWM:
 	case CY8C95X0_INVERT:
-	case CY8C95X0_PWMSEL:
 	case CY8C95X0_DIRECTION:
 	case CY8C95X0_DRV_PU:
 	case CY8C95X0_DRV_PD:

@@ -399,7 +399,7 @@ static bool cy8c95x0_muxed_register(unsigned int reg)
 {
 	switch (reg) {
 	case CY8C95X0_INTMASK:
-	case CY8C95X0_PWMSEL:
+	case CY8C95X0_SELPWM:
 	case CY8C95X0_INVERT:
 	case CY8C95X0_DIRECTION:
 	case CY8C95X0_DRV_PU:

@@ -797,7 +797,7 @@ static int cy8c95x0_gpio_get_pincfg(struct cy8c95x0_pinctrl *chip,
 		reg = CY8C95X0_DIRECTION;
 		break;
 	case PIN_CONFIG_MODE_PWM:
-		reg = CY8C95X0_PWMSEL;
+		reg = CY8C95X0_SELPWM;
 		break;
 	case PIN_CONFIG_OUTPUT:
 		reg = CY8C95X0_OUTPUT;

@@ -876,7 +876,7 @@ static int cy8c95x0_gpio_set_pincfg(struct cy8c95x0_pinctrl *chip,
 		reg = CY8C95X0_DRV_PP_FAST;
 		break;
 	case PIN_CONFIG_MODE_PWM:
-		reg = CY8C95X0_PWMSEL;
+		reg = CY8C95X0_SELPWM;
 		break;
 	case PIN_CONFIG_OUTPUT_ENABLE:
 		return cy8c95x0_pinmux_direction(chip, off, !arg);

@@ -1161,7 +1161,7 @@ static void cy8c95x0_pin_dbg_show(struct pinctrl_dev *pctldev, struct seq_file *
 	bitmap_zero(mask, MAX_LINE);
 	__set_bit(pin, mask);
 
-	if (cy8c95x0_read_regs_mask(chip, CY8C95X0_PWMSEL, pwm, mask)) {
+	if (cy8c95x0_read_regs_mask(chip, CY8C95X0_SELPWM, pwm, mask)) {
 		seq_puts(s, "not available");
 		return;
 	}

@@ -1206,7 +1206,7 @@ static int cy8c95x0_set_mode(struct cy8c95x0_pinctrl *chip, unsigned int off, bo
 	u8 port = cypress_get_port(chip, off);
 	u8 bit = cypress_get_pin_mask(chip, off);
 
-	return cy8c95x0_regmap_write_bits(chip, CY8C95X0_PWMSEL, port, bit, mode ? bit : 0);
+	return cy8c95x0_regmap_write_bits(chip, CY8C95X0_SELPWM, port, bit, mode ? bit : 0);
 }
 
 static int cy8c95x0_pinmux_mode(struct cy8c95x0_pinctrl *chip,

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Shevchenko <[email protected]>

[ Upstream commit 1ddee69108d305bbc059cbf31c0b47626796be77 ]

Some of the platforms may connect the INT pin via inversion logic effectively make the triggering to be active-low.
Remove explicit trigger flag to respect the settings from firmware.

Without this change even idling chip produces spurious interrupts and kernel disables the line in the result:

irq 33: nobody cared (try booting with the "irqpoll" option)

  CPU: 0 UID: 0 PID: 125 Comm: irq/33-i2c-INT3 Not tainted 6.12.0-00236-g8b874ed11dae #64
  Hardware name: Intel Corp. QUARK/Galileo, BIOS 0x01000900 01/01/2014
  ...
  handlers:
  [<86e86bea>] irq_default_primary_handler threaded [<d153e44a>] cy8c95x0_irq_handler [pinctrl_cy8c95x0]
  Disabling IRQ #33

---
 drivers/pinctrl/pinctrl-cy8c95x0.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 75100a9fb8e4c..d73004b4a45e7 100644
@@ -1355,7 +1355,7 @@ static int cy8c95x0_irq_setup(struct cy8c95x0_pinctrl *chip, int irq)
 
 	ret = devm_request_threaded_irq(chip->dev, irq,
 					NULL, cy8c95x0_irq_handler,
-					IRQF_ONESHOT | IRQF_SHARED | IRQF_TRIGGER_HIGH,
+					IRQF_ONESHOT | IRQF_SHARED,
 					dev_name(chip->dev), chip);
 	if (ret) {
 		dev_err(chip->dev, "failed to request irq %d\n", irq);

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Charles Han <[email protected]>

[ Upstream commit 45ab5166a82d038c898985b0ad43ead69c1f9573 ]

devm_kasprintf() can return a NULL pointer on failure,but this returned value in winwing_init_led() is not checked. Add NULL check in winwing_init_led(), to handle kernel NULL pointer dereference error.

---
 drivers/hid/hid-winwing.c | 2 ++
 1 file changed, 2 insertions(+)

index 831b760c66ea7..d4afbbd278079 100644
@@ -106,6 +106,8 @@ static int winwing_init_led(struct hid_device *hdev,
 						"%s::%s",
 						dev_name(&input->dev),
 						info->led_name);
+		if (!led->cdev.name)
+			return -ENOMEM;
 
 		ret = devm_led_classdev_register(&hdev->dev, &led->cdev);
 		if (ret)

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Charles Han <[email protected]>

[ Upstream commit 9b8e2220d3a052a690b1d1b23019673e612494c5 ]

devm_kasprintf() can return a NULL pointer on failure,but this returned value in mt_input_configured() is not checked. Add NULL check in mt_input_configured(), to handle kernel NULL pointer dereference error.

---
 drivers/hid/hid-multitouch.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

index 82900857bfd87..e50887a6d22c2 100644
@@ -1679,9 +1679,12 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
 		break;
 	}
 
-	if (suffix)
+	if (suffix) {
 		hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
 						 "%s %s", hdev->name, suffix);
+		if (!hi->input->name)
+			return -ENOMEM;
+	}
 
 	return 0;
 }

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nathan Chancellor <[email protected]>

[ Upstream commit 738fc998b639407346a9e026514f0562301462cd ]

Clang's -Wformat-overflow and -Wformat-truncation have chosen to check '%p' unlike GCC but it does not know about the kernel's pointer extensions in lib/vsprintf.c, so the developers split that part of the warning out for the kernel to disable because there will always be false positives.

Commit 908dd508276d ("kbuild: enable -Wformat-truncation on clang") did disabled these warnings but only in a block that would be called when W=1 was not passed, so they would appear with W=1. Move the disabling of the non-kprintf warnings to a block that always runs so that they are never seen, regardless of warning level.

---
 scripts/Makefile.extrawarn | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

index 04faf15ed316a..d75897559d184 100644
@@ -31,6 +31,11 @@ KBUILD_CFLAGS-$(CONFIG_CC_NO_ARRAY_BOUNDS) += -Wno-array-bounds
 ifdef CONFIG_CC_IS_CLANG
 # The kernel builds with '-std=gnu11' so use of GNU extensions is acceptable.
 KBUILD_CFLAGS += -Wno-gnu
+
+# Clang checks for overflow/truncation with '%p', while GCC does not:
+# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111219
+KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow-non-kprintf)
+KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation-non-kprintf)
 else
 
 # gcc inanely warns about local variables called 'main'

@@ -102,11 +107,6 @@ KBUILD_CFLAGS += $(call cc-disable-warning, packed-not-aligned)
 KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow)
 ifdef CONFIG_CC_IS_GCC
 KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation)
-else
-# Clang checks for overflow/truncation with '%p', while GCC does not:
-# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111219
-KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow-non-kprintf)
-KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation-non-kprintf)
 endif
 KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation)
 

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Claudiu Beznea <[email protected]>

[ Upstream commit 0af4c120f5e7a1ea70aff7da2dfb65b6148a3e84 ]

Commit 3ba11e684d16 ("pinctrl: pinconf-generic: print hex value") unconditionally switched to printing hex values in pinconf_generic_dump_one(). However, if a dump format is registered for the dumped pin, the hex value is printed as well. This hex value does not necessarily correspond 1:1 with the hardware register value (as noted by commit 3ba11e684d16 ("pinctrl: pinconf-generic: print hex value")). As a result, user-facing output may include information like:
output drive strength (0x100 uA).

To address this, check if a dump format is registered for the dumped property, and print the unsigned value instead when applicable.

---
 drivers/pinctrl/pinconf-generic.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

index 0b13d7f17b325..42547f64453e8 100644
@@ -89,12 +89,12 @@ static void pinconf_generic_dump_one(struct pinctrl_dev *pctldev,
 		seq_puts(s, items[i].display);
 		/* Print unit if available */
 		if (items[i].has_arg) {
-			seq_printf(s, " (0x%x",
-				   pinconf_to_config_argument(config));
+			u32 val = pinconf_to_config_argument(config);
+
 			if (items[i].format)
-				seq_printf(s, " %s)", items[i].format);
+				seq_printf(s, " (%u %s)", val, items[i].format);
 			else
-				seq_puts(s, ")");
+				seq_printf(s, " (0x%x)", val);
 		}
 	}
 }

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tulio Fernandes <[email protected]>

[ Upstream commit 0b43d98ff29be3144e86294486b1373b5df74c0e ]

Syzbot[1] has detected a stack-out-of-bounds read of the ep_addr array from hid-thrustmaster driver. This array is passed to usb_check_int_endpoints function from usb.c core driver, which executes a for loop that iterates over the elements of the passed array. Not finding a null element at the end of the array, it tries to read the next, non-existent element, crashing the kernel.

To fix this, a 0 element was added at the end of the array to break the for loop.

[1] https://syzkaller.appspot.com/bug?extid=9c9179ac46169c56c1ad

---
 drivers/hid/hid-thrustmaster.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 6c3e758bbb09e..3b81468a1df29 100644
@@ -171,7 +171,7 @@ static void thrustmaster_interrupts(struct hid_device *hdev)
 	b_ep = ep->desc.bEndpointAddress;
 
 	/* Are the expected endpoints present? */
-	u8 ep_addr[1] = {b_ep};
+	u8 ep_addr[2] = {b_ep, 0};
 
 	if (!usb_check_int_endpoints(usbif, ep_addr)) {
 		hid_err(hdev, "Unexpected non-int endpoint\n");

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Vicki Pfau <[email protected]>

[ Upstream commit b051ffa2aeb2a60e092387b6fb2af1ad42f51a3c ]

Lockdep reported that, as steam_do_deck_input_event is called from steam_raw_event inside of an IRQ context, it can lead to issues if that IRQ occurs while the work to be cancelled is running. By using cancel_delayed_work, this issue can be avoided. The exact ordering of the work and the event processing is not super important, so this is safe.

---
 drivers/hid/hid-steam.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 6439913372a8a..12a6887cd12c9 100644
@@ -1592,7 +1592,7 @@ static void steam_do_deck_input_event(struct steam_device *steam,
 
 	if (!(b9 & BIT(6)) && steam->did_mode_switch) {
 		steam->did_mode_switch = false;
-		cancel_delayed_work_sync(&steam->mode_switch);
+		cancel_delayed_work(&steam->mode_switch);
 	} else if (!steam->client_opened && (b9 & BIT(6)) && !steam->did_mode_switch) {
 		steam->did_mode_switch = true;
 		schedule_delayed_work(&steam->mode_switch, 45 * HZ / 100);

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kunihiko Hayashi <[email protected]>

[ Upstream commit 3588b1c0fde2f58d166e3f94a5a58d64b893526c ]

When there is no dummy cycle in the spi-nor commands, both dummy bus cycle bytes and width are zero. Because of the cpu's warning when divided by zero, the warning should be avoided. Return just zero to avoid such calculations.

---
 drivers/spi/spi-sn-f-ospi.c | 3 +++
 1 file changed, 3 insertions(+)

index adac645732fed..56ef114effc97 100644
@@ -116,6 +116,9 @@ struct f_ospi {
 
 static u32 f_ospi_get_dummy_cycle(const struct spi_mem_op *op)
 {
+	if (!op->dummy.nbytes)
+		return 0;
+
 	return (op->dummy.nbytes * 8) / op->dummy.buswidth;
 }
 

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Murad Masimov <[email protected]>

[ Upstream commit bca0902e61731a75fc4860c8720168d9f1bae3b6 ]

If an AX25 device is bound to a socket by setting the SO_BINDTODEVICE socket option, a refcount leak will occur in ax25_release().

Commit 9fd75b66b8f6 ("ax25: Fix refcount leaks caused by ax25_cb_del()") added decrement of device refcounts in ax25_release(). In order for that to work correctly the refcounts must already be incremented when the device is bound to the socket. An AX25 device can be bound to a socket by either calling ax25_bind() or setting SO_BINDTODEVICE socket option. In both cases the refcounts should be incremented, but in fact it is done only in ax25_bind().

This bug leads to the following issue reported by Syzkaller:

================================================================
refcount_t: decrement hit 0; leaking memory.

WARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31
Modules linked in:
CPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31
Call Trace:
 <TASK>
 __refcount_dec include/linux/refcount.h:336 [inline]
 refcount_dec include/linux/refcount.h:351 [inline]
 ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236
 netdev_tracker_free include/linux/netdevice.h:4156 [inline]
 netdev_put include/linux/netdevice.h:4173 [inline]
 netdev_put include/linux/netdevice.h:4169 [inline]
 ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069
 __sock_release+0xb0/0x270 net/socket.c:640
 sock_close+0x1c/0x30 net/socket.c:1408
 ...
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 ...
 </TASK>
================================================================

Fix the implementation of ax25_setsockopt() by adding increment of refcounts for the new device bound, and decrement of refcounts for the old unbound device.

---
 net/ax25/af_ax25.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

index aa6c714892ec9..9f3b8b682adb2 100644
@@ -685,6 +685,15 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
 			break;
 		}
 
+		if (ax25->ax25_dev) {
+			if (dev == ax25->ax25_dev->dev) {
+				rcu_read_unlock();
+				break;
+			}
+			netdev_put(ax25->ax25_dev->dev, &ax25->dev_tracker);
+			ax25_dev_put(ax25->ax25_dev);
+		}
+
 		ax25->ax25_dev = ax25_dev_ax25dev(dev);
 		if (!ax25->ax25_dev) {
 			rcu_read_unlock();

@@ -692,6 +701,8 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
 			break;
 		}
 		ax25_fillin_cb(ax25, ax25->ax25_dev);
+		netdev_hold(dev, &ax25->dev_tracker, GFP_ATOMIC);
+		ax25_dev_hold(ax25->ax25_dev);
 		rcu_read_unlock();
 		break;
 

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stuart Hayhurst <[email protected]>

commit 48e487b002891eb0aeaec704c9bed51f028deff1 upstream.

The cancel_delayed_work_sync() call was missed, causing a use-after-free in corsair_void_remove().

---
 drivers/hid/hid-corsair-void.c | 1 +
 1 file changed, 1 insertion(+)

index 6ece56b850fc..bd8f3d849b58 100644
@@ -726,6 +726,7 @@ static void corsair_void_remove(struct hid_device *hid_dev)
 	if (drvdata->battery)
 		power_supply_unregister(drvdata->battery);
 
+	cancel_delayed_work_sync(&drvdata->delayed_status_work);
 	cancel_delayed_work_sync(&drvdata->delayed_firmware_work);
 	sysfs_remove_group(&hid_dev->dev.kobj, &corsair_void_attr_group);
 }

2.48.1

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit cb827db50a88aebec516151681adb6db10b688ee ]

rule->iifindex and rule->oifindex can be read without holding RTNL.

Add READ_ONCE()/WRITE_ONCE() annotations where needed.

---
 net/core/fib_rules.c | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

index 34185d138c95a..ff1cebd71f7b4 100644
@@ -37,8 +37,8 @@ static const struct fib_kuid_range fib_kuid_range_unset = {
 
 bool fib_rule_matchall(const struct fib_rule *rule)
 {
-	if (rule->iifindex || rule->oifindex || rule->mark || rule->tun_id ||
-	    rule->flags)
+	if (READ_ONCE(rule->iifindex) || READ_ONCE(rule->oifindex) ||
+	    rule->mark || rule->tun_id || rule->flags)
 		return false;
 	if (rule->suppress_ifgroup != -1 || rule->suppress_prefixlen != -1)
 		return false;

@@ -261,12 +261,14 @@ static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops,
 			  struct flowi *fl, int flags,
 			  struct fib_lookup_arg *arg)
 {
-	int ret = 0;
+	int iifindex, oifindex, ret = 0;
 
-	if (rule->iifindex && (rule->iifindex != fl->flowi_iif))
+	iifindex = READ_ONCE(rule->iifindex);
+	if (iifindex && (iifindex != fl->flowi_iif))
 		goto out;
 
-	if (rule->oifindex && (rule->oifindex != fl->flowi_oif))
+	oifindex = READ_ONCE(rule->oifindex);
+	if (oifindex && (oifindex != fl->flowi_oif))
 		goto out;
 
 	if ((rule->mark ^ fl->flowi_mark) & rule->mark_mask)

@@ -1039,14 +1041,14 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
 	if (rule->iifname[0]) {
 		if (nla_put_string(skb, FRA_IIFNAME, rule->iifname))
 			goto nla_put_failure;
-		if (rule->iifindex == -1)
+		if (READ_ONCE(rule->iifindex) == -1)
 			frh->flags |= FIB_RULE_IIF_DETACHED;
 	}
 
 	if (rule->oifname[0]) {
 		if (nla_put_string(skb, FRA_OIFNAME, rule->oifname))
 			goto nla_put_failure;
-		if (rule->oifindex == -1)
+		if (READ_ONCE(rule->oifindex) == -1)
 			frh->flags |= FIB_RULE_OIF_DETACHED;
 	}
 

@@ -1218,10 +1220,10 @@ static void attach_rules(struct list_head *rules, struct net_device *dev)
 	list_for_each_entry(rule, rules, list) {
 		if (rule->iifindex == -1 &&
 		    strcmp(dev->name, rule->iifname) == 0)
-			rule->iifindex = dev->ifindex;
+			WRITE_ONCE(rule->iifindex, dev->ifindex);
 		if (rule->oifindex == -1 &&
 		    strcmp(dev->name, rule->oifname) == 0)
-			rule->oifindex = dev->ifindex;
+			WRITE_ONCE(rule->oifindex, dev->ifindex);
 	}
 }
 

@@ -1231,9 +1233,9 @@ static void detach_rules(struct list_head *rules, struct net_device *dev)
 
 	list_for_each_entry(rule, rules, list) {
 		if (rule->iifindex == dev->ifindex)
-			rule->iifindex = -1;
+			WRITE_ONCE(rule->iifindex, -1);
 		if (rule->oifindex == dev->ifindex)
-			rule->oifindex = -1;
+			WRITE_ONCE(rule->oifindex, -1);
 	}
 }
 

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Reyders Morales <[email protected]>

[ Upstream commit d0b197b6505fe3788860fc2a81b3ce53cbecc69c ]

In the current struct sockaddr_can tp is member of can_addr. tp is not member of struct sockaddr_can.

