Linux 5.15.113

 
ACPI: EC: Fix oops when removing custom query handlers [+ + +]
Author: Armin Wolf <[email protected]>
Date:   Fri Mar 24 21:26:27 2023 +0100

    ACPI: EC: Fix oops when removing custom query handlers
    
    [ Upstream commit e5b492c6bb900fcf9722e05f4a10924410e170c1 ]
    
    When removing custom query handlers, the handler might still
    be used inside the EC query workqueue, causing a kernel oops
    if the module holding the callback function was already unloaded.
    
    Fix this by flushing the EC query workqueue when removing
    custom query handlers.
    
    Tested on a Acer Travelmate 4002WLMi
    
    Signed-off-by: Armin Wolf <[email protected]>
    Signed-off-by: Rafael J. Wysocki <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects [+ + +]
Author: void0red <[email protected]>
Date:   Wed Apr 5 15:57:57 2023 +0200

    ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects
    
    [ Upstream commit ae5a0eccc85fc960834dd66e3befc2728284b86c ]
    
    ACPICA commit 0d5f467d6a0ba852ea3aad68663cbcbd43300fd4
    
    ACPI_ALLOCATE_ZEROED may fails, object_info might be null and will cause
    null pointer dereference later.
    
    Link: https://github.com/acpica/acpica/commit/0d5f467d
    Signed-off-by: Bob Moore <[email protected]>
    Signed-off-by: Rafael J. Wysocki <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

ACPICA: Avoid undefined behavior: applying zero offset to null pointer [+ + +]
Author: Tamir Duberstein <[email protected]>
Date:   Wed Apr 5 15:42:43 2023 +0200

    ACPICA: Avoid undefined behavior: applying zero offset to null pointer
    
    [ Upstream commit 05bb0167c80b8f93c6a4e0451b7da9b96db990c2 ]
    
    ACPICA commit 770653e3ba67c30a629ca7d12e352d83c2541b1e
    
    Before this change we see the following UBSAN stack trace in Fuchsia:
    
      #0    0x000021e4213b3302 in acpi_ds_init_aml_walk(struct acpi_walk_state*, union acpi_parse_object*, struct acpi_namespace_node*, u8*, u32, struct acpi_evaluate_info*, u8) ../../third_party/acpica/source/components/dispatcher/dswstate.c:682 <platform-bus-x86.so>+0x233302
      #1.2  0x000020d0f660777f in ubsan_get_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:41 <libclang_rt.asan.so>+0x3d77f
      #1.1  0x000020d0f660777f in maybe_print_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:51 <libclang_rt.asan.so>+0x3d77f
      #1    0x000020d0f660777f in ~scoped_report() compiler-rt/lib/ubsan/ubsan_diag.cpp:387 <libclang_rt.asan.so>+0x3d77f
      #2    0x000020d0f660b96d in handlepointer_overflow_impl() compiler-rt/lib/ubsan/ubsan_handlers.cpp:809 <libclang_rt.asan.so>+0x4196d
      #3    0x000020d0f660b50d in compiler-rt/lib/ubsan/ubsan_handlers.cpp:815 <libclang_rt.asan.so>+0x4150d
      #4    0x000021e4213b3302 in acpi_ds_init_aml_walk(struct acpi_walk_state*, union acpi_parse_object*, struct acpi_namespace_node*, u8*, u32, struct acpi_evaluate_info*, u8) ../../third_party/acpica/source/components/dispatcher/dswstate.c:682 <platform-bus-x86.so>+0x233302
      #5    0x000021e4213e2369 in acpi_ds_call_control_method(struct acpi_thread_state*, struct acpi_walk_state*, union acpi_parse_object*) ../../third_party/acpica/source/components/dispatcher/dsmethod.c:605 <platform-bus-x86.so>+0x262369
      #6    0x000021e421437fac in acpi_ps_parse_aml(struct acpi_walk_state*) ../../third_party/acpica/source/components/parser/psparse.c:550 <platform-bus-x86.so>+0x2b7fac
      #7    0x000021e4214464d2 in acpi_ps_execute_method(struct acpi_evaluate_info*) ../../third_party/acpica/source/components/parser/psxface.c:244 <platform-bus-x86.so>+0x2c64d2
      #8    0x000021e4213aa052 in acpi_ns_evaluate(struct acpi_evaluate_info*) ../../third_party/acpica/source/components/namespace/nseval.c:250 <platform-bus-x86.so>+0x22a052
      #9    0x000021e421413dd8 in acpi_ns_init_one_device(acpi_handle, u32, void*, void**) ../../third_party/acpica/source/components/namespace/nsinit.c:735 <platform-bus-x86.so>+0x293dd8
      #10   0x000021e421429e98 in acpi_ns_walk_namespace(acpi_object_type, acpi_handle, u32, u32, acpi_walk_callback, acpi_walk_callback, void*, void**) ../../third_party/acpica/source/components/namespace/nswalk.c:298 <platform-bus-x86.so>+0x2a9e98
      #11   0x000021e4214131ac in acpi_ns_initialize_devices(u32) ../../third_party/acpica/source/components/namespace/nsinit.c:268 <platform-bus-x86.so>+0x2931ac
      #12   0x000021e42147c40d in acpi_initialize_objects(u32) ../../third_party/acpica/source/components/utilities/utxfinit.c:304 <platform-bus-x86.so>+0x2fc40d
      #13   0x000021e42126d603 in acpi::acpi_impl::initialize_acpi(acpi::acpi_impl*) ../../src/devices/board/lib/acpi/acpi-impl.cc:224 <platform-bus-x86.so>+0xed603
    
    Add a simple check that avoids incrementing a pointer by zero, but
    otherwise behaves as before. Note that our findings are against ACPICA
    20221020, but the same code exists on master.
    
    Link: https://github.com/acpica/acpica/commit/770653e3
    Signed-off-by: Bob Moore <[email protected]>
    Signed-off-by: Rafael J. Wysocki <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
af_key: Reject optional tunnel/BEET mode templates in outbound policies [+ + +]
Author: Tobias Brunner <[email protected]>
Date:   Tue May 9 11:00:06 2023 +0200

    af_key: Reject optional tunnel/BEET mode templates in outbound policies
    
    [ Upstream commit cf3128a7aca55b2eefb68281d44749c683bdc96f ]
    
    xfrm_state_find() uses `encap_family` of the current template with
    the passed local and remote addresses to find a matching state.
    If an optional tunnel or BEET mode template is skipped in a mixed-family
    scenario, there could be a mismatch causing an out-of-bounds read as
    the addresses were not replaced to match the family of the next template.
    
    While there are theoretical use cases for optional templates in outbound
    policies, the only practical one is to skip IPComp states in inbound
    policies if uncompressed packets are received that are handled by an
    implicitly created IPIP state instead.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Tobias Brunner <[email protected]>
    Acked-by: Herbert Xu <[email protected]>
    Signed-off-by: Steffen Klassert <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
af_unix: Fix a data race of sk->sk_receive_queue->qlen. [+ + +]
Author: Kuniyuki Iwashima <[email protected]>
Date:   Tue May 9 17:34:55 2023 -0700

    af_unix: Fix a data race of sk->sk_receive_queue->qlen.
    
    [ Upstream commit 679ed006d416ea0cecfe24a99d365d1dea69c683 ]
    
    KCSAN found a data race of sk->sk_receive_queue->qlen where recvmsg()
    updates qlen under the queue lock and sendmsg() checks qlen under
    unix_state_sock(), not the queue lock, so the reader side needs
    READ_ONCE().
    
    BUG: KCSAN: data-race in __skb_try_recv_from_queue / unix_wait_for_peer
    
    write (marked) to 0xffff888019fe7c68 of 4 bytes by task 49792 on cpu 0:
     __skb_unlink include/linux/skbuff.h:2347 [inline]
     __skb_try_recv_from_queue+0x3de/0x470 net/core/datagram.c:197
     __skb_try_recv_datagram+0xf7/0x390 net/core/datagram.c:263
     __unix_dgram_recvmsg+0x109/0x8a0 net/unix/af_unix.c:2452
     unix_dgram_recvmsg+0x94/0xa0 net/unix/af_unix.c:2549
     sock_recvmsg_nosec net/socket.c:1019 [inline]
     ____sys_recvmsg+0x3a3/0x3b0 net/socket.c:2720
     ___sys_recvmsg+0xc8/0x150 net/socket.c:2764
     do_recvmmsg+0x182/0x560 net/socket.c:2858
     __sys_recvmmsg net/socket.c:2937 [inline]
     __do_sys_recvmmsg net/socket.c:2960 [inline]
     __se_sys_recvmmsg net/socket.c:2953 [inline]
     __x64_sys_recvmmsg+0x153/0x170 net/socket.c:2953
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x72/0xdc
    
    read to 0xffff888019fe7c68 of 4 bytes by task 49793 on cpu 1:
     skb_queue_len include/linux/skbuff.h:2127 [inline]
     unix_recvq_full net/unix/af_unix.c:229 [inline]
     unix_wait_for_peer+0x154/0x1a0 net/unix/af_unix.c:1445
     unix_dgram_sendmsg+0x13bc/0x14b0 net/unix/af_unix.c:2048
     sock_sendmsg_nosec net/socket.c:724 [inline]
     sock_sendmsg+0x148/0x160 net/socket.c:747
     ____sys_sendmsg+0x20e/0x620 net/socket.c:2503
     ___sys_sendmsg+0xc6/0x140 net/socket.c:2557
     __sys_sendmmsg+0x11d/0x370 net/socket.c:2643
     __do_sys_sendmmsg net/socket.c:2672 [inline]
     __se_sys_sendmmsg net/socket.c:2669 [inline]
     __x64_sys_sendmmsg+0x58/0x70 net/socket.c:2669
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x72/0xdc
    
    value changed: 0x0000000b -> 0x00000001
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 1 PID: 49793 Comm: syz-executor.0 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #2
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-by: syzbot <[email protected]>
    Signed-off-by: Kuniyuki Iwashima <[email protected]>
    Reviewed-by: Eric Dumazet <[email protected]>
    Reviewed-by: Michal Kubiak <[email protected]>
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

af_unix: Fix data races around sk->sk_shutdown. [+ + +]
Author: Kuniyuki Iwashima <[email protected]>
Date:   Tue May 9 17:34:56 2023 -0700

    af_unix: Fix data races around sk->sk_shutdown.
    
    [ Upstream commit e1d09c2c2f5793474556b60f83900e088d0d366d ]
    
    KCSAN found a data race around sk->sk_shutdown where unix_release_sock()
    and unix_shutdown() update it under unix_state_lock(), OTOH unix_poll()
    and unix_dgram_poll() read it locklessly.
    
    We need to annotate the writes and reads with WRITE_ONCE() and READ_ONCE().
    
    BUG: KCSAN: data-race in unix_poll / unix_release_sock
    
    write to 0xffff88800d0f8aec of 1 bytes by task 264 on cpu 0:
     unix_release_sock+0x75c/0x910 net/unix/af_unix.c:631
     unix_release+0x59/0x80 net/unix/af_unix.c:1042
     __sock_release+0x7d/0x170 net/socket.c:653
     sock_close+0x19/0x30 net/socket.c:1397
     __fput+0x179/0x5e0 fs/file_table.c:321
     ____fput+0x15/0x20 fs/file_table.c:349
     task_work_run+0x116/0x1a0 kernel/task_work.c:179
     resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
     exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
     exit_to_user_mode_prepare+0x174/0x180 kernel/entry/common.c:204
     __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
     syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:297
     do_syscall_64+0x4b/0x90 arch/x86/entry/common.c:86
     entry_SYSCALL_64_after_hwframe+0x72/0xdc
    
    read to 0xffff88800d0f8aec of 1 bytes by task 222 on cpu 1:
     unix_poll+0xa3/0x2a0 net/unix/af_unix.c:3170
     sock_poll+0xcf/0x2b0 net/socket.c:1385
     vfs_poll include/linux/poll.h:88 [inline]
     ep_item_poll.isra.0+0x78/0xc0 fs/eventpoll.c:855
     ep_send_events fs/eventpoll.c:1694 [inline]
     ep_poll fs/eventpoll.c:1823 [inline]
     do_epoll_wait+0x6c4/0xea0 fs/eventpoll.c:2258
     __do_sys_epoll_wait fs/eventpoll.c:2270 [inline]
     __se_sys_epoll_wait fs/eventpoll.c:2265 [inline]
     __x64_sys_epoll_wait+0xcc/0x190 fs/eventpoll.c:2265
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x72/0xdc
    
    value changed: 0x00 -> 0x03
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 1 PID: 222 Comm: dbus-broker Not tainted 6.3.0-rc7-02330-gca6270c12e20 #2
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
    
    Fixes: 3c73419c09a5 ("af_unix: fix 'poll for write'/ connected DGRAM sockets")
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-by: syzbot <[email protected]>
    Signed-off-by: Kuniyuki Iwashima <[email protected]>
    Reviewed-by: Eric Dumazet <[email protected]>
    Reviewed-by: Michal Kubiak <[email protected]>
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
ALSA: firewire-digi00x: prevent potential use after free [+ + +]
Author: Dan Carpenter <[email protected]>
Date:   Tue May 9 12:07:11 2023 +0300

    ALSA: firewire-digi00x: prevent potential use after free
    
    [ Upstream commit c0e72058d5e21982e61a29de6b098f7c1f0db498 ]
    
    This code was supposed to return an error code if init_stream()
    failed, but it instead freed dg00x->rx_stream and returned success.
    This potentially leads to a use after free.
    
    Fixes: 9a08067ec318 ("ALSA: firewire-digi00x: support AMDTP domain")
    Signed-off-by: Dan Carpenter <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

ALSA: hda/realtek: Add a quirk for HP EliteDesk 805 [+ + +]
Author: Ai Chao <[email protected]>
Date:   Sat May 6 10:26:53 2023 +0800

    ALSA: hda/realtek: Add a quirk for HP EliteDesk 805
    
    commit 90670ef774a8b6700c38ce1222e6aa263be54d5f upstream.
    
    Add a quirk for HP EliteDesk 805 to fixup ALC3867 headset MIC no sound.
    
    Signed-off-by: Ai Chao <[email protected]>
    Cc: <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

ALSA: hda/realtek: Add quirk for 2nd ASUS GU603 [+ + +]
Author: Luke D. Jones <[email protected]>
Date:   Sat May 6 11:58:24 2023 +1200

    ALSA: hda/realtek: Add quirk for 2nd ASUS GU603
    
    commit a4671b7fba59775845ee60cfbdfc4ba64300211b upstream.
    
    Add quirk for GU603 with 0x1c62 variant of codec.
    
    Signed-off-by: Luke D. Jones <[email protected]>
    Cc: <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

ALSA: hda/realtek: Add quirk for Clevo L140AU [+ + +]
Author: Jeremy Soller <[email protected]>
Date:   Fri May 5 10:36:51 2023 -0600

    ALSA: hda/realtek: Add quirk for Clevo L140AU
    
    commit 0a6b36c5dc3dda0196f4fb65bdb34c38b8d060c3 upstream.
    
    Fixes headset detection on Clevo L140AU.
    
    Signed-off-by: Jeremy Soller <[email protected]>
    Signed-off-by: Tim Crawford <[email protected]>
    Cc: <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15 [+ + +]
Author: Ryan C. Underwood <[email protected]>
Date:   Thu May 11 12:32:21 2023 -0500

    ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15
    
    [ Upstream commit 92553ee03166ef8fa978e7683f9f4af30c9c4e6b ]
    
    The Pavilion 15 line has B&O top speakers similar to the x360 and
    applying the same profile produces good sound.  Without this, the
    sound would be tinny and underpowered without either applying
    model=alc295-hp-x360 or booting another OS first.
    
    Signed-off-by: Ryan Underwood <[email protected]>
    Fixes: 563785edfcef ("ALSA: hda/realtek - Add quirk entry for HP Pavilion 15")
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table [+ + +]
Author: Nikhil Mahale <[email protected]>
Date:   Wed May 17 14:37:36 2023 +0530

    ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table
    
    commit dc4f2ccaedddb489a83e7b12ebbdc347272aacc9 upstream.
    
    These IDs are for AD102, AD103, AD104, AD106, and AD107 gpus with
    audio functions that are largely similar to the existing ones.
    
    Tested audio using gnome-settings, over HDMI, DP-SST and DP-MST
    connections on AD106 gpu.
    
    Signed-off-by: Nikhil Mahale <[email protected]>
    Cc: <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

ALSA: hda: Fix Oops by 9.1 surround channel names [+ + +]
Author: Takashi Iwai <[email protected]>
Date:   Tue May 16 20:44:12 2023 +0200

    ALSA: hda: Fix Oops by 9.1 surround channel names
    
    commit 3b44ec8c5c44790a82f07e90db45643c762878c6 upstream.
    
    get_line_out_pfx() may trigger an Oops by overflowing the static array
    with more than 8 channels.  This was reported for MacBookPro 12,1 with
    Cirrus codec.
    
    As a workaround, extend for the 9.1 channels and also fix the
    potential Oops by unifying the code paths accessing the same array
    with the proper size check.
    
    Reported-by: Olliver Schinagl <[email protected]>
    Cc: <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go [+ + +]
Author: Takashi Iwai <[email protected]>
Date:   Fri May 12 09:58:58 2023 +0200

    ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go
    
    commit 359b4315471181f108723c61612d96e383e56179 upstream.
    
    Line6 Pod Go (0e41:424b) requires the similar workaround for the fixed
    48k sample rate like other Line6 models.  This patch adds the
    corresponding entry to line6_parse_audio_format_rate_quirk().
    
    Reported-by: John Humlick <[email protected]>
    Cc: <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
arm64: dts: qcom: msm8996: Add missing DWC3 quirks [+ + +]
Author: Konrad Dybcio <[email protected]>
Date:   Thu Mar 2 02:18:49 2023 +0100

    arm64: dts: qcom: msm8996: Add missing DWC3 quirks
    
    [ Upstream commit d0af0537e28f6eace02deed63b585396de939213 ]
    
    Add missing dwc3 quirks from msm-3.18. Unfortunately, none of them
    make `dwc3-qcom 6af8800.usb: HS-PHY not in L2` go away.
    
    Signed-off-by: Konrad Dybcio <[email protected]>
    Signed-off-by: Bjorn Andersson <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Sasha Levin <[email protected]>

 
ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings [+ + +]
Author: Randy Dunlap <[email protected]>
Date:   Sun Apr 23 06:48:45 2023 +0100

    ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings
    
    [ Upstream commit 46dd6078dbc7e363a8bb01209da67015a1538929 ]
    
    Fix kernel-doc warnings from the kernel test robot:
    
    jornada720_ssp.c:24: warning: Function parameter or member 'jornada_ssp_lock' not described in 'DEFINE_SPINLOCK'
    jornada720_ssp.c:24: warning: expecting prototype for arch/arm/mac(). Prototype was for DEFINE_SPINLOCK() instead
    jornada720_ssp.c:34: warning: Function parameter or member 'byte' not described in 'jornada_ssp_reverse'
    jornada720_ssp.c:57: warning: Function parameter or member 'byte' not described in 'jornada_ssp_byte'
    jornada720_ssp.c:85: warning: Function parameter or member 'byte' not described in 'jornada_ssp_inout'
    
    Link: lore.kernel.org/r/[email protected]
    
    Fixes: 69ebb22277a5 ("[ARM] 4506/1: HP Jornada 7XX: Addition of SSP Platform Driver")
    Signed-off-by: Randy Dunlap <[email protected]>
    Reported-by: kernel test robot <[email protected]>
    Cc: Arnd Bergmann <[email protected]>
    Cc: Kristoffer Ericson <[email protected]>
    Cc: [email protected]
    Signed-off-by: Russell King (Oracle) <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
ASoC: fsl_micfil: Fix error handler with pm_runtime_enable [+ + +]
Author: Shengjiu Wang <[email protected]>
Date:   Mon May 8 18:16:36 2023 +0800

    ASoC: fsl_micfil: Fix error handler with pm_runtime_enable
    
    [ Upstream commit 17955aba7877a4494d8093ae5498e19469b01d57 ]
    
    There is error message when defer probe happens:
    
    fsl-micfil-dai 30ca0000.micfil: Unbalanced pm_runtime_enable!
    
    Fix the error handler with pm_runtime_enable and add
    fsl_micfil_remove() for pm_runtime_disable.
    
    Fixes: 47a70e6fc9a8 ("ASoC: Add MICFIL SoC Digital Audio Interface driver.")
    Signed-off-by: Shengjiu Wang <[email protected]
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Mark Brown <[email protected]
    Signed-off-by: Sasha Levin <[email protected]>

 
Bluetooth: btintel: Add LE States quirk support [+ + +]
Author: Chethan T N <[email protected]>
Date:   Tue Mar 21 10:03:10 2023 +0530

    Bluetooth: btintel: Add LE States quirk support
    
    [ Upstream commit 77f542b10c535c9a93bf8afdd2665524935807c2 ]
    
    Basically all Intel controllers support both Central/Peripheral
    LE states.
    
    This patch enables the LE States quirk by default on all
    Solar and Magnertor Intel controllers.
    
    Signed-off-by: Chethan T N <[email protected]>
    Signed-off-by: Luiz Augusto von Dentz <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set [+ + +]
Author: Hans de Goede <[email protected]>
Date:   Fri Mar 31 23:11:21 2023 +0200

    Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set
    
    [ Upstream commit 0d218c3642b9ccf71f44987cd03c19320f3bd918 ]
    
    On some devices the BCM Bluetooth adapter does not have a valid bdaddr set.
    
    btbcm.c currently sets HCI_QUIRK_INVALID_BDADDR to indicate when this is
    the case. But this requires users to manual setup a btaddr, by doing e.g.:
    
    btmgmt -i hci0 public-addr 'B0:F1:EC:82:1D:B3'
    
    Which means that Bluetooth will not work out of the box on such devices.
    To avoid this (where possible) hci_bcm sets: HCI_QUIRK_USE_BDADDR_PROPERTY
    which tries to get the bdaddr from devicetree.
    
    But this only works on devicetree platforms. On UEFI based platforms
    there is a special Broadcom UEFI variable which when present contains
    the devices bdaddr, just like how there is another UEFI variable which
    contains wifi nvram contents including the wifi MAC address.
    
    Add support for getting the bdaddr from this Broadcom UEFI variable,
    so that Bluetooth will work OOTB for users on devices where this
    UEFI variable is present.
    
    This fixes Bluetooth not working on for example Asus T100HA 2-in-1s.
    
    Signed-off-by: Hans de Goede <[email protected]>
    Signed-off-by: Luiz Augusto von Dentz <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp [+ + +]
Author: Min Li <[email protected]>
Date:   Mon Apr 17 10:27:54 2023 +0800

    Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp
    
    [ Upstream commit 25e97f7b1866e6b8503be349eeea44bb52d661ce ]
    
    conn->chan_lock isn't acquired before l2cap_get_chan_by_scid,
    if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance'
    is triggered.
    
    Reported-by: [email protected]
    Link: https://lore.kernel.org/all/[email protected]/
    Signed-off-by: Min Li <[email protected]>
    Signed-off-by: Luiz Augusto von Dentz <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
bnxt: avoid overflow in bnxt_get_nvram_directory() [+ + +]
Author: Maxim Korotkov <[email protected]>
Date:   Thu Mar 9 20:43:47 2023 +0300

    bnxt: avoid overflow in bnxt_get_nvram_directory()
    
    [ Upstream commit 7c6dddc239abe660598c49ec95ea0ed6399a4b2a ]
    
    The value of an arithmetic expression is subject
    of possible overflow due to a failure to cast operands to a larger data
    type before performing arithmetic. Used macro for multiplication instead
    operator for avoiding overflow.
    
    Found by Security Code and Linux Verification
    Center (linuxtesting.org) with SVACE.
    
    Signed-off-by: Maxim Korotkov <[email protected]>
    Reviewed-by: Pavan Chebbi <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
bpf: Add preempt_count_{sub,add} into btf id deny list [+ + +]
Author: Yafang <[email protected]>
Date:   Thu Apr 13 02:52:48 2023 +0000

    bpf: Add preempt_count_{sub,add} into btf id deny list
    
    [ Upstream commit c11bd046485d7bf1ca200db0e7d0bdc4bafdd395 ]
    
    The recursion check in __bpf_prog_enter* and __bpf_prog_exit*
    leave preempt_count_{sub,add} unprotected. When attaching trampoline to
    them we get panic as follows,
    
    [  867.843050] BUG: TASK stack guard page was hit at 0000000009d325cf (stack is 0000000046a46a15..00000000537e7b28)
    [  867.843064] stack guard page: 0000 [#1] PREEMPT SMP NOPTI
    [  867.843067] CPU: 8 PID: 11009 Comm: trace Kdump: loaded Not tainted 6.2.0+ #4
    [  867.843100] Call Trace:
    [  867.843101]  <TASK>
    [  867.843104]  asm_exc_int3+0x3a/0x40
    [  867.843108] RIP: 0010:preempt_count_sub+0x1/0xa0
    [  867.843135]  __bpf_prog_enter_recur+0x17/0x90
    [  867.843148]  bpf_trampoline_6442468108_0+0x2e/0x1000
    [  867.843154]  ? preempt_count_sub+0x1/0xa0
    [  867.843157]  preempt_count_sub+0x5/0xa0
    [  867.843159]  ? migrate_enable+0xac/0xf0
    [  867.843164]  __bpf_prog_exit_recur+0x2d/0x40
    [  867.843168]  bpf_trampoline_6442468108_0+0x55/0x1000
    ...
    [  867.843788]  preempt_count_sub+0x5/0xa0
    [  867.843793]  ? migrate_enable+0xac/0xf0
    [  867.843829]  __bpf_prog_exit_recur+0x2d/0x40
    [  867.843837] BUG: IRQ stack guard page was hit at 0000000099bd8228 (stack is 00000000b23e2bc4..000000006d95af35)
    [  867.843841] BUG: IRQ stack guard page was hit at 000000005ae07924 (stack is 00000000ffd69623..0000000014eb594c)
    [  867.843843] BUG: IRQ stack guard page was hit at 00000000028320f0 (stack is 00000000034b6438..0000000078d1bcec)
    [  867.843842]  bpf_trampoline_6442468108_0+0x55/0x1000
    ...
    
    That is because in __bpf_prog_exit_recur, the preempt_count_{sub,add} are
    called after prog->active is decreased.
    
    Fixing this by adding these two functions into btf ids deny list.
    
    Suggested-by: Steven Rostedt <[email protected]>
    Signed-off-by: Yafang <[email protected]>
    Cc: Masami Hiramatsu <[email protected]>
    Cc: Steven Rostedt <[email protected]>
    Cc: Jiri Olsa <[email protected]>
    Acked-by: Hao Luo <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Alexei Starovoitov <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

bpf: Annotate data races in bpf_local_storage [+ + +]
Author: Kumar Kartikeya Dwivedi <[email protected]>
Date:   Tue Feb 21 21:06:42 2023 +0100

    bpf: Annotate data races in bpf_local_storage
    
    [ Upstream commit 0a09a2f933c73dc76ab0b72da6855f44342a8903 ]
    
    There are a few cases where hlist_node is checked to be unhashed without
    holding the lock protecting its modification. In this case, one must use
    hlist_unhashed_lockless to avoid load tearing and KCSAN reports. Fix
    this by using lockless variant in places not protected by the lock.
    
    Since this is not prompted by any actual KCSAN reports but only from
    code review, I have not included a fixes tag.
    
    Cc: Martin KaFai Lau <[email protected]>
    Cc: KP Singh <[email protected]>
    Signed-off-by: Kumar Kartikeya Dwivedi <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Alexei Starovoitov <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
bridge: always declare tunnel functions [+ + +]
Author: Arnd Bergmann <[email protected]>
Date:   Tue May 16 21:45:35 2023 +0200

    bridge: always declare tunnel functions
    
    [ Upstream commit 89dcd87ce534a3a7f267cfd58505803006f51301 ]
    
    When CONFIG_BRIDGE_VLAN_FILTERING is disabled, two functions are still
    defined but have no prototype or caller. This causes a W=1 warning for
    the missing prototypes:
    
    net/bridge/br_netlink_tunnel.c:29:6: error: no previous prototype for 'vlan_tunid_inrange' [-Werror=missing-prototypes]
    net/bridge/br_netlink_tunnel.c:199:5: error: no previous prototype for 'br_vlan_tunnel_info' [-Werror=missing-prototypes]
    
    The functions are already contitional on CONFIG_BRIDGE_VLAN_FILTERING,
    and I coulnd't easily figure out the right set of #ifdefs, so just
    move the declarations out of the #ifdef to avoid the warning,
    at a small cost in code size over a more elaborate fix.
    
    Fixes: 188c67dd1906 ("net: bridge: vlan options: add support for tunnel id dumping")
    Fixes: 569da0822808 ("net: bridge: vlan options: add support for tunnel mapping set/del")
    Signed-off-by: Arnd Bergmann <[email protected]>
    Acked-by: Nikolay Aleksandrov <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag [+ + +]
Author: Oliver Hartkopp <[email protected]>
Date:   Thu Apr 6 13:08:45 2023 +0200

    can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag
    
    commit db2773d65b02aed319a93efdfb958087771d4e19 upstream.
    
    The control message provided by isotp support MSG_CMSG_COMPAT but
    blocked recvmsg() syscalls that have set this flag, i.e. on 32bit user
    space on 64 bit kernels.
    
    Link: https://github.com/hartkopp/can-isotp/issues/59
    Cc: Oleksij Rempel <[email protected]>
    Suggested-by: Marc Kleine-Budde <[email protected]>
    Signed-off-by: Oliver Hartkopp <[email protected]>
    Fixes: 42bf50a1795a ("can: isotp: support MSG_TRUNC flag when reading from socket")
    Link: https://lore.kernel.org/[email protected]
    Cc: [email protected]
    Signed-off-by: Marc Kleine-Budde <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag [+ + +]
Author: Oliver Hartkopp <[email protected]>
Date:   Thu Apr 6 13:08:45 2023 +0200

    can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag
    
    commit 1db080cbdbab28752bbb1c86d64daf96253a5da1 upstream.
    
    The control message provided by J1939 support MSG_CMSG_COMPAT but
    blocked recvmsg() syscalls that have set this flag, i.e. on 32bit user
    space on 64 bit kernels.
    
    Link: https://github.com/hartkopp/can-isotp/issues/59
    Cc: Oleksij Rempel <[email protected]>
    Suggested-by: Marc Kleine-Budde <[email protected]>
    Signed-off-by: Oliver Hartkopp <[email protected]>
    Tested-by: Oleksij Rempel <[email protected]>
    Acked-by: Oleksij Rempel <[email protected]>
    Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
    Link: https://lore.kernel.org/[email protected]
    Cc: [email protected]
    Signed-off-by: Marc Kleine-Budde <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

can: kvaser_pciefd: Call request_irq() before enabling interrupts [+ + +]
Author: Jimmy Assarsson <[email protected]>
Date:   Tue May 16 15:43:15 2023 +0200

    can: kvaser_pciefd: Call request_irq() before enabling interrupts
    
    commit 84762d8da89d29ba842317eb842973e628c27391 upstream.
    
    Make sure the interrupt handler is registered before enabling interrupts.
    
    Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices")
    Cc: [email protected]
    Signed-off-by: Jimmy Assarsson <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Marc Kleine-Budde <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

can: kvaser_pciefd: Clear listen-only bit if not explicitly requested [+ + +]
Author: Jimmy Assarsson <[email protected]>
Date:   Tue May 16 15:43:14 2023 +0200

    can: kvaser_pciefd: Clear listen-only bit if not explicitly requested
    
    commit bf7ac55e991ca177f1ac16be51152f1ef291a4df upstream.
    
    The listen-only bit was never cleared, causing the controller to
    always use listen-only mode, if previously set.
    
    Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices")
    Cc: [email protected]
    Signed-off-by: Jimmy Assarsson <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Marc Kleine-Budde <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

can: kvaser_pciefd: Disable interrupts in probe error path [+ + +]
Author: Jimmy Assarsson <[email protected]>
Date:   Tue May 16 15:43:18 2023 +0200

    can: kvaser_pciefd: Disable interrupts in probe error path
    
    commit 11164bc39459335ab93c6e99d53b7e4292fba38b upstream.
    
    Disable interrupts in error path of probe function.
    
    Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices")
    Cc: [email protected]
    Signed-off-by: Jimmy Assarsson <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Marc Kleine-Budde <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt [+ + +]
Author: Jimmy Assarsson <[email protected]>
Date:   Tue May 16 15:43:17 2023 +0200

    can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt
    
    commit 262d7a52ba27525e3c1203230c9f0524e48bbb34 upstream.
    
    Under certain circumstances we send two EFLUSH commands, resulting in two
    EFLUSH ack packets, while only expecting a single EFLUSH ack.
    This can cause the driver Tx flush completion to get out of sync.
    
    To avoid this problem, don't enable the "Transmit buffer flush done" (TFD)
    interrupt and remove the code handling it.
    Now we only send EFLUSH command after receiving status packet with
    "Init detected" (IDET) bit set.
    
    Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices")
    Cc: [email protected]
    Signed-off-by: Jimmy Assarsson <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Marc Kleine-Budde <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

can: kvaser_pciefd: Empty SRB buffer in probe [+ + +]
Author: Jimmy Assarsson <[email protected]>
Date:   Tue May 16 15:43:16 2023 +0200

    can: kvaser_pciefd: Empty SRB buffer in probe
    
    commit c589557dd1426f5adf90c7a919d4fde5a3e4ef64 upstream.
    
    Empty the "Shared receive buffer" (SRB) in probe, to assure we start in a
    known state, and don't process any irrelevant packets.
    
    Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices")
    Cc: [email protected]
    Signed-off-by: Jimmy Assarsson <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Marc Kleine-Budde <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop() [+ + +]
Author: Jimmy Assarsson <[email protected]>
Date:   Tue May 16 15:43:13 2023 +0200

    can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop()
    
    commit aed0e6ca7dbb8fbea9bc69c9ac663d5533c8c5d8 upstream.
    
    Set can.state to CAN_STATE_STOPPED in kvaser_pciefd_stop().
    Without this fix, wrong CAN state was repported after the interface was
    brought down.
    
    Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices")
    Cc: [email protected]
    Signed-off-by: Jimmy Assarsson <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Marc Kleine-Budde <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
cassini: Fix a memory leak in the error handling path of cas_init_one() [+ + +]
Author: Christophe JAILLET <[email protected]>
Date:   Mon May 15 21:09:11 2023 +0200

    cassini: Fix a memory leak in the error handling path of cas_init_one()
    
    [ Upstream commit 412cd77a2c24b191c65ea53025222418db09817c ]
    
    cas_saturn_firmware_init() allocates some memory using vmalloc(). This
    memory is freed in the .remove() function but not it the error handling
    path of the probe.
    
    Add the missing vfree() to avoid a memory leak, should an error occur.
    
    Fixes: fcaa40669cd7 ("cassini: use request_firmware")
    Signed-off-by: Christophe JAILLET <[email protected]>
    Reviewed-by: Pavan Chebbi <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
ceph: force updating the msg pointer in non-split case [+ + +]
Author: Xiubo Li <[email protected]>
Date:   Thu May 18 09:47:23 2023 +0800

    ceph: force updating the msg pointer in non-split case
    
    commit 4cafd0400bcb6187c0d4ab4d4b0229a89ac4f8c2 upstream.
    
    When the MClientSnap reqeust's op is not CEPH_SNAP_OP_SPLIT the
    request may still contain a list of 'split_realms', and we need
    to skip it anyway. Or it will be parsed as a corrupt snaptrace.
    
    Cc: [email protected]
    Link: https://tracker.ceph.com/issues/61200
    Reported-by: Frank Schilder <[email protected]>
    Signed-off-by: Xiubo Li <[email protected]>
    Reviewed-by: Ilya Dryomov <[email protected]>
    Signed-off-by: Ilya Dryomov <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
clk: tegra20: fix gcc-7 constant overflow warning [+ + +]
Author: Arnd Bergmann <[email protected]>
Date:   Mon Feb 27 09:59:10 2023 +0100

    clk: tegra20: fix gcc-7 constant overflow warning
    
    [ Upstream commit b4a2adbf3586efa12fe78b9dec047423e01f3010 ]
    
    Older gcc versions get confused by comparing a u32 value to a negative
    constant in a switch()/case block:
    
    drivers/clk/tegra/clk-tegra20.c: In function 'tegra20_clk_measure_input_freq':
    drivers/clk/tegra/clk-tegra20.c:581:2: error: case label does not reduce to an integer constant
      case OSC_CTRL_OSC_FREQ_12MHZ:
      ^~~~
    drivers/clk/tegra/clk-tegra20.c:593:2: error: case label does not reduce to an integer constant
      case OSC_CTRL_OSC_FREQ_26MHZ:
    
    Make the constants unsigned instead.
    
    Signed-off-by: Arnd Bergmann <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Stephen Boyd <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
cpupower: Make TSC read per CPU for Mperf monitor [+ + +]
Author: Wyes Karny <[email protected]>
Date:   Thu May 4 06:25:44 2023 +0000

    cpupower: Make TSC read per CPU for Mperf monitor
    
    [ Upstream commit c2adb1877b76fc81ae041e1db1a6ed2078c6746b ]
    
    System-wide TSC read could cause a drift in C0 percentage calculation.
    Because if first TSC is read and then one by one mperf is read for all
    cpus, this introduces drift between mperf reading of later CPUs and TSC
    reading.  To lower this drift read TSC per CPU and also just after mperf
    read.  This technique improves C0 percentage calculation in Mperf monitor.
    
    Before fix: (System 100% busy)
    
                  | Mperf              || RAPL        || Idle_Stats
     PKG|CORE| CPU| C0   | Cx   | Freq  || pack | core  || POLL | C1   | C2
       0|   0|   0| 87.15| 12.85|  2695||168659003|3970468||  0.00|  0.00| 0.00
       0|   0| 256| 84.62| 15.38|  2695||168659003|3970468||  0.00|  0.00| 0.00
       0|   1|   1| 87.15| 12.85|  2695||168659003|3970468||  0.00|  0.00| 0.00
       0|   1| 257| 84.08| 15.92|  2695||168659003|3970468||  0.00|  0.00| 0.00
       0|   2|   2| 86.61| 13.39|  2695||168659003|3970468||  0.00|  0.00| 0.00
       0|   2| 258| 83.26| 16.74|  2695||168659003|3970468||  0.00|  0.00| 0.00
       0|   3|   3| 86.61| 13.39|  2695||168659003|3970468||  0.00|  0.00| 0.00
       0|   3| 259| 83.60| 16.40|  2695||168659003|3970468||  0.00|  0.00| 0.00
       0|   4|   4| 86.33| 13.67|  2695||168659003|3970468||  0.00|  0.00| 0.00
       0|   4| 260| 83.33| 16.67|  2695||168659003|3970468||  0.00|  0.00| 0.00
       0|   5|   5| 86.06| 13.94|  2695||168659003|3970468||  0.00|  0.00| 0.00
       0|   5| 261| 83.05| 16.95|  2695||168659003|3970468||  0.00|  0.00| 0.00
       0|   6|   6| 85.51| 14.49|  2695||168659003|3970468||  0.00|  0.00| 0.00
    
    After fix: (System 100% busy)
    
                 | Mperf              || RAPL        || Idle_Stats
     PKG|CORE| CPU| C0   | Cx   | Freq  || pack | core  || POLL | C1   | C2
       0|   0|   0| 98.03|  1.97|  2415||163295480|3811189||  0.00|  0.00| 0.00
       0|   0| 256| 98.50|  1.50|  2394||163295480|3811189||  0.00|  0.00| 0.00
       0|   1|   1| 99.99|  0.01|  2401||163295480|3811189||  0.00|  0.00| 0.00
       0|   1| 257| 99.99|  0.01|  2375||163295480|3811189||  0.00|  0.00| 0.00
       0|   2|   2| 99.99|  0.01|  2401||163295480|3811189||  0.00|  0.00| 0.00
       0|   2| 258|100.00|  0.00|  2401||163295480|3811189||  0.00|  0.00| 0.00
       0|   3|   3|100.00|  0.00|  2401||163295480|3811189||  0.00|  0.00| 0.00
       0|   3| 259| 99.99|  0.01|  2435||163295480|3811189||  0.00|  0.00| 0.00
       0|   4|   4|100.00|  0.00|  2401||163295480|3811189||  0.00|  0.00| 0.00
       0|   4| 260|100.00|  0.00|  2435||163295480|3811189||  0.00|  0.00| 0.00
       0|   5|   5| 99.99|  0.01|  2401||163295480|3811189||  0.00|  0.00| 0.00
       0|   5| 261|100.00|  0.00|  2435||163295480|3811189||  0.00|  0.00| 0.00
       0|   6|   6|100.00|  0.00|  2401||163295480|3811189||  0.00|  0.00| 0.00
       0|   6| 262|100.00|  0.00|  2435||163295480|3811189||  0.00|  0.00| 0.00
    
    Cc: Thomas Renninger <[email protected]>
    Cc: Shuah Khan <[email protected]>
    Cc: Dominik Brodowski <[email protected]>
    
    Fixes: 7fe2f6399a84 ("cpupowerutils - cpufrequtils extended with quite some features")
    Signed-off-by: Wyes Karny <[email protected]>
    Signed-off-by: Shuah Khan <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
drm/amd/display: Use DC_LOG_DC in the trasform pixel function [+ + +]
Author: Rodrigo Siqueira <[email protected]>
Date:   Tue Nov 1 10:20:09 2022 -0400

    drm/amd/display: Use DC_LOG_DC in the trasform pixel function
    
    [ Upstream commit 7222f5841ff49709ca666b05ff336776e0664a20 ]
    
    [Why & How]
    DC now uses a new commit sequence which is more robust since it
    addresses cases where we need to reorganize pipes based on planes and
    other parameters. As a result, this new commit sequence reset the DC
    state by cleaning plane states and re-creating them accordingly with the
    need. For this reason, the dce_transform_set_pixel_storage_depth can be
    invoked after a plane state is destroyed and before its re-creation. In
    this situation and on DCE devices, DC will hit a condition that will
    trigger a dmesg log that looks like this:
    
    Console: switching to colour frame buffer device 240x67
    ------------[ cut here ]------------
    [..]
    Hardware name: System manufacturer System Product Name/PRIME X370-PRO, BIOS 5603 07/28/2020
    RIP: 0010:dce_transform_set_pixel_storage_depth+0x3f8/0x480 [amdgpu]
    [..]
    RSP: 0018:ffffc9000202b850 EFLAGS: 00010293
    RAX: ffffffffa081d100 RBX: ffff888110790000 RCX: 000000000000000c
    RDX: ffff888100bedbf8 RSI: 0000000000001a50 RDI: ffff88810463c900
    RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000007
    R10: 0000000000000001 R11: 0000000000000f00 R12: ffff88810f500010
    R13: ffff888100bedbf8 R14: ffff88810f515688 R15: 0000000000000000
    FS:  00007ff0159249c0(0000) GS:ffff88840e940000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007ff01528e550 CR3: 0000000002a10000 CR4: 00000000003506e0
    Call Trace:
     <TASK>
     ? dm_write_reg_func+0x21/0x80 [amdgpu 340dadd3f7c8cf4be11cf0bdc850245e99abe0e8]
     dc_stream_set_dither_option+0xfb/0x130 [amdgpu 340dadd3f7c8cf4be11cf0bdc850245e99abe0e8]
     amdgpu_dm_crtc_configure_crc_source+0x10b/0x190 [amdgpu 340dadd3f7c8cf4be11cf0bdc850245e99abe0e8]
     amdgpu_dm_atomic_commit_tail+0x20a8/0x2a90 [amdgpu 340dadd3f7c8cf4be11cf0bdc850245e99abe0e8]
     ? free_unref_page_commit+0x98/0x170
     ? free_unref_page+0xcc/0x150
     commit_tail+0x94/0x120
     drm_atomic_helper_commit+0x10f/0x140
     drm_atomic_commit+0x94/0xc0
     ? drm_plane_get_damage_clips.cold+0x1c/0x1c
     drm_client_modeset_commit_atomic+0x203/0x250
     drm_client_modeset_commit_locked+0x56/0x150
     drm_client_modeset_commit+0x21/0x40
     drm_fb_helper_lastclose+0x42/0x70
     amdgpu_driver_lastclose_kms+0xa/0x10 [amdgpu 340dadd3f7c8cf4be11cf0bdc850245e99abe0e8]
     drm_release+0xda/0x110
     __fput+0x89/0x240
     task_work_run+0x5c/0x90
     do_exit+0x333/0xae0
     do_group_exit+0x2d/0x90
     __x64_sys_exit_group+0x14/0x20
     do_syscall_64+0x5b/0x80
     ? exit_to_user_mode_prepare+0x1e/0x140
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    RIP: 0033:0x7ff016ceaca1
    Code: Unable to access opcode bytes at RIP 0x7ff016ceac77.
    RSP: 002b:00007ffe7a2357e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
    RAX: ffffffffffffffda RBX: 00007ff016e15a00 RCX: 00007ff016ceaca1
    RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
    RBP: 0000000000000000 R08: ffffffffffffff78 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff016e15a00
    R13: 0000000000000000 R14: 00007ff016e1aee8 R15: 00007ff016e1af00
     </TASK>
    
    Since this issue only happens in a transition state on DC, this commit
    replace BREAK_TO_DEBUGGER with DC_LOG_DC.
    
    Reviewed-by: Harry Wentland <[email protected]>
    Acked-by: Qingqing Zhuo <[email protected]>
    Signed-off-by: Rodrigo Siqueira <[email protected]>
    Tested-by: Daniel Wheeler <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
drm/amd: Fix an out of bounds error in BIOS parser [+ + +]
Author: Mario Limonciello <[email protected]>
Date:   Thu Mar 23 14:07:06 2023 -0500

    drm/amd: Fix an out of bounds error in BIOS parser
    
    [ Upstream commit d116db180decec1b21bba31d2ff495ac4d8e1b83 ]
    
    The array is hardcoded to 8 in atomfirmware.h, but firmware provides
    a bigger one sometimes. Deferencing the larger array causes an out
    of bounds error.
    
    commit 4fc1ba4aa589 ("drm/amd/display: fix array index out of bound error
    in bios parser") fixed some of this, but there are two other cases
    not covered by it.  Fix those as well.
    
    Reported-by: [email protected]
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=214853
    Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2473
    Signed-off-by: Mario Limonciello <[email protected]>
    Reviewed-by: Harry Wentland <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
drm/displayid: add displayid_get_header() and check bounds better [+ + +]
Author: Jani Nikula <[email protected]>
Date:   Thu Feb 16 22:44:58 2023 +0200

    drm/displayid: add displayid_get_header() and check bounds better
    
    [ Upstream commit 5bacecc3c56131c31f18b23d366f2184328fd9cf ]
    
    Add a helper to get a pointer to struct displayid_header. To be
    pedantic, add buffer overflow checks to not touch the base if that
    itself would overflow.
    
    Cc: Iaroslav Boliukin <[email protected]>
    Cc: Dmitry Osipenko <[email protected]>
    Signed-off-by: Jani Nikula <[email protected]>
    Tested-by: Dmitry Osipenko <[email protected]>
    Reviewed-by: Dmitry Osipenko <[email protected]>
    Signed-off-by: Dmitry Osipenko <[email protected]>
    Link: https://patchwork.freedesktop.org/patch/msgid/4a03b3a5132642d3cdb6d4c2641422955a917292.1676580180.git.jani.nikula@intel.com
    Signed-off-by: Sasha Levin <[email protected]>

 
drm/exynos: fix g2d_open/close helper function definitions [+ + +]
Author: Arnd Bergmann <[email protected]>
Date:   Mon Apr 17 23:04:11 2023 +0200

    drm/exynos: fix g2d_open/close helper function definitions
    
    [ Upstream commit 2ef0785b30bd6549ddbc124979f1b6596e065ae2 ]
    
    The empty stub functions are defined as global functions, which
    causes a warning because of missing prototypes:
    
    drivers/gpu/drm/exynos/exynos_drm_g2d.h:37:5: error: no previous prototype for 'g2d_open'
    drivers/gpu/drm/exynos/exynos_drm_g2d.h:42:5: error: no previous prototype for 'g2d_close'
    
    Mark them as 'static inline' to avoid the warning and to make
    them behave as intended.
    
    Fixes: eb4d9796fa34 ("drm/exynos: g2d: Convert to driver component API")
    Signed-off-by: Arnd Bergmann <[email protected]>
    Reviewed-by: Andi Shyti <[email protected]>
    Signed-off-by: Inki Dae <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
drm/i915/dp: prevent potential div-by-zero [+ + +]
Author: Nikita Zhandarovich <[email protected]>
Date:   Tue Apr 18 07:04:30 2023 -0700

    drm/i915/dp: prevent potential div-by-zero
    
    [ Upstream commit 0ff80028e2702c7c3d78b69705dc47c1ccba8c39 ]
    
    drm_dp_dsc_sink_max_slice_count() may return 0 if something goes
    wrong on the part of the DSC sink and its DPCD register. This null
    value may be later used as a divisor in intel_dsc_compute_params(),
    which will lead to an error.
    In the unlikely event that this issue occurs, fix it by testing the
    return value of drm_dp_dsc_sink_max_slice_count() against zero.
    
    Found by Linux Verification Center (linuxtesting.org) with static
    analysis tool SVACE.
    
    Fixes: a4a157777c80 ("drm/i915/dp: Compute DSC pipe config in atomic check")
    Signed-off-by: Nikita Zhandarovich <[email protected]>
    Reviewed-by: Rodrigo Vivi <[email protected]>
    Signed-off-by: Rodrigo Vivi <[email protected]>
    Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
    (cherry picked from commit 51f7008239de011370c5067bbba07f0207f06b72)
    Signed-off-by: Joonas Lahtinen <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
drm/mipi-dsi: Set the fwnode for mipi_dsi_device [+ + +]
Author: Saravana Kannan <[email protected]>
Date:   Thu Mar 9 22:39:09 2023 -0800

    drm/mipi-dsi: Set the fwnode for mipi_dsi_device
    
    [ Upstream commit a26cc2934331b57b5a7164bff344f0a2ec245fc0 ]
    
    After commit 3fb16866b51d ("driver core: fw_devlink: Make cycle
    detection more robust"), fw_devlink prints an error when consumer
    devices don't have their fwnode set. This used to be ignored silently.
    
    Set the fwnode mipi_dsi_device so fw_devlink can find them and properly
    track their dependencies.
    
    This fixes errors like this:
    [    0.334054] nwl-dsi 30a00000.mipi-dsi: Failed to create device link with regulator-lcd-1v8
    [    0.346964] nwl-dsi 30a00000.mipi-dsi: Failed to create device link with backlight-dsi
    
    Reported-by: Martin Kepplinger <[email protected]>
    Link: https://lore.kernel.org/lkml/[email protected]/
    Fixes: 068a00233969 ("drm: Add MIPI DSI bus support")
    Signed-off-by: Saravana Kannan <[email protected]>
    Tested-by: Martin Kepplinger <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Maxime Ripard <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>
 
drm/msm/dp: Clean up handling of DP AUX interrupts [+ + +]
Author: Douglas Anderson <[email protected]>
Date:   Thu Jan 26 17:09:12 2023 -0800

    drm/msm/dp: Clean up handling of DP AUX interrupts
    
    [ Upstream commit b20566cdef05cd40d95f10869d2a7646f48b1bbe ]
    
    The DP AUX interrupt handling was a bit of a mess.
    * There were two functions (one for "native" transfers and one for
      "i2c" transfers) that were quite similar. It was hard to say how
      many of the differences between the two functions were on purpose
      and how many of them were just an accident of how they were coded.
    * Each function sometimes used "else if" to test for error bits and
      sometimes didn't and again it was hard to say if this was on purpose
      or just an accident.
    * The two functions wouldn't notice whether "unknown" bits were
      set. For instance, there seems to be a bit "DP_INTR_PLL_UNLOCKED"
      and if it was set there would be no indication.
    * The two functions wouldn't notice if more than one error was set.
    
    Let's fix this by being more consistent / explicit about what we're
    doing.
    
    By design this could cause different handling for AUX transfers,
    though I'm not actually aware of any bug fixed as a result of
    this patch (this patch was created because we simply noticed how odd
    the old code was by code inspection). Specific notes here:
    1. In the old native transfer case if we got "done + wrong address"
       we'd ignore the "wrong address" (because of the "else if"). Now we
       won't.
    2. In the old native transfer case if we got "done + timeout" we'd
       ignore the "timeout" (because of the "else if"). Now we won't.
    3. In the old native transfer case we'd see "nack_defer" and translate
       it to the error number for "nack". This differed from the i2c
       transfer case where "nack_defer" was given the error number for
       "nack_defer". This 100% can't matter because the only user of this
       error number treats "nack defer" the same as "nack", so it's clear
       that the difference between the "native" and "i2c" was pointless
       here.
    4. In the old i2c transfer case if we got "done" plus any error
       besides "nack" or "defer" then we'd ignore the error. Now we don't.
    5. If there is more than one error signaled by the hardware it's
       possible that we'll report a different one than we used to. I don't
       know if this matters. If someone is aware of a case this matters we
       should document it and change the code to make it explicit.
    6. One quirk we keep (I don't know if this is important) is that in
       the i2c transfer case if we see "done + defer" we report that as a
       "nack". That seemed too intentional in the old code to just drop.
    
    After this change we will add extra logging, including:
    * A warning if we see more than one error bit set.
    * A warning if we see an unexpected interrupt.
    * A warning if we get an AUX transfer interrupt when shouldn't.
    
    It actually turns out that as a result of this change then at boot we
    sometimes see an error:
      [drm:dp_aux_isr] *ERROR* Unexpected DP AUX IRQ 0x01000000 when not busy
    That means that, during init, we are seeing DP_INTR_PLL_UNLOCKED. For
    now I'm going to say that leaving this error reported in the logs is
    OK-ish and hopefully it will encourage someone to track down what's
    going on at init time.
    
    One last note here is that this change renames one of the interrupt
    bits. The bit named "i2c done" clearly was used for native transfers
    being done too, so I renamed it to indicate this.
    
    Signed-off-by: Douglas Anderson <[email protected]>
    Tested-by: Kuogee Hsieh <[email protected]>
    Reviewed-by: Kuogee Hsieh <[email protected]>
    Patchwork: https://patchwork.freedesktop.org/patch/520658/
    Link: https://lore.kernel.org/r/20230126170745.v2.1.I90ffed3ddd21e818ae534f820cb4d6d8638859ab@changeid
    Signed-off-by: Dmitry Baryshkov <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

drm/msm/dp: unregister audio driver during unbind [+ + +]
Author: Srinivas Kandagatla <[email protected]>
Date:   Fri Apr 21 15:56:57 2023 +0100

    drm/msm/dp: unregister audio driver during unbind
    
    [ Upstream commit 85c636284cb63b7740b4ae98881ace92158068d3 ]
    
    while binding the code always registers a audio driver, however there
    is no corresponding unregistration done in unbind. This leads to multiple
    redundant audio platform devices if dp_display_bind and dp_display_unbind
    happens multiple times during startup. On X13s platform this resulted in
    6 to 9 audio codec device instead of just 3 codec devices for 3 dp ports.
    
    Fix this by unregistering codecs on unbind.
    
    Signed-off-by: Srinivas Kandagatla <[email protected]>
    Fixes: d13e36d7d222 ("drm/msm/dp: add audio support for Display Port on MSM")
    Reviewed-by: Abhinav Kumar <[email protected]>
    Patchwork: https://patchwork.freedesktop.org/patch/533324/
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Abhinav Kumar <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
drm/msm/dpu: Add INTF_5 interrupts [+ + +]
Author: Bjorn Andersson <[email protected]>
Date:   Mon Feb 14 20:33:52 2022 -0800

    drm/msm/dpu: Add INTF_5 interrupts
    
    [ Upstream commit 148e852f290fe8be9fa69953bee2f958befd65d4 ]
    
    SC8180x has the eDP controller wired up to INTF_5, so add the interrupt
    register block for this interface to the list.
    
    Signed-off-by: Bjorn Andersson <[email protected]>
    Reviewed-by: Dmitry Baryshkov <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Dmitry Baryshkov <[email protected]>
    Stable-dep-of: e9d9ce5462fe ("drm/msm/dpu: Move non-MDP_TOP INTF_INTR offsets out of hwio header")
    Signed-off-by: Sasha Levin <[email protected]>

drm/msm/dpu: Move non-MDP_TOP INTF_INTR offsets out of hwio header [+ + +]
Author: Marijn Suijten <[email protected]>
Date:   Thu Apr 27 00:37:17 2023 +0200

    drm/msm/dpu: Move non-MDP_TOP INTF_INTR offsets out of hwio header
    
    [ Upstream commit e9d9ce5462fecdeefec87953de71df4d025cbc72 ]
    
    These offsets do not fall under the MDP TOP block and do not fit the
    comment right above.  Move them to dpu_hw_interrupts.c next to the
    repsective MDP_INTF_x_OFF interrupt block offsets.
    
    Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
    Signed-off-by: Marijn Suijten <[email protected]>
    Reviewed-by: Konrad Dybcio <[email protected]>
    Reviewed-by: Dmitry Baryshkov <[email protected]>
    Reviewed-by: Abhinav Kumar <[email protected]>
    Patchwork: https://patchwork.freedesktop.org/patch/534203/
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Abhinav Kumar <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

drm/msm/dpu: Remove duplicate register defines from INTF [+ + +]
Author: Marijn Suijten <[email protected]>
Date:   Thu Apr 27 00:37:22 2023 +0200

    drm/msm/dpu: Remove duplicate register defines from INTF
    
    [ Upstream commit 202c044203ac5860e3025169105368d99f9bc6a2 ]
    
    The INTF_FRAME_LINE_COUNT_EN, INTF_FRAME_COUNT and INTF_LINE_COUNT
    registers are already defined higher up, in the right place when sorted
    numerically.
    
    Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
    Signed-off-by: Marijn Suijten <[email protected]>
    Reviewed-by: Konrad Dybcio <[email protected]>
    Reviewed-by: Dmitry Baryshkov <[email protected]>
    Reviewed-by: Abhinav Kumar <[email protected]>
    Patchwork: https://patchwork.freedesktop.org/patch/534231/
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Abhinav Kumar <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
drm/tegra: Avoid potential 32-bit integer overflow [+ + +]
Author: Nur Hussein <[email protected]>
Date:   Thu Apr 6 04:25:59 2023 +0800

    drm/tegra: Avoid potential 32-bit integer overflow
    
    [ Upstream commit 2429b3c529da29d4277d519bd66d034842dcd70c ]
    
    In tegra_sor_compute_config(), the 32-bit value mode->clock is
    multiplied by 1000, and assigned to the u64 variable pclk. We can avoid
    a potential 32-bit integer overflow by casting mode->clock to u64 before
    we do the arithmetic and assignment.
    
    Signed-off-by: Nur Hussein <[email protected]>
    Signed-off-by: Thierry Reding <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
dt-bindings: display/msm: dsi-controller-main: Document qcom, master-dsi and qcom, sync-dual-dsi [+ + +]
Author: Jianhua Lu <[email protected]>
Date:   Thu Apr 27 20:21:32 2023 +0800

    dt-bindings: display/msm: dsi-controller-main: Document qcom, master-dsi and qcom, sync-dual-dsi
    
    [ Upstream commit ca29699a57ecee6084a4056f5bfd6f11dd359a71 ]
    
    This fixes warning:
      sm8250-xiaomi-elish-csot.dtb: [email protected]: Unevaluated properties are not allowed ('qcom,master-dsi', 'qcom,sync-dual-dsi' were unexpected)
    
    Reviewed-by: Dmitry Baryshkov <[email protected]>
    Acked-by: Rob Herring <[email protected]>
    Signed-off-by: Jianhua Lu <[email protected]>
    Fixes: 4dbe55c97741 ("dt-bindings: msm: dsi: add yaml schemas for DSI bindings")
    Reviewed-by: Abhinav Kumar <[email protected]>
    Patchwork: https://patchwork.freedesktop.org/patch/534306/
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Abhinav Kumar <quic_a[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
erspan: get the proto with the md version for collect_md [+ + +]
Author: Xin Long <[email protected]>
Date:   Thu May 11 19:22:11 2023 -0400

    erspan: get the proto with the md version for collect_md
    
    [ Upstream commit d80fc101d2eb9b3188c228d61223890aeea480a4 ]
    
    In commit 20704bd1633d ("erspan: build the header with the right proto
    according to erspan_ver"), it gets the proto with t->parms.erspan_ver,
    but t->parms.erspan_ver is not used by collect_md branch, and instead
    it should get the proto with md->version for collect_md.
    
    Thanks to Kevin for pointing this out.
    
    Fixes: 20704bd1633d ("erspan: build the header with the right proto according to erspan_ver")
    Fixes: 94d7d8f29287 ("ip6_gre: add erspan v2 support")
    Reported-by: Kevin Traynor <[email protected]>
    Signed-off-by: Xin Long <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Reviewed-by: William Tu <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
ext2: Check block size validity during mount [+ + +]
Author: Jan Kara <[email protected]>
Date:   Wed Mar 1 11:59:39 2023 +0100

    ext2: Check block size validity during mount
    
    [ Upstream commit 62aeb94433fcec80241754b70d0d1836d5926b0a ]
    
    Check that log of block size stored in the superblock has sensible
    value. Otherwise the shift computing the block size can overflow leading
    to undefined behavior.
    
    Reported-by: [email protected]
    Signed-off-by: Jan Kara <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
ext4: allow ext4_get_group_info() to fail [+ + +]
Author: Theodore Ts'o <[email protected]>
Date:   Sat Apr 29 00:06:28 2023 -0400

    ext4: allow ext4_get_group_info() to fail
    
    [ Upstream commit 5354b2af34064a4579be8bc0e2f15a7b70f14b5f ]
    
    Previously, ext4_get_group_info() would treat an invalid group number
    as BUG(), since in theory it should never happen.  However, if a
    malicious attaker (or fuzzer) modifies the superblock via the block
    device while it is the file system is mounted, it is possible for
    s_first_data_block to get set to a very large number.  In that case,
    when calculating the block group of some block number (such as the
    starting block of a preallocation region), could result in an
    underflow and very large block group number.  Then the BUG_ON check in
    ext4_get_group_info() would fire, resutling in a denial of service
    attack that can be triggered by root or someone with write access to
    the block device.
    