---
 Documentation/networking/iso15765-2.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 0e9d960741783..37ebb2c417cb4 100644
@@ -369,8 +369,8 @@ to their default.
 
   addr.can_family = AF_CAN;
   addr.can_ifindex = if_nametoindex("can0");
-  addr.tp.tx_id = 0x18DA42F1 | CAN_EFF_FLAG;
-  addr.tp.rx_id = 0x18DAF142 | CAN_EFF_FLAG;
+  addr.can_addr.tp.tx_id = 0x18DA42F1 | CAN_EFF_FLAG;
+  addr.can_addr.tp.rx_id = 0x18DAF142 | CAN_EFF_FLAG;
 
   ret = bind(s, (struct sockaddr *)&addr, sizeof(addr));
   if (ret < 0)

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit 48145a57d4bbe3496e8e4880b23ea6b511e6e519 ]

ndisc_send_redirect() is called under RCU protection, not RTNL.

It must use dev_get_by_index_rcu() instead of __dev_get_by_index()

---
 net/ipv6/ndisc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index d044c67019de6..264b10a947577 100644
@@ -1694,7 +1694,7 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
 	bool ret;
 
 	if (netif_is_l3_master(skb->dev)) {
-		dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
+		dev = dev_get_by_index_rcu(dev_net(skb->dev), IPCB(skb)->iif);
 		if (!dev)
 			return;
 	}

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit 6d0ce46a93135d96b7fa075a94a88fe0da8e8773 ]

l3mdev_l3_out() can be called without RCU being held:

raw_sendmsg()
ip_push_pending_frames()
ip_send_skb()
ip_local_out()

    __ip_local_out()
     l3mdev_ip_out()

Add rcu_read_lock() / rcu_read_unlock() pair to avoid a potential UAF.

---
 include/net/l3mdev.h | 2 ++
 1 file changed, 2 insertions(+)

index 2d6141f28b530..f7fe796e8429a 100644
@@ -198,10 +198,12 @@ struct sk_buff *l3mdev_l3_out(struct sock *sk, struct sk_buff *skb, u16 proto)
 	if (netif_is_l3_slave(dev)) {
 		struct net_device *master;
 
+		rcu_read_lock();
 		master = netdev_master_upper_dev_get_rcu(dev);
 		if (master && master->l3mdev_ops->l3mdev_l3_out)
 			skb = master->l3mdev_ops->l3mdev_l3_out(master, sk,
 								skb, proto);
+		rcu_read_unlock();
 	}
 
 	return skb;

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jerome Brunet <[email protected]>

[ Upstream commit 35e21de48e693af1dcfdbf2dc3d73dcfa3c8f2d9 ]

This reverts commit cd7a38c40b231350a3cd0fd774f4e6bb68c4b411.

When submitting the change above, it was thought that the origin of the init_data should be a clear choice, from the driver or from DT but not both.

It turns out some devices, such as qcom-msm8974-lge-nexus5-hammerhead, relied on the old behaviour to override the init_data provided by the driver, making it some kind of default if none is provided by the platform.

Using the init_data provided by the driver when it is present broke these devices so revert the change to fixup the situation and add a comment to make things a bit more clear

---
 drivers/regulator/core.c | 61 ++++++++++++++++++----------------------
 1 file changed, 27 insertions(+), 34 deletions(-)

index 13d9c3e349682..8524018e89914 100644
@@ -5643,43 +5643,36 @@ regulator_register(struct device *dev,
 		goto clean;
 	}
 
-	if (config->init_data) {
-		/*
-		 * Providing of_match means the framework is expected to parse
-		 * DT to get the init_data. This would conflict with provided
-		 * init_data, if set. Warn if it happens.
-		 */
-		if (regulator_desc->of_match)
-			dev_warn(dev, "Using provided init data - OF match ignored\n");
+	/*
+	 * DT may override the config->init_data provided if the platform
+	 * needs to do so. If so, config->init_data is completely ignored.
+	 */
+	init_data = regulator_of_get_init_data(dev, regulator_desc, config,
+					       &rdev->dev.of_node);
 
+	/*
+	 * Sometimes not all resources are probed already so we need to take
+	 * that into account. This happens most the time if the ena_gpiod comes
+	 * from a gpio extender or something else.
+	 */
+	if (PTR_ERR(init_data) == -EPROBE_DEFER) {
+		ret = -EPROBE_DEFER;
+		goto clean;
+	}
+
+	/*
+	 * We need to keep track of any GPIO descriptor coming from the
+	 * device tree until we have handled it over to the core. If the
+	 * config that was passed in to this function DOES NOT contain
+	 * a descriptor, and the config after this call DOES contain
+	 * a descriptor, we definitely got one from parsing the device
+	 * tree.
+	 */
+	if (!cfg->ena_gpiod && config->ena_gpiod)
+		dangling_of_gpiod = true;
+	if (!init_data) {
 		init_data = config->init_data;
 		rdev->dev.of_node = of_node_get(config->of_node);
-
-	} else {
-		init_data = regulator_of_get_init_data(dev, regulator_desc,
-						       config,
-						       &rdev->dev.of_node);
-
-		/*
-		 * Sometimes not all resources are probed already so we need to
-		 * take that into account. This happens most the time if the
-		 * ena_gpiod comes from a gpio extender or something else.
-		 */
-		if (PTR_ERR(init_data) == -EPROBE_DEFER) {
-			ret = -EPROBE_DEFER;
-			goto clean;
-		}
-
-		/*
-		 * We need to keep track of any GPIO descriptor coming from the
-		 * device tree until we have handled it over to the core. If the
-		 * config that was passed in to this function DOES NOT contain a
-		 * descriptor, and the config after this call DOES contain a
-		 * descriptor, we definitely got one from parsing the device
-		 * tree.
-		 */
-		if (!cfg->ena_gpiod && config->ena_gpiod)
-			dangling_of_gpiod = true;
 	}
 
 	ww_mutex_init(&rdev->mutex, &regulator_ww_class);

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sridhar Samudrala <[email protected]>

[ Upstream commit 69ab25a74e2df53edc2de4acfce0a484bdb88155 ]

Handle rsc packet with a single segment same as a multi segment rsc packet so that CHECKSUM_PARTIAL is set in the skb->ip_summed field. The current code is passing CHECKSUM_NONE resulting in TCP GRO layer doing checksum in SW and hiding the issue. This will fail when using dmabufs as payload buffers as skb frag would be unreadable.

---
 drivers/net/ethernet/intel/idpf/idpf_txrx.c | 2 --
 1 file changed, 2 deletions(-)

index 2fa9c36e33c9c..c9fcf8f4d7363 100644
@@ -3008,8 +3008,6 @@ static int idpf_rx_rsc(struct idpf_rx_queue *rxq, struct sk_buff *skb,
 		return -EINVAL;
 
 	rsc_segments = DIV_ROUND_UP(skb->data_len, rsc_seg_len);
-	if (unlikely(rsc_segments == 1))
-		return 0;
 
 	NAPI_GRO_CB(skb)->count = rsc_segments;
 	skb_shinfo(skb)->gso_size = rsc_seg_len;

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sridhar Samudrala <[email protected]>

[ Upstream commit 2ff66c2f9ea4e9311e9a00004348b6c465bd5d3b ]

Move the call to skb_record_rx_queue in idpf_rx_process_skb_fields() so that RX queue is recorded for RSC packets too.

---
 drivers/net/ethernet/intel/idpf/idpf_txrx.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

index c9fcf8f4d7363..9be6a6b59c4e1 100644
@@ -3070,6 +3070,7 @@ idpf_rx_process_skb_fields(struct idpf_rx_queue *rxq, struct sk_buff *skb,
 	idpf_rx_hash(rxq, skb, rx_desc, decoded);
 
 	skb->protocol = eth_type_trans(skb, rxq->netdev);
+	skb_record_rx_queue(skb, rxq->idx);
 
 	if (le16_get_bits(rx_desc->hdrlen_flags,
 			  VIRTCHNL2_RX_FLEX_DESC_ADV_RSC_M))

@@ -3078,8 +3079,6 @@ idpf_rx_process_skb_fields(struct idpf_rx_queue *rxq, struct sk_buff *skb,
 	csum_bits = idpf_rx_splitq_extract_csum_bits(rx_desc);
 	idpf_rx_csum(rxq, skb, csum_bits, decoded);
 
-	skb_record_rx_queue(skb, rxq->idx);
-
 	return 0;
 }
 

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Joshua Hay <[email protected]>

[ Upstream commit 52c11d31b5a1d1c747bb5f36cc4808e93e2348f4 ]

On initial driver load, alloc_etherdev_mqs is called with whatever max queue values are provided by the control plane. However, if the driver is loaded on a system where num_online_cpus() returns less than the max queues, the netdev will think there are more queues than are actually available. Only num_online_cpus() will be allocated, but skb_get_queue_mapping(skb) could possibly return an index beyond the range of allocated queues. Consequently, the packet is silently dropped and it appears as if TX is broken.

Set the real number of queues during open so the netdev knows how many queues will be allocated.

---
 drivers/net/ethernet/intel/idpf/idpf_lib.c | 5 +++++
 1 file changed, 5 insertions(+)

index b4fbb99bfad20..a3d6b8f198a86 100644
@@ -2159,8 +2159,13 @@ static int idpf_open(struct net_device *netdev)
 	idpf_vport_ctrl_lock(netdev);
 	vport = idpf_netdev_to_vport(netdev);
 
+	err = idpf_set_real_num_queues(vport);
+	if (err)
+		goto unlock;
+
 	err = idpf_vport_open(vport);
 
+unlock:
 	idpf_vport_ctrl_unlock(netdev);
 
 	return err;

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zdenek Bouska <[email protected]>

[ Upstream commit 7822dd4d6d4bebca5045a395e1784ef09cae2d43 ]

Fixes HW RX timestamp in the following scenario:
- AF_PACKET socket with enabled HW RX timestamps is created
- AF_XDP socket with enabled zero copy is created
- frame is forwarded to the BPF program, where the timestamp should still be readable (extracted by igc_xdp_rx_timestamp(), kfunc behind bpf_xdp_metadata_rx_timestamp())
- the frame got XDP_PASS from BPF program, redirecting to the stack
- AF_PACKET socket receives the frame with HW RX timestamp

Moves the skb timestamp setting from igc_dispatch_skb_zc() to igc_construct_skb_zc() so that igc_construct_skb_zc() is similar to igc_construct_skb().

This issue can also be reproduced by running:

 # tools/testing/selftests/bpf/xdp_hw_metadata enp1s0
When a frame with the wrong port 9092 (instead of 9091) is used:
 # echo -n xdp | nc -u -q1 192.168.10.9 9092
then the RX timestamp is missing and xdp_hw_metadata prints:
 skb hwtstamp is not found!

With this fix or when copy mode is used:

 # tools/testing/selftests/bpf/xdp_hw_metadata -c enp1s0
then RX timestamp is found and xdp_hw_metadata prints:
 found skb hwtstamp = 1736509937.852786132

---
 drivers/net/ethernet/intel/igc/igc_main.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

index 27872bdea9bd1..d6c3147725b7e 100644
@@ -2707,8 +2707,9 @@ static int igc_clean_rx_irq(struct igc_q_vector *q_vector, const int budget)
 }
 
 static struct sk_buff *igc_construct_skb_zc(struct igc_ring *ring,
-					    struct xdp_buff *xdp)
+					    struct igc_xdp_buff *ctx)
 {
+	struct xdp_buff *xdp = &ctx->xdp;
 	unsigned int totalsize = xdp->data_end - xdp->data_meta;
 	unsigned int metasize = xdp->data - xdp->data_meta;
 	struct sk_buff *skb;

@@ -2727,27 +2728,28 @@ static struct sk_buff *igc_construct_skb_zc(struct igc_ring *ring,
 		__skb_pull(skb, metasize);
 	}
 
+	if (ctx->rx_ts) {
+		skb_shinfo(skb)->tx_flags |= SKBTX_HW_TSTAMP_NETDEV;
+		skb_hwtstamps(skb)->netdev_data = ctx->rx_ts;
+	}
+
 	return skb;
 }
 
 static void igc_dispatch_skb_zc(struct igc_q_vector *q_vector,
 				union igc_adv_rx_desc *desc,
-				struct xdp_buff *xdp,
-				ktime_t timestamp)
+				struct igc_xdp_buff *ctx)
 {
 	struct igc_ring *ring = q_vector->rx.ring;
 	struct sk_buff *skb;
 
-	skb = igc_construct_skb_zc(ring, xdp);
+	skb = igc_construct_skb_zc(ring, ctx);
 	if (!skb) {
 		ring->rx_stats.alloc_failed++;
 		set_bit(IGC_RING_FLAG_RX_ALLOC_FAILED, &ring->flags);
 		return;
 	}
 
-	if (timestamp)
-		skb_hwtstamps(skb)->hwtstamp = timestamp;
-
 	if (igc_cleanup_headers(ring, desc, skb))
 		return;
 

@@ -2783,7 +2785,6 @@ static int igc_clean_rx_irq_zc(struct igc_q_vector *q_vector, const int budget)
 		union igc_adv_rx_desc *desc;
 		struct igc_rx_buffer *bi;
 		struct igc_xdp_buff *ctx;
-		ktime_t timestamp = 0;
 		unsigned int size;
 		int res;
 

@@ -2813,6 +2814,8 @@ static int igc_clean_rx_irq_zc(struct igc_q_vector *q_vector, const int budget)
 			 */
 			bi->xdp->data_meta += IGC_TS_HDR_LEN;
 			size -= IGC_TS_HDR_LEN;
+		} else {
+			ctx->rx_ts = NULL;
 		}
 
 		bi->xdp->data_end = bi->xdp->data + size;

@@ -2821,7 +2824,7 @@ static int igc_clean_rx_irq_zc(struct igc_q_vector *q_vector, const int budget)
 		res = __igc_xdp_run_prog(adapter, prog, bi->xdp);
 		switch (res) {
 		case IGC_XDP_PASS:
-			igc_dispatch_skb_zc(q_vector, desc, bi->xdp, timestamp);
+			igc_dispatch_skb_zc(q_vector, desc, ctx);
 			fallthrough;
 		case IGC_XDP_CONSUMED:
 			xsk_buff_free(bi->xdp);

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit 5805402dcc56241987bca674a1b4da79a249bab7 ]

vxlan_init() must check vxlan_vnigroup_init() success otherwise a crash happens later, spotted by syzbot.

Oops: general protection fault, probably for non-canonical address 0xdffffc000000002c: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000160-0x0000000000000167]
CPU: 0 UID: 0 PID: 7313 Comm: syz-executor147 Not tainted 6.14.0-rc1-syzkaller-00276-g69b54314c975 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
 RIP: 0010:vxlan_vnigroup_uninit+0x89/0x500 drivers/net/vxlan/vxlan_vnifilter.c:912
Code: 00 48 8b 44 24 08 4c 8b b0 98 41 00 00 49 8d 86 60 01 00 00 48 89 c2 48 89 44 24 10 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 4d 04 00 00 49 8b 86 60 01 00 00 48 ba 00 00 00
RSP: 0018:ffffc9000cc1eea8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff8672effb
RDX: 000000000000002c RSI: ffffffff8672ecb9 RDI: ffff8880461b4f18
RBP: ffff8880461b4ef4 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000020000
R13: ffff8880461b0d80 R14: 0000000000000000 R15: dffffc0000000000
FS:  00007fecfa95d6c0(0000) GS:ffff88806a600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fecfa95cfb8 CR3: 000000004472c000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
  vxlan_uninit+0x1ab/0x200 drivers/net/vxlan/vxlan_core.c:2942
  unregister_netdevice_many_notify+0x12d6/0x1f30 net/core/dev.c:11824
  unregister_netdevice_many net/core/dev.c:11866 [inline]
  unregister_netdevice_queue+0x307/0x3f0 net/core/dev.c:11736
  register_netdevice+0x1829/0x1eb0 net/core/dev.c:10901
  __vxlan_dev_create+0x7c6/0xa30 drivers/net/vxlan/vxlan_core.c:3981
  vxlan_newlink+0xd1/0x130 drivers/net/vxlan/vxlan_core.c:4407
  rtnl_newlink_create net/core/rtnetlink.c:3795 [inline]
  __rtnl_newlink net/core/rtnetlink.c:3906 [inline]

---
 drivers/net/vxlan/vxlan_core.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

index 9ea63059d52d7..cbe0f191a116b 100644
@@ -2904,8 +2904,11 @@ static int vxlan_init(struct net_device *dev)
 	struct vxlan_dev *vxlan = netdev_priv(dev);
 	int err;
 
-	if (vxlan->cfg.flags & VXLAN_F_VNIFILTER)
-		vxlan_vnigroup_init(vxlan);
+	if (vxlan->cfg.flags & VXLAN_F_VNIFILTER) {
+		err = vxlan_vnigroup_init(vxlan);
+		if (err)
+			return err;
+	}
 
 	err = gro_cells_init(&vxlan->gro_cells, dev);
 	if (err)

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Li Lingfeng <[email protected]>

commit 7faf14a7b0366f153284db0ad3347c457ea70136 upstream.

If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a pointer pointing to the released posix_acl, which will trigger a WARNING in nfs3svc_release_getacl like this:

------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 26 PID: 3199 at lib/refcount.c:28
refcount_warn_saturate+0xb5/0x170
Modules linked in:
CPU: 26 UID: 0 PID: 3199 Comm: nfsd Not tainted
6.12.0-rc6-00079-g04ae226af01f-dirty #8
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.16.1-2.fc37 04/01/2014
RIP: 0010:refcount_warn_saturate+0xb5/0x170
Code: cc cc 0f b6 1d b3 20 a5 03 80 fb 01 0f 87 65 48 d8 00 83 e3 01 75
e4 48 c7 c7 c0 3b 9b 85 c6 05 97 20 a5 03 01 e8 fb 3e 30 ff <0f> 0b eb
cd 0f b6 1d 8a3
RSP: 0018:ffffc90008637cd8 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff83904fde
RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88871ed36380
RBP: ffff888158beeb40 R08: 0000000000000001 R09: fffff520010c6f56
R10: ffffc90008637ab7 R11: 0000000000000001 R12: 0000000000000001
R13: ffff888140e77400 R14: ffff888140e77408 R15: ffffffff858b42c0
FS:  0000000000000000(0000) GS:ffff88871ed00000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000562384d32158 CR3: 000000055cc6a000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ? refcount_warn_saturate+0xb5/0x170
 ? __warn+0xa5/0x140
 ? refcount_warn_saturate+0xb5/0x170
 ? report_bug+0x1b1/0x1e0
 ? handle_bug+0x53/0xa0
 ? exc_invalid_op+0x17/0x40
 ? asm_exc_invalid_op+0x1a/0x20
 ? tick_nohz_tick_stopped+0x1e/0x40
 ? refcount_warn_saturate+0xb5/0x170
 ? refcount_warn_saturate+0xb5/0x170
 nfs3svc_release_getacl+0xc9/0xe0
 svc_process_common+0x5db/0xb60
 ? __pfx_svc_process_common+0x10/0x10
 ? __rcu_read_unlock+0x69/0xa0
 ? __pfx_nfsd_dispatch+0x10/0x10
 ? svc_xprt_received+0xa1/0x120
 ? xdr_init_decode+0x11d/0x190
 svc_process+0x2a7/0x330
 svc_handle_xprt+0x69d/0x940
 svc_recv+0x180/0x2d0
 nfsd+0x168/0x200
 ? __pfx_nfsd+0x10/0x10
 kthread+0x1a2/0x1e0
 ? kthread+0xf4/0x1e0
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x34/0x60
 ? __pfx_kthread+0x10/0x10
 ret_from_fork_asm+0x1a/0x30
 </TASK>
Kernel panic - not syncing: kernel: panic_on_warn set ...

Clear acl_access/acl_default after posix_acl_release is called to prevent UAF from being triggered.

---
 fs/nfsd/nfs2acl.c |    2 ++
 fs/nfsd/nfs3acl.c |    2 ++
 2 files changed, 4 insertions(+)

@@ -84,6 +84,8 @@ out:
 fail:
 	posix_acl_release(resp->acl_access);
 	posix_acl_release(resp->acl_default);
+	resp->acl_access = NULL;
+	resp->acl_default = NULL;
 	goto out;
 }
 

@@ -76,6 +76,8 @@ out:
 fail:
 	posix_acl_release(resp->acl_access);
 	posix_acl_release(resp->acl_default);
+	resp->acl_access = NULL;
+	resp->acl_default = NULL;
 	goto out;
 }
 

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marco Crivellari <[email protected]>

[ Upstream commit edb1942542bc538707cea221e9c7923a6270465f ]

LoongArch re-enables interrupts on its idle routine and performs a TIF_NEED_RESCHED check afterwards before putting the CPU to sleep.

The IRQs firing between the check and the idle instruction may set the TIF_NEED_RESCHED flag. In order to deal with such a race, IRQs interrupting __arch_cpu_idle() rollback their return address to the beginning of __arch_cpu_idle() so that TIF_NEED_RESCHED is checked again before going back to sleep.

However idle IRQs can also queue timers that may require a tick reprogramming through a new generic idle loop iteration but those timers would go unnoticed here because __arch_cpu_idle() only checks TIF_NEED_RESCHED. It doesn't check for pending timers.

Fix this with fast-forwarding idle IRQs return address to the end of the idle routine instead of the beginning, so that the generic idle loop can handle both TIF_NEED_RESCHED and pending timers.

---
 arch/loongarch/kernel/genex.S | 28 +++++++++++++++-------------
 arch/loongarch/kernel/idle.c  |  3 +--
 arch/loongarch/kernel/reset.c |  6 +++---
 3 files changed, 19 insertions(+), 18 deletions(-)

index 86d5d90ebefe5..4f09121417818 100644
@@ -18,16 +18,19 @@
 
 	.align	5
 SYM_FUNC_START(__arch_cpu_idle)
-	/* start of rollback region */
-	LONG_L	t0, tp, TI_FLAGS
-	nop
-	andi	t0, t0, _TIF_NEED_RESCHED
-	bnez	t0, 1f
-	nop
-	nop
-	nop
+	/* start of idle interrupt region */
+	ori	t0, zero, CSR_CRMD_IE
+	/* idle instruction needs irq enabled */
+	csrxchg	t0, t0, LOONGARCH_CSR_CRMD
+	/*
+	 * If an interrupt lands here; between enabling interrupts above and
+	 * going idle on the next instruction, we must *NOT* go idle since the
+	 * interrupt could have set TIF_NEED_RESCHED or caused an timer to need
+	 * reprogramming. Fall through -- see handle_vint() below -- and have
+	 * the idle loop take care of things.
+	 */
 	idle	0
-	/* end of rollback region */
+	/* end of idle interrupt region */
 1:	jr	ra
 SYM_FUNC_END(__arch_cpu_idle)
 

@@ -35,11 +38,10 @@ SYM_CODE_START(handle_vint)
 	UNWIND_HINT_UNDEFINED
 	BACKUP_T0T1
 	SAVE_ALL
-	la_abs	t1, __arch_cpu_idle
+	la_abs	t1, 1b
 	LONG_L	t0, sp, PT_ERA
-	/* 32 byte rollback region */
-	ori	t0, t0, 0x1f
-	xori	t0, t0, 0x1f
+	/* 3 instructions idle interrupt region */
+	ori	t0, t0, 0b1100
 	bne	t0, t1, 1f
 	LONG_S	t0, sp, PT_ERA
 1:	move	a0, sp

index 0b5dd2faeb90b..54b247d8cdb69 100644
@@ -11,7 +11,6 @@
 
 void __cpuidle arch_cpu_idle(void)
 {
-	raw_local_irq_enable();
-	__arch_cpu_idle(); /* idle instruction needs irq enabled */
+	__arch_cpu_idle();
 	raw_local_irq_disable();
 }

index 1ef8c63835351..de8fa5a8a825c 100644
@@ -33,7 +33,7 @@ void machine_halt(void)
 	console_flush_on_panic(CONSOLE_FLUSH_PENDING);
 
 	while (true) {
-		__arch_cpu_idle();
+		__asm__ __volatile__("idle 0" : : : "memory");
 	}
 }
 

@@ -53,7 +53,7 @@ void machine_power_off(void)
 #endif
 
 	while (true) {
-		__arch_cpu_idle();
+		__asm__ __volatile__("idle 0" : : : "memory");
 	}
 }
 

@@ -74,6 +74,6 @@ void machine_restart(char *command)
 		acpi_reboot();
 
 	while (true) {
-		__arch_cpu_idle();
+		__asm__ __volatile__("idle 0" : : : "memory");
 	}
 }

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yuli Wang <[email protected]>

[ Upstream commit 6287f1a8c16138c2ec750953e35039634018c84a ]

Commit 69e3a6aa6be2 ("LoongArch: Add checksum optimization for 64-bit system") would cause an undefined shift and an out-of-bounds read.

Commit 8bd795fedb84 ("arm64: csum: Fix OoB access in IP checksum code for negative lengths") fixes the same issue on ARM64.

---
 arch/loongarch/lib/csum.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index a5e84b403c3b3..df309ae4045de 100644
@@ -25,7 +25,7 @@ unsigned int __no_sanitize_address do_csum(const unsigned char *buff, int len)
 	const u64 *ptr;
 	u64 data, sum64 = 0;
 
-	if (unlikely(len == 0))
+	if (unlikely(len <= 0))
 		return 0;
 
 	offset = (unsigned long)buff & 7;

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bibo Mao <[email protected]>

[ Upstream commit bdb13252e5d1518823b81f458d9975c85d5240c2 ]

This is typo issue and misusage about GCFG feature macro. The code is wrong, only that it does not cause obvious problem since GCFG is set again on vCPU context switch.

---
 arch/loongarch/kvm/main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 396fed2665a51..034402e0948c9 100644
@@ -285,9 +285,9 @@ int kvm_arch_enable_virtualization_cpu(void)
 	 * TOE=0:       Trap on Exception.
 	 * TIT=0:       Trap on Timer.
 	 */
-	if (env & CSR_GCFG_GCIP_ALL)
+	if (env & CSR_GCFG_GCIP_SECURE)
 		gcfg |= CSR_GCFG_GCI_SECURE;
-	if (env & CSR_GCFG_MATC_ROOT)
+	if (env & CSR_GCFG_MATP_ROOT)
 		gcfg |= CSR_GCFG_MATC_ROOT;
 
 	write_csr_gcfg(gcfg);

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dai Ngo <[email protected]>

commit 036ac2778f7b28885814c6fbc07e156ad1624d03 upstream.

If nfs4_client is in courtesy state then there is no point to send the callback. This causes nfsd4_shutdown_callback to hang since cl_cb_inflight is not 0. This hang lasts about 15 minutes until TCP notifies NFSD that the connection was dropped.

This patch modifies nfsd4_run_cb_work to skip the RPC call if nfs4_client is in courtesy state.

---
 fs/nfsd/nfs4callback.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

@@ -1547,8 +1547,11 @@ nfsd4_run_cb_work(struct work_struct *wo
 		nfsd4_process_cb_update(cb);
 
 	clnt = clp->cl_cb_client;
-	if (!clnt) {
-		/* Callback channel broken, or client killed; give up: */
+	if (!clnt || clp->cl_state == NFSD4_COURTESY) {
+		/*
+		 * Callback channel broken, client killed or
+		 * nfs4_client in courtesy state; give up.
+		 */
 		nfsd41_destroy_cb(cb);
 		return;
 	}

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jeff Layton <[email protected]>

commit b9382e29ca538b879645899ce45d652a304e2ed2 upstream.

nfsd_file_dispose_list_delayed can be called from the filecache laundrette, which is shut down after the nfsd threads are shut down and the nfsd_serv pointer is cleared. If nn->nfsd_serv is NULL then there are no threads to wake.

Ensure that the nn->nfsd_serv pointer is non-NULL before calling svc_wake_up in nfsd_file_dispose_list_delayed. This is safe since the svc_serv is not freed until after the filecache laundrette is cancelled.

---
 fs/nfsd/filecache.c |   11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

@@ -445,11 +445,20 @@ nfsd_file_dispose_list_delayed(struct li
 						struct nfsd_file, nf_gc);
 		struct nfsd_net *nn = net_generic(nf->nf_net, nfsd_net_id);
 		struct nfsd_fcache_disposal *l = nn->fcache_disposal;
+		struct svc_serv *serv;
 
 		spin_lock(&l->lock);
 		list_move_tail(&nf->nf_gc, &l->freeme);
 		spin_unlock(&l->lock);
-		svc_wake_up(nn->nfsd_serv);
+
+		/*
+		 * The filecache laundrette is shut down after the
+		 * nn->nfsd_serv pointer is cleared, but before the
+		 * svc_serv is freed.
+		 */
+		serv = nn->nfsd_serv;
+		if (serv)
+			svc_wake_up(serv);
 	}
 }
 

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Patrick Bellasi <[email protected]>

commit 318e8c339c9a0891c389298bb328ed0762a9935e upstream.

In [1] the meaning of the synthetic IBPB flags has been redefined for a better separation of concerns:
- ENTRY_IBPB -- issue IBPB on entry only
- IBPB_ON_VMEXIT -- issue IBPB on VM-Exit only
and the Retbleed mitigations have been updated to match this new semantics.

Commit [2] was merged shortly before [1], and their interaction was not handled properly. This resulted in IBPB not being triggered on VM-Exit in all SRSO mitigation configs requesting an IBPB there.

Specifically, an IBPB on VM-Exit is triggered only when X86_FEATURE_IBPB_ON_VMEXIT is set. However:

- X86_FEATURE_IBPB_ON_VMEXIT is not set for "spec_rstack_overflow=ibpb", because before [1] having X86_FEATURE_ENTRY_IBPB was enough. Hence, an IBPB is triggered on entry but the expected IBPB on VM-exit is not.

- X86_FEATURE_IBPB_ON_VMEXIT is not set also when "spec_rstack_overflow=ibpb-vmexit" if X86_FEATURE_ENTRY_IBPB is already set.

That's because before [1] this was effectively redundant. Hence, e.g. a "retbleed=ibpb spec_rstack_overflow=bpb-vmexit" config mistakenly reports the machine still vulnerable to SRSO, despite an IBPB being triggered both on entry and VM-Exit, because of the Retbleed selected mitigation config.

- UNTRAIN_RET_VM won't still actually do anything unless CONFIG_MITIGATION_IBPB_ENTRY is set.

For "spec_rstack_overflow=ibpb", enable IBPB on both entry and VM-Exit and clear X86_FEATURE_RSB_VMEXIT which is made superfluous by X86_FEATURE_IBPB_ON_VMEXIT. This effectively makes this mitigation option similar to the one for 'retbleed=ibpb', thus re-order the code for the RETBLEED_MITIGATION_IBPB option to be less confusing by having all features enabling before the disabling of the not needed ones.

For "spec_rstack_overflow=ibpb-vmexit", guard this mitigation setting with CONFIG_MITIGATION_IBPB_ENTRY to ensure UNTRAIN_RET_VM sequence is effectively compiled in. Drop instead the CONFIG_MITIGATION_SRSO guard, since none of the SRSO compile cruft is required in this configuration. Also, check only that the required microcode is present to effectively enabled the IBPB on VM-Exit.

Finally, update the KConfig description for CONFIG_MITIGATION_IBPB_ENTRY to list also all SRSO config settings enabled by this guard.

---
 arch/x86/Kconfig           |    3 ++-
 arch/x86/kernel/cpu/bugs.c |   21 ++++++++++++++-------
 2 files changed, 16 insertions(+), 8 deletions(-)

@@ -2593,7 +2593,8 @@ config MITIGATION_IBPB_ENTRY
 	depends on CPU_SUP_AMD && X86_64
 	default y
 	help
-	  Compile the kernel with support for the retbleed=ibpb mitigation.
+	  Compile the kernel with support for the retbleed=ibpb and
+	  spec_rstack_overflow={ibpb,ibpb-vmexit} mitigations.
 
 config MITIGATION_IBRS_ENTRY
 	bool "Enable IBRS on kernel entry"

@@ -1115,6 +1115,8 @@ do_cmd_auto:
 
 	case RETBLEED_MITIGATION_IBPB:
 		setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB);
+		setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
+		mitigate_smt = true;
 
 		/*
 		 * IBPB on entry already obviates the need for

@@ -1124,9 +1126,6 @@ do_cmd_auto:
 		setup_clear_cpu_cap(X86_FEATURE_UNRET);
 		setup_clear_cpu_cap(X86_FEATURE_RETHUNK);
 
-		setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
-		mitigate_smt = true;
-
 		/*
 		 * There is no need for RSB filling: entry_ibpb() ensures
 		 * all predictions, including the RSB, are invalidated,

@@ -2643,6 +2642,7 @@ static void __init srso_select_mitigatio
 		if (IS_ENABLED(CONFIG_MITIGATION_IBPB_ENTRY)) {
 			if (has_microcode) {
 				setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB);
+				setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
 				srso_mitigation = SRSO_MITIGATION_IBPB;
 
 				/*

@@ -2652,6 +2652,13 @@ static void __init srso_select_mitigatio
 				 */
 				setup_clear_cpu_cap(X86_FEATURE_UNRET);
 				setup_clear_cpu_cap(X86_FEATURE_RETHUNK);
+
+				/*
+				 * There is no need for RSB filling: entry_ibpb() ensures
+				 * all predictions, including the RSB, are invalidated,
+				 * regardless of IBPB implementation.
+				 */
+				setup_clear_cpu_cap(X86_FEATURE_RSB_VMEXIT);
 			}
 		} else {
 			pr_err("WARNING: kernel not compiled with MITIGATION_IBPB_ENTRY.\n");

@@ -2659,8 +2666,8 @@ static void __init srso_select_mitigatio
 		break;
 
 	case SRSO_CMD_IBPB_ON_VMEXIT:
-		if (IS_ENABLED(CONFIG_MITIGATION_SRSO)) {
-			if (!boot_cpu_has(X86_FEATURE_ENTRY_IBPB) && has_microcode) {
+		if (IS_ENABLED(CONFIG_MITIGATION_IBPB_ENTRY)) {
+			if (has_microcode) {
 				setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
 				srso_mitigation = SRSO_MITIGATION_IBPB_ON_VMEXIT;
 

@@ -2672,8 +2679,8 @@ static void __init srso_select_mitigatio
 				setup_clear_cpu_cap(X86_FEATURE_RSB_VMEXIT);
 			}
 		} else {
-			pr_err("WARNING: kernel not compiled with MITIGATION_SRSO.\n");
-                }
+			pr_err("WARNING: kernel not compiled with MITIGATION_IBPB_ENTRY.\n");
+		}
 		break;
 	default:
 		break;

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Shevchenko <[email protected]>

[ Upstream commit 6f36f103cff1737094f2187b1f9a7b312820d377 ]

The range_max is inclusive, so we need to use the number of the last accessible register address.

---
 drivers/pinctrl/pinctrl-cy8c95x0.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

index 0d6c2027d4c18..5c6bcbf6c3377 100644
@@ -1438,15 +1438,15 @@ static int cy8c95x0_probe(struct i2c_client *client)
 	switch (chip->tpin) {
 	case 20:
 		strscpy(chip->name, cy8c95x0_id[0].name);
-		regmap_range_conf.range_max = CY8C95X0_VIRTUAL + 3 * MUXED_STRIDE;
+		regmap_range_conf.range_max = CY8C95X0_VIRTUAL + 3 * MUXED_STRIDE - 1;
 		break;
 	case 40:
 		strscpy(chip->name, cy8c95x0_id[1].name);
-		regmap_range_conf.range_max = CY8C95X0_VIRTUAL + 6 * MUXED_STRIDE;
+		regmap_range_conf.range_max = CY8C95X0_VIRTUAL + 6 * MUXED_STRIDE - 1;
 		break;
 	case 60:
 		strscpy(chip->name, cy8c95x0_id[2].name);
-		regmap_range_conf.range_max = CY8C95X0_VIRTUAL + 8 * MUXED_STRIDE;
+		regmap_range_conf.range_max = CY8C95X0_VIRTUAL + 8 * MUXED_STRIDE - 1;
 		break;
 	default:
 		return -ENODEV;

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Shevchenko <[email protected]>

[ Upstream commit 3fbe3fe28764455e4fc3578afb9765f46f9ce93d ]

The checks for vrtual registers in the cy8c95x0_readable_register() and cy8c95x0_writeable_register() are not aligned and broken.