    For a quality of implementation perspective, it's best that even if
    the system administrator does something that they shouldn't, that it
    will not trigger a BUG.  So instead of BUG'ing, ext4_get_group_info()
    will call ext4_error and return NULL.  We also add fallback code in
    all of the callers of ext4_get_group_info() that it might NULL.
    
    Also, since ext4_get_group_info() was already borderline to be an
    inline function, un-inline it.  The results in a next reduction of the
    compiled text size of ext4 by roughly 2k.
    
    Cc: [email protected]
    Link: https://lore.kernel.org/r/[email protected]
    Reported-by: [email protected]
    Link: https://syzkaller.appspot.com/bug?id=69b28112e098b070f639efb356393af3ffec4220
    Signed-off-by: Theodore Ts'o <[email protected]>
    Reviewed-by: Jan Kara <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set [+ + +]
Author: Kemeng Shi <[email protected]>
Date:   Sat Mar 4 01:21:02 2023 +0800

    ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set
    
    [ Upstream commit 01e4ca29451760b9ac10b4cdc231c52150842643 ]
    
    If EXT4_MB_HINT_GOAL_ONLY is set, ext4_mb_regular_allocator will only
    allocate blocks from ext4_mb_find_by_goal. Allow to find by goal in
    ext4_mb_find_by_goal if EXT4_MB_HINT_GOAL_ONLY is set or allocation
    with EXT4_MB_HINT_GOAL_ONLY set will always fail.
    
    EXT4_MB_HINT_GOAL_ONLY is not used at all, so the problem is not
    found for now.
    
    Signed-off-by: Kemeng Shi <[email protected]>
    Reviewed-by: Ojaswin Mujoo <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Theodore Ts'o <[email protected]>
    Stable-dep-of: 5354b2af3406 ("ext4: allow ext4_get_group_info() to fail")
    Signed-off-by: Sasha Levin <[email protected]>

ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled [+ + +]
Author: Theodore Ts'o <[email protected]>
Date:   Fri May 5 21:02:30 2023 -0400

    ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled
    
    [ Upstream commit a44be64bbecb15a452496f60db6eacfee2b59c79 ]
    
    When a file system currently mounted read/only is remounted
    read/write, if we clear the SB_RDONLY flag too early, before the quota
    is initialized, and there is another process/thread constantly
    attempting to create a directory, it's possible to trigger the
    
            WARN_ON_ONCE(dquot_initialize_needed(inode));
    
    in ext4_xattr_block_set(), with the following stack trace:
    
       WARNING: CPU: 0 PID: 5338 at fs/ext4/xattr.c:2141 ext4_xattr_block_set+0x2ef2/0x3680
       RIP: 0010:ext4_xattr_block_set+0x2ef2/0x3680 fs/ext4/xattr.c:2141
       Call Trace:
        ext4_xattr_set_handle+0xcd4/0x15c0 fs/ext4/xattr.c:2458
        ext4_initxattrs+0xa3/0x110 fs/ext4/xattr_security.c:44
        security_inode_init_security+0x2df/0x3f0 security/security.c:1147
        __ext4_new_inode+0x347e/0x43d0 fs/ext4/ialloc.c:1324
        ext4_mkdir+0x425/0xce0 fs/ext4/namei.c:2992
        vfs_mkdir+0x29d/0x450 fs/namei.c:4038
        do_mkdirat+0x264/0x520 fs/namei.c:4061
        __do_sys_mkdirat fs/namei.c:4076 [inline]
        __se_sys_mkdirat fs/namei.c:4074 [inline]
        __x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4074
    
    Cc: [email protected]
    Link: https://lore.kernel.org/r/[email protected]
    Reported-by: [email protected]
    Link: https://syzkaller.appspot.com/bug?id=6513f6cb5cd6b5fc9f37e3bb70d273b94be9c34c
    Signed-off-by: Theodore Ts'o <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() [+ + +]
Author: Ojaswin Mujoo <[email protected]>
Date:   Sat Mar 25 13:43:39 2023 +0530

    ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()
    
    [ Upstream commit 93cdf49f6eca5e23f6546b8f28457b2e6a6961d9 ]
    
    When the length of best extent found is less than the length of goal extent
    we need to make sure that the best extent atleast covers the start of the
    original request. This is done by adjusting the ac_b_ex.fe_logical (logical
    start) of the extent.
    
    While doing so, the current logic sometimes results in the best extent's
    logical range overflowing the goal extent. Since this best extent is later
    added to the inode preallocation list, we have a possibility of introducing
    overlapping preallocations. This is discussed in detail here [1].
    
    As per Jan's suggestion, to fix this, replace the existing logic with the
    below logic for adjusting best extent as it keeps fragmentation in check
    while ensuring logical range of best extent doesn't overflow out of goal
    extent:
    
    1. Check if best extent can be kept at end of goal range and still cover
       original start.
    2. Else, check if best extent can be kept at start of goal range and still
       cover original start.
    3. Else, keep the best extent at start of original request.
    
    Also, add a few extra BUG_ONs that might help catch errors faster.
    
    [1] https://lore.kernel.org/r/[email protected]
    
    Suggested-by: Jan Kara <[email protected]>
    Signed-off-by: Ojaswin Mujoo <[email protected]>
    Reviewed-by: Ritesh Harjani (IBM) <[email protected]>
    Reviewed-by: Jan Kara <[email protected]>
    Link: https://lore.kernel.org/r/f96aca6d415b36d1f90db86c1a8cd7e2e9d7ab0e.1679731817.git.ojaswin@linux.ibm.com
    Signed-off-by: Theodore Ts'o <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

ext4: fix lockdep warning when enabling MMP [+ + +]
Author: Jan Kara <[email protected]>
Date:   Tue Apr 11 14:10:19 2023 +0200

    ext4: fix lockdep warning when enabling MMP
    
    [ Upstream commit 949f95ff39bf188e594e7ecd8e29b82eb108f5bf ]
    
    When we enable MMP in ext4_multi_mount_protect() during mount or
    remount, we end up calling sb_start_write() from write_mmp_block(). This
    triggers lockdep warning because freeze protection ranks above s_umount
    semaphore we are holding during mount / remount. The problem is harmless
    because we are guaranteed the filesystem is not frozen during mount /
    remount but still let's fix the warning by not grabbing freeze
    protection from ext4_multi_mount_protect().
    
    Cc: [email protected]
    Reported-by: [email protected]
    Link: https://syzkaller.appspot.com/bug?id=ab7e5b6f400b7778d46f01841422e5718fb81843
    Signed-off-by: Jan Kara <[email protected]>
    Reviewed-by: Christian Brauner <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Theodore Ts'o <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

ext4: reflect error codes from ext4_multi_mount_protect() to its callers [+ + +]
Author: Theodore Ts'o <[email protected]>
Date:   Thu Apr 27 22:49:34 2023 -0400

    ext4: reflect error codes from ext4_multi_mount_protect() to its callers
    
    [ Upstream commit 3b50d5018ed06a647bb26c44bb5ae74e59c903c7 ]
    
    This will allow more fine-grained errno codes to be returned by the
    mount system call.
    
    Cc: Andreas Dilger <[email protected]>
    Signed-off-by: Theodore Ts'o <[email protected]>
    Stable-dep-of: a44be64bbecb ("ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled")
    Signed-off-by: Sasha Levin <[email protected]>

ext4: remove an unused variable warning with CONFIG_QUOTA=n [+ + +]
Author: Austin Kim <[email protected]>
Date:   Tue Aug 24 04:49:29 2021 +0100

    ext4: remove an unused variable warning with CONFIG_QUOTA=n
    
    [ Upstream commit 3bbef91bdd2180c67407285ba160b023eb4d5306 ]
    
    The 'enable_quota' variable is only used in an CONFIG_QUOTA.
    With CONFIG_QUOTA=n, compiler causes a harmless warning:
    
    fs/ext4/super.c: In function ‘ext4_remount’:
    fs/ext4/super.c:5840:6: warning: variable ‘enable_quota’ set but not used
      [-Wunused-but-set-variable]
      int enable_quota = 0;
                  ^~~~~
    
    Move 'enable_quota' into the same #ifdef CONFIG_QUOTA block
    to remove an unused variable warning.
    
    Signed-off-by: Austin Kim <[email protected]>
    Reviewed-by: Jan Kara <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Theodore Ts'o <[email protected]>
    Stable-dep-of: a44be64bbecb ("ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled")
    Signed-off-by: Sasha Levin <[email protected]>

ext4: set goal start correctly in ext4_mb_normalize_request [+ + +]
Author: Kemeng Shi <[email protected]>
Date:   Sat Mar 4 01:21:01 2023 +0800

    ext4: set goal start correctly in ext4_mb_normalize_request
    
    [ Upstream commit b07ffe6927c75d99af534d685282ea188d9f71a6 ]
    
    We need to set ac_g_ex to notify the goal start used in
    ext4_mb_find_by_goal. Set ac_g_ex instead of ac_f_ex in
    ext4_mb_normalize_request.
    Besides we should assure goal start is in range [first_data_block,
    blocks_count) as ext4_mb_initialize_context does.
    
    [ Added a check to make sure size is less than ar->pright; otherwise
      we could end up passing an underflowed value of ar->pright - size to
      ext4_get_group_no_and_offset(), which will trigger a BUG_ON later on.
      - TYT ]
    
    Signed-off-by: Kemeng Shi <[email protected]>
    Reviewed-by: Ritesh Harjani (IBM) <[email protected]>
    Link: https://lore.kernel.org/r/20230303172120.3800725-2-shikem[email protected]
    Signed-off-by: Theodore Ts'o <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
f2fs: fix to check readonly condition correctly [+ + +]
Author: Chao Yu <[email protected]>
Date:   Tue Apr 4 23:28:07 2023 +0800

    f2fs: fix to check readonly condition correctly
    
    [ Upstream commit d78dfefcde9d311284434560d69c0478c55a657e ]
    
    With below case, it can mount multi-device image w/ rw option, however
    one of secondary device is set as ro, later update will cause panic, so
    let's introduce f2fs_dev_is_readonly(), and check multi-devices rw status
    in f2fs_remount() w/ it in order to avoid such inconsistent mount status.
    
    mkfs.f2fs -c /dev/zram1 /dev/zram0 -f
    blockdev --setro /dev/zram1
    mount -t f2fs dev/zram0 /mnt/f2fs
    mount: /mnt/f2fs: WARNING: source write-protected, mounted read-only.
    mount -t f2fs -o remount,rw mnt/f2fs
    dd if=/dev/zero  of=/mnt/f2fs/file bs=1M count=8192
    
    kernel BUG at fs/f2fs/inline.c:258!
    RIP: 0010:f2fs_write_inline_data+0x23e/0x2d0 [f2fs]
    Call Trace:
      f2fs_write_single_data_page+0x26b/0x9f0 [f2fs]
      f2fs_write_cache_pages+0x389/0xa60 [f2fs]
      __f2fs_write_data_pages+0x26b/0x2d0 [f2fs]
      f2fs_write_data_pages+0x2e/0x40 [f2fs]
      do_writepages+0xd3/0x1b0
      __writeback_single_inode+0x5b/0x420
      writeback_sb_inodes+0x236/0x5a0
      __writeback_inodes_wb+0x56/0xf0
      wb_writeback+0x2a3/0x490
      wb_do_writeback+0x2b2/0x330
      wb_workfn+0x6a/0x260
      process_one_work+0x270/0x5e0
      worker_thread+0x52/0x3e0
      kthread+0xf4/0x120
      ret_from_fork+0x29/0x50
    
    Signed-off-by: Chao Yu <[email protected]>
    Signed-off-by: Jaegeuk Kim <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

f2fs: fix to drop all dirty pages during umount() if cp_error is set [+ + +]
Author: Chao Yu <[email protected]>
Date:   Mon Apr 10 10:12:22 2023 +0800

    f2fs: fix to drop all dirty pages during umount() if cp_error is set
    
    [ Upstream commit c9b3649a934d131151111354bcbb638076f03a30 ]
    
    xfstest generic/361 reports a bug as below:
    
    f2fs_bug_on(sbi, sbi->fsync_node_num);
    
    kernel BUG at fs/f2fs/super.c:1627!
    RIP: 0010:f2fs_put_super+0x3a8/0x3b0
    Call Trace:
     generic_shutdown_super+0x8c/0x1b0
     kill_block_super+0x2b/0x60
     kill_f2fs_super+0x87/0x110
     deactivate_locked_super+0x39/0x80
     deactivate_super+0x46/0x50
     cleanup_mnt+0x109/0x170
     __cleanup_mnt+0x16/0x20
     task_work_run+0x65/0xa0
     exit_to_user_mode_prepare+0x175/0x190
     syscall_exit_to_user_mode+0x25/0x50
     do_syscall_64+0x4c/0x90
     entry_SYSCALL_64_after_hwframe+0x72/0xdc
    
    During umount(), if cp_error is set, f2fs_wait_on_all_pages() should
    not stop waiting all F2FS_WB_CP_DATA pages to be writebacked, otherwise,
    fsync_node_num can be non-zero after f2fs_wait_on_all_pages() causing
    this bug.
    
    In this case, to avoid deadloop in f2fs_wait_on_all_pages(), it needs
    to drop all dirty pages rather than redirtying them.
    
    Signed-off-by: Chao Yu <[email protected]>
    Signed-off-by: Jaegeuk Kim <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
fbdev: arcfb: Fix error handling in arcfb_probe() [+ + +]
Author: Zongjie Li <[email protected]>
Date:   Tue May 9 19:27:26 2023 +0800

    fbdev: arcfb: Fix error handling in arcfb_probe()
    
    [ Upstream commit 5a6bef734247c7a8c19511664ff77634ab86f45b ]
    
    Smatch complains that:
    arcfb_probe() warn: 'irq' from request_irq() not released on lines: 587.
    
    Fix error handling in the arcfb_probe() function. If IO addresses are
    not provided or framebuffer registration fails, the code will jump to
    the err_addr or err_register_fb label to release resources.
    If IRQ request fails, previously allocated resources will be freed.
    
    Fixes: 1154ea7dcd8e ("[PATCH] Framebuffer driver for Arc LCD board")
    Signed-off-by: Zongjie Li <[email protected]>
    Reviewed-by: Dongliang Mu <[email protected]>
    Signed-off-by: Helge Deller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
firmware: arm_sdei: Fix sleep from invalid context BUG [+ + +]
Author: Pierre Gondois <[email protected]>
Date:   Thu Feb 16 09:49:19 2023 +0100

    firmware: arm_sdei: Fix sleep from invalid context BUG
    
    [ Upstream commit d2c48b2387eb89e0bf2a2e06e30987cf410acad4 ]
    
    Running a preempt-rt (v6.2-rc3-rt1) based kernel on an Ampere Altra
    triggers:
    
      BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46
      in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 24, name: cpuhp/0
      preempt_count: 0, expected: 0
      RCU nest depth: 0, expected: 0
      3 locks held by cpuhp/0/24:
        #0: ffffda30217c70d0 (cpu_hotplug_lock){++++}-{0:0}, at: cpuhp_thread_fun+0x5c/0x248
        #1: ffffda30217c7120 (cpuhp_state-up){+.+.}-{0:0}, at: cpuhp_thread_fun+0x5c/0x248
        #2: ffffda3021c711f0 (sdei_list_lock){....}-{3:3}, at: sdei_cpuhp_up+0x3c/0x130
      irq event stamp: 36
      hardirqs last  enabled at (35): [<ffffda301e85b7bc>] finish_task_switch+0xb4/0x2b0
      hardirqs last disabled at (36): [<ffffda301e812fec>] cpuhp_thread_fun+0x21c/0x248
      softirqs last  enabled at (0): [<ffffda301e80b184>] copy_process+0x63c/0x1ac0
      softirqs last disabled at (0): [<0000000000000000>] 0x0
      CPU: 0 PID: 24 Comm: cpuhp/0 Not tainted 5.19.0-rc3-rt5-[...]
      Hardware name: WIWYNN Mt.Jade Server [...]
      Call trace:
        dump_backtrace+0x114/0x120
        show_stack+0x20/0x70
        dump_stack_lvl+0x9c/0xd8
        dump_stack+0x18/0x34
        __might_resched+0x188/0x228
        rt_spin_lock+0x70/0x120
        sdei_cpuhp_up+0x3c/0x130
        cpuhp_invoke_callback+0x250/0xf08
        cpuhp_thread_fun+0x120/0x248
        smpboot_thread_fn+0x280/0x320
        kthread+0x130/0x140
        ret_from_fork+0x10/0x20
    
    sdei_cpuhp_up() is called in the STARTING hotplug section,
    which runs with interrupts disabled. Use a CPUHP_AP_ONLINE_DYN entry
    instead to execute the cpuhp cb later, with preemption enabled.
    
    SDEI originally got its own cpuhp slot to allow interacting
    with perf. It got superseded by pNMI and this early slot is not
    relevant anymore. [1]
    
    Some SDEI calls (e.g. SDEI_1_0_FN_SDEI_PE_MASK) take actions on the
    calling CPU. It is checked that preemption is disabled for them.
    _ONLINE cpuhp cb are executed in the 'per CPU hotplug thread'.
    Preemption is enabled in those threads, but their cpumask is limited
    to 1 CPU.
    Move 'WARN_ON_ONCE(preemptible())' statements so that SDEI cpuhp cb
    don't trigger them.
    
    Also add a check for the SDEI_1_0_FN_SDEI_PRIVATE_RESET SDEI call
    which acts on the calling CPU.
    
    [1]:
    https://lore.kernel.org/all/[email protected]/
    
    Suggested-by: James Morse <[email protected]>
    Signed-off-by: Pierre Gondois <[email protected]>
    Reviewed-by: James Morse <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Will Deacon <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
fs/ntfs3: Add length check in indx_get_root [+ + +]
Author: Edward Lo <[email protected]>
Date:   Tue Oct 4 23:15:06 2022 +0800

    fs/ntfs3: Add length check in indx_get_root
    
    [ Upstream commit 08e8cf5f2d9ec383a2e339a2711b62a54ff3fba0 ]
    
    This adds a length check to guarantee the retrieved index root is legit.
    
    [  162.459513] BUG: KASAN: use-after-free in hdr_find_e.isra.0+0x10c/0x320
    [  162.460176] Read of size 2 at addr ffff8880037bca99 by task mount/243
    [  162.460851]
    [  162.461252] CPU: 0 PID: 243 Comm: mount Not tainted 6.0.0-rc7 #42
    [  162.461744] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
    [  162.462609] Call Trace:
    [  162.462954]  <TASK>
    [  162.463276]  dump_stack_lvl+0x49/0x63
    [  162.463822]  print_report.cold+0xf5/0x689
    [  162.464608]  ? unwind_get_return_address+0x3a/0x60
    [  162.465766]  ? hdr_find_e.isra.0+0x10c/0x320
    [  162.466975]  kasan_report+0xa7/0x130
    [  162.467506]  ? _raw_spin_lock_irq+0xc0/0xf0
    [  162.467998]  ? hdr_find_e.isra.0+0x10c/0x320
    [  162.468536]  __asan_load2+0x68/0x90
    [  162.468923]  hdr_find_e.isra.0+0x10c/0x320
    [  162.469282]  ? cmp_uints+0xe0/0xe0
    [  162.469557]  ? cmp_sdh+0x90/0x90
    [  162.469864]  ? ni_find_attr+0x214/0x300
    [  162.470217]  ? ni_load_mi+0x80/0x80
    [  162.470479]  ? entry_SYSCALL_64_after_hwframe+0x63/0xcd
    [  162.470931]  ? ntfs_bread_run+0x190/0x190
    [  162.471307]  ? indx_get_root+0xe4/0x190
    [  162.471556]  ? indx_get_root+0x140/0x190
    [  162.471833]  ? indx_init+0x1e0/0x1e0
    [  162.472069]  ? fnd_clear+0x115/0x140
    [  162.472363]  ? _raw_spin_lock_irqsave+0x100/0x100
    [  162.472731]  indx_find+0x184/0x470
    [  162.473461]  ? sysvec_apic_timer_interrupt+0x57/0xc0
    [  162.474429]  ? indx_find_buffer+0x2d0/0x2d0
    [  162.474704]  ? do_syscall_64+0x3b/0x90
    [  162.474962]  dir_search_u+0x196/0x2f0
    [  162.475381]  ? ntfs_nls_to_utf16+0x450/0x450
    [  162.475661]  ? ntfs_security_init+0x3d6/0x440
    [  162.475906]  ? is_sd_valid+0x180/0x180
    [  162.476191]  ntfs_extend_init+0x13f/0x2c0
    [  162.476496]  ? ntfs_fix_post_read+0x130/0x130
    [  162.476861]  ? iput.part.0+0x286/0x320
    [  162.477325]  ntfs_fill_super+0x11e0/0x1b50
    [  162.477709]  ? put_ntfs+0x1d0/0x1d0
    [  162.477970]  ? vsprintf+0x20/0x20
    [  162.478258]  ? set_blocksize+0x95/0x150
    [  162.478538]  get_tree_bdev+0x232/0x370
    [  162.478789]  ? put_ntfs+0x1d0/0x1d0
    [  162.479038]  ntfs_fs_get_tree+0x15/0x20
    [  162.479374]  vfs_get_tree+0x4c/0x130
    [  162.479729]  path_mount+0x654/0xfe0
    [  162.480124]  ? putname+0x80/0xa0
    [  162.480484]  ? finish_automount+0x2e0/0x2e0
    [  162.480894]  ? putname+0x80/0xa0
    [  162.481467]  ? kmem_cache_free+0x1c4/0x440
    [  162.482280]  ? putname+0x80/0xa0
    [  162.482714]  do_mount+0xd6/0xf0
    [  162.483264]  ? path_mount+0xfe0/0xfe0
    [  162.484782]  ? __kasan_check_write+0x14/0x20
    [  162.485593]  __x64_sys_mount+0xca/0x110
    [  162.486024]  do_syscall_64+0x3b/0x90
    [  162.486543]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
    [  162.487141] RIP: 0033:0x7f9d374e948a
    [  162.488324] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008
    [  162.489728] RSP: 002b:00007ffe30e73d18 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
    [  162.490971] RAX: ffffffffffffffda RBX: 0000561cdb43a060 RCX: 00007f9d374e948a
    [  162.491669] RDX: 0000561cdb43a260 RSI: 0000561cdb43a2e0 RDI: 0000561cdb442af0
    [  162.492050] RBP: 0000000000000000 R08: 0000561cdb43a280 R09: 0000000000000020
    [  162.492459] R10: 00000000c0ed0000 R11: 0000000000000206 R12: 0000561cdb442af0
    [  162.493183] R13: 0000561cdb43a260 R14: 0000000000000000 R15: 00000000ffffffff
    [  162.493644]  </TASK>
    [  162.493908]
    [  162.494214] The buggy address belongs to the physical page:
    [  162.494761] page:000000003e38a3d5 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x37bc
    [  162.496064] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)
    [  162.497278] raw: 000fffffc0000000 ffffea00000df1c8 ffffea00000df008 0000000000000000
    [  162.498928] raw: 0000000000000000 0000000000240000 00000000ffffffff 0000000000000000
    [  162.500542] page dumped because: kasan: bad access detected
    [  162.501057]
    [  162.501242] Memory state around the buggy address:
    [  162.502230]  ffff8880037bc980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    [  162.502977]  ffff8880037bca00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    [  162.503522] >ffff8880037bca80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    [  162.503963]                             ^
    [  162.504370]  ffff8880037bcb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    [  162.504766]  ffff8880037bcb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    
    Signed-off-by: Edward Lo <[email protected]>
    Signed-off-by: Konstantin Komarov <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

fs/ntfs3: Enhance the attribute size check [+ + +]
Author: Edward Lo <[email protected]>
Date:   Thu Oct 27 23:33:37 2022 +0800

    fs/ntfs3: Enhance the attribute size check
    
    [ Upstream commit 4f082a7531223a438c757bb20e304f4c941c67a8 ]
    
    This combines the overflow and boundary check so that all attribute size
    will be properly examined while enumerating them.
    
    [  169.181521] BUG: KASAN: slab-out-of-bounds in run_unpack+0x2e3/0x570
    [  169.183161] Read of size 1 at addr ffff8880094b6240 by task mount/247
    [  169.184046]
    [  169.184925] CPU: 0 PID: 247 Comm: mount Not tainted 6.0.0-rc7+ #3
    [  169.185908] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
    [  169.187066] Call Trace:
    [  169.187492]  <TASK>
    [  169.188049]  dump_stack_lvl+0x49/0x63
    [  169.188495]  print_report.cold+0xf5/0x689
    [  169.188964]  ? run_unpack+0x2e3/0x570
    [  169.189331]  kasan_report+0xa7/0x130
    [  169.189714]  ? run_unpack+0x2e3/0x570
    [  169.190079]  __asan_load1+0x51/0x60
    [  169.190634]  run_unpack+0x2e3/0x570
    [  169.191290]  ? run_pack+0x840/0x840
    [  169.191569]  ? run_lookup_entry+0xb3/0x1f0
    [  169.192443]  ? mi_enum_attr+0x20a/0x230
    [  169.192886]  run_unpack_ex+0xad/0x3e0
    [  169.193276]  ? run_unpack+0x570/0x570
    [  169.193557]  ? ni_load_mi+0x80/0x80
    [  169.193889]  ? debug_smp_processor_id+0x17/0x20
    [  169.194236]  ? mi_init+0x4a/0x70
    [  169.194496]  attr_load_runs_vcn+0x166/0x1c0
    [  169.194851]  ? attr_data_write_resident+0x250/0x250
    [  169.195188]  mi_read+0x133/0x2c0
    [  169.195481]  ntfs_iget5+0x277/0x1780
    [  169.196017]  ? call_rcu+0x1c7/0x330
    [  169.196392]  ? ntfs_get_block_bmap+0x70/0x70
    [  169.196708]  ? evict+0x223/0x280
    [  169.197014]  ? __kmalloc+0x33/0x540
    [  169.197305]  ? wnd_init+0x15b/0x1b0
    [  169.197599]  ntfs_fill_super+0x1026/0x1ba0
    [  169.197994]  ? put_ntfs+0x1d0/0x1d0
    [  169.198299]  ? vsprintf+0x20/0x20
    [  169.198583]  ? mutex_unlock+0x81/0xd0
    [  169.198930]  ? set_blocksize+0x95/0x150
    [  169.199269]  get_tree_bdev+0x232/0x370
    [  169.199750]  ? put_ntfs+0x1d0/0x1d0
    [  169.200094]  ntfs_fs_get_tree+0x15/0x20
    [  169.200431]  vfs_get_tree+0x4c/0x130
    [  169.200714]  path_mount+0x654/0xfe0
    [  169.201067]  ? putname+0x80/0xa0
    [  169.201358]  ? finish_automount+0x2e0/0x2e0
    [  169.201965]  ? putname+0x80/0xa0
    [  169.202445]  ? kmem_cache_free+0x1c4/0x440
    [  169.203075]  ? putname+0x80/0xa0
    [  169.203414]  do_mount+0xd6/0xf0
    [  169.203719]  ? path_mount+0xfe0/0xfe0
    [  169.203977]  ? __kasan_check_write+0x14/0x20
    [  169.204382]  __x64_sys_mount+0xca/0x110
    [  169.204711]  do_syscall_64+0x3b/0x90
    [  169.205059]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
    [  169.205571] RIP: 0033:0x7f67a80e948a
    [  169.206327] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008
    [  169.208296] RSP: 002b:00007ffddf020f58 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
    [  169.209253] RAX: ffffffffffffffda RBX: 000055e2547a6060 RCX: 00007f67a80e948a
    [  169.209777] RDX: 000055e2547a6260 RSI: 000055e2547a62e0 RDI: 000055e2547aeaf0
    [  169.210342] RBP: 0000000000000000 R08: 000055e2547a6280 R09: 0000000000000020
    [  169.210843] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 000055e2547aeaf0
    [  169.211307] R13: 000055e2547a6260 R14: 0000000000000000 R15: 00000000ffffffff
    [  169.211913]  </TASK>
    [  169.212304]
    [  169.212680] Allocated by task 0:
    [  169.212963] (stack is not available)
    [  169.213200]
    [  169.213472] The buggy address belongs to the object at ffff8880094b5e00
    [  169.213472]  which belongs to the cache UDP of size 1152
    [  169.214095] The buggy address is located 1088 bytes inside of
    [  169.214095]  1152-byte region [ffff8880094b5e00, ffff8880094b6280)
    [  169.214639]
    [  169.215004] The buggy address belongs to the physical page:
    [  169.215766] page:000000002e324c8c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x94b4
    [  169.218412] head:000000002e324c8c order:2 compound_mapcount:0 compound_pincount:0
    [  169.219078] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff)
    [  169.220272] raw: 000fffffc0010200 0000000000000000 dead000000000122 ffff888002409b40
    [  169.221006] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
    [  169.222320] page dumped because: kasan: bad access detected
    [  169.222922]
    [  169.223119] Memory state around the buggy address:
    [  169.224056]  ffff8880094b6100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    [  169.224908]  ffff8880094b6180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    [  169.225677] >ffff8880094b6200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    [  169.226445]                                            ^
    [  169.227055]  ffff8880094b6280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    [  169.227638]  ffff8880094b6300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    
    Signed-off-by: Edward Lo <[email protected]>
    Signed-off-by: Konstantin Komarov <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

fs/ntfs3: Fix a possible null-pointer dereference in ni_clear() [+ + +]
Author: Jia-Ju Bai <[email protected]>
Date:   Wed Jan 11 16:59:43 2023 +0800

    fs/ntfs3: Fix a possible null-pointer dereference in ni_clear()
    
    [ Upstream commit ec275bf9693d19cc0fdce8436f4c425ced86f6e7 ]
    
    In a previous commit c1006bd13146, ni->mi.mrec in ni_write_inode()
    could be NULL, and thus a NULL check is added for this variable.
    
    However, in the same call stack, ni->mi.mrec can be also dereferenced
    in ni_clear():
    
    ntfs_evict_inode(inode)
      ni_write_inode(inode, ...)
        ni = ntfs_i(inode);
        is_rec_inuse(ni->mi.mrec) -> Add a NULL check by previous commit
      ni_clear(ntfs_i(inode))
        is_rec_inuse(ni->mi.mrec) -> No check
    
    Thus, a possible null-pointer dereference may exist in ni_clear().
    To fix it, a NULL check is added in this function.
    
    Signed-off-by: Jia-Ju Bai <[email protected]>
    Reported-by: TOTE Robot <[email protected]>
    Signed-off-by: Konstantin Komarov <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

fs/ntfs3: Fix NULL dereference in ni_write_inode [+ + +]
Author: Abdun Nihaal <[email protected]>
Date:   Sun Oct 30 12:32:51 2022 +0530

    fs/ntfs3: Fix NULL dereference in ni_write_inode
    
    [ Upstream commit 8dae4f6341e335a09575be60b4fdf697c732a470 ]
    
    Syzbot reports a NULL dereference in ni_write_inode.
    When creating a new inode, if allocation fails in mi_init function
    (called in mi_format_new function), mi->mrec is set to NULL.
    In the error path of this inode creation, mi->mrec is later
    dereferenced in ni_write_inode.
    