Fix that by explicitly avoiding reserved registers to be accessed.

---
 drivers/pinctrl/pinctrl-cy8c95x0.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

index 5c6bcbf6c3377..c787a9aadfdfb 100644
@@ -328,14 +328,14 @@ static int cypress_get_pin_mask(struct cy8c95x0_pinctrl *chip, unsigned int pin)
 static bool cy8c95x0_readable_register(struct device *dev, unsigned int reg)
 {
 	/*
-	 * Only 12 registers are present per port (see Table 6 in the
-	 * datasheet).
+	 * Only 12 registers are present per port (see Table 6 in the datasheet).
 	 */
-	if (reg >= CY8C95X0_VIRTUAL && (reg % MUXED_STRIDE) < 12)
-		return true;
+	if (reg >= CY8C95X0_VIRTUAL && (reg % MUXED_STRIDE) >= 12)
+		return false;
 
 	switch (reg) {
 	case 0x24 ... 0x27:
+	case 0x31 ... 0x3f:
 		return false;
 	default:
 		return true;

@@ -344,8 +344,11 @@ static bool cy8c95x0_readable_register(struct device *dev, unsigned int reg)
 
 static bool cy8c95x0_writeable_register(struct device *dev, unsigned int reg)
 {
-	if (reg >= CY8C95X0_VIRTUAL)
-		return true;
+	/*
+	 * Only 12 registers are present per port (see Table 6 in the datasheet).
+	 */
+	if (reg >= CY8C95X0_VIRTUAL && (reg % MUXED_STRIDE) >= 12)
+		return false;
 
 	switch (reg) {
 	case CY8C95X0_INPUT_(0) ... CY8C95X0_INPUT_(7):

@@ -353,6 +356,7 @@ static bool cy8c95x0_writeable_register(struct device *dev, unsigned int reg)
 	case CY8C95X0_DEVID:
 		return false;
 	case 0x24 ... 0x27:
+	case 0x31 ... 0x3f:
 		return false;
 	default:
 		return true;

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Shevchenko <[email protected]>

[ Upstream commit aac4470fa6e695e4d6ac94cc77d4690b57f1d2bc ]

When regmap locking is disabled, debugfs is also disabled. Enable locking for debug when CONFIG_DEBUG_PINCTRL is set.

---
 drivers/pinctrl/pinctrl-cy8c95x0.c | 4 ++++
 1 file changed, 4 insertions(+)

index c787a9aadfdfb..bfa16f70e29ce 100644
@@ -470,7 +470,11 @@ static const struct regmap_config cy8c9520_i2c_regmap = {
 	.max_register = 0,		/* Updated at runtime */
 	.num_reg_defaults_raw = 0,	/* Updated at runtime */
 	.use_single_read = true,	/* Workaround for regcache bug */
+#if IS_ENABLED(CONFIG_DEBUG_PINCTRL)
+	.disable_locking = false,
+#else
 	.disable_locking = true,
+#endif
 };
 
 static inline int cy8c95x0_regmap_update_bits_base(struct cy8c95x0_pinctrl *chip,

2.39.5

This is the start of the stable review cycle for the 6.13.4 release. There are 274 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Fri, 21 Feb 2025 08:25:11 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.13.4-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.13.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.13.4-rc1

Greg Kroah-Hartman <[email protected]>
Revert "vfio/platform: check the bounds of read/write syscalls"

Michal Luczaj <[email protected]>
vsock: Orphan socket after transport release

Michal Luczaj <[email protected]>
vsock: Keep the binding until socket destruction

Pavel Begunkov <[email protected]>
io_uring/kbuf: reallocate buf lists on upgrade

Tejun Heo <[email protected]>
sched_ext: Fix incorrect assumption about migration disabled tasks in task_can_run_on_remote_rq()

Avri Altman <[email protected]>
scsi: ufs: core: Ensure clk_gating.lock is used only after initialization

Jakub Kicinski <[email protected]>
net: ipv6: fix dst refleaks in rpl, seg6 and ioam6 lwtunnels

Dhananjay Ugwekar <[email protected]>
cpufreq/amd-pstate: Remove the goto label in amd_pstate_update_limits

Eric Dumazet <[email protected]>

    net: destroy dev->lock later in free_netdev()

Juri Lelli <[email protected]>
sched/deadline: Check bandwidth overflow earlier for hotplug

Juri Lelli <[email protected]>
sched/deadline: Correctly account for allocated bandwidth during hotplug

Juri Lelli <[email protected]>
sched/deadline: Restore dl_server bandwidth on non-destructive root domain changes

Chris Brandt <[email protected]>
drm: renesas: rz-du: Increase supported resolutions

Thomas Hellström <[email protected]>
drm/xe/tracing: Fix a potential TP_printk UAF

Karol Przybylski <[email protected]>
drm: zynqmp_dp: Fix integer overflow in zynqmp_dp_rate_get()

Christian Gmeiner <[email protected]>
drm/v3d: Stop active perfmon if it is being destroyed

Dmitry Baryshkov <[email protected]>
drm/msm/dpu1: don't choke on disabling the writeback connector

Stephan Gerhold <[email protected]>
drm/msm/dpu: fix x1e80100 intf_6 underrun/vsync interrupt

Tomi Valkeinen <[email protected]>
drm/rcar-du: dsi: Fix PHY lock bit check

Dan Carpenter <[email protected]>
drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()

Devarsh Thakkar <[email protected]>
drm/tidss: Clear the interrupt status for interrupts being disabled

Devarsh Thakkar <[email protected]>
drm/tidss: Fix race condition while handling interrupt registers

Tomi Valkeinen <[email protected]>
drm/tidss: Fix issue in irq handling causing irq-flood issue

Jens Axboe <[email protected]>
io_uring/uring_cmd: unconditionally copy SQEs at prep time

Jakub Kicinski <[email protected]>
Reapply "net: skb: introduce and use a single page frag cache"

Alexandra Winter <[email protected]>
s390/qeth: move netif_napi_add_tx() and napi_enable() from under BH

Eric Dumazet <[email protected]>
ipv6: mcast: add RCU protection to mld_newpack()

Caleb Sander Mateos <[email protected]>
io_uring/uring_cmd: switch sqe to async_data on EAGAIN

Caleb Sander Mateos <[email protected]>
io_uring/uring_cmd: don't assume io_uring_cmd_data layout

Jens Axboe <[email protected]>
io_uring/uring_cmd: cleanup struct io_uring_cmd_data layout

Bart Van Assche <[email protected]>
iavf: Fix a locking bug in an error path

Filipe Manana <[email protected]>
btrfs: fix stale page cache after race between readahead and direct IO write

David Sterba <[email protected]>
btrfs: rename __get_extent_map() and pass btrfs_inode

Eric Dumazet <[email protected]>
ipv6: mcast: extend RCU protection in igmp6_send()

Eric Dumazet <[email protected]>
ndisc: extend RCU protection in ndisc_send_skb()

Eric Dumazet <[email protected]>
openvswitch: use RCU protection in ovs_vport_cmd_fill_info()

Eric Dumazet <[email protected]>
arp: use RCU protection in arp_xmit()

Eric Dumazet <[email protected]>
neighbour: use RCU protection in __neigh_notify()

Eric Dumazet <[email protected]>
ndisc: use RCU protection in ndisc_alloc_skb()

Paolo Abeni <[email protected]>
Revert "net: skb: introduce and use a single page frag cache"

Jakub Kicinski <[email protected]>

    net: protect netdev->napi_list with netdev_lock()

Jakub Kicinski <[email protected]>

    net: add netdev->up protected by netdev_lock()

Jakub Kicinski <[email protected]>

    net: make netdev_lock() protect netdev->reg_state

Jakub Kicinski <[email protected]>
net: add netdev_lock() / netdev_unlock() helpers

Jakub Kicinski <[email protected]>
eth: iavf: extend the netdev_lock usage

Jakub Kicinski <[email protected]>

    net: make sure we retain NAPI ordering on netdev->napi_list

Vicki Pfau <[email protected]>
HID: hid-steam: Move hidraw input (un)registering to work

Vicki Pfau <[email protected]>
HID: hid-steam: Make sure rumble work is canceled on removal

Geert Uytterhoeven <[email protected]>
genirq: Remove leading space from irq_chip::irq_print_chip() callbacks

Kees Cook <[email protected]>
compiler.h: Move C string helpers into C-only kernel section

Eric Dumazet <[email protected]>
ipv6: icmp: convert to dev_net_rcu()

Eric Dumazet <[email protected]>
ipv6: use RCU protection in ip6_default_advmss()

Eric Dumazet <[email protected]>
flow_dissector: use RCU protection to fetch dev_net()

Eric Dumazet <[email protected]>
ipv4: icmp: convert to dev_net_rcu()

Eric Dumazet <[email protected]>
ipv4: use RCU protection in __ip_rt_update_pmtu()

Eric Dumazet <[email protected]>
ipv4: use RCU protection in inet_select_addr()

Eric Dumazet <[email protected]>
ipv4: use RCU protection in rt_is_expired()

Eric Dumazet <[email protected]>
ipv4: use RCU protection in ipv4_default_advmss()

Eric Dumazet <[email protected]>
net: add dev_net_rcu() helper

Eric Dumazet <[email protected]>
ipv4: use RCU protection in ip_dst_mtu_maybe_forward()

Eric Dumazet <[email protected]>
ipv4: add RCU protection to ip4_dst_hoplimit()

Dhananjay Ugwekar <[email protected]>
cpufreq/amd-pstate: Fix cpufreq_policy ref counting

Mario Limonciello <[email protected]>
cpufreq/amd-pstate: convert mutex use to guard()

Dhananjay Ugwekar <[email protected]>
cpufreq/amd-pstate: Merge amd_pstate_epp_cpu_offline() and amd_pstate_epp_offline()

Dhananjay Ugwekar <[email protected]>
cpufreq/amd-pstate: Remove the cppc_state check in offline/online functions

Dhananjay Ugwekar <[email protected]>
cpufreq/amd-pstate: Refactor amd_pstate_epp_reenable() and amd_pstate_epp_offline()

Justin M. Forbes <[email protected]>
rust: kbuild: add -fzero-init-padding-bits to bindgen_skip_cflags

Jinghao Jia <[email protected]>
samples/hid: fix broken vmlinux path for VMLINUX_BTF

Jinghao Jia <[email protected]>
samples/hid: remove unnecessary -I flags from libbpf EXTRA_CFLAGS

Avri Altman <[email protected]>
scsi: ufs: Fix toggling of clk_gating.state when clock gating is not allowed

Avri Altman <[email protected]>
scsi: ufs: core: Introduce a new clock_gating lock

Avri Altman <[email protected]>
scsi: ufs: core: Prepare to introduce a new clock_gating lock

Avri Altman <[email protected]>
scsi: ufs: core: Introduce ufshcd_has_pending_tasks()

Ashutosh Dixit <[email protected]>

    drm/xe/oa: Set stream->pollin in xe_oa_buffer_check_unlocked

Ashutosh Dixit <[email protected]>
drm/xe/oa/uapi: Expose an unblock after N reports OA property

Sai Teja Pottumuttu <[email protected]>
drm/xe/oa/uapi: Make OA buffer size configurable

Waiman Long <[email protected]>
clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context

Waiman Long <[email protected]>
clocksource: Use pr_info() for "Checking clocksource synchronization" message

Jakub Kicinski <[email protected]>
net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels

Justin Iurman <[email protected]>
net: ipv6: rpl_iptunnel: mitigate 2-realloc issue

Justin Iurman <[email protected]>
net: ipv6: seg6_iptunnel: mitigate 2-realloc issue

Justin Iurman <[email protected]>
net: ipv6: ioam6_iptunnel: mitigate 2-realloc issue

Justin Iurman <[email protected]>
include: net: add static inline dst_dev_overhead() to dst.h

Filipe Manana <[email protected]>
btrfs: fix hole expansion when writing at an offset beyond EOF

Wentao Liang <[email protected]>
mlxsw: Add return value check for mlxsw_sp_port_get_stats_raw()

Oliver Upton <[email protected]>
ACPI: GTDT: Relax sanity checking on Platform Timers array count

Shyam Prasad N <[email protected]>
cifs: pick channels for individual subrequests

Song Yoong Siang <[email protected]>
igc: Set buffer type for empty frames in igc_init_empty_frame

Thomas Weißschuh <[email protected]>
ptp: vmclock: Set driver data before its usage

Tejun Heo <[email protected]>
sched_ext: Fix migration disabled handling in targeted dispatches

David Woodhouse <[email protected]>
ptp: vmclock: Add .owner to vmclock_miscdev_fops

Andy-ld Lu <[email protected]>
mmc: mtk-sd: Fix register settings for hs400(es) mode

Thomas Weißschuh <[email protected]>
ptp: vmclock: Don't unregister misc device if it was not registered

Nathan Chancellor <[email protected]>
arm64: Handle .ARM.attributes section in linker scripts

Jiasheng Jiang <[email protected]>
regmap-irq: Add missing kfree()

Lu Baolu <[email protected]>
iommu: Fix potential memory leak in iopf_queue_remove_device()

Josua Mayer <[email protected]>
Revert "mmc: sdhci_am654: Add sdhci_am654_start_signal_voltage_switch"

Varadarajan Narayanan <[email protected]>
regulator: qcom_smd: Add l2, l5 sub-node to mp5496 regulator

Tejun Heo <[email protected]>
sched_ext: Fix incorrect autogroup migration detection

Lu Baolu <[email protected]>
iommu/vt-d: Make intel_iommu_drain_pasid_prq() cover faults for RID

Jann Horn <[email protected]>
partitions: mac: fix handling of bogus partition table

Wentao Liang <[email protected]>
gpio: stmpe: Check return value of stmpe_reg_read in stmpe_gpio_irq_sync_unlock

Mario Limonciello <[email protected]>
gpiolib: acpi: Add a quirk for Acer Nitro ANV14

Niklas Schnelle <[email protected]>
s390/pci: Fix handling of isolated VFs

Niklas Schnelle <[email protected]>
s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn()

Ivan Kokshaysky <[email protected]>
alpha: align stack for page fault and user unaligned trap handlers

Ivan Kokshaysky <[email protected]>
alpha: replace hardcoded stack offsets with autogenerated ones

John Keeping <[email protected]>
serial: 8250: Fix fifo underflow on flush

Andy Shevchenko <[email protected]>

    serial: port: Always update ->iotype in __uart_read_properties()

Andy Shevchenko <[email protected]>

    serial: port: Assign ->iotype correctly when ->iobase is set

Nicolas Dichtel <[email protected]>
rtnetlink: fix netns leak with rtnl_setlink()

Shakeel Butt <[email protected]>
cgroup: fix race between fork and cgroup.kill

Miguel Ojeda <[email protected]>
rust: rbtree: fix overindented list item

Miguel Ojeda <[email protected]>
objtool/rust: add one more noreturn Rust function

Miguel Ojeda <[email protected]>
arm64: rust: clean Rust 1.85.0 warning using softfloat target

Ard Biesheuvel <[email protected]>
efi: Avoid cold plugged memory for placing the kernel

Thomas Weißschuh <[email protected]>
kbuild: userprogs: fix bitsize and target detection on clang

Bjorn Helgaas <[email protected]>
PCI: Avoid FLR for Mediatek MT7922 WiFi

Aditya Kumar Singh <[email protected]>
wifi: ath12k: fix handling of 6 GHz rules

Aditya Garg <[email protected]>
wifi: brcmfmac: use random seed flag for BCM4355 and BCM4364 firmware

Ivan Kokshaysky <[email protected]>
alpha: make stack 16-byte aligned (most cases)

Vincent Mailhol <[email protected]>

    can: etas_es58x: fix potential NULL pointer dereference on udev->serial

Robin van der Gracht <[email protected]>
can: rockchip: rkcanfd_handle_rx_fifo_overflow_int(): bail out if skb cannot be allocated

Alexander Hölzl <[email protected]>
can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero

Krzysztof Kozlowski <[email protected]>
can: c_can: fix unbalanced runtime PM disable in error path

Fedor Pchelkin <[email protected]>
can: ctucanfd: handle skb allocation failure

Johan Hovold <[email protected]>
USB: serial: option: drop MeiG Smart defines

Fabio Porcedda <[email protected]>
USB: serial: option: fix Telit Cinterion FN990A name

Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FN990B compositions

Chester A. Unal <[email protected]>
USB: serial: option: add MeiG Smart SLM828

Roy Luo <[email protected]>
usb: gadget: core: flush gadget workqueue after device removal

Jann Horn <[email protected]>
usb: cdc-acm: Fix handling of oversized fragments

Jann Horn <[email protected]>
usb: cdc-acm: Check control transfer buffer size before access

Marek Vasut <[email protected]>
USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk

Alan Stern <[email protected]>
USB: hub: Ignore non-compliant devices with too many configs or interfaces

John Keeping <[email protected]>
usb: gadget: f_midi: fix MIDI Streaming descriptor lengths

Mathias Nyman <[email protected]>
USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone

Lei Huang <[email protected]>
USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist

Stefan Eichenberger <[email protected]>
usb: core: fix pipe creation for get_bMaxPacketSize0

Huacai Chen <[email protected]>
USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI

Michal Pecio <[email protected]>
usb: xhci: Restore xhci_pci support for Renesas HCs

Fabrice Gasnier <[email protected]>
usb: dwc2: gadget: remove of_node reference upon udc_stop

Guo Ren <[email protected]>
usb: gadget: udc: renesas_usb3: Fix compiler warning

Jos Wang <[email protected]>
usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY

Elson Roy Serrao <[email protected]>
usb: roles: set switch registered flag early on

Selvarasu Ganesan <[email protected]>
usb: dwc3: Fix timeout issue during controller enter/exit from halt state

Selvarasu Ganesan <[email protected]>
usb: gadget: f_midi: Fixing wMaxPacketSize exceeded issue during MIDI bind retries

Steven Rostedt <[email protected]>
ring-buffer: Update pages_touched to reflect persistent buffer content

Steven Rostedt <[email protected]>
ring-buffer: Validate the persistent meta data subbuf array

Steven Rostedt <[email protected]>
tracing: Do not allow mmap() of persistent ring buffer

Steven Rostedt <[email protected]>
ring-buffer: Unlock resize on mmap error

Sean Christopherson <[email protected]>
perf/x86/intel: Ensure LBRs are disabled when a CPU is starting