    Add a NULL check to prevent NULL dereference.
    
    Link: https://syzkaller.appspot.com/bug?extid=f45957555ed4a808cc7a
    Reported-and-tested-by: [email protected]
    Signed-off-by: Abdun Nihaal <[email protected]>
    Signed-off-by: Konstantin Komarov <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

fs/ntfs3: Fix NULL pointer dereference in 'ni_write_inode' [+ + +]
Author: Ye Bin <[email protected]>
Date:   Thu Nov 17 17:19:12 2022 +0800

    fs/ntfs3: Fix NULL pointer dereference in 'ni_write_inode'
    
    [ Upstream commit db2a3cc6a3481076da6344cc62a80a4e2525f36f ]
    
    Syzbot found the following issue:
    Unable to handle kernel NULL pointer dereference at virtual address 0000000000000016
    Mem abort info:
      ESR = 0x0000000096000006
      EC = 0x25: DABT (current EL), IL = 32 bits
      SET = 0, FnV = 0
      EA = 0, S1PTW = 0
      FSC = 0x06: level 2 translation fault
    Data abort info:
      ISV = 0, ISS = 0x00000006
      CM = 0, WnR = 0
    user pgtable: 4k pages, 48-bit VAs, pgdp=000000010af56000
    [0000000000000016] pgd=08000001090da003, p4d=08000001090da003, pud=08000001090ce003, pmd=0000000000000000
    Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
    Modules linked in:
    CPU: 1 PID: 3036 Comm: syz-executor206 Not tainted 6.0.0-rc6-syzkaller-17739-g16c9f284e746 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
    pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    pc : is_rec_inuse fs/ntfs3/ntfs.h:313 [inline]
    pc : ni_write_inode+0xac/0x798 fs/ntfs3/frecord.c:3232
    lr : ni_write_inode+0xa0/0x798 fs/ntfs3/frecord.c:3226
    sp : ffff8000126c3800
    x29: ffff8000126c3860 x28: 0000000000000000 x27: ffff0000c8b02000
    x26: ffff0000c7502320 x25: ffff0000c7502288 x24: 0000000000000000
    x23: ffff80000cbec91c x22: ffff0000c8b03000 x21: ffff0000c8b02000
    x20: 0000000000000001 x19: ffff0000c75024d8 x18: 00000000000000c0
    x17: ffff80000dd1b198 x16: ffff80000db59158 x15: ffff0000c4b6b500
    x14: 00000000000000b8 x13: 0000000000000000 x12: ffff0000c4b6b500
    x11: ff80800008be1b60 x10: 0000000000000000 x9 : ffff0000c4b6b500
    x8 : 0000000000000000 x7 : ffff800008be1b50 x6 : 0000000000000000
    x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
    x2 : 0000000000000008 x1 : 0000000000000001 x0 : 0000000000000000
    Call trace:
     is_rec_inuse fs/ntfs3/ntfs.h:313 [inline]
     ni_write_inode+0xac/0x798 fs/ntfs3/frecord.c:3232
     ntfs_evict_inode+0x54/0x84 fs/ntfs3/inode.c:1744
     evict+0xec/0x334 fs/inode.c:665
     iput_final fs/inode.c:1748 [inline]
     iput+0x2c4/0x324 fs/inode.c:1774
     ntfs_new_inode+0x7c/0xe0 fs/ntfs3/fsntfs.c:1660
     ntfs_create_inode+0x20c/0xe78 fs/ntfs3/inode.c:1278
     ntfs_create+0x54/0x74 fs/ntfs3/namei.c:100
     lookup_open fs/namei.c:3413 [inline]
     open_last_lookups fs/namei.c:3481 [inline]
     path_openat+0x804/0x11c4 fs/namei.c:3688
     do_filp_open+0xdc/0x1b8 fs/namei.c:3718
     do_sys_openat2+0xb8/0x22c fs/open.c:1311
     do_sys_open fs/open.c:1327 [inline]
     __do_sys_openat fs/open.c:1343 [inline]
     __se_sys_openat fs/open.c:1338 [inline]
     __arm64_sys_openat+0xb0/0xe0 fs/open.c:1338
     __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
     invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
     el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
     do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
     el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636
     el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
     el0t_64_sync+0x18c/0x190
    Code: 97dafee4 340001b4 f9401328 2a1f03e0 (79402d14)
    ---[ end trace 0000000000000000 ]---
    
    Above issue may happens as follows:
    ntfs_new_inode
      mi_init
        mi->mrec = kmalloc(sbi->record_size, GFP_NOFS); -->failed to allocate memory
          if (!mi->mrec)
            return -ENOMEM;
    iput
      iput_final
        evict
          ntfs_evict_inode
            ni_write_inode
              is_rec_inuse(ni->mi.mrec)-> As 'ni->mi.mrec' is NULL trigger NULL-ptr-deref
    
    To solve above issue if new inode failed make inode bad before call 'iput()' in
    'ntfs_new_inode()'.
    
    Reported-by: [email protected]
    Signed-off-by: Ye Bin <[email protected]>
    Signed-off-by: Konstantin Komarov <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

fs/ntfs3: Validate MFT flags before replaying logs [+ + +]
Author: Edward Lo <[email protected]>
Date:   Sat Nov 5 23:39:44 2022 +0800

    fs/ntfs3: Validate MFT flags before replaying logs
    
    [ Upstream commit 98bea253aa28ad8be2ce565a9ca21beb4a9419e5 ]
    
    Log load and replay is part of the metadata handle flow during mount
    operation. The $MFT record will be loaded and used while replaying logs.
    However, a malformed $MFT record, say, has RECORD_FLAG_DIR flag set and
    contains an ATTR_ROOT attribute will misguide kernel to treat it as a
    directory, and try to free the allocated resources when the
    corresponding inode is freed, which will cause an invalid kfree because
    the memory hasn't actually been allocated.
    
    [  101.368647] BUG: KASAN: invalid-free in kvfree+0x2c/0x40
    [  101.369457]
    [  101.369986] CPU: 0 PID: 198 Comm: mount Not tainted 6.0.0-rc7+ #5
    [  101.370529] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
    [  101.371362] Call Trace:
    [  101.371795]  <TASK>
    [  101.372157]  dump_stack_lvl+0x49/0x63
    [  101.372658]  print_report.cold+0xf5/0x689
    [  101.373022]  ? ni_write_inode+0x754/0xd90
    [  101.373378]  ? kvfree+0x2c/0x40
    [  101.373698]  kasan_report_invalid_free+0x77/0xf0
    [  101.374058]  ? kvfree+0x2c/0x40
    [  101.374352]  ? kvfree+0x2c/0x40
    [  101.374668]  __kasan_slab_free+0x189/0x1b0
    [  101.374992]  ? kvfree+0x2c/0x40
    [  101.375271]  kfree+0x168/0x3b0
    [  101.375717]  kvfree+0x2c/0x40
    [  101.376002]  indx_clear+0x26/0x60
    [  101.376316]  ni_clear+0xc5/0x290
    [  101.376661]  ntfs_evict_inode+0x45/0x70
    [  101.377001]  evict+0x199/0x280
    [  101.377432]  iput.part.0+0x286/0x320
    [  101.377819]  iput+0x32/0x50
    [  101.378166]  ntfs_loadlog_and_replay+0x143/0x320
    [  101.378656]  ? ntfs_bio_fill_1+0x510/0x510
    [  101.378968]  ? iput.part.0+0x286/0x320
    [  101.379367]  ntfs_fill_super+0xecb/0x1ba0
    [  101.379729]  ? put_ntfs+0x1d0/0x1d0
    [  101.380046]  ? vsprintf+0x20/0x20
    [  101.380542]  ? mutex_unlock+0x81/0xd0
    [  101.380914]  ? set_blocksize+0x95/0x150
    [  101.381597]  get_tree_bdev+0x232/0x370
    [  101.382254]  ? put_ntfs+0x1d0/0x1d0
    [  101.382699]  ntfs_fs_get_tree+0x15/0x20
    [  101.383094]  vfs_get_tree+0x4c/0x130
    [  101.383675]  path_mount+0x654/0xfe0
    [  101.384203]  ? putname+0x80/0xa0
    [  101.384540]  ? finish_automount+0x2e0/0x2e0
    [  101.384943]  ? putname+0x80/0xa0
    [  101.385362]  ? kmem_cache_free+0x1c4/0x440
    [  101.385968]  ? putname+0x80/0xa0
    [  101.386666]  do_mount+0xd6/0xf0
    [  101.387228]  ? path_mount+0xfe0/0xfe0
    [  101.387585]  ? __kasan_check_write+0x14/0x20
    [  101.387979]  __x64_sys_mount+0xca/0x110
    [  101.388436]  do_syscall_64+0x3b/0x90
    [  101.388757]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
    [  101.389289] RIP: 0033:0x7fa0f70e948a
    [  101.390048] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008
    [  101.391297] RSP: 002b:00007ffc24fdecc8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
    [  101.391988] RAX: ffffffffffffffda RBX: 000055932c183060 RCX: 00007fa0f70e948a
    [  101.392494] RDX: 000055932c183260 RSI: 000055932c1832e0 RDI: 000055932c18bce0
    [  101.393053] RBP: 0000000000000000 R08: 000055932c183280 R09: 0000000000000020
    [  101.393577] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 000055932c18bce0
    [  101.394044] R13: 000055932c183260 R14: 0000000000000000 R15: 00000000ffffffff
    [  101.394747]  </TASK>
    [  101.395402]
    [  101.396047] Allocated by task 198:
    [  101.396724]  kasan_save_stack+0x26/0x50
    [  101.397400]  __kasan_slab_alloc+0x6d/0x90
    [  101.397974]  kmem_cache_alloc_lru+0x192/0x5a0
    [  101.398524]  ntfs_alloc_inode+0x23/0x70
    [  101.399137]  alloc_inode+0x3b/0xf0
    [  101.399534]  iget5_locked+0x54/0xa0
    [  101.400026]  ntfs_iget5+0xaf/0x1780
    [  101.400414]  ntfs_loadlog_and_replay+0xe5/0x320
    [  101.400883]  ntfs_fill_super+0xecb/0x1ba0
    [  101.401313]  get_tree_bdev+0x232/0x370
    [  101.401774]  ntfs_fs_get_tree+0x15/0x20
    [  101.402224]  vfs_get_tree+0x4c/0x130
    [  101.402673]  path_mount+0x654/0xfe0
    [  101.403160]  do_mount+0xd6/0xf0
    [  101.403537]  __x64_sys_mount+0xca/0x110
    [  101.404058]  do_syscall_64+0x3b/0x90
    [  101.404333]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
    [  101.404816]
    [  101.405067] The buggy address belongs to the object at ffff888008cc9ea0
    [  101.405067]  which belongs to the cache ntfs_inode_cache of size 992
    [  101.406171] The buggy address is located 232 bytes inside of
    [  101.406171]  992-byte region [ffff888008cc9ea0, ffff888008cca280)
    [  101.406995]
    [  101.408559] The buggy address belongs to the physical page:
    [  101.409320] page:00000000dccf19dd refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8cc8
    [  101.410654] head:00000000dccf19dd order:2 compound_mapcount:0 compound_pincount:0
    [  101.411533] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff)
    [  101.412665] raw: 000fffffc0010200 0000000000000000 dead000000000122 ffff888003695140
    [  101.413209] raw: 0000000000000000 00000000800e000e 00000001ffffffff 0000000000000000
    [  101.413799] page dumped because: kasan: bad access detected
    [  101.414213]
    [  101.414427] Memory state around the buggy address:
    [  101.414991]  ffff888008cc9e80: fc fc fc fc 00 00 00 00 00 00 00 00 00 00 00 00
    [  101.415785]  ffff888008cc9f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    [  101.416933] >ffff888008cc9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    [  101.417857]                       ^
    [  101.418566]  ffff888008cca000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    [  101.419704]  ffff888008cca080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    
    Signed-off-by: Edward Lo <[email protected]>
    Signed-off-by: Konstantin Komarov <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() [+ + +]
Author: Tetsuo Handa <[email protected]>
Date:   Tue Apr 11 19:57:33 2023 +0900

    fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()
    
    [ Upstream commit 81b21c0f0138ff5a499eafc3eb0578ad2a99622c ]
    
    syzbot is hitting WARN_ON() in hfsplus_cat_{read,write}_inode(), for
    crafted filesystem image can contain bogus length. There conditions are
    not kernel bugs that can justify kernel to panic.
    
    Reported-by: syzbot <[email protected]>
    Link: https://syzkaller.appspot.com/bug?extid=e2787430e752a92b8750
    Reported-by: syzbot <[email protected]>
    Link: https://syzkaller.appspot.com/bug?extid=4913dca2ea6e4d43f3f1
    Signed-off-by: Tetsuo Handa <[email protected]>
    Reviewed-by: Viacheslav Dubeyko <slav[email protected]>
    Message-Id: <[email protected]>
    Signed-off-by: Christian Brauner <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
gfs2: Fix inode height consistency check [+ + +]
Author: Andreas Gruenbacher <[email protected]>
Date:   Tue Mar 28 00:43:16 2023 +0200

    gfs2: Fix inode height consistency check
    
    [ Upstream commit cfcdb5bad34f600aed7613c3c1a5e618111f77b7 ]
    
    The maximum allowed height of an inode's metadata tree depends on the
    filesystem block size; it is lower for bigger-block filesystems.  When
    reading in an inode, make sure that the height doesn't exceed the
    maximum allowed height.
    
    Arrays like sd_heightsize are sized to be big enough for any filesystem
    block size; they will often be slightly bigger than what's needed for a
    specific filesystem.
    
    Reported-by: [email protected]
    Signed-off-by: Andreas Gruenbacher <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
gve: Remove the code of clearing PBA bit [+ + +]
Author: Ziwei Xiao <[email protected]>
Date:   Tue May 9 15:51:23 2023 -0700

    gve: Remove the code of clearing PBA bit
    
    [ Upstream commit f4c2e67c1773d2a2632381ee30e9139c1e744c16 ]
    
    Clearing the PBA bit from the driver is race prone and it may lead to
    dropped interrupt events. This could potentially lead to the traffic
    being completely halted.
    
    Fixes: 5e8c5adf95f8 ("gve: DQO: Add core netdev features")
    Signed-off-by: Ziwei Xiao <[email protected]>
    Signed-off-by: Bailey Forrest <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
HID: logitech-hidpp: Don't use the USB serial for USB devices [+ + +]
Author: Bastien Nocera <[email protected]>
Date:   Thu Mar 2 14:01:16 2023 +0100

    HID: logitech-hidpp: Don't use the USB serial for USB devices
    
    [ Upstream commit 7ad1fe0da0fa91bf920b79ab05ae97bfabecc4f4 ]
    
    For devices that support the 0x0003 feature (Device Information) version 4,
    set the serial based on the output of that feature, rather than relying
    on the usbhid code setting the USB serial.
    
    This should allow the serial when connected through USB to (nearly)
    match the one when connected through a unifying receiver.
    
    For example, on the serials on a G903 wired/wireless mouse:
    - Unifying: 4067-e8-ce-cd-45
    - USB before patch: 017C385C3837
    - USB after patch: c086-e8-ce-cd-45
    
    Signed-off-by: Bastien Nocera <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Benjamin Tissoires <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

HID: logitech-hidpp: Reconcile USB and Unifying serials [+ + +]
Author: Bastien Nocera <[email protected]>
Date:   Thu Mar 2 14:01:17 2023 +0100

    HID: logitech-hidpp: Reconcile USB and Unifying serials
    
    [ Upstream commit 5b3691d15e04b6d5a32c915577b8dbc5cfb56382 ]
    
    Now that USB HID++ devices can gather a serial number that matches the
    one that would be gathered when connected through a Unifying receiver,
    remove the last difference by dropping the product ID as devices
    usually have different product IDs when connected through USB or
    Unifying.
    
    For example, on the serials on a G903 wired/wireless mouse:
    - Unifying before patch: 4067-e8-ce-cd-45
    - USB before patch: c086-e8-ce-cd-45
    - Unifying and USB after patch: e8-ce-cd-45
    
    Signed-off-by: Bastien Nocera <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Benjamin Tissoires <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs [+ + +]
Author: Ping Cheng <[email protected]>
Date:   Fri Aug 26 14:34:02 2022 -0700

    HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs
    
    commit 0627f3df95e1609693f89e7ceb4156ac5db6e358 upstream.
    
    Add the new PIDs to wacom_wac.c to support the new model in the Intuos Pro series.
    
    Signed-off-by: Ping Cheng <[email protected]>
    Tested-by: Aaron Armstrong Skomra <[email protected]>
    Signed-off-by: Jiri Kosina <[email protected]>
    Cc: Ping Cheng <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

HID: wacom: add three styli to wacom_intuos_get_tool_type [+ + +]
Author: Ping Cheng <[email protected]>
Date:   Wed Sep 28 13:49:29 2022 -0700

    HID: wacom: add three styli to wacom_intuos_get_tool_type
    
    commit bfdc750c4cb2f3461b9b00a2755e2145ac195c9a upstream.
    
    We forgot to add the 3D pen ID a year ago. There are two new pro pen
    IDs to be added.
    
    Signed-off-by: Ping Cheng <[email protected]>
    Signed-off-by: Jiri Kosina <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

HID: wacom: Force pen out of prox if no events have been received in a while [+ + +]
Author: Jason Gerecke <[email protected]>
Date:   Fri Jul 15 16:05:19 2022 -0700

    HID: wacom: Force pen out of prox if no events have been received in a while
    
    commit 94b179052f95c294d83e9c9c34f7833cf3cd4305 upstream.
    
    Prox-out events may not be reliably sent by some AES firmware. This can
    cause problems for users, particularly due to arbitration logic disabling
    touch input while the pen is in prox.
    
    This commit adds a timer which is reset every time a new prox event is
    received. When the timer expires we check to see if the pen is still in
    prox and force it out if necessary. This is patterend off of the same
    solution used by 'hid-letsketch' driver which has a similar problem.
    
    Link: https://github.com/linuxwacom/input-wacom/issues/310
    Signed-off-by: Jason Gerecke <[email protected]>
    Signed-off-by: Jiri Kosina <[email protected]>
    Cc: Ping Cheng <pingli[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

HID: wacom: generic: Set battery quirk only when we see battery data [+ + +]
Author: Jason Gerecke <[email protected]>
Date:   Thu Apr 13 11:17:43 2023 -0700

    HID: wacom: generic: Set battery quirk only when we see battery data
    
    [ Upstream commit bea407a427baa019758f29f4d31b26f008bb8cc6 ]
    
    Some devices will include battery status usages in the HID descriptor
    but we won't see that battery data for one reason or another. For example,
    AES sensors won't send battery data unless an AES pen is in proximity.
    If a user does not have an AES pen but instead only interacts with the
    AES touchscreen with their fingers then there is no need for us to create
    a battery object. Similarly, if a family of peripherals shares the same
    HID descriptor between wired-only and wireless-capable SKUs, users of the
    former may never see a battery event and will not want a power_supply
    object created.
    
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=217062
    Link: https://gitlab.gnome.org/GNOME/gnome-control-center/-/issues/2354
    Signed-off-by: Jason Gerecke <[email protected]>
    Tested-by: Mario Limonciello <[email protected]>
    Signed-off-by: Jiri Kosina <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
igb: fix bit_shift to be in [1..8] range [+ + +]
Author: Aleksandr Loktionov <[email protected]>
Date:   Tue May 16 10:41:46 2023 -0700

    igb: fix bit_shift to be in [1..8] range
    
    [ Upstream commit 60d758659f1fb49e0d5b6ac2691ede8c0958795b ]
    
    In igb_hash_mc_addr() the expression:
            "mc_addr[4] >> 8 - bit_shift", right shifting "mc_addr[4]"
    shift by more than 7 bits always yields zero, so hash becomes not so different.
    Add initialization with bit_shift = 1 and add a loop condition to ensure
    bit_shift will be always in [1..8] range.
    
    Fixes: 9d5c824399de ("igb: PCI-Express 82575 Gigabit Ethernet driver")
    Signed-off-by: Aleksandr Loktionov <[email protected]>
    Tested-by: Pucha Himasekhar Reddy <[email protected]> (A Contingent worker at Intel)
    Signed-off-by: Tony Nguyen <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
Input: xpad - add constants for GIP interface numbers [+ + +]
Author: Vicki Pfau <[email protected]>
Date:   Thu Apr 13 23:57:42 2023 -0700

    Input: xpad - add constants for GIP interface numbers
    
    [ Upstream commit f9b2e603c6216824e34dc9a67205d98ccc9a41ca ]
    
    Wired GIP devices present multiple interfaces with the same USB identification
    other than the interface number. This adds constants for differentiating two of
    them and uses them where appropriate
    
    Signed-off-by: Vicki Pfau <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Dmitry Torokhov <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
iommu/arm-smmu-qcom: Limit the SMR groups to 128 [+ + +]
Author: Manivannan Sadhasivam <[email protected]>
Date:   Mon Mar 27 13:30:29 2023 +0530

    iommu/arm-smmu-qcom: Limit the SMR groups to 128
    
    [ Upstream commit 12261134732689b7e30c59db9978f81230965181 ]
    
    Some platforms support more than 128 stream matching groups than what is
    defined by the ARM SMMU architecture specification. But due to some unknown
    reasons, those additional groups don't exhibit the same behavior as the
    architecture supported ones.
    
    For instance, the additional groups will not detect the quirky behavior of
    some firmware versions intercepting writes to S2CR register, thus skipping
    the quirk implemented in the driver and causing boot crash.
    
    So let's limit the groups to 128 for now until the issue with those groups
    are fixed and issue a notice to users in that case.
    
    Reviewed-by: Johan Hovold <[email protected]>
    Tested-by: Johan Hovold <johan+[email protected]>
    Signed-off-by: Manivannan Sadhasivam <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    [will: Reworded the comment slightly]
    Signed-off-by: Will Deacon <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any [+ + +]
Author: Tomas Krcka <[email protected]>
Date:   Wed Mar 29 12:34:19 2023 +0000

    iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any
    
    [ Upstream commit 67ea0b7ce41844eae7c10bb04dfe66a23318c224 ]
    
    When an overflow occurs in the PRI queue, the SMMU toggles the overflow
    flag in the PROD register. To exit the overflow condition, the PRI thread
    is supposed to acknowledge it by toggling this flag in the CONS register.
    Unacknowledged overflow causes the queue to stop adding anything new.
    
    Currently, the priq thread always writes the CONS register back to the
    SMMU after clearing the queue.
    
    The writeback is not necessary if the OVFLG in the PROD register has not
    been changed, no overflow has occured.
    
    This commit checks the difference of the overflow flag between CONS and
    PROD register. If it's different, toggles the OVACKFLG flag in the CONS
    register and write it to the SMMU.
    
    The situation is similar for the event queue.
    The acknowledge register is also toggled after clearing the event
    queue but never propagated to the hardware. This would only be done the
    next time when executing evtq thread.
    
    Unacknowledged event queue overflow doesn't affect the event
    queue, because the SMMU still adds elements to that queue when the
    overflow condition is active.
    But it feel nicer to keep SMMU in sync when possible, so use the same
    way here as well.
    
    Signed-off-by: Tomas Krcka <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Will Deacon <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
iommu/sprd: Release dma buffer to avoid memory leak [+ + +]
Author: Chunyan Zhang <[email protected]>
Date:   Fri Mar 31 11:31:23 2023 +0800

    iommu/sprd: Release dma buffer to avoid memory leak
    
    [ Upstream commit 9afea57384d4ae7b2034593eac7fa76c7122762a ]
    
    When attaching to a domain, the driver would alloc a DMA buffer which
    is used to store address mapping table, and it need to be released
    when the IOMMU domain is freed.
    
    Signed-off-by: Chunyan Zhang <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Joerg Roedel <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
Linux: ipvlan:Fix out-of-bounds caused by unclear skb->cb [+ + +]
Author: t.feng <[email protected]>
Date:   Wed May 10 11:50:44 2023 +0800

    ipvlan:Fix out-of-bounds caused by unclear skb->cb
    
    [ Upstream commit 90cbed5247439a966b645b34eb0a2e037836ea8e ]
    
    If skb enqueue the qdisc, fq_skb_cb(skb)->time_to_send is changed which
    is actually skb->cb, and IPCB(skb_in)->opt will be used in
    __ip_options_echo. It is possible that memcpy is out of bounds and lead
    to stack overflow.
    We should clear skb->cb before ip_local_out or ip6_local_out.
    
    v2:
    1. clean the stack info
    2. use IPCB/IP6CB instead of skb->cb
    
    crash on stable-5.10(reproduce in kasan kernel).
    Stack info:
    [ 2203.651571] BUG: KASAN: stack-out-of-bounds in
    __ip_options_echo+0x589/0x800
    [ 2203.653327] Write of size 4 at addr ffff88811a388f27 by task
    swapper/3/0
    [ 2203.655460] CPU: 3 PID: 0 Comm: swapper/3 Kdump: loaded Not tainted
    5.10.0-60.18.0.50.h856.kasan.eulerosv2r11.x86_64 #1
    [ 2203.655466] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
    BIOS rel-1.10.2-0-g5f4c7b1-20181220_000000-szxrtosci10000 04/01/2014
    [ 2203.655475] Call Trace:
    [ 2203.655481]  <IRQ>
    [ 2203.655501]  dump_stack+0x9c/0xd3
    [ 2203.655514]  print_address_description.constprop.0+0x19/0x170
    [ 2203.655530]  __kasan_report.cold+0x6c/0x84
    [ 2203.655586]  kasan_report+0x3a/0x50
    [ 2203.655594]  check_memory_region+0xfd/0x1f0
    [ 2203.655601]  memcpy+0x39/0x60
    [ 2203.655608]  __ip_options_echo+0x589/0x800
    [ 2203.655654]  __icmp_send+0x59a/0x960
    [ 2203.655755]  nf_send_unreach+0x129/0x3d0 [nf_reject_ipv4]
    [ 2203.655763]  reject_tg+0x77/0x1bf [ipt_REJECT]
    [ 2203.655772]  ipt_do_table+0x691/0xa40 [ip_tables]
    [ 2203.655821]  nf_hook_slow+0x69/0x100
    [ 2203.655828]  __ip_local_out+0x21e/0x2b0
    [ 2203.655857]  ip_local_out+0x28/0x90
    [ 2203.655868]  ipvlan_process_v4_outbound+0x21e/0x260 [ipvlan]
    [ 2203.655931]  ipvlan_xmit_mode_l3+0x3bd/0x400 [ipvlan]
    [ 2203.655967]  ipvlan_queue_xmit+0xb3/0x190 [ipvlan]
    [ 2203.655977]  ipvlan_start_xmit+0x2e/0xb0 [ipvlan]
    [ 2203.655984]  xmit_one.constprop.0+0xe1/0x280
    [ 2203.655992]  dev_hard_start_xmit+0x62/0x100
    [ 2203.656000]  sch_direct_xmit+0x215/0x640
    [ 2203.656028]  __qdisc_run+0x153/0x1f0
    [ 2203.656069]  __dev_queue_xmit+0x77f/0x1030
    [ 2203.656173]  ip_finish_output2+0x59b/0xc20
    [ 2203.656244]  __ip_finish_output.part.0+0x318/0x3d0
    [ 2203.656312]  ip_finish_output+0x168/0x190
    [ 2203.656320]  ip_output+0x12d/0x220
    [ 2203.656357]  __ip_queue_xmit+0x392/0x880
    [ 2203.656380]  __tcp_transmit_skb+0x1088/0x11c0
    [ 2203.656436]  __tcp_retransmit_skb+0x475/0xa30
    [ 2203.656505]  tcp_retransmit_skb+0x2d/0x190
    [ 2203.656512]  tcp_retransmit_timer+0x3af/0x9a0
    [ 2203.656519]  tcp_write_timer_handler+0x3ba/0x510
    [ 2203.656529]  tcp_write_timer+0x55/0x180
    [ 2203.656542]  call_timer_fn+0x3f/0x1d0
    [ 2203.656555]  expire_timers+0x160/0x200
    [ 2203.656562]  run_timer_softirq+0x1f4/0x480
    [ 2203.656606]  __do_softirq+0xfd/0x402
    [ 2203.656613]  asm_call_irq_on_stack+0x12/0x20
    [ 2203.656617]  </IRQ>
    [ 2203.656623]  do_softirq_own_stack+0x37/0x50
    [ 2203.656631]  irq_exit_rcu+0x134/0x1a0
    [ 2203.656639]  sysvec_apic_timer_interrupt+0x36/0x80
    [ 2203.656646]  asm_sysvec_apic_timer_interrupt+0x12/0x20
    [ 2203.656654] RIP: 0010:default_idle+0x13/0x20
    [ 2203.656663] Code: 89 f0 5d 41 5c 41 5d 41 5e c3 cc cc cc cc cc cc cc
    cc cc cc cc cc cc 0f 1f 44 00 00 0f 1f 44 00 00 0f 00 2d 9f 32 57 00 fb
    f4 <c3> cc cc cc cc 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 54 be 08
    [ 2203.656668] RSP: 0018:ffff88810036fe78 EFLAGS: 00000256
    [ 2203.656676] RAX: ffffffffaf2a87f0 RBX: ffff888100360000 RCX:
    ffffffffaf290191
    [ 2203.656681] RDX: 0000000000098b5e RSI: 0000000000000004 RDI:
    ffff88811a3c4f60
    [ 2203.656686] RBP: 0000000000000000 R08: 0000000000000001 R09:
    ffff88811a3c4f63
    [ 2203.656690] R10: ffffed10234789ec R11: 0000000000000001 R12:
    0000000000000003
    [ 2203.656695] R13: ffff888100360000 R14: 0000000000000000 R15:
    0000000000000000
    [ 2203.656729]  default_idle_call+0x5a/0x150
    [ 2203.656735]  cpuidle_idle_call+0x1c6/0x220
    [ 2203.656780]  do_idle+0xab/0x100
    [ 2203.656786]  cpu_startup_entry+0x19/0x20
    [ 2203.656793]  secondary_startup_64_no_verify+0xc2/0xcb
    
    [ 2203.657409] The buggy address belongs to the page:
    [ 2203.658648] page:0000000027a9842f refcount:1 mapcount:0
    mapping:0000000000000000 index:0x0 pfn:0x11a388
    [ 2203.658665] flags:
    0x17ffffc0001000(reserved|node=0|zone=2|lastcpupid=0x1fffff)
    [ 2203.658675] raw: 0017ffffc0001000 ffffea000468e208 ffffea000468e208
    0000000000000000
    [ 2203.658682] raw: 0000000000000000 0000000000000000 00000001ffffffff
    0000000000000000
    [ 2203.658686] page dumped because: kasan: bad access detected
    
    To reproduce(ipvlan with IPVLAN_MODE_L3):
    Env setting:
    =======================================================
    modprobe ipvlan ipvlan_default_mode=1
    sysctl net.ipv4.conf.eth0.forwarding=1
    iptables -t nat -A POSTROUTING -s 20.0.0.0/255.255.255.0 -o eth0 -j
    MASQUERADE
    ip link add gw link eth0 type ipvlan
    ip -4 addr add 20.0.0.254/24 dev gw
    ip netns add net1
    ip link add ipv1 link eth0 type ipvlan
    ip link set ipv1 netns net1
    ip netns exec net1 ip link set ipv1 up
    ip netns exec net1 ip -4 addr add 20.0.0.4/24 dev ipv1
    ip netns exec net1 route add default gw 20.0.0.254
    ip netns exec net1 tc qdisc add dev ipv1 root netem loss 10%
    ifconfig gw up
    iptables -t filter -A OUTPUT -p tcp --dport 8888 -j REJECT --reject-with
    icmp-port-unreachable
    =======================================================
    And then excute the shell(curl any address of eth0 can reach):
    
    for((i=1;i<=100000;i++))
    do
            ip netns exec net1 curl x.x.x.x:8888
    done
    =======================================================
    
    Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.")
    Signed-off-by: "t.feng" <[email protected]>
    Suggested-by: Florian Westphal <[email protected]>
    Reviewed-by: Paolo Abeni <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
ipvs: Update width of source for ip_vs_sync_conn_options [+ + +]
Author: Simon Horman <[email protected]>
Date:   Mon Apr 17 17:10:45 2023 +0200

    ipvs: Update width of source for ip_vs_sync_conn_options
    
    [ Upstream commit e3478c68f6704638d08f437cbc552ca5970c151a ]
    
    In ip_vs_sync_conn_v0() copy is made to struct ip_vs_sync_conn_options.
    That structure looks like this:
    
    struct ip_vs_sync_conn_options {
            struct ip_vs_seq        in_seq;
            struct ip_vs_seq        out_seq;
    };
    
    The source of the copy is the in_seq field of struct ip_vs_conn.  Whose
    type is struct ip_vs_seq. Thus we can see that the source - is not as
    wide as the amount of data copied, which is the width of struct
    ip_vs_sync_conn_option.
    