Kan Liang <[email protected]>
perf/x86/intel: Fix ARCH_PERFMON_NUM_COUNTER_LEAF

Sean Christopherson <[email protected]>
KVM: nSVM: Enter guest mode before initializing nested NPT MMU

Sean Christopherson <[email protected]>
KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop

Sean Christopherson <[email protected]>
KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel

Jiang Liu <[email protected]>
drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()

Alex Deucher <[email protected]>
drm/amdgpu: bump version for RV/PCO compute fix

Alex Deucher <[email protected]>
drm/amdgpu/gfx9: manually control gfxoff for CS on RV

Nirmoy Das <[email protected]>
drm/xe: Carve out wopcm portion from the stolen memory

Remi Pommarel <[email protected]>
batman-adv: Fix incorrect offset in batadv_tt_tvlv_ogm_handler_v1()

Sven Eckelmann <[email protected]>
batman-adv: Drop unmanaged ELP metric worker

Sven Eckelmann <[email protected]>
batman-adv: Ignore neighbor throughput metrics in error case

Andy Strohman <[email protected]>
batman-adv: fix panic during interface removal

Kees Cook <[email protected]>
kbuild: Use -fzero-init-padding-bits=all

Geert Uytterhoeven <[email protected]>
ASoC: renesas: SND_SIU_MIGOR should depend on DMADEVICES

Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V

Masahiro Yamada <[email protected]>
kbuild: suppress stdout from merge_config for silent builds

Mike Marshall <[email protected]>
orangefs: fix a oob in orangefs_debug_write

Rik van Riel <[email protected]>
x86/mm/tlb: Only trim the mm_cpumask once a second

Hans de Goede <[email protected]>
ACPI: x86: Add skip i2c clients quirk for Vexia EDU ATLA 10 tablet 5V

Koichiro Den <[email protected]>
selftests: gpio: gpio-sim: Fix missing chip disablements

Maksym Planeta <[email protected]>
Grab mm lock before grabbing pt lock

Konstantin Komarov <[email protected]>
fs/ntfs3: Unify inode corruption marking with _ntfs_bad_inode()

Konstantin Komarov <[email protected]>
fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()

Ankit Agrawal <[email protected]>
vfio/nvgrace-gpu: Expose the blackwell device PF BAR1 to the VM

Ankit Agrawal <[email protected]>
vfio/nvgrace-gpu: Read dvsec register to determine need for uncached resmem

Zichen Xie <[email protected]>
NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()

Ramesh Thomas <[email protected]>
vfio/pci: Enable iowrite64 and ioread64 for vfio pci

Brian Norris <[email protected]>
kunit: platform: Resolve 'struct completion' warning

Rengarajan S <[email protected]>
8250: microchip: pci1xxxx: Add workaround for RTS bit toggle

Andy Shevchenko <[email protected]>
serial: 8250_pci: Share WCH IDs with parport_serial driver

Andy Shevchenko <[email protected]>
serial: 8250_pci: Resolve WCH vendor ID ambiguity

Tomas Glozar <[email protected]>
rtla/timerlat_top: Abort event processing on second signal

Tomas Glozar <[email protected]>
rtla/timerlat_hist: Abort event processing on second signal

Guixin Liu <[email protected]>
scsi: ufs: bsg: Set bsg_queue to NULL after removal

Rakesh Babu Saladi <[email protected]>
PCI: switchtec: Add Microchip PCI100X device IDs

Takashi Iwai <[email protected]>
PCI/DPC: Quirk PIO log size for Intel Raptor Lake-P

Lorenzo Bianconi <[email protected]>
PCI: mediatek-gen3: Avoid PCIe resetting via PERST# for Airoha EN7581 SoC

Naman Jain <[email protected]>
Drivers: hv: vmbus: Wait for boot-time offers during boot and resume

Edward Adam Davis <[email protected]>
media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread

Isaac Scott <[email protected]>
media: uvcvideo: Add Kurokesu C1 PRO camera

Isaac Scott <[email protected]>
media: uvcvideo: Add new quirk definition for the Sonix Technology Co. 292a camera

Isaac Scott <[email protected]>
media: uvcvideo: Implement dual stream quirk to fix loss of usb packets

Naushir Patuck <[email protected]>
media: bcm2835-unicam: Disable trigger mode operation

Tomi Valkeinen <[email protected]>
media: i2c: ds90ub953: Add error handling for i2c reads/writes

Tomi Valkeinen <[email protected]>

    media: i2c: ds90ub913: Add error handling to ub913_hw_init()

Niklas Cassel <[email protected]>
PCI: endpoint: Add size check for fixed size BARs in pci_epc_set_bar()

Arnd Bergmann <[email protected]>
media: cxd2841er: fix 64-bit division on gcc-9

Jarkko Nikula <[email protected]>
i3c: mipi-i3c-hci: Add support for MIPI I3C HCI on PCI bus

Jarkko Nikula <[email protected]>
i3c: mipi-i3c-hci: Add Intel specific quirk to ring resuming

Kartik Rajput <[email protected]>
soc/tegra: fuse: Update Tegra234 nvmem keepout list

Aaro Koskinen <[email protected]>
fbdev: omap: use threaded IRQ for LCD DMA

Varadarajan Narayanan <[email protected]>
soc: qcom: llcc: Update configuration data for IPQ5424

Krzysztof Kozlowski <[email protected]>
firmware: qcom: scm: smc: Handle missing SCM device

Michael Margolin <[email protected]>
RDMA/efa: Reset device on probe failure

Masahiro Yamada <[email protected]>
tools: fix annoying "mkdir -p ..." logs when building tools in parallel

Vasant Hegde <[email protected]>
iommu/amd: Expicitly enable CNTRL.EPHEn bit in resume path

Andy Shevchenko <[email protected]>
gpiolib: Fix crash on error in gpiochip_get_ngpios()

Chuyi Zhou <[email protected]>
sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx

Chuyi Zhou <[email protected]>
sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h.

Jens Axboe <[email protected]>
block: cleanup and fix batch completion adding conditions

Juergen Gross <[email protected]>
x86/xen: allow larger contiguous memory regions in PV guests

Juergen Gross <[email protected]>
xen/swiotlb: relax alignment requirements

Imre Deak <[email protected]>
drm: Fix DSC BPP increment decoding

Jiang Liu <[email protected]>
drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode()

Zhu Lingshan <[email protected]>
amdkfd: properly free gang_ctx_bo when failed to init user queue

Benjamin Berg <[email protected]>
um: fix execve stub execution on old host OSs

Benjamin Berg <[email protected]>
um: properly align signal stack on x86_64

Benjamin Berg <[email protected]>
um: avoid copying FP state from init_task

Benjamin Berg <[email protected]>
um: add back support for FXSAVE registers

Jens Axboe <[email protected]>
io_uring/uring_cmd: remove dead req_has_async_data() check

Pavel Begunkov <[email protected]>
io_uring/waitid: don't abuse io_tw_state

Zhang Rui <[email protected]>
thermal/netlink: Prevent userspace segmentation fault by adjusting UAPI header

Artur Weber <[email protected]>
gpio: bcm-kona: Add missing newline to dev_err format string

Artur Weber <[email protected]>
gpio: bcm-kona: Make sure GPIO bits are unlocked when requesting IRQ

Artur Weber <[email protected]>
gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0

Krzysztof Karas <[email protected]>
drm/i915/selftests: avoid using uninitialized context

Tejas Upadhyay <[email protected]>

    drm/xe/client: bo->client does not need bos_lock

Kan Liang <[email protected]>
perf/x86/intel: Clean up PEBS-via-PT on hybrid

Muhammad Adeel <[email protected]>
cgroup: Remove steal time from usage_usec

Su Hui <[email protected]>
drm/panthor: avoid garbage value in panthor_ioctl_dev_query()

Rupinderjit Singh <[email protected]>
gpu: host1x: Fix a use of uninitialized mutex

Radu Rendec <[email protected]>
arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array

Maxime Ripard <[email protected]>
drm/tests: hdmi: Fix WW_MUTEX_SLOWPATH failures

Andrea Righi <[email protected]>
sched_ext: Fix lock imbalance in dispatch_to_local_dsq()

Lai Jiangshan <[email protected]>
workqueue: Put the pwq after detaching the rescuer from the pool

Eric Dumazet <[email protected]>
team: better TEAM_OPTION_TYPE_STRING validation

Kiran K <[email protected]>
Bluetooth: btintel_pcie: Fix a potential race condition

Roger Quadros <[email protected]>
net: ethernet: ti: am65_cpsw: fix tx_cleanup for XDP case

Roger Quadros <[email protected]>
net: ethernet: ti: am65-cpsw: fix RX & TX statistics for XDP_TX case

Roger Quadros <[email protected]>
net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases

Bibo Mao <[email protected]>
LoongArch: KVM: Fix typo issue about GCFG feature detection

Yuli Wang <[email protected]>
LoongArch: csum: Fix OoB access in IP checksum code for negative lengths

Marco Crivellari <[email protected]>
LoongArch: Fix idle VS timer enqueue

Eric Dumazet <[email protected]>
vxlan: check vxlan_vnigroup_init() return value

Zdenek Bouska <[email protected]>
igc: Fix HW RX timestamp when passed by ZC XDP

Joshua Hay <[email protected]>
idpf: call set_real_num_queues in idpf_open

Sridhar Samudrala <[email protected]>
idpf: record rx queue in skb for RSC packets

Sridhar Samudrala <[email protected]>
idpf: fix handling rsc packet with a single segment

Jerome Brunet <[email protected]>
regulator: core: let dt properties override driver init_data

Eric Dumazet <[email protected]>
vrf: use RCU protection in l3mdev_l3_out()

Eric Dumazet <[email protected]>
ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()

Reyders Morales <[email protected]>
Documentation/networking: fix basic node example document ISO 15765-2

Eric Dumazet <[email protected]>

    net: fib_rules: annotate data-races around rule->[io]ifindex

Murad Masimov <[email protected]>
ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt

Kunihiko Hayashi <[email protected]>
spi: sn-f-ospi: Fix division by zero

Vicki Pfau <[email protected]>
HID: hid-steam: Don't use cancel_delayed_work_sync in IRQ context

Tulio Fernandes <[email protected]>
HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints()

Claudiu Beznea <[email protected]>
pinctrl: pinconf-generic: Print unsigned value if a format is registered

Nathan Chancellor <[email protected]>
scripts/Makefile.extrawarn: Do not show clang's non-kprintf warnings at W=1

Charles Han <[email protected]>
HID: multitouch: Add NULL check in mt_input_configured

Charles Han <[email protected]>
HID: winwing: Add NULL check in winwing_init_led()

Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: Respect IRQ trigger settings from firmware

Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: Rename PWMSEL to SELPWM

Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: Enable regmap locking for debug

Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: Avoid accessing reserved registers

Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: Fix off-by-one in the regmap range settings

Patrick Bellasi <[email protected]>
x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit

Jeff Layton <[email protected]>
nfsd: validate the nfsd_serv pointer before calling svc_wake_up

Dai Ngo <[email protected]>
NFSD: fix hang in nfsd4_shutdown_callback

Li Lingfeng <[email protected]>
nfsd: clear acl_access/acl_default after releasing them

Stuart Hayhurst <[email protected]>
HID: corsair-void: Add missing delayed work cancel for headset status

Stuart Hayhurst <[email protected]>
HID: corsair-void: Initialise memory for psy_cfg

-------------

Diffstat:

 .../bindings/regulator/qcom,smd-rpm-regulator.yaml |   2 +-
 Documentation/networking/iso15765-2.rst            |   4 +-
 Makefile                                           |  17 +--
 arch/alpha/include/uapi/asm/ptrace.h               |   2 +
 arch/alpha/kernel/asm-offsets.c                    |   4 +
 arch/alpha/kernel/entry.S                          |  24 ++--
 arch/alpha/kernel/traps.c                          |   2 +-
 arch/alpha/mm/fault.c                              |   4 +-
 arch/arm64/Makefile                                |   4 +
 arch/arm64/kernel/cacheinfo.c                      |  12 +-
 arch/arm64/kernel/vdso/vdso.lds.S                  |   1 +
 arch/arm64/kernel/vmlinux.lds.S                    |   1 +
 arch/loongarch/kernel/genex.S                      |  28 ++--
 arch/loongarch/kernel/idle.c                       |   3 +-
 arch/loongarch/kernel/reset.c                      |   6 +-
 arch/loongarch/kvm/main.c                          |   4 +-
 arch/loongarch/lib/csum.c                          |   2 +-
 arch/powerpc/sysdev/fsl_msi.c                      |   2 +-
 arch/s390/pci/pci_bus.c                            |  20 +++
 arch/s390/pci/pci_iov.c                            |  56 ++++++--
 arch/s390/pci/pci_iov.h                            |   7 +
 arch/um/kernel/process.c                           |  10 +-
 arch/um/os-Linux/skas/process.c                    |  16 ++-
 arch/x86/Kconfig                                   |   3 +-
 arch/x86/events/intel/core.c                       |  33 ++---
 arch/x86/events/intel/ds.c                         |  10 +-
 arch/x86/include/asm/kvm-x86-ops.h                 |   1 +
 arch/x86/include/asm/kvm_host.h                    |   1 +
 arch/x86/include/asm/mmu.h                         |   2 +
 arch/x86/include/asm/mmu_context.h                 |   1 +
 arch/x86/include/asm/msr-index.h                   |   3 +-
 arch/x86/include/asm/perf_event.h                  |  28 +++-
 arch/x86/include/asm/tlbflush.h                    |   1 +
 arch/x86/kernel/cpu/bugs.c                         |  21 ++-
 arch/x86/kvm/hyperv.c                              |   6 +-
 arch/x86/kvm/mmu/mmu.c                             |   2 +-
 arch/x86/kvm/svm/nested.c                          |  10 +-
 arch/x86/kvm/svm/svm.c                             |  13 +-
 arch/x86/kvm/vmx/main.c                            |   1 +
 arch/x86/kvm/vmx/vmx.c                             |  10 +-
 arch/x86/kvm/vmx/x86_ops.h                         |   1 +
 arch/x86/kvm/x86.c                                 |   3 +
 arch/x86/mm/tlb.c                                  |  35 ++++-
 arch/x86/um/os-Linux/registers.c                   |  21 ++-
 arch/x86/um/signal.c                               |  13 +-
 arch/x86/xen/mmu_pv.c                              |  75 +++++++++--
 block/partitions/mac.c                             |  18 ++-
 drivers/acpi/arm64/gtdt.c                          |  12 +-
 drivers/acpi/x86/utils.c                           |  13 ++
 drivers/base/regmap/regmap-irq.c                   |   2 +
 drivers/bluetooth/btintel_pcie.c                   |   5 +-
 drivers/bus/moxtet.c                               |   2 +-
 drivers/cpufreq/amd-pstate.c                       | 107 +++++----------
 drivers/firmware/efi/efi.c                         |   6 +-
 drivers/firmware/efi/libstub/randomalloc.c         |   3 +
 drivers/firmware/efi/libstub/relocate.c            |   3 +
 drivers/firmware/qcom/qcom_scm-smc.c               |   3 +
 drivers/gpio/gpio-bcm-kona.c                       |  71 ++++++++--
 drivers/gpio/gpio-stmpe.c                          |  15 ++-
 drivers/gpio/gpiolib-acpi.c                        |  14 ++
 drivers/gpio/gpiolib.c                             |   6 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c            |   3 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c            |   5 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c              |  36 ++++-
 .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c |   2 +-
 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c          |   3 +-
 drivers/gpu/drm/display/drm_dp_helper.c            |   2 +-
 drivers/gpu/drm/i915/selftests/i915_gem_gtt.c      |   4 +-
 .../drm/msm/disp/dpu1/catalog/dpu_9_2_x1e80100.h   |   4 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c      |   3 -
 drivers/gpu/drm/msm/msm_gem_submit.c               |   3 +-
 drivers/gpu/drm/panthor/panthor_drv.c              |   1 +
 drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c    |   2 +-
 .../gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h   |   1 -
 drivers/gpu/drm/renesas/rz-du/rzg2l_du_kms.c       |   6 +-
 drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c |   7 +
 drivers/gpu/drm/tidss/tidss_dispc.c                |  26 ++--
 drivers/gpu/drm/tidss/tidss_irq.c                  |   2 +
 drivers/gpu/drm/v3d/v3d_perfmon.c                  |   5 +
 drivers/gpu/drm/xe/regs/xe_oa_regs.h               |   9 +-
 drivers/gpu/drm/xe/xe_drm_client.c                 |   2 +-
 drivers/gpu/drm/xe/xe_oa.c                         |  92 ++++++++++---
 drivers/gpu/drm/xe/xe_oa_types.h                   |   5 +-
 drivers/gpu/drm/xe/xe_query.c                      |   4 +-
 drivers/gpu/drm/xe/xe_trace_bo.h                   |  12 +-
 drivers/gpu/drm/xe/xe_ttm_stolen_mgr.c             |  70 +++++-----
 drivers/gpu/drm/xlnx/zynqmp_dp.c                   |   2 +-
 drivers/gpu/host1x/dev.c                           |   2 +
 drivers/gpu/host1x/intr.c                          |   2 -
 drivers/hid/hid-corsair-void.c                     |   3 +-
 drivers/hid/hid-multitouch.c                       |   5 +-
 drivers/hid/hid-steam.c                            |  41 ++++--
 drivers/hid/hid-thrustmaster.c                     |   2 +-
 drivers/hid/hid-winwing.c                          |   2 +
 drivers/hv/channel_mgmt.c                          |  61 ++++++---
 drivers/hv/connection.c                            |   4 +-
 drivers/hv/hyperv_vmbus.h                          |  14 +-
 drivers/hv/vmbus_drv.c                             |  16 ---
 drivers/i3c/master/Kconfig                         |  11 ++
 drivers/i3c/master/mipi-i3c-hci/Makefile           |   1 +
 drivers/i3c/master/mipi-i3c-hci/dma.c              |  17 +++
 drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c | 148 +++++++++++++++++++++
 drivers/infiniband/hw/efa/efa_main.c               |   9 +-
 drivers/iommu/amd/amd_iommu_types.h                |   1 +
 drivers/iommu/amd/init.c                           |   4 +
 drivers/iommu/intel/prq.c                          |   4 +-
 drivers/iommu/io-pgfault.c                         |   1 +
 drivers/irqchip/irq-partition-percpu.c             |   2 +-
 drivers/media/dvb-frontends/cxd2841er.c            |   8 +-
 drivers/media/i2c/ds90ub913.c                      |  25 +++-
 drivers/media/i2c/ds90ub953.c                      |  46 +++++--
 drivers/media/platform/broadcom/bcm2835-unicam.c   |   8 +-
 drivers/media/test-drivers/vidtv/vidtv_bridge.c    |   8 +-
 drivers/media/usb/uvc/uvc_driver.c                 |  18 +++
 drivers/media/usb/uvc/uvc_video.c                  |  27 +++-
 drivers/media/usb/uvc/uvcvideo.h                   |   1 +
 drivers/mmc/host/mtk-sd.c                          |  31 +++--
 drivers/mmc/host/sdhci_am654.c                     |  30 -----
 drivers/net/can/c_can/c_can_platform.c             |   5 +-
 drivers/net/can/ctucanfd/ctucanfd_base.c           |  10 +-
 drivers/net/can/rockchip/rockchip_canfd-core.c     |   2 +-
 drivers/net/can/usb/etas_es58x/es58x_devlink.c     |   6 +-
 drivers/net/ethernet/intel/iavf/iavf_main.c        |  75 ++++++++---
 drivers/net/ethernet/intel/idpf/idpf_lib.c         |   5 +
 drivers/net/ethernet/intel/idpf/idpf_txrx.c        |   5 +-
 drivers/net/ethernet/intel/igc/igc_main.c          |  22 +--
 .../net/ethernet/mellanox/mlxsw/spectrum_ethtool.c |   4 +-
 drivers/net/ethernet/ti/am65-cpsw-nuss.c           |  50 ++++---
 drivers/net/netdevsim/ethtool.c                    |   4 +-
 drivers/net/team/team_core.c                       |   4 +-
 drivers/net/vxlan/vxlan_core.c                     |   7 +-
 drivers/net/wireless/ath/ath12k/wmi.c              |  61 ++++++---
 drivers/net/wireless/ath/ath12k/wmi.h              |   1 -
 .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |   4 +-
 drivers/parport/parport_serial.c                   |  12 +-
 drivers/pci/controller/pcie-mediatek-gen3.c        |  57 +++++---
 drivers/pci/endpoint/pci-epc-core.c                |  11 +-
 drivers/pci/quirks.c                               |  15 ++-
 drivers/pci/switch/switchtec.c                     |  26 ++++
 drivers/pinctrl/pinconf-generic.c                  |   8 +-
 drivers/pinctrl/pinctrl-cy8c95x0.c                 |  42 +++---
 drivers/ptp/ptp_vmclock.c                          |   8 +-
 drivers/regulator/core.c                           |  61 ++++-----
 drivers/s390/net/qeth_core_main.c                  |   8 +-
 drivers/soc/qcom/llcc-qcom.c                       |  57 +++++++-
 drivers/soc/qcom/smp2p.c                           |   2 +-
 drivers/soc/tegra/fuse/fuse-tegra30.c              |  17 ++-
 drivers/spi/spi-sn-f-ospi.c                        |   3 +
 drivers/tty/serial/8250/8250.h                     |   2 +
 drivers/tty/serial/8250/8250_dma.c                 |  16 +++
 drivers/tty/serial/8250/8250_pci.c                 |  76 +++++------
 drivers/tty/serial/8250/8250_pci1xxxx.c            |  60 ++++++++-
 drivers/tty/serial/8250/8250_port.c                |   9 ++
 drivers/tty/serial/serial_port.c                   |   5 +-
 drivers/ufs/core/ufs_bsg.c                         |   1 +
 drivers/ufs/core/ufshcd.c                          | 127 +++++++++---------
 drivers/usb/class/cdc-acm.c                        |  28 +++-
 drivers/usb/core/hub.c                             |  14 +-
 drivers/usb/core/quirks.c                          |   6 +
 drivers/usb/dwc2/gadget.c                          |   1 +
 drivers/usb/dwc3/gadget.c                          |  34 +++++
 drivers/usb/gadget/function/f_midi.c               |  17 ++-
 drivers/usb/gadget/udc/core.c                      |   2 +-
 drivers/usb/gadget/udc/renesas_usb3.c              |   2 +-
 drivers/usb/host/pci-quirks.c                      |   9 ++
 drivers/usb/host/xhci-pci.c                        |   7 +-
 drivers/usb/roles/class.c                          |   5 +-
 drivers/usb/serial/option.c                        |  49 ++++---
 drivers/usb/typec/tcpm/tcpm.c                      |   3 +-
 drivers/vfio/pci/nvgrace-gpu/main.c                |  95 ++++++++++---
 drivers/vfio/pci/vfio_pci_rdwr.c                   |   1 +
 drivers/vfio/platform/vfio_platform_common.c       |  10 --
 drivers/video/fbdev/omap/lcd_dma.c                 |   4 +-
 drivers/xen/swiotlb-xen.c                          |  20 +--
 fs/btrfs/extent_io.c                               |  29 ++--
 fs/btrfs/file.c                                    |   4 +-
 fs/nfs/sysfs.c                                     |   6 +-
 fs/nfsd/filecache.c                                |  11 +-
 fs/nfsd/nfs2acl.c                                  |   2 +
 fs/nfsd/nfs3acl.c                                  |   2 +
 fs/nfsd/nfs4callback.c                             |   7 +-
 fs/ntfs3/attrib.c                                  |  15 ++-
 fs/ntfs3/dir.c                                     |   2 +-
 fs/ntfs3/frecord.c                                 |  71 +++++-----
 fs/ntfs3/fsntfs.c                                  |   6 +-
 fs/ntfs3/index.c                                   |   6 +-
 fs/ntfs3/inode.c                                   |   3 +
 fs/ntfs3/ntfs_fs.h                                 |  21 +--
 fs/ntfs3/record.c                                  |  79 +++++------
 fs/orangefs/orangefs-debugfs.c                     |   4 +-
 fs/smb/client/cifsglob.h                           |   1 -
 fs/smb/client/file.c                               |   7 +-
 include/drm/display/drm_dp.h                       |   1 +
 include/kunit/platform_device.h                    |   1 +
 include/linux/blk-mq.h                             |  18 ++-
 include/linux/cgroup-defs.h                        |   6 +-
 include/linux/compiler.h                           |  26 ++--
 include/linux/efi.h                                |   1 +
 include/linux/netdevice.h                          |  93 +++++++++++--
 include/linux/pci_ids.h                            |  11 ++
 include/linux/sched/task.h                         |   1 +
 include/net/dst.h                                  |   9 ++
 include/net/ip.h                                   |  13 +-
 include/net/l3mdev.h                               |   2 +
 include/net/net_namespace.h                        |   2 +-
 include/net/route.h                                |   9 +-
 include/uapi/drm/xe_drm.h                          |  16 +++
 include/uapi/linux/thermal.h                       |   2 +-
 include/ufs/ufshcd.h                               |   9 +-
 io_uring/kbuf.c                                    |  15 ++-
 io_uring/uring_cmd.c                               |  32 ++---
 io_uring/waitid.c                                  |   4 +-
 kernel/cgroup/cgroup.c                             |  20 +--
 kernel/cgroup/rstat.c                              |   1 -
 kernel/sched/autogroup.c                           |   4 +-
 kernel/sched/core.c                                |  29 ++--
 kernel/sched/deadline.c                            |  73 ++++++++--
 kernel/sched/ext.c                                 |  71 ++++++----
 kernel/sched/ext.h                                 |   4 +-
 kernel/sched/sched.h                               |   4 +-
 kernel/sched/topology.c                            |   8 +-
 kernel/time/clocksource.c                          |   9 +-
 kernel/trace/ring_buffer.c                         |  28 +++-
 kernel/trace/trace.c                               |   4 +
 kernel/workqueue.c                                 |  12 +-
 net/ax25/af_ax25.c                                 |  11 ++
 net/batman-adv/bat_v.c                             |   2 -
 net/batman-adv/bat_v_elp.c                         | 122 ++++++++++++-----
 net/batman-adv/bat_v_elp.h                         |   2 -
 net/batman-adv/translation-table.c                 |  12 +-
 net/batman-adv/types.h                             |   3 -
 net/can/j1939/socket.c                             |   4 +-
 net/can/j1939/transport.c                          |   5 +-
 net/core/dev.c                                     |  71 +++++++---
 net/core/dev.h                                     |  12 ++
 net/core/fib_rules.c                               |  24 ++--
 net/core/flow_dissector.c                          |  21 +--
 net/core/neighbour.c                               |   8 +-
 net/core/rtnetlink.c                               |   1 +
 net/ipv4/arp.c                                     |   4 +-
 net/ipv4/devinet.c                                 |   3 +-
 net/ipv4/icmp.c                                    |  31 +++--
 net/ipv4/route.c                                   |  30 +++--
 net/ipv6/icmp.c                                    |  42 +++---
 net/ipv6/ioam6_iptunnel.c                          |  73 +++++-----
 net/ipv6/mcast.c                                   |  45 ++++---
 net/ipv6/ndisc.c                                   |  28 ++--
 net/ipv6/route.c                                   |   7 +-
 net/ipv6/rpl_iptunnel.c                            |  59 ++++----
 net/ipv6/seg6_iptunnel.c                           |  98 ++++++++------
 net/openvswitch/datapath.c                         |  12 +-
 net/shaper/shaper.c                                |   6 +-
 net/vmw_vsock/af_vsock.c                           |  12 +-
 rust/Makefile                                      |   1 +
 rust/kernel/rbtree.rs                              |   2 +-
 samples/hid/Makefile                               |  13 +-
 scripts/Makefile.defconf                           |  13 +-
 scripts/Makefile.extrawarn                         |  13 +-
 scripts/kconfig/Makefile                           |   4 +-
 sound/soc/intel/boards/bytcr_rt5640.c              |  17 ++-
 sound/soc/renesas/Kconfig                          |   2 +-
 tools/objtool/check.c                              |   1 +
 tools/sched_ext/include/scx/common.bpf.h           |  12 +-
 tools/testing/selftests/gpio/gpio-sim.sh           |  31 ++++-
 tools/tracing/rtla/src/timerlat_hist.c             |   8 ++
 tools/tracing/rtla/src/timerlat_top.c              |   8 ++
 266 files changed, 3125 insertions(+), 1425 deletions(-)

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Roger Quadros <[email protected]>

[ Upstream commit 8a9f82ff15da03a6804cdd6557fb36ff71c0924f ]

For successful XDP_TX and XDP_REDIRECT cases, the packet was received successfully so update RX statistics. Use original received packet length for that.

TX packets statistics are incremented on TX completion so don't update it while TX queueing.

If xdp_convert_buff_to_frame() fails, increment tx_dropped.

---
 drivers/net/ethernet/ti/am65-cpsw-nuss.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

index 0bbbd4cb6fb5c..43a3f36f0d220 100644
@@ -1134,9 +1134,11 @@ static int am65_cpsw_run_xdp(struct am65_cpsw_rx_flow *flow,
 	struct xdp_frame *xdpf;
 	struct bpf_prog *prog;
 	struct page *page;
+	int pkt_len;
 	u32 act;
 	int err;
 
+	pkt_len = *len;
 	prog = READ_ONCE(port->xdp_prog);
 	if (!prog)
 		return AM65_CPSW_XDP_PASS;

@@ -1154,8 +1156,10 @@ static int am65_cpsw_run_xdp(struct am65_cpsw_rx_flow *flow,
 		netif_txq = netdev_get_tx_queue(ndev, tx_chn->id);
 
 		xdpf = xdp_convert_buff_to_frame(xdp);
-		if (unlikely(!xdpf))
+		if (unlikely(!xdpf)) {
+			ndev->stats.tx_dropped++;
 			goto drop;
+		}
 
 		__netif_tx_lock(netif_txq, cpu);
 		err = am65_cpsw_xdp_tx_frame(ndev, tx_chn, xdpf,

@@ -1164,14 +1168,14 @@ static int am65_cpsw_run_xdp(struct am65_cpsw_rx_flow *flow,
 		if (err)
 			goto drop;
 
-		dev_sw_netstats_tx_add(ndev, 1, *len);
+		dev_sw_netstats_rx_add(ndev, pkt_len);
 		ret = AM65_CPSW_XDP_CONSUMED;
 		goto out;
 	case XDP_REDIRECT:
 		if (unlikely(xdp_do_redirect(ndev, xdp, prog)))
 			goto drop;
 
-		dev_sw_netstats_rx_add(ndev, *len);
+		dev_sw_netstats_rx_add(ndev, pkt_len);
 		ret = AM65_CPSW_XDP_REDIRECT;
 		goto out;
 	default:

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Su Hui <[email protected]>

[ Upstream commit 3b32b7f638fe61e9d29290960172f4e360e38233 ]

'priorities_info' is uninitialized, and the uninitialized value is copied to user object when calling PANTHOR_UOBJ_SET(). Using memset to initialize 'priorities_info' to avoid this garbage value problem.

---
 drivers/gpu/drm/panthor/panthor_drv.c | 1 +
 1 file changed, 1 insertion(+)

index 0b3fbee3d37a8..44f5c72d46c3f 100644
@@ -802,6 +802,7 @@ static void panthor_query_group_priorities_info(struct drm_file *file,
 {
 	int prio;
 
+	memset(arg, 0, sizeof(*arg));
 	for (prio = PANTHOR_GROUP_PRIORITY_REALTIME; prio >= 0; prio--) {
 		if (!group_priority_permit(file, prio))
 			arg->allowed_mask |= BIT(prio);

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Muhammad Adeel <[email protected]>

[ Upstream commit db5fd3cf8bf41b84b577b8ad5234ea95f327c9be ]

The CPU usage time is the time when user, system or both are using the CPU. Steal time is the time when CPU is waiting to be run by the Hypervisor. It should not be added to the CPU usage time, hence removing it from the usage_usec entry.

---
 kernel/cgroup/rstat.c | 1 -
 1 file changed, 1 deletion(-)

index 5877974ece92c..aac91466279f1 100644
@@ -590,7 +590,6 @@ static void root_cgroup_cputime(struct cgroup_base_stat *bstat)
 
 		cputime->sum_exec_runtime += user;
 		cputime->sum_exec_runtime += sys;
-		cputime->sum_exec_runtime += cpustat[CPUTIME_STEAL];
 
 #ifdef CONFIG_SCHED_CORE
 		bstat->forceidle_sum += cpustat[CPUTIME_FORCEIDLE];

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kan Liang <[email protected]>

[ Upstream commit 0a5561501397e2bbd0fb0e300eb489f72a90597a ]

The PEBS-via-PT feature is exposed for the e-core of some hybrid platforms, e.g., ADL and MTL. But it never works.

$ dmesg | grep PEBS
[    1.793888] core: cpu_atom PMU driver: PEBS-via-PT

$ perf record -c 1000 -e '{intel_pt/branch=0/,
cpu_atom/cpu-cycles,aux-output/pp}' -C8
Error:
The sys_perf_event_open() syscall returned with 22 (Invalid argument)
for event (cpu_atom/cpu-cycles,aux-output/pp).
"dmesg | grep -i perf" may provide additional information.

The "PEBS-via-PT" is printed if the corresponding bit of per-PMU capabilities is set. Since the feature is supported by the e-core HW, perf sets the bit for e-core. However, for Intel PT, if a feature is not supported on all CPUs, it is not supported at all. The PEBS-via-PT event cannot be created successfully.

The PEBS-via-PT is no longer enumerated on the latest hybrid platform. It will be deprecated on future platforms with Arch PEBS. Let's remove it from the existing hybrid platforms.

---
 arch/x86/events/intel/core.c | 10 ----------
 arch/x86/events/intel/ds.c   | 10 +++++++++-
 2 files changed, 9 insertions(+), 11 deletions(-)

index 99c590da0ae24..810d8c889f507 100644
@@ -4923,11 +4923,6 @@ static void intel_pmu_check_hybrid_pmus(struct x86_hybrid_pmu *pmu)
 	else
 		pmu->intel_ctrl &= ~(1ULL << GLOBAL_CTRL_EN_PERF_METRICS);
 
-	if (pmu->intel_cap.pebs_output_pt_available)
-		pmu->pmu.capabilities |= PERF_PMU_CAP_AUX_OUTPUT;
-	else
-		pmu->pmu.capabilities &= ~PERF_PMU_CAP_AUX_OUTPUT;
-
 	intel_pmu_check_event_constraints(pmu->event_constraints,
 					  pmu->cntr_mask64,
 					  pmu->fixed_cntr_mask64,

@@ -5005,9 +5000,6 @@ static bool init_hybrid_pmu(int cpu)
 
 	pr_info("%s PMU driver: ", pmu->name);
 
-	if (pmu->intel_cap.pebs_output_pt_available)
-		pr_cont("PEBS-via-PT ");
-
 	pr_cont("\n");
 
 	x86_pmu_show_pmu_cap(&pmu->pmu);

@@ -6362,11 +6354,9 @@ static __always_inline int intel_pmu_init_hybrid(enum hybrid_pmu_type pmus)
 		pmu->intel_cap.capabilities = x86_pmu.intel_cap.capabilities;
 		if (pmu->pmu_type & hybrid_small_tiny) {
 			pmu->intel_cap.perf_metrics = 0;
-			pmu->intel_cap.pebs_output_pt_available = 1;
 			pmu->mid_ack = true;
 		} else if (pmu->pmu_type & hybrid_big) {
 			pmu->intel_cap.perf_metrics = 1;
-			pmu->intel_cap.pebs_output_pt_available = 0;
 			pmu->late_ack = true;
 		}
 	}

index 6ba6549f26fac..cb0eca7347899 100644
@@ -2544,7 +2544,15 @@ void __init intel_ds_init(void)
 			}
 			pr_cont("PEBS fmt4%c%s, ", pebs_type, pebs_qual);
 
-			if (!is_hybrid() && x86_pmu.intel_cap.pebs_output_pt_available) {
+			/*
+			 * The PEBS-via-PT is not supported on hybrid platforms,
+			 * because not all CPUs of a hybrid machine support it.
+			 * The global x86_pmu.intel_cap, which only contains the
+			 * common capabilities, is used to check the availability
+			 * of the feature. The per-PMU pebs_output_pt_available
+			 * in a hybrid machine should be ignored.
+			 */
+			if (x86_pmu.intel_cap.pebs_output_pt_available) {
 				pr_cont("PEBS-via-PT, ");
 				x86_get_pmu(smp_processor_id())->capabilities |= PERF_PMU_CAP_AUX_OUTPUT;
 			}

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tejas Upadhyay <[email protected]>

[ Upstream commit fc876c9524e2a9f816f51d533ed31df789cff65a ]

bos_lock is to protect list of bos used by client, it is not required to protect bo->client so bring it outside of bos_lock.