    The copy is safe because the next field in is another struct ip_vs_seq.
    Make use of struct_group() to annotate this.
    
    Flagged by gcc-13 as:
    
     In file included from ./include/linux/string.h:254,
                      from ./include/linux/bitmap.h:11,
                      from ./include/linux/cpumask.h:12,
                      from ./arch/x86/include/asm/paravirt.h:17,
                      from ./arch/x86/include/asm/cpuid.h:62,
                      from ./arch/x86/include/asm/processor.h:19,
                      from ./arch/x86/include/asm/timex.h:5,
                      from ./include/linux/timex.h:67,
                      from ./include/linux/time32.h:13,
                      from ./include/linux/time.h:60,
                      from ./include/linux/stat.h:19,
                      from ./include/linux/module.h:13,
                      from net/netfilter/ipvs/ip_vs_sync.c:38:
     In function 'fortify_memcpy_chk',
         inlined from 'ip_vs_sync_conn_v0' at net/netfilter/ipvs/ip_vs_sync.c:606:3:
     ./include/linux/fortify-string.h:529:25: error: call to '__read_overflow2_field' declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning]
       529 |                         __read_overflow2_field(q_size_field, size);
           |
    
    Compile tested only.
    
    Signed-off-by: Simon Horman <[email protected]>
    Reviewed-by: Horatiu Vultur <[email protected]>
    Signed-off-by: Pablo Neira Ayuso <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
ksmbd: allocate one more byte for implied bcc[0] [+ + +]
Author: Chih-Yen Chang <[email protected]>
Date:   Sat May 6 00:03:54 2023 +0900

    ksmbd: allocate one more byte for implied bcc[0]
    
    commit 443d61d1fa9faa60ef925513d83742902390100f upstream.
    
    ksmbd_smb2_check_message allows client to return one byte more, so we
    need to allocate additional memory in ksmbd_conn_handler_loop to avoid
    out-of-bound access.
    
    Cc: [email protected]
    Signed-off-by: Chih-Yen Chang <[email protected]>
    Acked-by: Namjae Jeon <[email protected]>
    Signed-off-by: Steve French <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

ksmbd: fix global-out-of-bounds in smb2_find_context_vals [+ + +]
Author: Chih-Yen Chang <[email protected]>
Date:   Sun May 14 12:05:05 2023 +0900

    ksmbd: fix global-out-of-bounds in smb2_find_context_vals
    
    commit 02f76c401d17e409ed45bf7887148fcc22c93c85 upstream.
    
    Add tag_len argument in smb2_find_context_vals() to avoid out-of-bound
    read when create_context's name_len is larger than tag length.
    
    [    7.995411] ==================================================================
    [    7.995866] BUG: KASAN: global-out-of-bounds in memcmp+0x83/0xa0
    [    7.996248] Read of size 8 at addr ffffffff8258d940 by task kworker/0:0/7
    ...
    [    7.998191] Call Trace:
    [    7.998358]  <TASK>
    [    7.998503]  dump_stack_lvl+0x33/0x50
    [    7.998743]  print_report+0xcc/0x620
    [    7.999458]  kasan_report+0xae/0xe0
    [    7.999895]  kasan_check_range+0x35/0x1b0
    [    8.000152]  memcmp+0x83/0xa0
    [    8.000347]  smb2_find_context_vals+0xf7/0x1e0
    [    8.000635]  smb2_open+0x1df2/0x43a0
    [    8.006398]  handle_ksmbd_work+0x274/0x810
    [    8.006666]  process_one_work+0x419/0x760
    [    8.006922]  worker_thread+0x2a2/0x6f0
    [    8.007429]  kthread+0x160/0x190
    [    8.007946]  ret_from_fork+0x1f/0x30
    [    8.008181]  </TASK>
    
    Cc: [email protected]
    Signed-off-by: Chih-Yen Chang <[email protected]>
    Acked-by: Namjae Jeon <[email protected]>
    Signed-off-by: Steve French <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

ksmbd: fix wrong UserName check in session_user [+ + +]
Author: Chih-Yen Chang <[email protected]>
Date:   Sat May 6 00:01:54 2023 +0900

    ksmbd: fix wrong UserName check in session_user
    
    commit f0a96d1aafd8964e1f9955c830a3e5cb3c60a90f upstream.
    
    The offset of UserName is related to the address of security
    buffer. To ensure the validaty of UserName, we need to compare name_off
    + name_len with secbuf_len instead of auth_msg_len.
    
    [   27.096243] ==================================================================
    [   27.096890] BUG: KASAN: slab-out-of-bounds in smb_strndup_from_utf16+0x188/0x350
    [   27.097609] Read of size 2 at addr ffff888005e3b542 by task kworker/0:0/7
    ...
    [   27.099950] Call Trace:
    [   27.100194]  <TASK>
    [   27.100397]  dump_stack_lvl+0x33/0x50
    [   27.100752]  print_report+0xcc/0x620
    [   27.102305]  kasan_report+0xae/0xe0
    [   27.103072]  kasan_check_range+0x35/0x1b0
    [   27.103757]  smb_strndup_from_utf16+0x188/0x350
    [   27.105474]  smb2_sess_setup+0xaf8/0x19c0
    [   27.107935]  handle_ksmbd_work+0x274/0x810
    [   27.108315]  process_one_work+0x419/0x760
    [   27.108689]  worker_thread+0x2a2/0x6f0
    [   27.109385]  kthread+0x160/0x190
    [   27.110129]  ret_from_fork+0x1f/0x30
    [   27.110454]  </TASK>
    
    Cc: [email protected]
    Signed-off-by: Chih-Yen Chang <[email protected]>
    Acked-by: Namjae Jeon <[email protected]>
    Signed-off-by: Steve French <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

ksmbd: smb2: Allow messages padded to 8byte boundary [+ + +]
Author: Gustav Johansson <[email protected]>
Date:   Sat May 6 00:05:07 2023 +0900

    ksmbd: smb2: Allow messages padded to 8byte boundary
    
    commit e7b8b8ed9960bf699bf4029f482d9e869c094ed6 upstream.
    
    clc length is now accepted to <= 8 less than length,
    rather than < 8.
    
    Solve issues on some of Axis's smb clients which send
    messages where clc length is 8 bytes less than length.
    
    The specific client was running kernel 4.19.217 with
    smb dialect 3.0.2 on armv7l.
    
    Cc: [email protected]
    Signed-off-by: Gustav Johansson <[email protected]>
    Acked-by: Namjae Jeon <[email protected]>
    Signed-off-by: Steve French <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
lib: cpu_rmap: Avoid use after free on rmap->obj array entries [+ + +]
Author: Eli Cohen <[email protected]>
Date:   Wed Feb 8 07:51:02 2023 +0200

    lib: cpu_rmap: Avoid use after free on rmap->obj array entries
    
    [ Upstream commit 4e0473f1060aa49621d40a113afde24818101d37 ]
    
    When calling irq_set_affinity_notifier() with NULL at the notify
    argument, it will cause freeing of the glue pointer in the
    corresponding array entry but will leave the pointer in the array. A
    subsequent call to free_irq_cpu_rmap() will try to free this entry again
    leading to possible use after free.
    
    Fix that by setting NULL to the array entry and checking that we have
    non-zero at the array entry when iterating over the array in
    free_irq_cpu_rmap().
    
    The current code does not suffer from this since there are no cases
    where irq_set_affinity_notifier(irq, NULL) (note the NULL passed for the
    notify arg) is called, followed by a call to free_irq_cpu_rmap() so we
    don't hit and issue. Subsequent patches in this series excersize this
    flow, hence the required fix.
    
    Cc: Thomas Gleixner <[email protected]>
    Signed-off-by: Eli Cohen <[email protected]>
    Signed-off-by: Saeed Mahameed <[email protected]>
    Reviewed-by: Jacob Keller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
Linux: Linux 5.15.113 [+ + +]
Author: Greg Kroah-Hartman <[email protected]>
Date:   Wed May 24 17:36:55 2023 +0100

    Linux 5.15.113
    
    Link: https://lore.kernel.org/r/[email protected]
    Tested-by: Florian Fainelli <[email protected]>
    Tested-by: Chris Paterson (CIP) <[email protected]>
    Tested-by: Shuah Khan <[email protected]>
    Tested-by: Theodore Ts'o <[email protected]>
    Tested-by: Bagas Sanjaya <[email protected]>
    Tested-by: Harshit Mogalapalli <[email protected]>
    Tested-by: Jon Hunter <[email protected]>
    Tested-by: Linux Kernel Functional Testing <[email protected]>
    Tested-by: Guenter Roeck <[email protected]>
    Tested-by: Ron Economos <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
linux/dim: Do nothing if no time delta between samples [+ + +]
Author: Roy Novich <[email protected]>
Date:   Sun May 7 16:57:43 2023 +0300

    linux/dim: Do nothing if no time delta between samples
    
    [ Upstream commit 162bd18eb55adf464a0fa2b4144b8d61c75ff7c2 ]
    
    Add return value for dim_calc_stats. This is an indication for the
    caller if curr_stats was assigned by the function. Avoid using
    curr_stats uninitialized over {rdma/net}_dim, when no time delta between
    samples. Coverity reported this potential use of an uninitialized
    variable.
    
    Fixes: 4c4dbb4a7363 ("net/mlx5e: Move dynamic interrupt coalescing code to include/linux")
    Fixes: cb3c7fd4f839 ("net/mlx5e: Support adaptive RX coalescing")
    Signed-off-by: Roy Novich <[email protected]>
    Reviewed-by: Aya Levin <[email protected]>
    Reviewed-by: Saeed Mahameed <[email protected]>
    Signed-off-by: Tariq Toukan <[email protected]>
    Reviewed-by: Leon Romanovsky <[email protected]>
    Reviewed-by: Michal Kubiak <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
mcb-pci: Reallocate memory region to avoid memory overlapping [+ + +]
Author: Rodríguez Barbarin, José Javier <[email protected]>
Date:   Tue Apr 11 10:33:28 2023 +0200

    mcb-pci: Reallocate memory region to avoid memory overlapping
    
    [ Upstream commit 9be24faadd085c284890c3afcec7a0184642315a ]
    
    mcb-pci requests a fixed-size memory region to parse the chameleon
    table, however, if the chameleon table is smaller that the allocated
    region, it could overlap with the IP Cores' memory regions.
    
    After parsing the chameleon table, drop/reallocate the memory region
    with the actual chameleon table size.
    
    Co-developed-by: Jorge Sanjuan Garcia <[email protected]>
    Signed-off-by: Jorge Sanjuan Garcia <[email protected]>
    Signed-off-by: Javier Rodriguez <[email protected]>
    Signed-off-by: Johannes Thumshirn <[email protected]>
    Link: https://lore.kernel.org/r/20230411083329.4506-3-jth@kernel.org
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish() [+ + +]
Author: harperchen <[email protected]>
Date:   Thu Mar 2 13:39:05 2023 +0100

    media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish()
    
    [ Upstream commit 47e8b73bc35d7c54642f78e498697692f6358996 ]
    
    When the driver calls cx23885_risc_buffer() to prepare the buffer, the
    function call dma_alloc_coherent may fail, resulting in a empty buffer
    risc->cpu. Later when we free the buffer or access the buffer, null ptr
    deref is triggered.
    
    This bug is similar to the following one:
    https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.
    
    We believe the bug can be also dynamically triggered from user side.
    Similarly, we fix this by checking the return value of cx23885_risc_buffer()
    and the value of risc->cpu before buffer free.
    
    Signed-off-by: harperchen <[email protected]>
    Signed-off-by: Hans Verkuil <[email protected]>
    Signed-off-by: Mauro Carvalho Chehab <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

media: netup_unidvb: fix use-after-free at del_timer() [+ + +]
Author: Duoming Zhou <[email protected]>
Date:   Wed Mar 8 12:55:14 2023 +0000

    media: netup_unidvb: fix use-after-free at del_timer()
    
    [ Upstream commit 0f5bb36bf9b39a2a96e730bf4455095b50713f63 ]
    
    When Universal DVB card is detaching, netup_unidvb_dma_fini()
    uses del_timer() to stop dma->timeout timer. But when timer
    handler netup_unidvb_dma_timeout() is running, del_timer()
    could not stop it. As a result, the use-after-free bug could
    happen. The process is shown below:
    
        (cleanup routine)          |        (timer routine)
                                   | mod_timer(&dev->tx_sim_timer, ..)
    netup_unidvb_finidev()         | (wait a time)
      netup_unidvb_dma_fini()      | netup_unidvb_dma_timeout()
        del_timer(&dma->timeout);  |
                                   |   ndev->pci_dev->dev //USE
    
    Fix by changing del_timer() to del_timer_sync().
    
    Link: https://lore.kernel.org/linux-media/[email protected]
    Fixes: 52b1eaf4c59a ("[media] netup_unidvb: NetUP Universal DVB-S/S2/T/T2/C PCI-E card driver")
    Signed-off-by: Duoming Zhou <[email protected]>
    Signed-off-by: Mauro Carvalho Chehab <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish [+ + +]
Author: harperchen <[email protected]>
Date:   Fri Mar 3 16:30:11 2023 +0100

    media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish
    
    [ Upstream commit 1634b7adcc5bef645b3666fdd564e5952a9e24e0 ]
    
    When the driver calls tw68_risc_buffer() to prepare the buffer, the
    function call dma_alloc_coherent may fail, resulting in a empty buffer
    buf->cpu. Later when we free the buffer or access the buffer, null ptr
    deref is triggered.
    
    This bug is similar to the following one:
    https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.
    
    We believe the bug can be also dynamically triggered from user side.
    Similarly, we fix this by checking the return value of tw68_risc_buffer()
    and the value of buf->cpu before buffer free.
    
    Signed-off-by: harperchen <[email protected]>
    Signed-off-by: Hans Verkuil <hverkuil-cisc[email protected]>
    Signed-off-by: Mauro Carvalho Chehab <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

media: Prefer designated initializers over memset for subdev pad ops [+ + +]
Author: Laurent Pinchart <[email protected]>
Date:   Wed Feb 15 17:18:39 2023 +0200

    media: Prefer designated initializers over memset for subdev pad ops
    
    [ Upstream commit e3a69496a1cde364c74a600d7a370179b58aed29 ]
    
    Structures passed to subdev pad operations are all zero-initialized, but
    not always with the same kind of code constructs. While most drivers
    used designated initializers, which zero all the fields that are not
    specified, when declaring variables, some use memset(). Those two
    methods lead to the same end result, and, depending on compiler
    optimizations, may even be completely equivalent, but they're not
    consistent.
    
    Improve coding style consistency by using designated initializers
    instead of calling memset(). Where applicable, also move the variables
    to inner scopes of for loops to ensure correct initialization in all
    iterations.
    
    Signed-off-by: Laurent Pinchart <[email protected]>
    Reviewed-by: Lad Prabhakar <[email protected]> # For am437x
    Acked-by: Sakari Ailus <[email protected]>
    Reviewed-by: Tomi Valkeinen <[email protected]>
    Reviewed-by: Kieran Bingham <[email protected]>
    Reviewed-by: Philipp Zabel <[email protected]>
    Signed-off-by: Hans Verkuil <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
memstick: r592: Fix UAF bug in r592_remove due to race condition [+ + +]
Author: Zheng Wang <[email protected]>
Date:   Wed Mar 8 00:43:38 2023 +0800

    memstick: r592: Fix UAF bug in r592_remove due to race condition
    
    [ Upstream commit 63264422785021704c39b38f65a78ab9e4a186d7 ]
    
    In r592_probe, dev->detect_timer was bound with r592_detect_timer.
    In r592_irq function, the timer function will be invoked by mod_timer.
    
    If we remove the module which will call hantro_release to make cleanup,
    there may be a unfinished work. The possible sequence is as follows,
    which will cause a typical UAF bug.
    
    Fix it by canceling the work before cleanup in r592_remove.
    
    CPU0                  CPU1
    
                        |r592_detect_timer
    r592_remove         |
      memstick_free_host|
      put_device;       |
      kfree(host);      |
                        |
                        | queue_work
                        |   &host->media_checker //use
    
    Signed-off-by: Zheng Wang <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Ulf Hansson <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
mfd: dln2: Fix memory leak in dln2_probe() [+ + +]
Author: Qiang Ning <[email protected]>
Date:   Thu Mar 30 10:43:53 2023 +0800

    mfd: dln2: Fix memory leak in dln2_probe()
    
    [ Upstream commit 96da8f148396329ba769246cb8ceaa35f1ddfc48 ]
    
    When dln2_setup_rx_urbs() in dln2_probe() fails, error out_free forgets
    to call usb_put_dev() to decrease the refcount of dln2->usb_dev.
    
    Fix this by adding usb_put_dev() in the error handling code of
    dln2_probe().
    
    Signed-off-by: Qiang Ning <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Sasha Levin <[email protected]>

 
nbd: fix incomplete validation of ioctl arg [+ + +]
Author: Zhong Jinghua <[email protected]>
Date:   Mon Feb 6 22:58:05 2023 +0800

    nbd: fix incomplete validation of ioctl arg
    
    [ Upstream commit 55793ea54d77719a071b1ccc05a05056e3b5e009 ]
    
    We tested and found an alarm caused by nbd_ioctl arg without verification.
    The UBSAN warning calltrace like below:
    
    UBSAN: Undefined behaviour in fs/buffer.c:1709:35
    signed integer overflow:
    -9223372036854775808 - 1 cannot be represented in type 'long long int'
    CPU: 3 PID: 2523 Comm: syz-executor.0 Not tainted 4.19.90 #1
    Hardware name: linux,dummy-virt (DT)
    Call trace:
     dump_backtrace+0x0/0x3f0 arch/arm64/kernel/time.c:78
     show_stack+0x28/0x38 arch/arm64/kernel/traps.c:158
     __dump_stack lib/dump_stack.c:77 [inline]
     dump_stack+0x170/0x1dc lib/dump_stack.c:118
     ubsan_epilogue+0x18/0xb4 lib/ubsan.c:161
     handle_overflow+0x188/0x1dc lib/ubsan.c:192
     __ubsan_handle_sub_overflow+0x34/0x44 lib/ubsan.c:206
     __block_write_full_page+0x94c/0xa20 fs/buffer.c:1709
     block_write_full_page+0x1f0/0x280 fs/buffer.c:2934
     blkdev_writepage+0x34/0x40 fs/block_dev.c:607
     __writepage+0x68/0xe8 mm/page-writeback.c:2305
     write_cache_pages+0x44c/0xc70 mm/page-writeback.c:2240
     generic_writepages+0xdc/0x148 mm/page-writeback.c:2329
     blkdev_writepages+0x2c/0x38 fs/block_dev.c:2114
     do_writepages+0xd4/0x250 mm/page-writeback.c:2344
    
    The reason for triggering this warning is __block_write_full_page()
    -> i_size_read(inode) - 1 overflow.
    inode->i_size is assigned in __nbd_ioctl() -> nbd_set_size() -> bytesize.
    We think it is necessary to limit the size of arg to prevent errors.
    
    Moreover, __nbd_ioctl() -> nbd_add_socket(), arg will be cast to int.
    Assuming the value of arg is 0x80000000000000001) (on a 64-bit machine),
    it will become 1 after the coercion, which will return unexpected results.
    
    Fix it by adding checks to prevent passing in too large numbers.
    
    Signed-off-by: Zhong Jinghua <[email protected]>
    Reviewed-by: Yu Kuai <[email protected]>
    Reviewed-by: Josef Bacik <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jens Axboe <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
net: add vlan_get_protocol_and_depth() helper [+ + +]
Author: Eric Dumazet <[email protected]>
Date:   Tue May 9 13:18:57 2023 +0000

    net: add vlan_get_protocol_and_depth() helper
    
    [ Upstream commit 4063384ef762cc5946fc7a3f89879e76c6ec51e2 ]
    
    Before blamed commit, pskb_may_pull() was used instead
    of skb_header_pointer() in __vlan_get_protocol() and friends.
    
    Few callers depended on skb->head being populated with MAC header,
    syzbot caught one of them (skb_mac_gso_segment())
    
    Add vlan_get_protocol_and_depth() to make the intent clearer
    and use it where sensible.
    
    This is a more generic fix than commit e9d3f80935b6
    ("net/af_packet: make sure to pull mac header") which was
    dealing with a similar issue.
    
    kernel BUG at include/linux/skbuff.h:2655 !
    invalid opcode: 0000 [#1] SMP KASAN
    CPU: 0 PID: 1441 Comm: syz-executor199 Not tainted 6.1.24-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
    RIP: 0010:__skb_pull include/linux/skbuff.h:2655 [inline]
    RIP: 0010:skb_mac_gso_segment+0x68f/0x6a0 net/core/gro.c:136
    Code: fd 48 8b 5c 24 10 44 89 6b 70 48 c7 c7 c0 ae 0d 86 44 89 e6 e8 a1 91 d0 00 48 c7 c7 00 af 0d 86 48 89 de 31 d2 e8 d1 4a e9 ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41
    RSP: 0018:ffffc90001bd7520 EFLAGS: 00010286
    RAX: ffffffff8469736a RBX: ffff88810f31dac0 RCX: ffff888115a18b00
    RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
    RBP: ffffc90001bd75e8 R08: ffffffff84697183 R09: fffff5200037adf9
    R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000012
    R13: 000000000000fee5 R14: 0000000000005865 R15: 000000000000fed7
    FS: 000055555633f300(0000) GS:ffff8881f6a00000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000020000000 CR3: 0000000116fea000 CR4: 00000000003506f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
    <TASK>
    [<ffffffff847018dd>] __skb_gso_segment+0x32d/0x4c0 net/core/dev.c:3419
    [<ffffffff8470398a>] skb_gso_segment include/linux/netdevice.h:4819 [inline]
    [<ffffffff8470398a>] validate_xmit_skb+0x3aa/0xee0 net/core/dev.c:3725
    [<ffffffff84707042>] __dev_queue_xmit+0x1332/0x3300 net/core/dev.c:4313
    [<ffffffff851a9ec7>] dev_queue_xmit+0x17/0x20 include/linux/netdevice.h:3029
    [<ffffffff851b4a82>] packet_snd net/packet/af_packet.c:3111 [inline]
    [<ffffffff851b4a82>] packet_sendmsg+0x49d2/0x6470 net/packet/af_packet.c:3142
    [<ffffffff84669a12>] sock_sendmsg_nosec net/socket.c:716 [inline]
    [<ffffffff84669a12>] sock_sendmsg net/socket.c:736 [inline]
    [<ffffffff84669a12>] __sys_sendto+0x472/0x5f0 net/socket.c:2139
    [<ffffffff84669c75>] __do_sys_sendto net/socket.c:2151 [inline]
    [<ffffffff84669c75>] __se_sys_sendto net/socket.c:2147 [inline]
    [<ffffffff84669c75>] __x64_sys_sendto+0xe5/0x100 net/socket.c:2147
    [<ffffffff8551d40f>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff8551d40f>] do_syscall_64+0x2f/0x50 arch/x86/entry/common.c:80
    [<ffffffff85600087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    Fixes: 469aceddfa3e ("vlan: consolidate VLAN parsing code and limit max parsing depth")
    Reported-by: syzbot <[email protected]>
    Signed-off-by: Eric Dumazet <[email protected]>
    Cc: Toke Høiland-Jørgensen <[email protected]>
    Cc: Willem de Bruijn <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: annotate sk->sk_err write from do_recvmmsg() [+ + +]
Author: Eric Dumazet <[email protected]>
Date:   Tue May 9 16:35:53 2023 +0000

    net: annotate sk->sk_err write from do_recvmmsg()
    
    [ Upstream commit e05a5f510f26607616fecdd4ac136310c8bea56b ]
    
    do_recvmmsg() can write to sk->sk_err from multiple threads.
    
    As said before, many other points reading or writing sk_err
    need annotations.
    
    Fixes: 34b88a68f26a ("net: Fix use after free in the recvmmsg exit path")
    Signed-off-by: Eric Dumazet <[email protected]>
    Reported-by: syzbot <[email protected]>
    Reviewed-by: Kuniyuki Iwashima <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() [+ + +]
Author: Florian Fainelli <[email protected]>
Date:   Thu May 4 16:07:27 2023 -0700

    net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
    
    [ Upstream commit 93e0401e0fc0c54b0ac05b687cd135c2ac38187c ]
    
    The call to phy_stop() races with the later call to phy_disconnect(),
    resulting in concurrent phy_suspend() calls being run from different
    CPUs. The final call to phy_disconnect() ensures that the PHY is
    stopped and suspended, too.
    
    Fixes: c96e731c93ff ("net: bcmgenet: connect and disconnect from the PHY state machine")
    Signed-off-by: Florian Fainelli <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: bcmgenet: Restore phy_stop() depending upon suspend/close [+ + +]
Author: Florian Fainelli <[email protected]>
Date:   Sun May 14 19:56:07 2023 -0700

    net: bcmgenet: Restore phy_stop() depending upon suspend/close
    
    [ Upstream commit 225c657945c4a6307741cb3cc89467eadcc26e9b ]
    
    Removing the phy_stop() from bcmgenet_netif_stop() ended up causing
    warnings from the PHY library that phy_start() is called from the
    RUNNING state since we are no longer stopping the PHY state machine
    during bcmgenet_suspend().
    
    Restore the call to phy_stop() but make it conditional on being called
    from the close or suspend path.
    
    Fixes: c96e731c93ff ("net: bcmgenet: connect and disconnect from the PHY state machine")
    Fixes: 93e0401e0fc0 ("net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()")
    Signed-off-by: Florian Fainelli <[email protected]>
    Reviewed-by: Pavan Chebbi <[email protected]>
    Link: https://lore.kernel.org/r/202305150256[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: Catch invalid index in XPS mapping [+ + +]
Author: Nick Child <[email protected]>
Date:   Tue Mar 21 10:07:24 2023 -0500

    net: Catch invalid index in XPS mapping
    
    [ Upstream commit 5dd0dfd55baec0742ba8f5625a0dd064aca7db16 ]
    
    When setting the XPS value of a TX queue, warn the user once if the
    index of the queue is greater than the number of allocated TX queues.
    
    Previously, this scenario went uncaught. In the best case, it resulted
    in unnecessary allocations. In the worst case, it resulted in
    out-of-bounds memory references through calls to `netdev_get_tx_queue(
    dev, index)`. Therefore, it is important to inform the user but not
    worth returning an error and risk downing the netdevice.
    
    Signed-off-by: Nick Child <[email protected]>
    Reviewed-by: Piotr Raczynski <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: datagram: fix data-races in datagram_poll() [+ + +]
Author: Eric Dumazet <[email protected]>
Date:   Tue May 9 17:31:31 2023 +0000

    net: datagram: fix data-races in datagram_poll()
    
    [ Upstream commit 5bca1d081f44c9443e61841842ce4e9179d327b6 ]
    
    datagram_poll() runs locklessly, we should add READ_ONCE()
    annotations while reading sk->sk_err, sk->sk_shutdown and sk->sk_state.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Eric Dumazet <[email protected]>
    Reviewed-by: Kuniyuki Iwashima <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: deal with most data-races in sk_wait_event() [+ + +]
Author: Eric Dumazet <[email protected]>
Date:   Tue May 9 18:29:48 2023 +0000

    net: deal with most data-races in sk_wait_event()
    
    [ Upstream commit d0ac89f6f9879fae316c155de77b5173b3e2c9c9 ]
    
    __condition is evaluated twice in sk_wait_event() macro.
    
    First invocation is lockless, and reads can race with writes,
    as spotted by syzbot.
    
    BUG: KCSAN: data-race in sk_stream_wait_connect / tcp_disconnect
    
    write to 0xffff88812d83d6a0 of 4 bytes by task 9065 on cpu 1:
    tcp_disconnect+0x2cd/0xdb0
    inet_shutdown+0x19e/0x1f0 net/ipv4/af_inet.c:911
    __sys_shutdown_sock net/socket.c:2343 [inline]
    __sys_shutdown net/socket.c:2355 [inline]
    __do_sys_shutdown net/socket.c:2363 [inline]
    __se_sys_shutdown+0xf8/0x140 net/socket.c:2361
    __x64_sys_shutdown+0x31/0x40 net/socket.c:2361
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    read to 0xffff88812d83d6a0 of 4 bytes by task 9040 on cpu 0:
    sk_stream_wait_connect+0x1de/0x3a0 net/core/stream.c:75
    tcp_sendmsg_locked+0x2e4/0x2120 net/ipv4/tcp.c:1266
    tcp_sendmsg+0x30/0x50 net/ipv4/tcp.c:1484
    inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:651
    sock_sendmsg_nosec net/socket.c:724 [inline]
    sock_sendmsg net/socket.c:747 [inline]
    __sys_sendto+0x246/0x300 net/socket.c:2142
    __do_sys_sendto net/socket.c:2154 [inline]
    __se_sys_sendto net/socket.c:2150 [inline]
    __x64_sys_sendto+0x78/0x90 net/socket.c:2150
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    value changed: 0x00000000 -> 0x00000068
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-by: syzbot <[email protected]>
    Signed-off-by: Eric Dumazet <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: dsa: mv88e6xxx: Fix mv88e6393x EPC write command offset [+ + +]
Author: Marco Migliore <[email protected]>
Date:   Tue May 16 09:38:54 2023 +0200

    net: dsa: mv88e6xxx: Fix mv88e6393x EPC write command offset
    
    [ Upstream commit 1323e0c6e1d7e103d59384c3ac50f72b17a6936c ]
    
    According to datasheet, the command opcode must be specified
    into bits [14:12] of the Extended Port Control register (EPC).
    