---
 drivers/gpu/drm/xe/xe_drm_client.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 22f0f1a6dfd55..e8eaeb4646061 100644
@@ -135,8 +135,8 @@ void xe_drm_client_add_bo(struct xe_drm_client *client,
 	XE_WARN_ON(bo->client);
 	XE_WARN_ON(!list_empty(&bo->client_link));
 
-	spin_lock(&client->bos_lock);
 	bo->client = xe_drm_client_get(client);
+	spin_lock(&client->bos_lock);
 	list_add_tail(&bo->client_link, &client->bos_list);
 	spin_unlock(&client->bos_lock);
 }

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Krzysztof Karas <[email protected]>

[ Upstream commit 53139b3f9998ea07289e7b70b909fea2264a0de9 ]

There is an error path in igt_ppgtt_alloc(), which leads to ww object being passed down to i915_gem_ww_ctx_fini() without initialization. Correct that by only putting ppgtt->vm and returning early.

---
 drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 5c397a2df70e2..5d27e1c733c52 100644
@@ -168,7 +168,7 @@ static int igt_ppgtt_alloc(void *arg)
 		return PTR_ERR(ppgtt);
 
 	if (!ppgtt->vm.allocate_va_range)
-		goto err_ppgtt_cleanup;
+		goto ppgtt_vm_put;
 
 	/*
 	 * While we only allocate the page tables here and so we could

@@ -236,7 +236,7 @@ static int igt_ppgtt_alloc(void *arg)
 			goto retry;
 	}
 	i915_gem_ww_ctx_fini(&ww);
-
+ppgtt_vm_put:
 	i915_vm_put(&ppgtt->vm);
 	return err;
 }

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Artur Weber <[email protected]>

[ Upstream commit de1d0d160f64ee76df1d364d521b2faf465a091c ]

The GPIO lock/unlock functions clear/write a bit to the relevant register for each bank. However, due to an oversight the bit that was being written was based on the total GPIO number, not the index of the GPIO within the relevant bank, causing it to fail for any GPIO above 32 (thus any GPIO for banks above bank 0).

Fix lock/unlock for these banks by using the correct bit.

---
 drivers/gpio/gpio-bcm-kona.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

index 5321ef98f4427..77bd4ec93a231 100644
@@ -86,11 +86,12 @@ static void bcm_kona_gpio_lock_gpio(struct bcm_kona_gpio *kona_gpio,
 	u32 val;
 	unsigned long flags;
 	int bank_id = GPIO_BANK(gpio);
+	int bit = GPIO_BIT(gpio);
 
 	raw_spin_lock_irqsave(&kona_gpio->lock, flags);
 
 	val = readl(kona_gpio->reg_base + GPIO_PWD_STATUS(bank_id));
-	val |= BIT(gpio);
+	val |= BIT(bit);
 	bcm_kona_gpio_write_lock_regs(kona_gpio->reg_base, bank_id, val);
 
 	raw_spin_unlock_irqrestore(&kona_gpio->lock, flags);

@@ -102,11 +103,12 @@ static void bcm_kona_gpio_unlock_gpio(struct bcm_kona_gpio *kona_gpio,
 	u32 val;
 	unsigned long flags;
 	int bank_id = GPIO_BANK(gpio);
+	int bit = GPIO_BIT(gpio);
 
 	raw_spin_lock_irqsave(&kona_gpio->lock, flags);
 
 	val = readl(kona_gpio->reg_base + GPIO_PWD_STATUS(bank_id));
-	val &= ~BIT(gpio);
+	val &= ~BIT(bit);
 	bcm_kona_gpio_write_lock_regs(kona_gpio->reg_base, bank_id, val);
 
 	raw_spin_unlock_irqrestore(&kona_gpio->lock, flags);

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Artur Weber <[email protected]>

[ Upstream commit 57f5db77a915cc29461a679a6bcae7097967be1a ]

The settings for all GPIOs are locked by default in bcm_kona_gpio_reset. The settings for a GPIO are unlocked when requesting it as a GPIO, but not when requesting it as an interrupt, causing the IRQ settings to not get applied.

Fix this by making sure to unlock the right bits when an IRQ is requested. To avoid a situation where an IRQ being released causes a lock despite the same GPIO being used by a GPIO request or vice versa, add an unlock counter and only lock if it reaches 0.

---
 drivers/gpio/gpio-bcm-kona.c | 67 +++++++++++++++++++++++++++++-------
 1 file changed, 55 insertions(+), 12 deletions(-)

index 77bd4ec93a231..17f3f210fee9d 100644
@@ -69,6 +69,22 @@ struct bcm_kona_gpio {
 struct bcm_kona_gpio_bank {
 	int id;
 	int irq;
+	/*
+	 * Used to keep track of lock/unlock operations for each GPIO in the
+	 * bank.
+	 *
+	 * All GPIOs are locked by default (see bcm_kona_gpio_reset), and the
+	 * unlock count for all GPIOs is 0 by default. Each unlock increments
+	 * the counter, and each lock decrements the counter.
+	 *
+	 * The lock function only locks the GPIO once its unlock counter is
+	 * down to 0. This is necessary because the GPIO is unlocked in two
+	 * places in this driver: once for requested GPIOs, and once for
+	 * requested IRQs. Since it is possible for a GPIO to be requested
+	 * as both a GPIO and an IRQ, we need to ensure that we don't lock it
+	 * too early.
+	 */
+	u8 gpio_unlock_count[GPIO_PER_BANK];
 	/* Used in the interrupt handler */
 	struct bcm_kona_gpio *kona_gpio;
 };

@@ -87,14 +103,23 @@ static void bcm_kona_gpio_lock_gpio(struct bcm_kona_gpio *kona_gpio,
 	unsigned long flags;
 	int bank_id = GPIO_BANK(gpio);
 	int bit = GPIO_BIT(gpio);
+	struct bcm_kona_gpio_bank *bank = &kona_gpio->banks[bank_id];
 
-	raw_spin_lock_irqsave(&kona_gpio->lock, flags);
+	if (bank->gpio_unlock_count[bit] == 0) {
+		dev_err(kona_gpio->gpio_chip.parent,
+			"Unbalanced locks for GPIO %u\n", gpio);
+		return;
+	}
 
-	val = readl(kona_gpio->reg_base + GPIO_PWD_STATUS(bank_id));
-	val |= BIT(bit);
-	bcm_kona_gpio_write_lock_regs(kona_gpio->reg_base, bank_id, val);
+	if (--bank->gpio_unlock_count[bit] == 0) {
+		raw_spin_lock_irqsave(&kona_gpio->lock, flags);
 
-	raw_spin_unlock_irqrestore(&kona_gpio->lock, flags);
+		val = readl(kona_gpio->reg_base + GPIO_PWD_STATUS(bank_id));
+		val |= BIT(bit);
+		bcm_kona_gpio_write_lock_regs(kona_gpio->reg_base, bank_id, val);
+
+		raw_spin_unlock_irqrestore(&kona_gpio->lock, flags);
+	}
 }
 
 static void bcm_kona_gpio_unlock_gpio(struct bcm_kona_gpio *kona_gpio,

@@ -104,14 +129,19 @@ static void bcm_kona_gpio_unlock_gpio(struct bcm_kona_gpio *kona_gpio,
 	unsigned long flags;
 	int bank_id = GPIO_BANK(gpio);
 	int bit = GPIO_BIT(gpio);
+	struct bcm_kona_gpio_bank *bank = &kona_gpio->banks[bank_id];
 
-	raw_spin_lock_irqsave(&kona_gpio->lock, flags);
+	if (bank->gpio_unlock_count[bit] == 0) {
+		raw_spin_lock_irqsave(&kona_gpio->lock, flags);
 
-	val = readl(kona_gpio->reg_base + GPIO_PWD_STATUS(bank_id));
-	val &= ~BIT(bit);
-	bcm_kona_gpio_write_lock_regs(kona_gpio->reg_base, bank_id, val);
+		val = readl(kona_gpio->reg_base + GPIO_PWD_STATUS(bank_id));
+		val &= ~BIT(bit);
+		bcm_kona_gpio_write_lock_regs(kona_gpio->reg_base, bank_id, val);
 
-	raw_spin_unlock_irqrestore(&kona_gpio->lock, flags);
+		raw_spin_unlock_irqrestore(&kona_gpio->lock, flags);
+	}
+
+	++bank->gpio_unlock_count[bit];
 }
 
 static int bcm_kona_gpio_get_dir(struct gpio_chip *chip, unsigned gpio)

@@ -362,6 +392,7 @@ static void bcm_kona_gpio_irq_mask(struct irq_data *d)
 
 	kona_gpio = irq_data_get_irq_chip_data(d);
 	reg_base = kona_gpio->reg_base;
+
 	raw_spin_lock_irqsave(&kona_gpio->lock, flags);
 
 	val = readl(reg_base + GPIO_INT_MASK(bank_id));

@@ -384,6 +415,7 @@ static void bcm_kona_gpio_irq_unmask(struct irq_data *d)
 
 	kona_gpio = irq_data_get_irq_chip_data(d);
 	reg_base = kona_gpio->reg_base;
+
 	raw_spin_lock_irqsave(&kona_gpio->lock, flags);
 
 	val = readl(reg_base + GPIO_INT_MSKCLR(bank_id));

@@ -479,15 +511,26 @@ static void bcm_kona_gpio_irq_handler(struct irq_desc *desc)
 static int bcm_kona_gpio_irq_reqres(struct irq_data *d)
 {
 	struct bcm_kona_gpio *kona_gpio = irq_data_get_irq_chip_data(d);
+	unsigned int gpio = d->hwirq;
+
+	/*
+	 * We need to unlock the GPIO before any other operations are performed
+	 * on the relevant GPIO configuration registers
+	 */
+	bcm_kona_gpio_unlock_gpio(kona_gpio, gpio);
 
-	return gpiochip_reqres_irq(&kona_gpio->gpio_chip, d->hwirq);
+	return gpiochip_reqres_irq(&kona_gpio->gpio_chip, gpio);
 }
 
 static void bcm_kona_gpio_irq_relres(struct irq_data *d)
 {
 	struct bcm_kona_gpio *kona_gpio = irq_data_get_irq_chip_data(d);
+	unsigned int gpio = d->hwirq;
+
+	/* Once we no longer use it, lock the GPIO again */
+	bcm_kona_gpio_lock_gpio(kona_gpio, gpio);
 
-	gpiochip_relres_irq(&kona_gpio->gpio_chip, d->hwirq);
+	gpiochip_relres_irq(&kona_gpio->gpio_chip, gpio);
 }
 
 static struct irq_chip bcm_gpio_irq_chip = {

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Artur Weber <[email protected]>

[ Upstream commit 615279db222c3ac56d5c93716efd72b843295c1f ]

Add a missing newline to the format string of the "Couldn't get IRQ for bank..." error message.

---
 drivers/gpio/gpio-bcm-kona.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 17f3f210fee9d..64908f1a5e7f9 100644
@@ -659,7 +659,7 @@ static int bcm_kona_gpio_probe(struct platform_device *pdev)
 		bank->irq = platform_get_irq(pdev, i);
 		bank->kona_gpio = kona_gpio;
 		if (bank->irq < 0) {
-			dev_err(dev, "Couldn't get IRQ for bank %d", i);
+			dev_err(dev, "Couldn't get IRQ for bank %d\n", i);
 			ret = -ENOENT;
 			goto err_irq_domain;
 		}

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zhang Rui <[email protected]>

[ Upstream commit c195b9c6ab9c383d7aa3f4a65879b3ca90cb378b ]

The intel-lpmd tool [1], which uses the THERMAL_GENL_ATTR_CPU_CAPABILITY attribute to receive HFI events from kernel space, encounters a segmentation fault after commit 1773572863c4 ("thermal: netlink: Add the commands and the events for the thresholds").

The issue arises because the THERMAL_GENL_ATTR_CPU_CAPABILITY raw value was changed while intel_lpmd still uses the old value.

Although intel_lpmd can be updated to check the THERMAL_GENL_VERSION and use the appropriate THERMAL_GENL_ATTR_CPU_CAPABILITY value, the commit itself is questionable.

The commit introduced a new element in the middle of enum thermal_genl_attr, which affects many existing attributes and introduces potential risks and unnecessary maintenance burdens for userspace thermal netlink event users.

Solve the issue by moving the newly introduced THERMAL_GENL_ATTR_TZ_PREV_TEMP attribute to the end of the enum thermal_genl_attr. This ensures that all existing thermal generic netlink attributes remain unaffected.

---
 include/uapi/linux/thermal.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 349718c271ebf..46a2633d33aaa 100644
@@ -30,7 +30,6 @@ enum thermal_genl_attr {
 	THERMAL_GENL_ATTR_TZ,
 	THERMAL_GENL_ATTR_TZ_ID,
 	THERMAL_GENL_ATTR_TZ_TEMP,
-	THERMAL_GENL_ATTR_TZ_PREV_TEMP,
 	THERMAL_GENL_ATTR_TZ_TRIP,
 	THERMAL_GENL_ATTR_TZ_TRIP_ID,
 	THERMAL_GENL_ATTR_TZ_TRIP_TYPE,

@@ -54,6 +53,7 @@ enum thermal_genl_attr {
 	THERMAL_GENL_ATTR_THRESHOLD,
 	THERMAL_GENL_ATTR_THRESHOLD_TEMP,
 	THERMAL_GENL_ATTR_THRESHOLD_DIRECTION,
+	THERMAL_GENL_ATTR_TZ_PREV_TEMP,
 	__THERMAL_GENL_ATTR_MAX,
 };
 #define THERMAL_GENL_ATTR_MAX (__THERMAL_GENL_ATTR_MAX - 1)

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pavel Begunkov <[email protected]>

[ Upstream commit 06521ac0485effdcc9c792cb0b40ed8e6f2f5fb8 ]

struct io_tw_state is managed by core io_uring, and opcode handling code must never try to cheat and create their own instances, it's plain incorrect.

io_waitid_complete() attempts exactly that outside of the task work context, and even though the ring is locked, there would be no one to reap the requests from the defer completion list. It only works now because luckily it's called before io_uring_try_cancel_uring_cmd(), which flushes completions.

---
 io_uring/waitid.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index daef5dd644f04..eddd2dffc88b6 100644
@@ -118,7 +118,6 @@ static int io_waitid_finish(struct io_kiocb *req, int ret)
 static void io_waitid_complete(struct io_kiocb *req, int ret)
 {
 	struct io_waitid *iw = io_kiocb_to_cmd(req, struct io_waitid);
-	struct io_tw_state ts = {};
 
 	/* anyone completing better be holding a reference */
 	WARN_ON_ONCE(!(atomic_read(&iw->refs) & IO_WAITID_REF_MASK));

@@ -131,7 +130,6 @@ static void io_waitid_complete(struct io_kiocb *req, int ret)
 	if (ret < 0)
 		req_set_fail(req);
 	io_req_set_res(req, ret, 0);
-	io_req_task_complete(req, &ts);
 }
 
 static bool __io_waitid_cancel(struct io_ring_ctx *ctx, struct io_kiocb *req)

@@ -153,6 +151,7 @@ static bool __io_waitid_cancel(struct io_ring_ctx *ctx, struct io_kiocb *req)
 	list_del_init(&iwa->wo.child_wait.entry);
 	spin_unlock_irq(&iw->head->lock);
 	io_waitid_complete(req, -ECANCELED);
+	io_req_queue_tw_complete(req, -ECANCELED);
 	return true;
 }
 

@@ -258,6 +257,7 @@ static void io_waitid_cb(struct io_kiocb *req, struct io_tw_state *ts)
 	}
 
 	io_waitid_complete(req, ret);
+	io_req_task_complete(req, ts);
 }
 
 static int io_waitid_wait(struct wait_queue_entry *wait, unsigned mode,

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Roger Quadros <[email protected]>

[ Upstream commit 4542536f664f752db5feba2c5998b165933c34f2 ]

For XDP transmit case, swdata doesn't contain SKB but the XDP Frame. Infer the correct swdata based on buffer type and return the XDP Frame for XDP transmit case.

---
 drivers/net/ethernet/ti/am65-cpsw-nuss.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

index 43a3f36f0d220..f4ddacff08469 100644
@@ -684,16 +684,24 @@ static void am65_cpsw_nuss_xmit_free(struct am65_cpsw_tx_chn *tx_chn,
 static void am65_cpsw_nuss_tx_cleanup(void *data, dma_addr_t desc_dma)
 {
 	struct am65_cpsw_tx_chn *tx_chn = data;
+	enum am65_cpsw_tx_buf_type buf_type;
 	struct cppi5_host_desc_t *desc_tx;
+	struct xdp_frame *xdpf;
 	struct sk_buff *skb;
 	void **swdata;
 
 	desc_tx = k3_cppi_desc_pool_dma2virt(tx_chn->desc_pool, desc_dma);
 	swdata = cppi5_hdesc_get_swdata(desc_tx);
-	skb = *(swdata);
-	am65_cpsw_nuss_xmit_free(tx_chn, desc_tx);
+	buf_type = am65_cpsw_nuss_buf_type(tx_chn, desc_dma);
+	if (buf_type == AM65_CPSW_TX_BUF_TYPE_SKB) {
+		skb = *(swdata);
+		dev_kfree_skb_any(skb);
+	} else {
+		xdpf = *(swdata);
+		xdp_return_frame(xdpf);
+	}
 
-	dev_kfree_skb_any(skb);
+	am65_cpsw_nuss_xmit_free(tx_chn, desc_tx);
 }
 
 static struct sk_buff *am65_cpsw_build_skb(void *page_addr,

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jens Axboe <[email protected]>

[ Upstream commit 0edf1283a9d1419a2095b4fcdd95c11ac00a191c ]

Any uring_cmd always has async data allocated now, there's no reason to check and clear a cached copy of the SQE.

---
 io_uring/uring_cmd.c | 3 ---
 1 file changed, 3 deletions(-)

index 25cae9f5575be..f43adcc16cf65 100644
@@ -74,9 +74,6 @@ bool io_uring_try_cancel_uring_cmd(struct io_ring_ctx *ctx,
 			continue;
 
 		if (cmd->flags & IORING_URING_CMD_CANCELABLE) {
-			/* ->sqe isn't available if no async data */
-			if (!req_has_async_data(req))
-				cmd->sqe = NULL;
 			file->f_op->uring_cmd(cmd, IO_URING_F_CANCEL |
 						   IO_URING_F_COMPLETE_DEFER);
 			ret = true;

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Benjamin Berg <[email protected]>

[ Upstream commit 5298b7cffa8461009a4410f4e23f1c50ade39182 ]

It was reported that qemu may not enable the XSTATE CPU extension, which is a requirement after commit 3f17fed21491 ("um: switch to regset API and depend on XSTATE"). Add a fallback to use FXSAVE (FP registers on x86_64 and XFP on i386) which is just a shorter version of the same data. The only difference is that the XSTATE magic should not be set in the signal frame.

Note that this still drops support for the older i386 FP register layout as supporting this would require more backward compatibility to build a correct signal frame.

---
 arch/x86/um/os-Linux/registers.c | 21 ++++++++++++++++++---
 arch/x86/um/signal.c             |  5 +++++
 2 files changed, 23 insertions(+), 3 deletions(-)

index 76eaeb93928cc..eb1cdadc8a61d 100644
@@ -18,6 +18,7 @@
 #include <registers.h>
 #include <sys/mman.h>
 
+static unsigned long ptrace_regset;
 unsigned long host_fp_size;
 
 int get_fp_registers(int pid, unsigned long *regs)

@@ -27,7 +28,7 @@ int get_fp_registers(int pid, unsigned long *regs)
 		.iov_len = host_fp_size,
 	};
 
-	if (ptrace(PTRACE_GETREGSET, pid, NT_X86_XSTATE, &iov) < 0)
+	if (ptrace(PTRACE_GETREGSET, pid, ptrace_regset, &iov) < 0)
 		return -errno;
 	return 0;
 }

@@ -39,7 +40,7 @@ int put_fp_registers(int pid, unsigned long *regs)
 		.iov_len = host_fp_size,
 	};
 
-	if (ptrace(PTRACE_SETREGSET, pid, NT_X86_XSTATE, &iov) < 0)
+	if (ptrace(PTRACE_SETREGSET, pid, ptrace_regset, &iov) < 0)
 		return -errno;
 	return 0;
 }

@@ -58,9 +59,23 @@ int arch_init_registers(int pid)
 		return -ENOMEM;
 
 	/* GDB has x86_xsave_length, which uses x86_cpuid_count */
-	ret = ptrace(PTRACE_GETREGSET, pid, NT_X86_XSTATE, &iov);
+	ptrace_regset = NT_X86_XSTATE;
+	ret = ptrace(PTRACE_GETREGSET, pid, ptrace_regset, &iov);
 	if (ret)
 		ret = -errno;
+
+	if (ret == -ENODEV) {
+#ifdef CONFIG_X86_32
+		ptrace_regset = NT_PRXFPREG;
+#else
+		ptrace_regset = NT_PRFPREG;
+#endif
+		iov.iov_len = 2 * 1024 * 1024;
+		ret = ptrace(PTRACE_GETREGSET, pid, ptrace_regset, &iov);
+		if (ret)
+			ret = -errno;
+	}
+
 	munmap(iov.iov_base, 2 * 1024 * 1024);
 
 	host_fp_size = iov.iov_len;

index 75087e85b6fdb..ea5b3bcc42456 100644
@@ -187,7 +187,12 @@ static int copy_sc_to_user(struct sigcontext __user *to,
 	 * Put magic/size values for userspace. We do not bother to verify them
 	 * later on, however, userspace needs them should it try to read the
 	 * XSTATE data. And ptrace does not fill in these parts.
+	 *
+	 * Skip this if we do not have an XSTATE frame.
 	 */
+	if (host_fp_size <= sizeof(to_fp64->fpstate))
+		return 0;
+
 	BUILD_BUG_ON(sizeof(int) != FP_XSTATE_MAGIC2_SIZE);
 #ifdef CONFIG_X86_32
 	__put_user(offsetof(struct _fpstate_32, _fxsr_env) +

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Benjamin Berg <[email protected]>

[ Upstream commit 8891b176d350ec5ea9a39c6ef4c99bd63d68e64c ]

The init_task instance of struct task_struct is statically allocated and does not contain the dynamic area for the userspace FP registers. As such, limit the copy to the valid area of init_task and fill the rest with zero.

Note that the FP state is only needed for userspace, and as such it is entirely reasonable for init_task to not contain it.

---
 arch/um/kernel/process.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

index 30bdc0a87dc85..3a67ba8aa62dc 100644
@@ -191,7 +191,15 @@ void initial_thread_cb(void (*proc)(void *), void *arg)
 int arch_dup_task_struct(struct task_struct *dst,
 			 struct task_struct *src)
 {
-	memcpy(dst, src, arch_task_struct_size);
+	/* init_task is not dynamically sized (missing FPU state) */
+	if (unlikely(src == &init_task)) {
+		memcpy(dst, src, sizeof(init_task));
+		memset((void *)dst + sizeof(init_task), 0,
+		       arch_task_struct_size - sizeof(init_task));
+	} else {
+		memcpy(dst, src, arch_task_struct_size);
+	}
+
 	return 0;
 }
 

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Benjamin Berg <[email protected]>

[ Upstream commit 3c2fc7434d90338cf4c1b37bc95994208d23bfc6 ]

The stack needs to be properly aligned so 16 byte memory accesses on the stack are correct. This was broken when introducing the dynamic math register sizing as the rounding was not moved appropriately.

---
 arch/x86/um/signal.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

index ea5b3bcc42456..2934e170b0fe0 100644
@@ -372,11 +372,13 @@ int setup_signal_stack_si(unsigned long stack_top, struct ksignal *ksig,
 	int err = 0, sig = ksig->sig;
 	unsigned long fp_to;
 
-	frame = (struct rt_sigframe __user *)
-		round_down(stack_top - sizeof(struct rt_sigframe), 16);
+	frame = (void __user *)stack_top - sizeof(struct rt_sigframe);
 
 	/* Add required space for math frame */
-	frame = (struct rt_sigframe __user *)((unsigned long)frame - math_size);
+	frame = (void __user *)((unsigned long)frame - math_size);
+
+	/* ABI requires 16 byte boundary alignment */
+	frame = (void __user *)round_down((unsigned long)frame, 16);
 
 	/* Subtract 128 for a red zone and 8 for proper alignment */
 	frame = (struct rt_sigframe __user *) ((unsigned long) frame - 128 - 8);

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Benjamin Berg <[email protected]>

[ Upstream commit f82a9e7b9fa922bb9cccb00aae684a27b79e6df7 ]

The stub execution uses the somewhat new close_range and execveat syscalls. Of these two, the execveat call is essential, but the close_range call is more about stub process hygiene rather than safety (and its result is ignored).

Replace both calls with a raw syscall as older machines might not have a recent enough kernel for close_range (with CLOSE_RANGE_CLOEXEC) or a libc that does not yet expose both of the syscalls.

---
 arch/um/os-Linux/skas/process.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

index f683cfc9e51a5..e2f8f156402f5 100644
@@ -181,6 +181,10 @@ extern char __syscall_stub_start[];
 
 static int stub_exe_fd;
 
+#ifndef CLOSE_RANGE_CLOEXEC
+#define CLOSE_RANGE_CLOEXEC	(1U << 2)
+#endif
+
 static int userspace_tramp(void *stack)
 {
 	char *const argv[] = { "uml-userspace", NULL };

@@ -202,8 +206,12 @@ static int userspace_tramp(void *stack)
 	init_data.stub_data_fd = phys_mapping(uml_to_phys(stack), &offset);
 	init_data.stub_data_offset = MMAP_OFFSET(offset);
 
-	/* Set CLOEXEC on all FDs and then unset on all memory related FDs */
-	close_range(0, ~0U, CLOSE_RANGE_CLOEXEC);
+	/*
+	 * Avoid leaking unneeded FDs to the stub by setting CLOEXEC on all FDs
+	 * and then unsetting it on all memory related FDs.
+	 * This is not strictly necessary from a safety perspective.
+	 */
+	syscall(__NR_close_range, 0, ~0U, CLOSE_RANGE_CLOEXEC);
 
 	fcntl(init_data.stub_data_fd, F_SETFD, 0);
 	for (iomem = iomem_regions; iomem; iomem = iomem->next)

@@ -224,7 +232,9 @@ static int userspace_tramp(void *stack)
 	if (ret != sizeof(init_data))
 		exit(4);
 
-	execveat(stub_exe_fd, "", argv, NULL, AT_EMPTY_PATH);
+	/* Raw execveat for compatibility with older libc versions */
+	syscall(__NR_execveat, stub_exe_fd, (unsigned long)"",
+		(unsigned long)argv, NULL, AT_EMPTY_PATH);
 
 	exit(5);
 }

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zhu Lingshan <[email protected]>

[ Upstream commit a33f7f9660705fb2ecf3467b2c48965564f392ce ]

The destructor of a gtt bo is declared as
void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj); Which takes void** as the second parameter.

GCC allows passing void* to the function because void* can be implicitly casted to any other types, so it can pass compiling.

However, passing this void* parameter into the function's execution process(which expects void** and dereferencing void**) will result in errors.

---
 drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index bd595b1db15f2..1d538e874140c 100644
@@ -298,7 +298,7 @@ static int init_user_queue(struct process_queue_manager *pqm,
 	return 0;
 
 free_gang_ctx_bo:
-	amdgpu_amdkfd_free_gtt_mem(dev->adev, (*q)->gang_ctx_bo);
+	amdgpu_amdkfd_free_gtt_mem(dev->adev, &(*q)->gang_ctx_bo);
 cleanup:
 	uninit_queue(*q);
 	*q = NULL;

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jiang Liu <[email protected]>

[ Upstream commit a0a455b4bc7483ad60e8b8a50330c1e05bb7bfcf ]

In function psp_init_cap_microcode(), it should bail out when failed to load firmware, otherwise it may cause invalid memory access.

---
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

index 448f9e742983f..75c0f64602ed9 100644
@@ -3790,9 +3790,10 @@ int psp_init_cap_microcode(struct psp_context *psp, const char *chip_name)
 		if (err == -ENODEV) {
 			dev_warn(adev->dev, "cap microcode does not exist, skip\n");
 			err = 0;
-			goto out;
+		} else {
+			dev_err(adev->dev, "fail to initialize cap microcode\n");
 		}
-		dev_err(adev->dev, "fail to initialize cap microcode\n");
+		goto out;
 	}
 
 	info = &adev->firmware.ucode[AMDGPU_UCODE_ID_CAP];

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Imre Deak <[email protected]>

[ Upstream commit e00a2e5d485faf53c7a24b9d1b575a642227947f ]

Starting with DPCD version 2.0 bits 6:3 of the DP_DSC_BITS_PER_PIXEL_INC DPCD register contains the NativeYCbCr422_MAX_bpp_DELTA field, which can be non-zero as opposed to earlier DPCD versions, hence decoding the bit_per_pixel increment value at bits 2:0 in the same register requires applying a mask, do so.

---
 drivers/gpu/drm/display/drm_dp_helper.c | 2 +-
 include/drm/display/drm_dp.h            | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

index 6ee51003de3ce..9fa13da513d24 100644
@@ -2421,7 +2421,7 @@ u8 drm_dp_dsc_sink_bpp_incr(const u8 dsc_dpcd[DP_DSC_RECEIVER_CAP_SIZE])
 {
 	u8 bpp_increment_dpcd = dsc_dpcd[DP_DSC_BITS_PER_PIXEL_INC - DP_DSC_SUPPORT];
 
-	switch (bpp_increment_dpcd) {
+	switch (bpp_increment_dpcd & DP_DSC_BITS_PER_PIXEL_MASK) {
 	case DP_DSC_BITS_PER_PIXEL_1_16:
 		return 16;
 	case DP_DSC_BITS_PER_PIXEL_1_8:

index a6f8b098c56f1..3bd9f482f0c3e 100644
@@ -359,6 +359,7 @@
 # define DP_DSC_BITS_PER_PIXEL_1_4          0x2
 # define DP_DSC_BITS_PER_PIXEL_1_2          0x3
 # define DP_DSC_BITS_PER_PIXEL_1_1          0x4
+# define DP_DSC_BITS_PER_PIXEL_MASK         0x7
 
 #define DP_PSR_SUPPORT                      0x070   /* XXX 1.2? */
 # define DP_PSR_IS_SUPPORTED                1

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Juergen Gross <[email protected]>

[ Upstream commit 85fcb57c983f423180ba6ec5d0034242da05cc54 ]

When mapping a buffer for DMA via .map_page or .map_sg DMA operations, there is no need to check the machine frames to be aligned according to the mapped areas size. All what is needed in these cases is that the buffer is contiguous at machine level.

So carve out the alignment check from range_straddles_page_boundary() and move it to a helper called by xen_swiotlb_alloc_coherent() and xen_swiotlb_free_coherent() directly.

---
 drivers/xen/swiotlb-xen.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

index a337edcf8faf7..26c62e0d34e98 100644
@@ -74,19 +74,21 @@ static inline phys_addr_t xen_dma_to_phys(struct device *dev,
 	return xen_bus_to_phys(dev, dma_to_phys(dev, dma_addr));
 }
 
+static inline bool range_requires_alignment(phys_addr_t p, size_t size)
+{
+	phys_addr_t algn = 1ULL << (get_order(size) + PAGE_SHIFT);
+	phys_addr_t bus_addr = pfn_to_bfn(XEN_PFN_DOWN(p)) << XEN_PAGE_SHIFT;
+
+	return IS_ALIGNED(p, algn) && !IS_ALIGNED(bus_addr, algn);
+}
+
 static inline int range_straddles_page_boundary(phys_addr_t p, size_t size)
 {
 	unsigned long next_bfn, xen_pfn = XEN_PFN_DOWN(p);
 	unsigned int i, nr_pages = XEN_PFN_UP(xen_offset_in_page(p) + size);
-	phys_addr_t algn = 1ULL << (get_order(size) + PAGE_SHIFT);
 
 	next_bfn = pfn_to_bfn(xen_pfn);
 
-	/* If buffer is physically aligned, ensure DMA alignment. */
-	if (IS_ALIGNED(p, algn) &&
-	    !IS_ALIGNED((phys_addr_t)next_bfn << XEN_PAGE_SHIFT, algn))
-		return 1;
-
 	for (i = 1; i < nr_pages; i++)
 		if (pfn_to_bfn(++xen_pfn) != ++next_bfn)
 			return 1;

@@ -156,7 +158,8 @@ xen_swiotlb_alloc_coherent(struct device *dev, size_t size,
 
 	*dma_handle = xen_phys_to_dma(dev, phys);
 	if (*dma_handle + size - 1 > dma_mask ||
-	    range_straddles_page_boundary(phys, size)) {
+	    range_straddles_page_boundary(phys, size) ||
+	    range_requires_alignment(phys, size)) {
 		if (xen_create_contiguous_region(phys, order, fls64(dma_mask),
 				dma_handle) != 0)
 			goto out_free_pages;

@@ -182,7 +185,8 @@ xen_swiotlb_free_coherent(struct device *dev, size_t size, void *vaddr,
 	size = ALIGN(size, XEN_PAGE_SIZE);
 
 	if (WARN_ON_ONCE(dma_handle + size - 1 > dev->coherent_dma_mask) ||
-	    WARN_ON_ONCE(range_straddles_page_boundary(phys, size)))
+	    WARN_ON_ONCE(range_straddles_page_boundary(phys, size) ||
+			 range_requires_alignment(phys, size)))
 	    	return;
 
 	if (TestClearPageXenRemapped(virt_to_page(vaddr)))

2.39.5

6.13-stable review patch. If anyone has any objections, please let me know.

------------------

From: Juergen Gross <[email protected]>

[ Upstream commit e93ec87286bd1fd30b7389e7a387cfb259f297e3 ]

Today a PV guest (including dom0) can create 2MB contiguous memory regions for DMA buffers at max. This has led to problems at least with the megaraid_sas driver, which wants to allocate a 2.3MB DMA buffer.

The limiting factor is the frame array used to do the hypercall for making the memory contiguous, which has 512 entries and is just a static array in mmu_pv.c.

In order to not waste memory for non-PV guests, put the initial frame array into .init.data section and dynamically allocate an array from the .init_after_bootmem hook of PV guests.

In case a contiguous memory area larger than the initially supported 2MB is requested, allocate a larger buffer for the frame list. Note that such an allocation is tried only after memory management has been initialized properly, which is tested via a flag being set in the .init_after_bootmem hook.

---
 arch/x86/xen/mmu_pv.c | 71 +++++++++++++++++++++++++++++++++++++------
 1 file changed, 62 insertions(+), 9 deletions(-)

index 55a4996d0c04f..ffdf0d299c5d7 100644
@@ -111,6 +111,51 @@ static pud_t level3_user_vsyscall[PTRS_PER_PUD] __page_aligned_bss;
  */
 static DEFINE_SPINLOCK(xen_reservation_lock);
 
+/* Protected by xen_reservation_lock. */
+#define MIN_CONTIG_ORDER 9 /* 2MB */
+static unsigned int discontig_frames_order = MIN_CONTIG_ORDER;
+static unsigned long discontig_frames_early[1UL << MIN_CONTIG_ORDER] __initdata;
+static unsigned long *discontig_frames __refdata = discontig_frames_early;
+static bool discontig_frames_dyn;
+
+static int alloc_discontig_frames(unsigned int order)
+{
+	unsigned long *new_array, *old_array;
+	unsigned int old_order;
+	unsigned long flags;
+
+	BUG_ON(order < MIN_CONTIG_ORDER);
+	BUILD_BUG_ON(sizeof(discontig_frames_early) != PAGE_SIZE);
+
+	new_array = (unsigned long *)__get_free_pages(GFP_KERNEL,
+						      order - MIN_CONTIG_ORDER);
+	if (!new_array)
+		return -ENOMEM;
+
+	spin_lock_irqsave(&xen_reservation_lock, flags);
+
+	old_order = discontig_frames_order;
+
+	if (order > discontig_frames_order || !discontig_frames_dyn) {
+		if (!discontig_frames_dyn)
+			old_array = NULL;
+		else
+			old_array = discontig_frames;
+
+		discontig_frames = new_array;
+		discontig_frames_order = order;
+		discontig_frames_dyn = true;
+	} else {
+		old_array = new_array;
+	}
+
+	spin_unlock_irqrestore(&xen_reservation_lock, flags);
+
+	free_pages((unsigned long)old_array, old_order - MIN_CONTIG_ORDER);
+
+	return 0;
+}
+
 /*
  * Note about cr3 (pagetable base) values:
  *