    Fixes: de776d0d316f ("net: dsa: mv88e6xxx: add support for mv88e6393x family")
    Signed-off-by: Marco Migliore <[email protected]>
    Reviewed-by: Andrew Lunn <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: fec: Better handle pm_runtime_get() failing in .remove() [+ + +]
Author: Uwe Kleine-König <[email protected]>
Date:   Wed May 10 22:00:20 2023 +0200

    net: fec: Better handle pm_runtime_get() failing in .remove()
    
    [ Upstream commit f816b9829b19394d318e01953aa3b2721bca040d ]
    
    In the (unlikely) event that pm_runtime_get() (disguised as
    pm_runtime_resume_and_get()) fails, the remove callback returned an
    error early. The problem with this is that the driver core ignores the
    error value and continues removing the device. This results in a
    resource leak. Worse the devm allocated resources are freed and so if a
    callback of the driver is called later the register mapping is already
    gone which probably results in a crash.
    
    Fixes: a31eda65ba21 ("net: fec: fix clock count mis-match")
    Signed-off-by: Uwe Kleine-König <[email protected]>
    Reviewed-by: Andrew Lunn <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). [+ + +]
Author: Kuniyuki Iwashima <[email protected]>
Date:   Mon May 8 10:55:43 2023 -0700

    net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().
    
    [ Upstream commit dfd9248c071a3710c24365897459538551cb7167 ]
    
    KCSAN found a data race in sock_recv_cmsgs() where the read access
    to sk->sk_stamp needs READ_ONCE().
    
    BUG: KCSAN: data-race in packet_recvmsg / packet_recvmsg
    
    write (marked) to 0xffff88803c81f258 of 8 bytes by task 19171 on cpu 0:
     sock_write_timestamp include/net/sock.h:2670 [inline]
     sock_recv_cmsgs include/net/sock.h:2722 [inline]
     packet_recvmsg+0xb97/0xd00 net/packet/af_packet.c:3489
     sock_recvmsg_nosec net/socket.c:1019 [inline]
     sock_recvmsg+0x11a/0x130 net/socket.c:1040
     sock_read_iter+0x176/0x220 net/socket.c:1118
     call_read_iter include/linux/fs.h:1845 [inline]
     new_sync_read fs/read_write.c:389 [inline]
     vfs_read+0x5e0/0x630 fs/read_write.c:470
     ksys_read+0x163/0x1a0 fs/read_write.c:613
     __do_sys_read fs/read_write.c:623 [inline]
     __se_sys_read fs/read_write.c:621 [inline]
     __x64_sys_read+0x41/0x50 fs/read_write.c:621
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x72/0xdc
    
    read to 0xffff88803c81f258 of 8 bytes by task 19183 on cpu 1:
     sock_recv_cmsgs include/net/sock.h:2721 [inline]
     packet_recvmsg+0xb64/0xd00 net/packet/af_packet.c:3489
     sock_recvmsg_nosec net/socket.c:1019 [inline]
     sock_recvmsg+0x11a/0x130 net/socket.c:1040
     sock_read_iter+0x176/0x220 net/socket.c:1118
     call_read_iter include/linux/fs.h:1845 [inline]
     new_sync_read fs/read_write.c:389 [inline]
     vfs_read+0x5e0/0x630 fs/read_write.c:470
     ksys_read+0x163/0x1a0 fs/read_write.c:613
     __do_sys_read fs/read_write.c:623 [inline]
     __se_sys_read fs/read_write.c:621 [inline]
     __x64_sys_read+0x41/0x50 fs/read_write.c:621
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x72/0xdc
    
    value changed: 0xffffffffc4653600 -> 0x0000000000000000
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 1 PID: 19183 Comm: syz-executor.5 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #2
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
    
    Fixes: 6c7c98bad488 ("sock: avoid dirtying sk_stamp, if possible")
    Reported-by: syzbot <[email protected]>
    Signed-off-by: Kuniyuki Iwashima <[email protected]>
    Reviewed-by: Eric Dumazet <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: hns3: fix output information incomplete for dumping tx queue info with debugfs [+ + +]
Author: Jie Wang <[email protected]>
Date:   Fri May 12 18:00:11 2023 +0800

    net: hns3: fix output information incomplete for dumping tx queue info with debugfs
    
    [ Upstream commit 89f6bfb071182f05d7188c255b0e7251c3806f16 ]
    
    In function hns3_dump_tx_queue_info, The print buffer is not enough when
    the tx BD number is configured to 32760. As a result several BD
    information wouldn't be displayed.
    
    So fix it by increasing the tx queue print buffer length.
    
    Fixes: 630a6738da82 ("net: hns3: adjust string spaces of some parameters of tx bd info in debugfs")
    Signed-off-by: Jie Wang <[email protected]>
    Signed-off-by: Hao Lan <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: hns3: fix reset delay time to avoid configuration timeout [+ + +]
Author: Jie Wang <[email protected]>
Date:   Fri May 12 18:00:13 2023 +0800

    net: hns3: fix reset delay time to avoid configuration timeout
    
    [ Upstream commit 814d0c786068e858d889ada3153bff82f64223ad ]
    
    Currently the hns3 vf function reset delays 5000ms before vf rebuild
    process. In product applications, this delay is too long for application
    configurations and causes configuration timeout.
    
    According to the tests, 500ms delay is enough for reset process except PF
    FLR. So this patch modifies delay to 500ms in these scenarios.
    
    Fixes: 6988eb2a9b77 ("net: hns3: Add support to reset the enet/ring mgmt layer")
    Signed-off-by: Jie Wang <[email protected]>
    Signed-off-by: Hao Lan <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: hns3: fix sending pfc frames after reset issue [+ + +]
Author: Jijie Shao <[email protected]>
Date:   Fri May 12 18:00:12 2023 +0800

    net: hns3: fix sending pfc frames after reset issue
    
    [ Upstream commit f14db07064727dd3bc0906c77a6d2759c1bbb395 ]
    
    To prevent the system from abnormally sending PFC frames after an
    abnormal reset. The hns3 driver notifies the firmware to disable pfc
    before reset.
    
    Fixes: 35d93a30040c ("net: hns3: adjust the process of PF reset")
    Signed-off-by: Jijie Shao <[email protected]>
    Signed-off-by: Hao Lan <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe() [+ + +]
Author: Christophe JAILLET <[email protected]>
Date:   Fri May 5 20:39:33 2023 +0200

    net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe()
    
    [ Upstream commit 27c1eaa07283b0c94becf8241f95368267cf558b ]
    
    Should of_mdiobus_register() fail, a previous usb_get_dev() call should be
    undone as in the .disconnect function.
    
    Fixes: 04e37d92fbed ("net: phy: add marvell usb to mdio controller")
    Signed-off-by: Christophe JAILLET <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Reviewed-by: Andrew Lunn <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() [+ + +]
Author: Dong Chenchen <[email protected]>
Date:   Thu May 11 20:54:40 2023 +0800

    net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
    
    [ Upstream commit c83b49383b595be50647f0c764a48c78b5f3c4f8 ]
    
    As the call trace shows, skb_panic was caused by wrong skb->mac_header
    in nsh_gso_segment():
    
    invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
    CPU: 3 PID: 2737 Comm: syz Not tainted 6.3.0-next-20230505 #1
    RIP: 0010:skb_panic+0xda/0xe0
    call Trace:
     skb_push+0x91/0xa0
     nsh_gso_segment+0x4f3/0x570
     skb_mac_gso_segment+0x19e/0x270
     __skb_gso_segment+0x1e8/0x3c0
     validate_xmit_skb+0x452/0x890
     validate_xmit_skb_list+0x99/0xd0
     sch_direct_xmit+0x294/0x7c0
     __dev_queue_xmit+0x16f0/0x1d70
     packet_xmit+0x185/0x210
     packet_snd+0xc15/0x1170
     packet_sendmsg+0x7b/0xa0
     sock_sendmsg+0x14f/0x160
    
    The root cause is:
    nsh_gso_segment() use skb->network_header - nhoff to reset mac_header
    in skb_gso_error_unwind() if inner-layer protocol gso fails.
    However, skb->network_header may be reset by inner-layer protocol
    gso function e.g. mpls_gso_segment. skb->mac_header reset by the
    inaccurate network_header will be larger than skb headroom.
    
    nsh_gso_segment
        nhoff = skb->network_header - skb->mac_header;
        __skb_pull(skb,nsh_len)
        skb_mac_gso_segment
            mpls_gso_segment
                skb_reset_network_header(skb);//skb->network_header+=nsh_len
                return -EINVAL;
        skb_gso_error_unwind
            skb_push(skb, nsh_len);
            skb->mac_header = skb->network_header - nhoff;
            // skb->mac_header > skb->headroom, cause skb_push panic
    
    Use correct mac_offset to restore mac_header and get rid of nhoff.
    
    Fixes: c411ed854584 ("nsh: add GSO support")
    Reported-by: [email protected]
    Suggested-by: Eric Dumazet <[email protected]>
    Signed-off-by: Dong Chenchen <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: pasemi: Fix return type of pasemi_mac_start_tx() [+ + +]
Author: Nathan Chancellor <[email protected]>
Date:   Sun Mar 19 16:41:08 2023 -0700

    net: pasemi: Fix return type of pasemi_mac_start_tx()
    
    [ Upstream commit c8384d4a51e7cb0e6587f3143f29099f202c5de1 ]
    
    With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),
    indirect call targets are validated against the expected function
    pointer prototype to make sure the call target is valid to help mitigate
    ROP attacks. If they are not identical, there is a failure at run time,
    which manifests as either a kernel panic or thread getting killed. A
    warning in clang aims to catch these at compile time, which reveals:
    
      drivers/net/ethernet/pasemi/pasemi_mac.c:1665:21: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict]
              .ndo_start_xmit         = pasemi_mac_start_tx,
                                        ^~~~~~~~~~~~~~~~~~~
      1 error generated.
    
    ->ndo_start_xmit() in 'struct net_device_ops' expects a return type of
    'netdev_tx_t', not 'int'. Adjust the return type of
    pasemi_mac_start_tx() to match the prototype's to resolve the warning.
    While PowerPC does not currently implement support for kCFI, it could in
    the future, which means this warning becomes a fatal CFI failure at run
    time.
    
    Link: https://github.com/ClangBuiltLinux/linux/issues/1750
    Signed-off-by: Nathan Chancellor <[email protected]>
    Reviewed-by: Horatiu Vultur <[email protected]>
    Link: https://lore.kernel.org/r/20230319-pasemi-incompatible-pointer-types-strict-v1-1-[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: phy: dp83867: add w/a for packet errors seen with short cables [+ + +]
Author: Grygorii Strashko <[email protected]>
Date:   Wed May 10 18:21:39 2023 +0530

    net: phy: dp83867: add w/a for packet errors seen with short cables
    
    [ Upstream commit 0b01db274028f5acd207332686ffc92ac77491ac ]
    
    Introduce the W/A for packet errors seen with short cables (<1m) between
    two DP83867 PHYs.
    
    The W/A recommended by DM requires FFE Equalizer Configuration tuning by
    writing value 0x0E81 to DSP_FFE_CFG register (0x012C), surrounded by hard
    and soft resets as follows:
    
    write_reg(0x001F, 0x8000); //hard reset
    write_reg(DSP_FFE_CFG, 0x0E81);
    write_reg(0x001F, 0x4000); //soft reset
    
    Since  DP83867 PHY DM says "Changing this register to 0x0E81, will not
    affect Long Cable performance.", enable the W/A by default.
    
    Fixes: 2a10154abcb7 ("net: phy: dp83867: Add TI dp83867 phy")
    Signed-off-by: Grygorii Strashko <[email protected]>
    Signed-off-by: Siddharth Vadapalli <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: stmmac: Initialize MAC_ONEUS_TIC_COUNTER register [+ + +]
Author: Marek Vasut <[email protected]>
Date:   Sun May 7 01:58:45 2023 +0200

    net: stmmac: Initialize MAC_ONEUS_TIC_COUNTER register
    
    [ Upstream commit 8efbdbfa99381a017dd2c0f6375a7d80a8118b74 ]
    
    Initialize MAC_ONEUS_TIC_COUNTER register with correct value derived
    from CSR clock, otherwise EEE is unstable on at least NXP i.MX8M Plus
    and Micrel KSZ9131RNX PHY, to the point where not even ARP request can
    be sent out.
    
    i.MX 8M Plus Applications Processor Reference Manual, Rev. 1, 06/2021
    11.7.6.1.34 One-microsecond Reference Timer (MAC_ONEUS_TIC_COUNTER)
    defines this register as:
    "
    This register controls the generation of the Reference time (1 microsecond
    tic) for all the LPI timers. This timer has to be programmed by the software
    initially.
    ...
    The application must program this counter so that the number of clock cycles
    of CSR clock is 1us. (Subtract 1 from the value before programming).
    For example if the CSR clock is 100MHz then this field needs to be programmed
    to value 100 - 1 = 99 (which is 0x63).
    This is required to generate the 1US events that are used to update some of
    the EEE related counters.
    "
    
    The reset value is 0x63 on i.MX8M Plus, which means expected CSR clock are
    100 MHz. However, the i.MX8M Plus "enet_qos_root_clk" are 266 MHz instead,
    which means the LPI timers reach their count much sooner on this platform.
    
    This is visible using a scope by monitoring e.g. exit from LPI mode on TX_CTL
    line from MAC to PHY. This should take 30us per STMMAC_DEFAULT_TWT_LS setting,
    during which the TX_CTL line transitions from tristate to low, and 30 us later
    from low to high. On i.MX8M Plus, this transition takes 11 us, which matches
    the 30us * 100/266 formula for misconfigured MAC_ONEUS_TIC_COUNTER register.
    
    Configure MAC_ONEUS_TIC_COUNTER based on CSR clock, so that the LPI timers
    have correct 1us reference. This then fixes EEE on i.MX8M Plus with Micrel
    KSZ9131RNX PHY.
    
    Fixes: 477286b53f55 ("stmmac: add GMAC4 core support")
    Signed-off-by: Marek Vasut <[email protected]>
    Tested-by: Harald Seiler <[email protected]>
    Reviewed-by: Francesco Dolcini <[email protected]>
    Tested-by: Francesco Dolcini <[email protected]> # Toradex Verdin iMX8MP
    Reviewed-by: Jesse Brandeburg <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: stmmac: switch to use interrupt for hw crosstimestamping [+ + +]
Author: Wong Vee Khee <[email protected]>
Date:   Thu Jul 14 15:54:27 2022 +0800

    net: stmmac: switch to use interrupt for hw crosstimestamping
    
    [ Upstream commit 76c16d3e19446deea98b7883f261758b96b8781a ]
    
    Using current implementation of polling mode, there is high chances we
    will hit into timeout error when running phc2sys. Hence, update the
    implementation of hardware crosstimestamping to use the MAC interrupt
    service routine instead of polling for TSIS bit in the MAC Timestamp
    Interrupt Status register to be set.
    
    Cc: Richard Cochran <[email protected]>
    Signed-off-by: Wong Vee Khee <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Stable-dep-of: 8efbdbfa9938 ("net: stmmac: Initialize MAC_ONEUS_TIC_COUNTER register")
    Signed-off-by: Sasha Levin <[email protected]>

 
netfilter: conntrack: fix possible bug_on with enable_hooks=1 [+ + +]
Author: Florian Westphal <[email protected]>
Date:   Thu May 4 14:55:02 2023 +0200

    netfilter: conntrack: fix possible bug_on with enable_hooks=1
    
    [ Upstream commit e72eeab542dbf4f544e389e64fa13b82a1b6d003 ]
    
    I received a bug report (no reproducer so far) where we trip over
    
    712         rcu_read_lock();
    713         ct_hook = rcu_dereference(nf_ct_hook);
    714         BUG_ON(ct_hook == NULL);  // here
    
    In nf_conntrack_destroy().
    
    First turn this BUG_ON into a WARN.  I think it was triggered
    via enable_hooks=1 flag.
    
    When this flag is turned on, the conntrack hooks are registered
    before nf_ct_hook pointer gets assigned.
    This opens a short window where packets enter the conntrack machinery,
    can have skb->_nfct set up and a subsequent kfree_skb might occur
    before nf_ct_hook is set.
    
    Call nf_conntrack_init_end() to set nf_ct_hook before we register the
    pernet ops.
    
    Fixes: ba3fbe663635 ("netfilter: nf_conntrack: provide modparam to always register conntrack hooks")
    Signed-off-by: Florian Westphal <[email protected]>
    Signed-off-by: Pablo Neira Ayuso <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

netfilter: nf_tables: always release netdev hooks from notifier [+ + +]
Author: Florian Westphal <[email protected]>
Date:   Thu May 4 14:20:21 2023 +0200

    netfilter: nf_tables: always release netdev hooks from notifier
    
    [ Upstream commit dc1c9fd4a8bbe1e06add9053010b652449bfe411 ]
    
    This reverts "netfilter: nf_tables: skip netdev events generated on netns removal".
    
    The problem is that when a veth device is released, the veth release
    callback will also queue the peer netns device for removal.
    
    Its possible that the peer netns is also slated for removal.  In this
    case, the device memory is already released before the pre_exit hook of
    the peer netns runs:
    
    BUG: KASAN: slab-use-after-free in nf_hook_entry_head+0x1b8/0x1d0
    Read of size 8 at addr ffff88812c0124f0 by task kworker/u8:1/45
    Workqueue: netns cleanup_net
    Call Trace:
     nf_hook_entry_head+0x1b8/0x1d0
     __nf_unregister_net_hook+0x76/0x510
     nft_netdev_unregister_hooks+0xa0/0x220
     __nft_release_hook+0x184/0x490
     nf_tables_pre_exit_net+0x12f/0x1b0
     ..
    
    Order is:
    1. First netns is released, veth_dellink() queues peer netns device
       for removal
    2. peer netns is queued for removal
    3. peer netns device is released, unreg event is triggered
    4. unreg event is ignored because netns is going down
    5. pre_exit hook calls nft_netdev_unregister_hooks but device memory
       might be free'd already.
    
    Fixes: 68a3765c659f ("netfilter: nf_tables: skip netdev events generated on netns removal")
    Signed-off-by: Florian Westphal <[email protected]>
    Signed-off-by: Pablo Neira Ayuso <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

netfilter: nf_tables: fix nft_trans type confusion [+ + +]
Author: Florian Westphal <[email protected]>
Date:   Thu May 11 14:15:15 2023 +0200

    netfilter: nf_tables: fix nft_trans type confusion
    
    [ Upstream commit e3c361b8acd636f5fe80c02849ca175201edf10c ]
    
    nft_trans_FOO objects all share a common nft_trans base structure, but
    trailing fields depend on the real object size. Access is only safe after
    trans->msg_type check.
    
    Check for rule type first.  Found by code inspection.
    
    Fixes: 1a94e38d254b ("netfilter: nf_tables: add NFTA_RULE_ID attribute")
    Signed-off-by: Florian Westphal <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

netfilter: nft_set_rbtree: fix null deref on element insertion [+ + +]
Author: Florian Westphal <[email protected]>
Date:   Thu May 11 22:39:30 2023 +0200

    netfilter: nft_set_rbtree: fix null deref on element insertion
    
    [ Upstream commit 61ae320a29b0540c16931816299eb86bf2b66c08 ]
    
    There is no guarantee that rb_prev() will not return NULL in nft_rbtree_gc_elem():
    
    general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
    KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
     nft_add_set_elem+0x14b0/0x2990
      nf_tables_newsetelem+0x528/0xb30
    
    Furthermore, there is a possible use-after-free while iterating,
    'node' can be free'd so we need to cache the next value to use.
    
    Fixes: c9e6978e2725 ("netfilter: nft_set_rbtree: Switch to node list walk for overlap detection")
    Signed-off-by: Florian Westphal <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
netlink: annotate accesses to nlk->cb_running [+ + +]
Author: Eric Dumazet <[email protected]>
Date:   Tue May 9 16:56:34 2023 +0000

    netlink: annotate accesses to nlk->cb_running
    
    [ Upstream commit a939d14919b799e6fff8a9c80296ca229ba2f8a4 ]
    
    Both netlink_recvmsg() and netlink_native_seq_show() read
    nlk->cb_running locklessly. Use READ_ONCE() there.
    
    Add corresponding WRITE_ONCE() to netlink_dump() and
    __netlink_dump_start()
    
    syzbot reported:
    BUG: KCSAN: data-race in __netlink_dump_start / netlink_recvmsg
    
    write to 0xffff88813ea4db59 of 1 bytes by task 28219 on cpu 0:
    __netlink_dump_start+0x3af/0x4d0 net/netlink/af_netlink.c:2399
    netlink_dump_start include/linux/netlink.h:308 [inline]
    rtnetlink_rcv_msg+0x70f/0x8c0 net/core/rtnetlink.c:6130
    netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2577
    rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6192
    netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
    netlink_unicast+0x56f/0x640 net/netlink/af_netlink.c:1365
    netlink_sendmsg+0x665/0x770 net/netlink/af_netlink.c:1942
    sock_sendmsg_nosec net/socket.c:724 [inline]
    sock_sendmsg net/socket.c:747 [inline]
    sock_write_iter+0x1aa/0x230 net/socket.c:1138
    call_write_iter include/linux/fs.h:1851 [inline]
    new_sync_write fs/read_write.c:491 [inline]
    vfs_write+0x463/0x760 fs/read_write.c:584
    ksys_write+0xeb/0x1a0 fs/read_write.c:637
    __do_sys_write fs/read_write.c:649 [inline]
    __se_sys_write fs/read_write.c:646 [inline]
    __x64_sys_write+0x42/0x50 fs/read_write.c:646
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    read to 0xffff88813ea4db59 of 1 bytes by task 28222 on cpu 1:
    netlink_recvmsg+0x3b4/0x730 net/netlink/af_netlink.c:2022
    sock_recvmsg_nosec+0x4c/0x80 net/socket.c:1017
    ____sys_recvmsg+0x2db/0x310 net/socket.c:2718
    ___sys_recvmsg net/socket.c:2762 [inline]
    do_recvmmsg+0x2e5/0x710 net/socket.c:2856
    __sys_recvmmsg net/socket.c:2935 [inline]
    __do_sys_recvmmsg net/socket.c:2958 [inline]
    __se_sys_recvmmsg net/socket.c:2951 [inline]
    __x64_sys_recvmmsg+0xe2/0x160 net/socket.c:2951
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    value changed: 0x00 -> 0x01
    
    Fixes: 16b304f3404f ("netlink: Eliminate kmalloc in netlink dump operation.")
    Reported-by: syzbot <[email protected]>
    Signed-off-by: Eric Dumazet <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() [+ + +]
Author: Ryusuke Konishi <[email protected]>
Date:   Wed May 10 00:29:56 2023 +0900

    nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()
    
    commit 9b5a04ac3ad9898c4745cba46ea26de74ba56a8e upstream.
    
    During unmount process of nilfs2, nothing holds nilfs_root structure after
    nilfs2 detaches its writer in nilfs_detach_log_writer().  However, since
    nilfs_evict_inode() uses nilfs_root for some cleanup operations, it may
    cause use-after-free read if inodes are left in "garbage_list" and
    released by nilfs_dispose_list() at the end of nilfs_detach_log_writer().
    
    Fix this issue by modifying nilfs_evict_inode() to only clear inode
    without additional metadata changes that use nilfs_root if the file system
    is degraded to read-only or the writer is detached.
    
    Link: https://lkml.kernel.org/r/[email protected]
    Signed-off-by: Ryusuke Konishi <[email protected]>
    Reported-by: [email protected]
    Closes: https://lkml.kernel.org/r/[email protected]
    Tested-by: Ryusuke Konishi <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
null_blk: Always check queue mode setting from configfs [+ + +]
Author: Chaitanya Kulkarni <[email protected]>
Date:   Sun Apr 16 15:03:39 2023 -0700

    null_blk: Always check queue mode setting from configfs
    
    [ Upstream commit 63f8793ee60513a09f110ea460a6ff2c33811cdb ]
    
    Make sure to check device queue mode in the null_validate_conf() and
    return error for NULL_Q_RQ as we don't allow legacy I/O path, without
    this patch we get OOPs when queue mode is set to 1 from configfs,
    following are repro steps :-
    
    modprobe null_blk nr_devices=0
    mkdir config/nullb/nullb0
    echo 1 > config/nullb/nullb0/memory_backed
    echo 4096 > config/nullb/nullb0/blocksize
    echo 20480 > config/nullb/nullb0/size
    echo 1 > config/nullb/nullb0/queue_mode
    echo 1 > config/nullb/nullb0/power
    
    Entering kdb (current=0xffff88810acdd080, pid 2372) on processor 42 Oops: (null)
    due to oops @ 0xffffffffc041c329
    CPU: 42 PID: 2372 Comm: sh Tainted: G           O     N 6.3.0-rc5lblk+ #5
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
    RIP: 0010:null_add_dev.part.0+0xd9/0x720 [null_blk]
    Code: 01 00 00 85 d2 0f 85 a1 03 00 00 48 83 bb 08 01 00 00 00 0f 85 f7 03 00 00 80 bb 62 01 00 00 00 48 8b 75 20 0f 85 6d 02 00 00 <48> 89 6e 60 48 8b 75 20 bf 06 00 00 00 e8 f5 37 2c c1 48 8b 75 20
    RSP: 0018:ffffc900052cbde0 EFLAGS: 00010246
    RAX: 0000000000000001 RBX: ffff88811084d800 RCX: 0000000000000001
    RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888100042e00
    RBP: ffff8881053d8200 R08: ffffc900052cbd68 R09: ffff888105db2000
    R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000002
    R13: ffff888104765200 R14: ffff88810eec1748 R15: ffff88810eec1740
    FS:  00007fd445fd1740(0000) GS:ffff8897dfc80000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000060 CR3: 0000000166a00000 CR4: 0000000000350ee0
    DR0: ffffffff8437a488 DR1: ffffffff8437a489 DR2: ffffffff8437a48a
    DR3: ffffffff8437a48b DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Call Trace:
     <TASK>
     nullb_device_power_store+0xd1/0x120 [null_blk]
     configfs_write_iter+0xb4/0x120
     vfs_write+0x2ba/0x3c0
     ksys_write+0x5f/0xe0
     do_syscall_64+0x3b/0x90
     entry_SYSCALL_64_after_hwframe+0x72/0xdc
    RIP: 0033:0x7fd4460c57a7
    Code: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
    RSP: 002b:00007ffd3792a4a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
    RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fd4460c57a7
    RDX: 0000000000000002 RSI: 000055b43c02e4c0 RDI: 0000000000000001
    RBP: 000055b43c02e4c0 R08: 000000000000000a R09: 00007fd44615b4e0
    R10: 00007fd44615b3e0 R11: 0000000000000246 R12: 0000000000000002
    R13: 00007fd446198520 R14: 0000000000000002 R15: 00007fd446198700
     </TASK>
    
    Signed-off-by: Chaitanya Kulkarni <[email protected]>
    Reviewed-by: Damien Le Moal <[email protected]>
    Reviewed-by: Ming Lei <[email protected]>
    Reviewed-by: Nitesh Shetty <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jens Axboe <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
parisc: Replace regular spinlock with spin_trylock on panic path [+ + +]
Author: Guilherme G. Piccoli <[email protected]>
Date:   Mon Feb 20 18:11:05 2023 -0300

    parisc: Replace regular spinlock with spin_trylock on panic path
    
    [ Upstream commit 829632dae8321787525ee37dc4828bbe6edafdae ]
    
    The panic notifiers' callbacks execute in an atomic context, with
    interrupts/preemption disabled, and all CPUs not running the panic
    function are off, so it's very dangerous to wait on a regular
    spinlock, there's a risk of deadlock.
    
    Refactor the panic notifier of parisc/power driver to make use
    of spin_trylock - for that, we've added a second version of the
    soft-power function. Also, some comments were reorganized and
    trailing white spaces, useless header inclusion and blank lines
    were removed.
    
    Cc: "James E.J. Bottomley" <[email protected]>
    Cc: Jeroen Roovers <[email protected]>
    Acked-by: Helge Deller <[email protected]> # parisc
    Signed-off-by: Guilherme G. Piccoli <[email protected]>
    Signed-off-by: Helge Deller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
phy: st: miphy28lp: use _poll_timeout functions for waits [+ + +]
Author: Alain Volmat <[email protected]>
Date:   Fri Feb 10 23:43:08 2023 +0100

    phy: st: miphy28lp: use _poll_timeout functions for waits
    
    [ Upstream commit e3be4dd2c8d8aabfd2c3127d0e2e5754d3ae82d6 ]
    
    This commit introduces _poll_timeout functions usage instead of
    wait loops waiting for a status bit.
    
    Signed-off-by: Alain Volmat <[email protected]>
    Reviewed-by: Patrice Chotard <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Vinod Koul <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
platform/x86: hp-wmi: add micmute to hp_wmi_keymap struct [+ + +]
Author: Fae <[email protected]>
Date:   Tue Apr 25 01:36:44 2023 -0500

    platform/x86: hp-wmi: add micmute to hp_wmi_keymap struct
    
    [ Upstream commit decab2825c3ef9b154c6f76bce40872ffb41c36f ]
    
    Fixes micmute key of HP Envy X360 ey0xxx.
    
    Signed-off-by: Fae <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Cc: [email protected]
    Reviewed-by: Hans de Goede <[email protected]>
    Signed-off-by: Hans de Goede <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

platform/x86: hp-wmi: Support touchpad on/off [+ + +]
Author: Daniel Houldsworth <[email protected]>
Date:   Thu Sep 22 12:54:59 2022 +0100

    platform/x86: hp-wmi: Support touchpad on/off
    
    [ Upstream commit 401199ffa9b69baf3fd1f9ad082aa65c10910585 ]
    
    Add scancodes reported by the touchpad on/off button. The actual disabling
    and enabling is done in hardware, and this just reports that change to
    userspace.
    
    Signed-off-by: Daniel Houldsworth <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Reviewed-by: Hans de Goede <[email protected]>
    Signed-off-by: Hans de Goede <[email protected]>
    Stable-dep-of: decab2825c3e ("platform/x86: hp-wmi: add micmute to hp_wmi_keymap struct")
    Signed-off-by: Sasha Levin <[email protected]>

platform/x86: Move existing HP drivers to a new hp subdir [+ + +]
Author: Jorge Lopez <[email protected]>
Date:   Thu Oct 20 15:10:28 2022 -0500

    platform/x86: Move existing HP drivers to a new hp subdir
    
    [ Upstream commit 6e9b8992b122cb12688bd259fc99e67d1be234eb ]
    
    The purpose of this patch is to provide a central location where all
    HP related drivers are found. HP drivers will recide under
    drivers/platform/x86/hp directory.
    
    Introduce changes to Kconfig file to list all HP driver under "HP X86
    Platform Specific Device Drivers" menu option. Additional changes
    include update MAINTAINERS file to indicate hp related drivers new
    path.
    
    Signed-off-by: Jorge Lopez <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Reviewed-by: Hans de Goede <[email protected]>
    Signed-off-by: Hans de Goede <[email protected]>
    Stable-dep-of: decab2825c3e ("platform/x86: hp-wmi: add micmute to hp_wmi_keymap struct")
    Signed-off-by: Sasha Levin <[email protected]>

 
powerpc/64s/radix: Fix soft dirty tracking [+ + +]
Author: Michael Ellerman <[email protected]>
Date:   Thu May 11 21:42:24 2023 +1000

    powerpc/64s/radix: Fix soft dirty tracking
    
    commit 66b2ca086210732954a7790d63d35542936fc664 upstream.
    
    It was reported that soft dirty tracking doesn't work when using the
    Radix MMU.
    
    The tracking is supposed to work by clearing the soft dirty bit for a
    mapping and then write protecting the PTE. If/when the page is written
    to, a page fault occurs and the soft dirty bit is added back via
    pte_mkdirty(). For example in wp_page_reuse():
    
            entry = maybe_mkwrite(pte_mkdirty(entry), vma);
            if (ptep_set_access_flags(vma, vmf->address, vmf->pte, entry, 1))
                    update_mmu_cache(vma, vmf->address, vmf->pte);
    
    Unfortunately on radix _PAGE_SOFTDIRTY is being dropped by
    radix__ptep_set_access_flags(), called from ptep_set_access_flags(),
    meaning the soft dirty bit is not set even though the page has been
    written to.
    
    Fix it by adding _PAGE_SOFTDIRTY to the set of bits that are able to be
    changed in radix__ptep_set_access_flags().
    
    Fixes: b0b5e9b13047 ("powerpc/mm/radix: Add radix pte #defines")
    Cc: [email protected] # v4.7+
    Reported-by: Dan Horák <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Michael Ellerman <[email protected]>
    Link: https://msgid.link/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
powerpc/iommu: Incorrect DDW Table is referenced for SR-IOV device [+ + +]
Author: Gaurav Batra <[email protected]>
Date:   Fri May 5 13:47:01 2023 -0500

    powerpc/iommu: Incorrect DDW Table is referenced for SR-IOV device
    
    commit 1f7aacc5eb9ed2cc17be7a90da5cd559effb9d59 upstream.
    
    For an SR-IOV device, while enabling DDW, a new table is created and
    added at index 1 in the group. In the below 2 scenarios, the table is
    incorrectly referenced at index 0 (which is where the table is for
    default DMA window).
    
    1. When adding DDW
    
       This issue is exposed with "slub_debug". Error thrown out from
       dma_iommu_dma_supported()
    
       Warning: IOMMU offset too big for device mask
       mask: 0xffffffff, table offset: 0x800000000000000
    
    2. During Dynamic removal of the PCI device.
    
       Error is from iommu_tce_table_put() since a NULL table pointer is
       passed in.
    
    Fixes: 381ceda88c4c ("powerpc/pseries/iommu: Make use of DDW for indirect mapping")
    Cc: [email protected] # v5.15+
    Signed-off-by: Gaurav Batra <[email protected]>
    Reviewed-by: Brian King <[email protected]>
    Signed-off-by: Michael Ellerman <[email protected]>
    Link: https://msgid.link/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access [+ + +]
Author: Zqiang <[email protected]>
Date:   Sat Dec 24 13:25:53 2022 +0800

    rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access
    
    [ Upstream commit 3c1566bca3f8349f12b75d0a2d5e4a20ad6262ec ]
    
    For kernels built with CONFIG_PREEMPT_RCU=y, the following scenario can
    result in a NULL-pointer dereference:
    
               CPU1                                           CPU2
    rcu_preempt_deferred_qs_irqrestore                rcu_print_task_exp_stall
      if (special.b.blocked)                            READ_ONCE(rnp->exp_tasks) != NULL
        raw_spin_lock_rcu_node
        np = rcu_next_node_entry(t, rnp)
        if (&t->rcu_node_entry == rnp->exp_tasks)
          WRITE_ONCE(rnp->exp_tasks, np)
          ....
          raw_spin_unlock_irqrestore_rcu_node
                                                        raw_spin_lock_irqsave_rcu_node
                                                        t = list_entry(rnp->exp_tasks->prev,
                                                            struct task_struct, rcu_node_entry)
                                                        (if rnp->exp_tasks is NULL, this
                                                           will dereference a NULL pointer)
    
    The problem is that CPU2 accesses the rcu_node structure's->exp_tasks
    field without holding the rcu_node structure's ->lock and CPU2 did
    not observe CPU1's change to rcu_node structure's ->exp_tasks in time.
    Therefore, if CPU1 sets rcu_node structure's->exp_tasks pointer to NULL,
    then CPU2 might dereference that NULL pointer.
    
    This commit therefore holds the rcu_node structure's ->lock while
    accessing that structure's->exp_tasks field.
    
    [ paulmck: Apply Frederic Weisbecker feedback. ]
    
    Acked-by: Joel Fernandes (Google) <[email protected]>
    Signed-off-by: Zqiang <[email protected]>
    Signed-off-by: Paul E. McKenney <[email protected]>
    Signed-off-by: Joel Fernandes (Google) <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
RDMA/core: Fix multiple -Warray-bounds warnings [+ + +]
Author: Gustavo A. R. Silva <[email protected]>
Date:   Tue Mar 21 17:47:03 2023 -0600

    RDMA/core: Fix multiple -Warray-bounds warnings
    
    [ Upstream commit aa4d540b4150052ae3b36d286b9c833a961ce291 ]
    
    GCC-13 (and Clang)[1] does not like to access a partially allocated
    object, since it cannot reason about it for bounds checking.
    
    In this case 140 bytes are allocated for an object of type struct
    ib_umad_packet:
    
            packet = kzalloc(sizeof(*packet) + IB_MGMT_RMPP_HDR, GFP_KERNEL);
    
    However, notice that sizeof(*packet) is only 104 bytes:
    
    struct ib_umad_packet {
            struct ib_mad_send_buf *   msg;                  /*     0     8 */
            struct ib_mad_recv_wc *    recv_wc;              /*     8     8 */
            struct list_head           list;                 /*    16    16 */
            int                        length;               /*    32     4 */
    
            /* XXX 4 bytes hole, try to pack */
    
            struct ib_user_mad         mad __attribute__((__aligned__(8))); /*    40    64 */
    
            /* size: 104, cachelines: 2, members: 5 */
            /* sum members: 100, holes: 1, sum holes: 4 */
            /* forced alignments: 1, forced holes: 1, sum forced holes: 4 */
            /* last cacheline: 40 bytes */
    } __attribute__((__aligned__(8)));
    
    and 36 bytes extra bytes are allocated for a flexible-array member in
    struct ib_user_mad:
    
    include/rdma/ib_mad.h:
    120 enum {
    ...
    123         IB_MGMT_RMPP_HDR = 36,
    ... }
    
    struct ib_user_mad {
            struct ib_user_mad_hdr     hdr;                  /*     0    64 */
            /* --- cacheline 1 boundary (64 bytes) --- */
            __u64                      data[] __attribute__((__aligned__(8))); /*    64     0 */
    
            /* size: 64, cachelines: 1, members: 2 */
            /* forced alignments: 1 */
    } __attribute__((__aligned__(8)));
    
    So we have sizeof(*packet) + IB_MGMT_RMPP_HDR == 140 bytes
    
    Then the address of the flex-array member (for which only 36 bytes were
    allocated) is casted and copied into a pointer to struct ib_rmpp_mad,
    which, in turn, is of size 256 bytes:
    
            rmpp_mad = (struct ib_rmpp_mad *) packet->mad.data;
    
    struct ib_rmpp_mad {
            struct ib_mad_hdr          mad_hdr;              /*     0    24 */
            struct ib_rmpp_hdr         rmpp_hdr;             /*    24    12 */
            u8                         data[220];            /*    36   220 */
    
            /* size: 256, cachelines: 4, members: 3 */
    };
    
    The thing is that those 36 bytes allocated for flex-array member data
    in struct ib_user_mad onlly account for the size of both struct ib_mad_hdr
    and struct ib_rmpp_hdr, but nothing is left for array u8 data[220].
    So, the compiler is legitimately complaining about accessing an object
    for which not enough memory was allocated.
    
    Apparently, the only members of struct ib_rmpp_mad that are relevant
    (that are actually being used) in function ib_umad_write() are mad_hdr
    and rmpp_hdr. So, instead of casting packet->mad.data to
    (struct ib_rmpp_mad *) create a new structure
    
    struct ib_rmpp_mad_hdr {
            struct ib_mad_hdr       mad_hdr;
            struct ib_rmpp_hdr      rmpp_hdr;
    } __packed;
    
    and cast packet->mad.data to (struct ib_rmpp_mad_hdr *).
    
    Notice that
    
            IB_MGMT_RMPP_HDR == sizeof(struct ib_rmpp_mad_hdr) == 36 bytes
    
    Refactor the rest of the code, accordingly.
    
    Fix the following warnings seen under GCC-13 and -Warray-bounds:
    drivers/infiniband/core/user_mad.c:564:50: warning: array subscript ‘struct ib_rmpp_mad[0]’ is partly outside array bounds of ‘unsigned char[140]’ [-Warray-bounds=]
    drivers/infiniband/core/user_mad.c:566:42: warning: array subscript ‘struct ib_rmpp_mad[0]’ is partly outside array bounds of ‘unsigned char[140]’ [-Warray-bounds=]
    drivers/infiniband/core/user_mad.c:618:25: warning: array subscript ‘struct ib_rmpp_mad[0]’ is partly outside array bounds of ‘unsigned char[140]’ [-Warray-bounds=]
    drivers/infiniband/core/user_mad.c:622:44: warning: array subscript ‘struct ib_rmpp_mad[0]’ is partly outside array bounds of ‘unsigned char[140]’ [-Warray-bounds=]
    
    Link: https://github.com/KSPP/linux/issues/273
    Link: https://godbolt.org/z/oYWaGM4Yb [1]
    Signed-off-by: Gustavo A. R. Silva <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Leon Romanovsky <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
recordmcount: Fix memory leaks in the uwrite function [+ + +]
Author: Hao Zeng <[email protected]>
Date:   Wed Apr 26 09:05:27 2023 +0800

    recordmcount: Fix memory leaks in the uwrite function
    
    [ Upstream commit fa359d068574d29e7d2f0fdd0ebe4c6a12b5cfb9 ]
    
    Common realloc mistake: 'file_append' nulled but not freed upon failure
    
    Link: https://lkml.kernel.org/r/[email protected]
    
    Signed-off-by: Hao Zeng <[email protected]>
    Suggested-by: Steven Rostedt <[email protected]>
    Signed-off-by: Steven Rostedt (Google) <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
refscale: Move shutdown from wait_event() to wait_event_idle() [+ + +]
Author: Paul E. McKenney <[email protected]>
Date:   Tue Jan 31 16:12:18 2023 -0800

    refscale: Move shutdown from wait_event() to wait_event_idle()
    
    [ Upstream commit 6bc6e6b27524304aadb9c04611ddb1c84dd7617a ]
    
    The ref_scale_shutdown() kthread/function uses wait_event() to wait for
    the refscale test to complete.  However, although the read-side tests
    are normally extremely fast, there is no law against specifying a very
    large value for the refscale.loops module parameter or against having
    a slow read-side primitive.  Either way, this might well trigger the
    hung-task timeout.
    
    This commit therefore replaces those wait_event() calls with calls to
    wait_event_idle(), which do not trigger the hung-task timeout.
    
    Signed-off-by: Paul E. McKenney <[email protected]>
    Signed-off-by: Boqun Feng <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
regmap: cache: Return error in cache sync operations for REGCACHE_NONE [+ + +]
Author: Alexander Stein <alexande[email protected]>
Date:   Mon Mar 13 08:18:11 2023 +0100

    regmap: cache: Return error in cache sync operations for REGCACHE_NONE
    
    [ Upstream commit fd883d79e4dcd2417c2b80756f22a2ff03b0f6e0 ]
    
    There is no sense in doing a cache sync on REGCACHE_NONE regmaps.
    Instead of panicking the kernel due to missing cache_ops, return an error
    to client driver.
    
    Signed-off-by: Alexander Stein <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Mark Brown <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
remoteproc: stm32_rproc: Add mutex protection for workqueue [+ + +]
Author: Arnaud Pouliquen <[email protected]>
Date:   Fri Mar 31 18:06:34 2023 +0200

    remoteproc: stm32_rproc: Add mutex protection for workqueue
    
    [ Upstream commit 35bdafda40cc343ad2ba2cce105eba03a70241cc ]
    
    The workqueue may execute late even after remoteproc is stopped or
    stopping, some resources (rpmsg device and endpoint) have been
    released in rproc_stop_subdevices(), then rproc_vq_interrupt()
    accessing these resources will cause kernel dump.
    
    Call trace:
    virtqueue_add_inbuf
    virtqueue_add_inbuf
    rpmsg_recv_single
    rpmsg_recv_done
    vring_interrupt
    stm32_rproc_mb_vq_work
    process_one_work
    worker_thread
    kthread
    
    Suggested-by: Mathieu Poirier <[email protected]>
    Signed-off-by: Arnaud Pouliquen <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Mathieu Poirier <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
Linux: Revert "Fix XFRM-I support for nested ESP tunnels" [+ + +]
Author: Martin Willi <[email protected]>
Date:   Tue Apr 25 09:46:18 2023 +0200

    Revert "Fix XFRM-I support for nested ESP tunnels"
    
    [ Upstream commit 5fc46f94219d1d103ffb5f0832be9da674d85a73 ]
    
    This reverts commit b0355dbbf13c0052931dd14c38c789efed64d3de.
    
    The reverted commit clears the secpath on packets received via xfrm interfaces
    to support nested IPsec tunnels. This breaks Netfilter policy matching using
    xt_policy in the FORWARD chain, as the secpath is missing during forwarding.
    Additionally, Benedict Wong reports that it breaks Transport-in-Tunnel mode.
    
    Fix this regression by reverting the commit until we have a better approach
    for nested IPsec tunnels.
    
    Fixes: b0355dbbf13c ("Fix XFRM-I support for nested ESP tunnels")
    Link: https://lore.kernel.org/netdev/[email protected]/
    Signed-off-by: Martin Willi <[email protected]>
    Signed-off-by: Steffen Klassert <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
s390/cio: include subchannels without devices also for evaluation [+ + +]
Author: Vineeth Vijayan <[email protected]>
Date:   Tue May 2 11:12:42 2023 +0200

    s390/cio: include subchannels without devices also for evaluation
    
    [ Upstream commit b1b0d5aec1cf9f9a900a14964f869c68688d923e ]
    
    Currently when the new channel-path is enabled, we do evaluation only
    on the subchannels with a device connected on it. This is because,
    in the past, if the device in the subchannel is not working or not
    available, we used to unregister the subchannels. But, from the 'commit
    2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")'
    we allow subchannels with or without an active device connected
    on it. So, when we do the io_subchannel_verify, make sure that,
    we are evaluating the subchannels without any device too.
    
    Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")
    Reported-by: Boris Fiuczynski <[email protected]>
    Signed-off-by: Vineeth Vijayan <[email protected]>
    Reviewed-by: Peter Oberparleiter <[email protected]>
    Signed-off-by: Alexander Gordeev <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
s390/qdio: fix do_sqbs() inline assembly constraint [+ + +]
Author: Heiko Carstens <[email protected]>
Date:   Thu May 11 17:04:41 2023 +0200

    s390/qdio: fix do_sqbs() inline assembly constraint
    
    commit 2862a2fdfae875888e3c1c3634e3422e01d98147 upstream.
    
    Use "a" constraint instead of "d" constraint to pass the state parameter to
    the do_sqbs() inline assembly. This prevents that general purpose register
    zero is used for the state parameter.
    
    If the compiler would select general purpose register zero this would be
    problematic for the used instruction in rsy format: the register used for
    the state parameter is a base register. If the base register is general
    purpose register zero the contents of the register are unexpectedly ignored
    when the instruction is executed.
    
    This only applies to z/VM guests using QIOASSIST with dedicated (pass through)
    QDIO-based devices such as FCP [zfcp driver] as well as real OSA or
    HiperSockets [qeth driver].
    
    A possible symptom for this case using zfcp is the following repeating kernel
    message pattern:
    
    zfcp <devbusid>: A QDIO problem occurred
    zfcp <devbusid>: A QDIO problem occurred
    zfcp <devbusid>: qdio: ZFCP on SC <sc> using AI:1 QEBSM:1 PRI:1 TDD:1 SIGA: W
    zfcp <devbusid>: A QDIO problem occurred
    zfcp <devbusid>: A QDIO problem occurred
    
    Each of the qdio problem message can be accompanied by the following entries
    for the affected subchannel <sc> in
    /sys/kernel/debug/s390dbf/qdio_error/hex_ascii for zfcp or qeth:
    
    <sc> ccq: 69....
    <sc> SQBS ERROR.
    
    Reviewed-by: Benjamin Block <[email protected]>
    Cc: Steffen Maier <[email protected]>
    Fixes: 8129ee164267 ("[PATCH] s390: qdio V=V pass-through")
    Cc: <[email protected]>
    Signed-off-by: Heiko Carstens <[email protected]>
    Signed-off-by: Alexander Gordeev <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
samples/bpf: Fix fout leak in hbm's run_bpf_prog [+ + +]
Author: Hao Zeng <[email protected]>
Date:   Tue Apr 11 16:43:49 2023 +0800

    samples/bpf: Fix fout leak in hbm's run_bpf_prog
    
    [ Upstream commit 23acb14af1914010dd0aae1bbb7fab28bf518b8e ]
    
    Fix fout being fopen'ed but then not subsequently fclose'd. In the affected
    branch, fout is otherwise going out of scope.
    
    Signed-off-by: Hao Zeng <[email protected]>
    Signed-off-by: Daniel Borkmann <[email protected]>
    Link: https://lore.kernel.org/bpf/[email protected]
    Signed-off-by: Sasha Levin <[email protected]>

 
sched: Fix KCSAN noinstr violation [+ + +]
Author: Josh Poimboeuf <[email protected]>
Date:   Wed Apr 12 10:24:07 2023 -0700

    sched: Fix KCSAN noinstr violation
    
    [ Upstream commit e0b081d17a9f4e5c0cbb0e5fbeb1abe3de0f7e4e ]
    
    With KCSAN enabled, end_of_stack() can get out-of-lined.  Force it
    inline.
    
    Fixes the following warnings:
    
      vmlinux.o: warning: objtool: check_stackleak_irqoff+0x2b: call to end_of_stack() leaves .noinstr.text section
    
    Signed-off-by: Josh Poimboeuf <[email protected]>
    Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
    Link: https://lore.kernel.org/r/cc1b4d73d3a428a00d206242a68fdf99a934ca7b.1681320026.git.jpoimboe@kernel.org
    Signed-off-by: Sasha Levin <[email protected]>

 
scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow [+ + +]
Author: Justin Tee <[email protected]>
Date:   Wed Mar 1 15:16:17 2023 -0800

    scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
    
    [ Upstream commit c6087b82a9146826564a55c5ca0164cac40348f5 ]
    
    A static code analysis tool flagged the possibility of buffer overflow when
    using copy_from_user() for a debugfs entry.
    
    Currently, it is possible that copy_from_user() copies more bytes than what
    would fit in the mybuf char array.  Add a min() restriction check between
    sizeof(mybuf) - 1 and nbytes passed from the userspace buffer to protect
    against buffer overflow.
    
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Justin Tee <[email protected]>
    Signed-off-by: Martin K. Petersen <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition [+ + +]
Author: Zheng Wang <[email protected]>
Date:   Sat Mar 18 16:16:35 2023 +0800

    scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition
    
    [ Upstream commit f486893288f3e9b171b836f43853a6426515d800 ]
    
    mptlan_probe() calls mpt_register_lan_device() which initializes the
    &priv->post_buckets_task workqueue. A call to
    mpt_lan_wake_post_buckets_task() will subsequently start the work.
    
    During driver unload in mptlan_remove() the following race may occur:
    
    CPU0                  CPU1
    
                        |mpt_lan_post_receive_buckets_work()
    mptlan_remove()     |
      free_netdev()     |
        kfree(dev);     |
                        |
                        | dev->mtu
                        |   //use
    
    Fix this by finishing the work prior to cleaning up in mptlan_remove().
    
    [mkp: we really should remove mptlan instead of attempting to fix it]
    
    Signed-off-by: Zheng Wang <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Martin K. Petersen <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

scsi: storvsc: Don't pass unused PFNs to Hyper-V host [+ + +]
Author: Michael Kelley <[email protected]>
Date:   Mon May 15 10:20:41 2023 -0700

    scsi: storvsc: Don't pass unused PFNs to Hyper-V host
    
    [ Upstream commit 4e81a6cba517cb33584308a331f14f5e3fec369b ]
    
    In a SCSI request, storvsc pre-allocates space for up to
    MAX_PAGE_BUFFER_COUNT physical frame numbers to be passed to Hyper-V.  If
    the size of the I/O request requires more PFNs, a separate memory area of
    exactly the correct size is dynamically allocated.
    
    But when the pre-allocated area is used, current code always passes
    MAX_PAGE_BUFFER_COUNT PFNs to Hyper-V, even if fewer are needed.  While
    this doesn't break anything because the additional PFNs are always zero,
    more bytes than necessary are copied into the VMBus channel ring buffer.
    This takes CPU cycles and wastes space in the ring buffer. For a typical 4
    Kbyte I/O that requires only a single PFN, 248 unnecessary bytes are
    copied.
    
    Fix this by setting the payload_sz based on the actual number of PFNs
    required, not the size of the pre-allocated space.
    
    Reported-by: John Starks <[email protected]>
    Fixes: 8f43710543ef ("scsi: storvsc: Support PAGE_SIZE larger than 4K")
    Signed-off-by: Michael Kelley <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Martin K. Petersen <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

scsi: target: iscsit: Free cmds before session free [+ + +]
Author: Dmitry Bogdanov <[email protected]>
Date:   Sat Mar 18 20:56:17 2023 -0500

    scsi: target: iscsit: Free cmds before session free
    
    [ Upstream commit d8990b5a4d065f38f35d69bcd627ec5a7f8330ca ]
    
    Commands from recovery entries are freed after session has been closed.
    That leads to use-after-free at command free or NPE with such call trace:
    
    Time2Retain timer expired for SID: 1, cleaning up iSCSI session.
    BUG: kernel NULL pointer dereference, address: 0000000000000140
    RIP: 0010:sbitmap_queue_clear+0x3a/0xa0
    Call Trace:
     target_release_cmd_kref+0xd1/0x1f0 [target_core_mod]
     transport_generic_free_cmd+0xd1/0x180 [target_core_mod]
     iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod]
     iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod]
     iscsit_close_session+0x13a/0x140 [iscsi_target_mod]
     iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod]
     call_timer_fn+0x24/0x140
    
    Move cleanup of recovery enrties to before session freeing.
    
    Reported-by: Forza <[email protected]>
    Signed-off-by: Dmitry Bogdanov <[email protected]>
    Signed-off-by: Mike Christie <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Reviewed-by: Maurizio Lombardi <[email protected]>
    Signed-off-by: Martin K. Petersen <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

scsi: ufs: core: Fix I/O hang that occurs when BKOPS fails in W-LUN suspend [+ + +]
Author: Keoseong Park <[email protected]>
Date:   Tue Apr 25 12:17:21 2023 +0900

    scsi: ufs: core: Fix I/O hang that occurs when BKOPS fails in W-LUN suspend
    
    [ Upstream commit 1a7edd041f2d252f251523ba3f2eaead076a8f8d ]
    
    Even when urgent BKOPS fails, the consumer will get stuck in runtime
    suspend status. Like commit 1a5665fc8d7a ("scsi: ufs: core: WLUN suspend
    SSU/enter hibern8 fail recovery"), trigger the error handler and return
    -EBUSY to break the suspend.
    
    Fixes: b294ff3e3449 ("scsi: ufs: core: Enable power management for wlun")
    Signed-off-by: Keoseong Park <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Reviewed-by: Avri Altman <[email protected]>
    Signed-off-by: Martin K. Petersen <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

scsi: ufs: ufs-pci: Add support for Intel Lunar Lake [+ + +]
Author: Adrian Hunter <[email protected]>
Date:   Tue Mar 28 13:58:32 2023 +0300

    scsi: ufs: ufs-pci: Add support for Intel Lunar Lake
    
    [ Upstream commit 0a07d3c7a1d205b47d9f3608ff4e9d1065d63b6d ]
    
    Add PCI ID to support Intel Lunar Lake, same as MTL.
    
    Signed-off-by: Adrian Hunter <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Martin K. Petersen <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
selftests: seg6: disable DAD on IPv6 router cfg for srv6_end_dt4_l3vpn_test [+ + +]
Author: Andrea Mayer <[email protected]>
Date:   Wed May 10 13:16:37 2023 +0200

    selftests: seg6: disable DAD on IPv6 router cfg for srv6_end_dt4_l3vpn_test
    
    [ Upstream commit 21a933c79a33add3612808f3be4ad65dd4dc026b ]
    
    The srv6_end_dt4_l3vpn_test instantiates a virtual network consisting of
    several routers (rt-1, rt-2) and hosts.
    When the IPv6 addresses of rt-{1,2} routers are configured, the Deduplicate
    Address Detection (DAD) kicks in when enabled in the Linux distros running
    the selftests. DAD is used to check whether an IPv6 address is already
    assigned in a network. Such a mechanism consists of sending an ICMPv6 Echo
    Request and waiting for a reply.
    As the DAD process could take too long to complete, it may cause the
    failing of some tests carried out by the srv6_end_dt4_l3vpn_test script.
    
    To make the srv6_end_dt4_l3vpn_test more robust, we disable DAD on routers
    since we configure the virtual network manually and do not need any address
    deduplication mechanism at all.
    
    Fixes: 2195444e09b4 ("selftests: add selftest for the SRv6 End.DT4 behavior")
    Signed-off-by: Andrea Mayer <[email protected]>
    Reviewed-by: David Ahern <[email protected]>
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
selftets: seg6: disable rp_filter by default in srv6_end_dt4_l3vpn_test [+ + +]
Author: Andrea Mayer <[email protected]>
Date:   Wed May 10 13:16:38 2023 +0200

    selftets: seg6: disable rp_filter by default in srv6_end_dt4_l3vpn_test
    
    [ Upstream commit f97b8401e0deb46ad1e4245c21f651f64f55aaa6 ]
    
    On some distributions, the rp_filter is automatically set (=1) by
    default on a netdev basis (also on VRFs).
    In an SRv6 End.DT4 behavior, decapsulated IPv4 packets are routed using
    the table associated with the VRF bound to that tunnel. During lookup
    operations, the rp_filter can lead to packet loss when activated on the
    VRF.
    Therefore, we chose to make this selftest more robust by explicitly
    disabling the rp_filter during tests (as it is automatically set by some
    Linux distributions).
    
    Fixes: 2195444e09b4 ("selftests: add selftest for the SRv6 End.DT4 behavior")
    Reported-by: Hangbin Liu <[email protected]>
    Signed-off-by: Andrea Mayer <andrea.m[email protected]>
    Tested-by: Hangbin Liu <[email protected]>
    Reviewed-by: David Ahern <[email protected]>
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
serial: 8250: Reinit port->pm on port specific driver unbind [+ + +]
Author: Tony Lindgren <[email protected]>
Date:   Tue Apr 18 13:14:06 2023 +0300

    serial: 8250: Reinit port->pm on port specific driver unbind
    
    [ Upstream commit 04e82793f068d2f0ffe62fcea03d007a8cdc16a7 ]
    
    When we unbind a serial port hardware specific 8250 driver, the generic
    serial8250 driver takes over the port. After that we see an oops about 10
    seconds later. This can produce the following at least on some TI SoCs:
    
    Unhandled fault: imprecise external abort (0x1406)
    Internal error: : 1406 [#1] SMP ARM
    
    Turns out that we may still have the serial port hardware specific driver
    port->pm in use, and serial8250_pm() tries to call it after the port
    specific driver is gone:
    
    serial8250_pm [8250_base] from uart_change_pm+0x54/0x8c [serial_base]
    uart_change_pm [serial_base] from uart_hangup+0x154/0x198 [serial_base]
    uart_hangup [serial_base] from __tty_hangup.part.0+0x328/0x37c
    __tty_hangup.part.0 from disassociate_ctty+0x154/0x20c
    disassociate_ctty from do_exit+0x744/0xaac
    do_exit from do_group_exit+0x40/0x8c
    do_group_exit from __wake_up_parent+0x0/0x1c
    
    Let's fix the issue by calling serial8250_set_defaults() in
    serial8250_unregister_port(). This will set the port back to using
    the serial8250 default functions, and sets the port->pm to point to
    serial8250_pm.
    
    Signed-off-by: Tony Lindgren <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

serial: 8250_bcm7271: balance clk_enable calls [+ + +]
Author: Doug Berger <[email protected]>
Date:   Thu Apr 27 11:19:15 2023 -0700

    serial: 8250_bcm7271: balance clk_enable calls
    
    [ Upstream commit 8a3b5477256a54ae4a470dcebbcf8cdc18e4696d ]
    
    The sw_baud clock must be disabled when the device driver is not
    connected to the device. This now occurs when probe fails and
    upon remove.
    
    Fixes: 41a469482de2 ("serial: 8250: Add new 8250-core based Broadcom STB driver")
    Reported-by: XuDong Liu <[email protected]>
    Link: https://lore.kernel.org/lkml/[email protected]/
    Signed-off-by: Doug Berger <[email protected]>
    Acked-by: Florian Fainelli <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

serial: 8250_bcm7271: fix leak in `brcmuart_probe` [+ + +]
Author: Doug Berger <[email protected]>
Date:   Thu Apr 27 11:19:16 2023 -0700

    serial: 8250_bcm7271: fix leak in `brcmuart_probe`
    
    [ Upstream commit f264f2f6f4788dc031cef60a0cf2881902736709 ]
    
    Smatch reports:
    drivers/tty/serial/8250/8250_bcm7271.c:1120 brcmuart_probe() warn:
    'baud_mux_clk' from clk_prepare_enable() not released on lines: 1032.
    
    The issue is fixed by using a managed clock.
    
    Fixes: 41a469482de2 ("serial: 8250: Add new 8250-core based Broadcom STB driver")
    Reported-by: XuDong Liu <[email protected]>
    Link: https://lore.kernel.org/lkml/[email protected]/
    Signed-off-by: Doug Berger <[email protected]>
    Acked-by: Florian Fainelli <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

serial: 8250_exar: Add support for USR298x PCI Modems [+ + +]
Author: Andrew Davis <[email protected]>
Date:   Thu Apr 20 11:02:09 2023 -0500

    serial: 8250_exar: Add support for USR298x PCI Modems
    
    commit 95d698869b404772cc8b72560df71548491c10bc upstream.
    
    Possibly the last PCI controller-based (i.e. not a soft/winmodem)
    dial-up modem one can still buy.
    
    Looks to have a stock XR17C154 PCI UART chip for communication, but for
    some reason when provisioning the PCI IDs they swapped the vendor and
    subvendor IDs. Otherwise this card would have worked out of the box.
    
    Searching online, some folks seem to not have this issue and others do,
    so it is possible only some batches of cards have this error.
    
    Create a new macro to handle the switched IDs and add support here.
    
    Signed-off-by: Andrew Davis <[email protected]>
    Cc: stable <[email protected]>
    Reviewed-by: Andy Shevchenko <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

serial: Add support for Advantech PCI-1611U card [+ + +]
Author: Vitaliy Tomin <[email protected]>
Date:   Sun Apr 23 11:45:12 2023 +0800

    serial: Add support for Advantech PCI-1611U card
    
    commit d2b00516de0e1d696724247098f6733a6ea53908 upstream.
    
    Add support for Advantech PCI-1611U card
    
    Advantech provides opensource drivers for this and many others card
    based on legacy copy of 8250_pci driver called adv950
    
    https://www.advantech.com/emt/support/details/driver?id=1-TDOIMJ
    
    It is hard to maintain to run as out of tree module on newer kernels.
    Just adding PCI ID to kernel 8250_pci works perfect.
    
    Signed-off-by: Vitaliy Tomin <[email protected]>
    Cc: stable <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

serial: arc_uart: fix of_iomap leak in `arc_serial_probe` [+ + +]
Author: Ke Zhang <[email protected]>
Date:   Fri Apr 28 11:16:36 2023 +0800

    serial: arc_uart: fix of_iomap leak in `arc_serial_probe`
    
    [ Upstream commit 8ab5fc55d7f65d58a3c3aeadf11bdf60267cd2bd ]
    
    Smatch reports:
    
    drivers/tty/serial/arc_uart.c:631 arc_serial_probe() warn:
    'port->membase' from of_iomap() not released on lines: 631.
    
    In arc_serial_probe(), if uart_add_one_port() fails,
    port->membase is not released, which would cause a resource leak.
    
    To fix this, I replace of_iomap with devm_platform_ioremap_resource.
    
    Fixes: 8dbe1d5e09a7 ("serial/arc: inline the probe helper")
    Signed-off-by: Ke Zhang <[email protected]>
    Reviewed-by: Dongliang Mu <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

serial: qcom-geni: fix enabling deactivated interrupt [+ + +]
Author: Krzysztof Kozlowski <[email protected]>
Date:   Fri May 5 17:23:01 2023 +0200

    serial: qcom-geni: fix enabling deactivated interrupt
    
    commit 5f949f140f73696f64acb89a1f16ff9153d017e0 upstream.
    
    The driver have a race, experienced only with PREEMPT_RT patchset:
    
    CPU0                         | CPU1
    ==================================================================
    qcom_geni_serial_probe       |
      uart_add_one_port          |
                                 | serdev_drv_probe
                                 |   qca_serdev_probe
                                 |     serdev_device_open
                                 |       uart_open
                                 |         uart_startup
                                 |           qcom_geni_serial_startup
                                 |             enable_irq
                                 |               __irq_startup
                                 |                 WARN_ON()
                                 |                 IRQ not activated
      request_threaded_irq       |
        irq_domain_activate_irq  |
    
    The warning:
    
      894000.serial: ttyHS1 at MMIO 0x894000 (irq = 144, base_baud = 0) is a MSM
      serial serial0: tty port ttyHS1 registered
      WARNING: CPU: 7 PID: 107 at kernel/irq/chip.c:241 __irq_startup+0x78/0xd8
      ...
      qcom_geni_serial 894000.serial: serial engine reports 0 RX bytes in!
    
    Adding UART port triggers probe of child serial devices - serdev and
    eventually Qualcomm Bluetooth hci_qca driver.  This opens UART port
    which enables the interrupt before it got activated in
    request_threaded_irq().  The issue originates in commit f3974413cf02
    ("tty: serial: qcom_geni_serial: Wakeup IRQ cleanup") and discussion on
    mailing list [1].  However the above commit does not explain why the
    uart_add_one_port() is moved above requesting interrupt.
    
    [1] https://lore.kernel.org/all/[email protected]/
    
    Fixes: f3974413cf02 ("tty: serial: qcom_geni_serial: Wakeup IRQ cleanup")
    Cc: <[email protected]>
    Cc: Stephen Boyd <[email protected]>
    Signed-off-by: Krzysztof Kozlowski <[email protected]>
    Reviewed-by: Stephen Boyd <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
SMB3: Close all deferred handles of inode in case of handle lease break [+ + +]
Author: Bharath SM <[email protected]>
Date:   Wed May 3 14:38:35 2023 +0000

    SMB3: Close all deferred handles of inode in case of handle lease break
    
    commit 47592fa8eb03742048b096b4696ec133384c45eb upstream.
    
    Oplock break may occur for different file handle than the deferred
    handle. Check for inode deferred closes list, if it's not empty then
    close all the deferred handles of inode because we should not cache
    handles if we dont have handle lease.
    
    Eg: If openfilelist has one deferred file handle and another open file
    handle from app for a same file, then on a lease break we choose the
    first handle in openfile list. The first handle in list can be deferred
    handle or actual open file handle from app. In case if it is actual open
    handle then today, we don't close deferred handles if we lose handle lease
    on a file. Problem with this is, later if app decides to close the existing
    open handle then we still be caching deferred handles until deferred close
    timeout. Leaving open handle may result in sharing violation when windows
    client tries to open a file with limited file share access.
    
    So we should check for deferred list of inode and walk through the list of
    deferred files in inode and close all deferred files.
    
    Fixes: 9e31678fb403 ("SMB3: fix lease break timeout when multiple deferred close handles for the same file.")
    Cc: [email protected]
    Signed-off-by: Bharath SM <[email protected]>
    Signed-off-by: Steve French <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

SMB3: drop reference to cfile before sending oplock break [+ + +]
Author: Bharath SM <[email protected]>
Date:   Mon May 15 21:25:12 2023 +0000

    SMB3: drop reference to cfile before sending oplock break
    
    commit 59a556aebc43dded08535fe97d94ca3f657915e4 upstream.
    
    In cifs_oplock_break function we drop reference to a cfile at
    the end of function, due to which close command goes on wire
    after lease break acknowledgment even if file is already closed
    by application but we had deferred the handle close.
    If other client with limited file shareaccess waiting on lease
    break ack proceeds operation on that file as soon as first client
    sends ack, then we may encounter status sharing violation error
    because of open handle.
    Solution is to put reference to cfile(send close on wire if last ref)
    and then send oplock acknowledgment to server.
    
    Fixes: 9e31678fb403 ("SMB3: fix lease break timeout when multiple deferred close handles for the same file.")
    Cc: [email protected]
    Signed-off-by: Bharath SM <[email protected]>
    Reviewed-by: Shyam Prasad N <[email protected]>
    Signed-off-by: Steve French <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
soundwire: qcom: gracefully handle too many ports in DT [+ + +]
Author: Krzysztof Kozlowski <[email protected]>
Date:   Wed Feb 22 15:44:12 2023 +0100

    soundwire: qcom: gracefully handle too many ports in DT
    
    [ Upstream commit 2367e0ecb498764e95cfda691ff0828f7d25f9a4 ]
    
    There are two issues related to the number of ports coming from
    Devicetree when exceeding in total QCOM_SDW_MAX_PORTS.  Both lead to
    incorrect memory accesses:
    1. With DTS having too big value of input or output ports, the driver,
       when copying port parameters from local/stack arrays into 'pconfig'
       array in 'struct qcom_swrm_ctrl', will iterate over their sizes.
    
    2. If DTS also has too many parameters for these ports (e.g.
       qcom,ports-sinterval-low), the driver will overflow buffers on the
       stack when reading these properties from DTS.
    
    Add a sanity check so incorrect DTS will not cause kernel memory
    corruption.
    
    Signed-off-by: Krzysztof Kozlowski <[email protected]>
    Reviewed-by: Srinivas Kandagatla <[email protected]>
    Reviewed-by: Konrad Dybcio <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Vinod Koul <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 [+ + +]
Author: Kevin Groeneveld <[email protected]>
Date:   Sat Mar 18 18:21:32 2023 -0400

    spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3
    
    [ Upstream commit 87c614175bbf28d3fd076dc2d166bac759e41427 ]
    
    When using gpio based chip select the cs value can go outside the range
    0 – 3. The various MX51_ECSPI_* macros did not take this into consideration
    resulting in possible corruption of the configuration.
    
    For example for any cs value over 3 the SCLKPHA bits would not be set and
    other values in the register possibly corrupted.
    
    One way to fix this is to just mask the cs bits to 2 bits. This still
    allows all 4 native chip selects to work as well as gpio chip selects
    (which can use any of the 4 chip select configurations).
    
    Signed-off-by: Kevin Groeneveld <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Mark Brown <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE [+ + +]
Author: Philipp Hortmann <[email protected]>
Date:   Thu Feb 23 07:47:21 2023 +0100

    staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE
    
    [ Upstream commit fda2093860df4812d69052a8cf4997e53853a340 ]
    
    Replace macro RTL_PCI_DEVICE with PCI_DEVICE to get rid of rtl819xp_ops
    which is empty.
    
    Signed-off-by: Philipp Hortmann <[email protected]>
    Link: https://lore.kernel.org/r/8b45ee783fa91196b7c9d6fc840a189496afd2f4.1677133271.git.philipp.g.hortmann@gmail.com
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
statfs: enforce statfs[64] structure initialization [+ + +]
Author: Ilya Leoshkevich <[email protected]>
Date:   Thu May 4 16:40:20 2023 +0200

    statfs: enforce statfs[64] structure initialization
    
    commit ed40866ec7d328b3dfb70db7e2011640a16202c3 upstream.
    
    s390's struct statfs and struct statfs64 contain padding, which
    field-by-field copying does not set. Initialize the respective structs
    with zeros before filling them and copying them to userspace, like it's
    already done for the compat versions of these structs.
    
    Found by KMSAN.
    
    [[email protected]: fixed typo in patch description]
    Acked-by: Heiko Carstens <[email protected]>
    Cc: [email protected] # v4.14+
    Signed-off-by: Ilya Leoshkevich <[email protected]>
    Reviewed-by: Andrew Morton <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Alexander Gordeev <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
SUNRPC: always free ctxt when freeing deferred request [+ + +]
Author: NeilBrown <[email protected]>
Date:   Tue May 9 09:42:47 2023 +1000

    SUNRPC: always free ctxt when freeing deferred request
    
    [ Upstream commit 948f072ada23e0a504c5e4d7d71d4c83bd0785ec ]
    
    Since the ->xprt_ctxt pointer was added to svc_deferred_req, it has not
    been sufficient to use kfree() to free a deferred request.  We may need
    to free the ctxt as well.
    
    As freeing the ctxt is all that ->xpo_release_rqst() does, we repurpose
    it to explicit do that even when the ctxt is not stored in an rqst.
    So we now have ->xpo_release_ctxt() which is given an xprt and a ctxt,
    which may have been taken either from an rqst or from a dreq.  The
    caller is now responsible for clearing that pointer after the call to
    ->xpo_release_ctxt.
    
    We also clear dr->xprt_ctxt when the ctxt is moved into a new rqst when
    revisiting a deferred request.  This ensures there is only one pointer
    to the ctxt, so the risk of double freeing in future is reduced.  The
    new code in svc_xprt_release which releases both the ctxt and any
    rq_deferred depends on this.
    
    Fixes: 773f91b2cf3f ("SUNRPC: Fix NFSD's request deferral on RDMA transports")
    Signed-off-by: NeilBrown <[email protected]>
    Reviewed-by: Jeff Layton <[email protected]>
    Signed-off-by: Chuck Lever <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

SUNRPC: Clean up svc_deferred_class trace events [+ + +]
Author: Chuck Lever <[email protected]>
Date:   Thu Apr 14 15:50:12 2022 -0400

    SUNRPC: Clean up svc_deferred_class trace events
    
    [ Upstream commit 45cb7955c180a2a34d291e68938250c4f9bd294f ]
    
    Replace the temporary fix from commit 4d5004451ab2 ("SUNRPC: Fix the
    svc_deferred_event trace class") with the use of __sockaddr and
    friends, which is the preferred solution (but only available in 5.18
    and newer).
    
    Signed-off-by: Chuck Lever <[email protected]>
    Stable-dep-of: 948f072ada23 ("SUNRPC: always free ctxt when freeing deferred request")
    Signed-off-by: Sasha Levin <[email protected]>

SUNRPC: double free xprt_ctxt while still in use [+ + +]
Author: NeilBrown <[email protected]>
Date:   Tue May 9 09:41:49 2023 +1000

    SUNRPC: double free xprt_ctxt while still in use
    
    [ Upstream commit eb8d3a2c809abd73ab0a060fe971d6b9019aa3c1 ]
    
    When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out
    of the svc_rqst into the svc_deferred_req.
    When the deferred request is revisited, the pointer is copied into
    the new svc_rqst - and also remains in the svc_deferred_req.
    
    In the (rare?) case that the request is deferred a second time, the old
    svc_deferred_req is reused - it still has all the correct content.
    However in that case the rq_xprt_ctxt pointer is NOT cleared so that
    when xpo_release_xprt is called, the ctxt is freed (UDP) or possible
    added to a free list (RDMA).
    When the deferred request is revisited for a second time, it will
    reference this ctxt which may be invalid, and the free the object a
    second time which is likely to oops.
    
    So change svc_defer() to *always* clear rq_xprt_ctxt, and assert that
    the value is now stored in the svc_deferred_req.
    
    Fixes: 773f91b2cf3f ("SUNRPC: Fix NFSD's request deferral on RDMA transports")
    Signed-off-by: NeilBrown <[email protected]>
    Reviewed-by: Jeff Layton <[email protected]>
    Signed-off-by: Chuck Lever <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

SUNRPC: Fix trace_svc_register() call site [+ + +]
Author: Chuck Lever <[email protected]>
Date:   Sun May 14 15:51:48 2023 -0400

    SUNRPC: Fix trace_svc_register() call site
    
    [ Upstream commit 07a27305938559fb35f7a46fb90a5e37728bdee6 ]
    
    The trace event recorded incorrect values for the registered family,
    protocol, and port because the arguments are in the wrong order.
    
    Fixes: b4af59328c25 ("SUNRPC: Trace server-side rpcbind registration events")
    Signed-off-by: Chuck Lever <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

SUNRPC: Remove dead code in svc_tcp_release_rqst() [+ + +]
Author: Chuck Lever <[email protected]>
Date:   Sun Apr 3 12:25:55 2022 -0400

    SUNRPC: Remove dead code in svc_tcp_release_rqst()
    
    [ Upstream commit 4af8b42e5629b97bdde287d5d6c250535d324676 ]
    
    Clean up: svc_tcp_sendto() always sets rq_xprt_ctxt to NULL.
    
    Signed-off-by: Chuck Lever <[email protected]>
    Stable-dep-of: 948f072ada23 ("SUNRPC: always free ctxt when freeing deferred request")
    Signed-off-by: Sasha Levin <[email protected]>

SUNRPC: Remove svc_rqst::rq_xprt_hlen [+ + +]
Author: Chuck Lever <[email protected]>
Date:   Wed Apr 6 14:38:59 2022 -0400

    SUNRPC: Remove svc_rqst::rq_xprt_hlen
    
    [ Upstream commit 983084b2672c593959e3148d6a17c8b920797dde ]
    
    Clean up: This field is now always set to zero.
    
    Signed-off-by: Chuck Lever <[email protected]>
    Stable-dep-of: 948f072ada23 ("SUNRPC: always free ctxt when freeing deferred request")
    Signed-off-by: Sasha Levin <[email protected]>

 
tcp: add annotations around sk->sk_shutdown accesses [+ + +]
Author: Eric Dumazet <[email protected]>
Date:   Tue May 9 20:36:56 2023 +0000

    tcp: add annotations around sk->sk_shutdown accesses
    
    [ Upstream commit e14cadfd80d76f01bfaa1a8d745b1db19b57d6be ]
    
    Now sk->sk_shutdown is no longer a bitfield, we can add
    standard READ_ONCE()/WRITE_ONCE() annotations to silence
    KCSAN reports like the following:
    
    BUG: KCSAN: data-race in tcp_disconnect / tcp_poll
    
    write to 0xffff88814588582c of 1 bytes by task 3404 on cpu 1:
    tcp_disconnect+0x4d6/0xdb0 net/ipv4/tcp.c:3121
    __inet_stream_connect+0x5dd/0x6e0 net/ipv4/af_inet.c:715
    inet_stream_connect+0x48/0x70 net/ipv4/af_inet.c:727
    __sys_connect_file net/socket.c:2001 [inline]
    __sys_connect+0x19b/0x1b0 net/socket.c:2018
    __do_sys_connect net/socket.c:2028 [inline]
    __se_sys_connect net/socket.c:2025 [inline]
    __x64_sys_connect+0x41/0x50 net/socket.c:2025
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    read to 0xffff88814588582c of 1 bytes by task 3374 on cpu 0:
    tcp_poll+0x2e6/0x7d0 net/ipv4/tcp.c:562
    sock_poll+0x253/0x270 net/socket.c:1383
    vfs_poll include/linux/poll.h:88 [inline]
    io_poll_check_events io_uring/poll.c:281 [inline]
    io_poll_task_func+0x15a/0x820 io_uring/poll.c:333
    handle_tw_list io_uring/io_uring.c:1184 [inline]
    tctx_task_work+0x1fe/0x4d0 io_uring/io_uring.c:1246
    task_work_run+0x123/0x160 kernel/task_work.c:179
    get_signal+0xe64/0xff0 kernel/signal.c:2635
    arch_do_signal_or_restart+0x89/0x2a0 arch/x86/kernel/signal.c:306
    exit_to_user_mode_loop+0x6f/0xe0 kernel/entry/common.c:168
    exit_to_user_mode_prepare+0x6c/0xb0 kernel/entry/common.c:204
    __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
    syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:297
    do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    value changed: 0x03 -> 0x00
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-by: syzbot <[email protected]>
    Signed-off-by: Eric Dumazet <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

tcp: fix possible sk_priority leak in tcp_v4_send_reset() [+ + +]
Author: Eric Dumazet <[email protected]>
Date:   Thu May 11 11:47:49 2023 +0000

    tcp: fix possible sk_priority leak in tcp_v4_send_reset()
    
    [ Upstream commit 1e306ec49a1f206fd2cc89a42fac6e6f592a8cc1 ]
    
    When tcp_v4_send_reset() is called with @sk == NULL,
    we do not change ctl_sk->sk_priority, which could have been
    set from a prior invocation.
    
    Change tcp_v4_send_reset() to set sk_priority and sk_mark
    fields before calling ip_send_unicast_reply().
    
    This means tcp_v4_send_reset() and tcp_v4_send_ack()
    no longer have to clear ctl_sk->sk_mark after
    their call to ip_send_unicast_reply().
    
    Fixes: f6c0f5d209fa ("tcp: honor SO_PRIORITY in TIME_WAIT state")
    Signed-off-by: Eric Dumazet <eduma[email protected]>
    Cc: Antoine Tenart <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
thunderbolt: Clear registers properly when auto clear isn't in use [+ + +]
Author: Mario Limonciello <[email protected]>
Date:   Mon Apr 24 14:55:54 2023 -0500

    thunderbolt: Clear registers properly when auto clear isn't in use
    
    commit c4af8e3fecd03b0aedcd38145955605cfebe7e3a upstream.
    
    When `QUIRK_AUTO_CLEAR_INT` isn't set, interrupt masking should be
    cleared by writing to Interrupt Mask Clear (IMR) and interrupt
    status should be cleared properly at shutdown/init.
    
    This fixes an error where interrupts are left enabled during resume
    from hibernation with `CONFIG_USB4=y`.
    
    Fixes: 468c49f44759 ("thunderbolt: Disable interrupt auto clear for rings")
    Cc: [email protected] # v6.3
    Reported-by: Takashi Iwai <[email protected]>
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=217343
    Signed-off-by: Mario Limonciello <[email protected]>
    Signed-off-by: Mika Westerberg <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
tick/broadcast: Make broadcast device replacement work correctly [+ + +]
Author: Thomas Gleixner <[email protected]>
Date:   Sat May 6 18:40:57 2023 +0200

    tick/broadcast: Make broadcast device replacement work correctly
    
    [ Upstream commit f9d36cf445ffff0b913ba187a3eff78028f9b1fb ]
    
    When a tick broadcast clockevent device is initialized for one shot mode
    then tick_broadcast_setup_oneshot() OR's the periodic broadcast mode
    cpumask into the oneshot broadcast cpumask.
    
    This is required when switching from periodic broadcast mode to oneshot
    broadcast mode to ensure that CPUs which are waiting for periodic
    broadcast are woken up on the next tick.
    
    But it is subtly broken, when an active broadcast device is replaced and
    the system is already in oneshot (NOHZ/HIGHRES) mode. Victor observed
    this and debugged the issue.
    
    Then the OR of the periodic broadcast CPU mask is wrong as the periodic
    cpumask bits are sticky after tick_broadcast_enable() set it for a CPU
    unless explicitly cleared via tick_broadcast_disable().
    
    That means that this sets all other CPUs which have tick broadcasting
    enabled at that point unconditionally in the oneshot broadcast mask.
    
    If the affected CPUs were already idle and had their bits set in the
    oneshot broadcast mask then this does no harm. But for non idle CPUs
    which were not set this corrupts their state.
    
    On their next invocation of tick_broadcast_enable() they observe the bit
    set, which indicates that the broadcast for the CPU is already set up.
    As a consequence they fail to update the broadcast event even if their
    earliest expiring timer is before the actually programmed broadcast
    event.
    
    If the programmed broadcast event is far in the future, then this can
    cause stalls or trigger the hung task detector.
    
    Avoid this by telling tick_broadcast_setup_oneshot() explicitly whether
    this is the initial switch over from periodic to oneshot broadcast which
    must take the periodic broadcast mask into account. In the case of
    initialization of a replacement device this prevents that the broadcast
    oneshot mask is modified.
    
    There is a second problem with broadcast device replacement in this
    function. The broadcast device is only armed when the previous state of
    the device was periodic.
    
    That is correct for the switch from periodic broadcast mode to oneshot
    broadcast mode as the underlying broadcast device could operate in
    oneshot state already due to lack of periodic state in hardware. In that
    case it is already armed to expire at the next tick.
    
    For the replacement case this is wrong as the device is in shutdown
    state. That means that any already pending broadcast event will not be
    armed.
    
    This went unnoticed because any CPU which goes idle will observe that
    the broadcast device has an expiry time of KTIME_MAX and therefore any
    CPUs next timer event will be earlier and cause a reprogramming of the
    broadcast device. But that does not guarantee that the events of the
    CPUs which were already in idle are delivered on time.
    
    Fix this by arming the newly installed device for an immediate event
    which will reevaluate the per CPU expiry times and reprogram the
    broadcast device accordingly. This is simpler than caching the last
    expiry time in yet another place or saving it before the device exchange
    and handing it down to the setup function. Replacement of broadcast
    devices is not a frequent operation and usually happens once somewhere
    late in the boot process.
    
    Fixes: 9c336c9935cf ("tick/broadcast: Allow late registered device to enter oneshot mode")
    Reported-by: Victor Hassan <[email protected]>
    Signed-off-by: Thomas Gleixner <[email protected]>
    Reviewed-by: Frederic Weisbecker <[email protected]>
    Link: https://lore.kernel.org/r/87pm7d2z1i.ffs@tglx
    Signed-off-by: Sasha Levin <[email protected]>

 
tipc: add tipc_bearer_min_mtu to calculate min mtu [+ + +]
Author: Xin Long <[email protected]>
Date:   Sun May 14 15:52:27 2023 -0400

    tipc: add tipc_bearer_min_mtu to calculate min mtu
    
    [ Upstream commit 3ae6d66b605be604644d4bb5708a7ffd9cf1abe8 ]
    
    As different media may requires different min mtu, and even the
    same media with different net family requires different min mtu,
    add tipc_bearer_min_mtu() to calculate min mtu accordingly.
    
    This API will be used to check the new mtu when doing the link
    mtu negotiation in the next patch.
    
    Signed-off-by: Xin Long <[email protected]>
    Acked-by: Jon Maloy <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Stable-dep-of: 56077b56cd3f ("tipc: do not update mtu if msg_max is too small in mtu negotiation")
    Signed-off-by: Sasha Levin <[email protected]>

tipc: check the bearer min mtu properly when setting it by netlink [+ + +]
Author: Xin Long <[email protected]>
Date:   Sun May 14 15:52:29 2023 -0400

    tipc: check the bearer min mtu properly when setting it by netlink
    
    [ Upstream commit 35a089b5d793d2bfd2cc7cfa6104545184de2ce7 ]
    
    Checking the bearer min mtu with tipc_udp_mtu_bad() only works for
    IPv4 UDP bearer, and IPv6 UDP bearer has a different value for the
    min mtu. This patch checks with encap_hlen + TIPC_MIN_BEARER_MTU
    for min mtu, which works for both IPv4 and IPv6 UDP bearer.
    
    Note that tipc_udp_mtu_bad() is still used to check media min mtu
    in __tipc_nl_media_set(), as m->mtu currently is only used by the
    IPv4 UDP bearer as its default mtu value.
    
    Fixes: 682cd3cf946b ("tipc: confgiure and apply UDP bearer MTU on running links")
    Signed-off-by: Xin Long <[email protected]>
    Acked-by: Jon Maloy <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

tipc: do not update mtu if msg_max is too small in mtu negotiation [+ + +]
Author: Xin Long <[email protected]>
Date:   Sun May 14 15:52:28 2023 -0400

    tipc: do not update mtu if msg_max is too small in mtu negotiation
    
    [ Upstream commit 56077b56cd3fb78e1c8619e29581ba25a5c55e86 ]
    
    When doing link mtu negotiation, a malicious peer may send Activate msg
    with a very small mtu, e.g. 4 in Shuang's testing, without checking for
    the minimum mtu, l->mtu will be set to 4 in tipc_link_proto_rcv(), then
    n->links[bearer_id].mtu is set to 4294967228, which is a overflow of
    '4 - INT_H_SIZE - EMSG_OVERHEAD' in tipc_link_mss().
    
    With tipc_link.mtu = 4, tipc_link_xmit() kept printing the warning:
    
     tipc: Too large msg, purging xmit list 1 5 0 40 4!
     tipc: Too large msg, purging xmit list 1 15 0 60 4!
    
    And with tipc_link_entry.mtu 4294967228, a huge skb was allocated in
    named_distribute(), and when purging it in tipc_link_xmit(), a crash
    was even caused:
    
      general protection fault, probably for non-canonical address 0x2100001011000dd: 0000 [#1] PREEMPT SMP PTI
      CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Not tainted 6.3.0.neta #19
      RIP: 0010:kfree_skb_list_reason+0x7e/0x1f0
      Call Trace:
       <IRQ>
       skb_release_data+0xf9/0x1d0
       kfree_skb_reason+0x40/0x100
       tipc_link_xmit+0x57a/0x740 [tipc]
       tipc_node_xmit+0x16c/0x5c0 [tipc]
       tipc_named_node_up+0x27f/0x2c0 [tipc]
       tipc_node_write_unlock+0x149/0x170 [tipc]
       tipc_rcv+0x608/0x740 [tipc]
       tipc_udp_recv+0xdc/0x1f0 [tipc]
       udp_queue_rcv_one_skb+0x33e/0x620
       udp_unicast_rcv_skb.isra.72+0x75/0x90
       __udp4_lib_rcv+0x56d/0xc20
       ip_protocol_deliver_rcu+0x100/0x2d0
    
    This patch fixes it by checking the new mtu against tipc_bearer_min_mtu(),
    and not updating mtu if it is too small.
    
    Fixes: ed193ece2649 ("tipc: simplify link mtu negotiation")
    Reported-by: Shuang Li <[email protected]>
    Signed-off-by: Xin Long <[email protected]>
    Acked-by: Jon Maloy <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
tpm/tpm_tis: Disable interrupts for more Lenovo devices [+ + +]
Author: Jerry Snitselaar <[email protected]>
Date:   Wed May 10 17:54:03 2023 -0700

    tpm/tpm_tis: Disable interrupts for more Lenovo devices
    
    commit e7d3e5c4b1dd50a70b31524c3228c62bb41bbab2 upstream.
    
    The P360 Tiny suffers from an irq storm issue like the T490s, so add
    an entry for it to tpm_tis_dmi_table, and force polling. There also
    previously was a report from the previous attempt to enable interrupts
    that involved a ThinkPad L490. So an entry is added for it as well.
    
    Cc: [email protected]
    Reported-by: Peter Zijlstra <[email protected]> # P360 Tiny
    Closes: https://lore.kernel.org/linux-integrity/[email protected]/
    Signed-off-by: Jerry Snitselaar <[email protected]>
    Signed-off-by: Jarkko Sakkinen <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
tracing: Introduce helpers to safely handle dynamic-sized sockaddrs [+ + +]
Author: Chuck Lever <[email protected]>
Date:   Tue Jan 11 12:43:55 2022 -0500

    tracing: Introduce helpers to safely handle dynamic-sized sockaddrs
    
    [ Upstream commit d07c9ad622474616e94572e59e725c2c4a494fb4 ]
    
    Enable a struct sockaddr to be stored in a trace record as a
    dynamically-sized field. The common cases are AF_INET and AF_INET6
    which are different sizes, and are vastly smaller than a struct
    sockaddr_storage.
    
    These are safer because, when used properly, the size of the
    sockaddr destination field in each trace record is now guaranteed
    to be the same as the source address that is being copied into it.
    
    Link: https://lore.kernel.org/all/1641829[email protected]/
    Signed-off-by: Chuck Lever <[email protected]>
    Stable-dep-of: 948f072ada23 ("SUNRPC: always free ctxt when freeing deferred request")
    Signed-off-by: Sasha Levin <[email protected]>

 
usb-storage: fix deadlock when a scsi command timeouts more than once [+ + +]
Author: Maxime Bizon <[email protected]>
Date:   Fri May 5 13:47:59 2023 +0200

    usb-storage: fix deadlock when a scsi command timeouts more than once
    
    commit a398d5eac6984316e71474e25b975688f282379b upstream.
    
    With faulty usb-storage devices, read/write can timeout, in that case
    the SCSI layer will abort and re-issue the command. USB storage has no
    internal timeout, it relies on SCSI layer aborting commands via
    .eh_abort_handler() for non those responsive devices.
    
    After two consecutive timeouts of the same command, SCSI layer calls
    .eh_device_reset_handler(), without calling .eh_abort_handler() first.
    
    With usb-storage, this causes a deadlock:
    
      -> .eh_device_reset_handler
        -> device_reset
          -> mutex_lock(&(us->dev_mutex));
    
    mutex already by usb_stor_control_thread(), which is waiting for
    command completion:
    
      -> usb_stor_control_thread (mutex taken here)
        -> usb_stor_invoke_transport
          -> usb_stor_Bulk_transport
            -> usb_stor_bulk_srb
              -> usb_stor_bulk_transfer_sglist
                -> usb_sg_wait
    
    Make sure we cancel any pending command in .eh_device_reset_handler()
    to avoid this.
    
    Signed-off-by: Maxime Bizon <[email protected]>
    Cc: [email protected]
    Cc: stable <[email protected]>
    Link: https://lore.kernel.org/all/[email protected]/
    Reviewed-by: Alan Stern <[email protected]>
    Acked-by: Alan Stern <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
usb: dwc3: debugfs: Resume dwc3 before accessing registers [+ + +]
Author: Udipto Goswami <[email protected]>
Date:   Tue May 9 20:18:36 2023 +0530

    usb: dwc3: debugfs: Resume dwc3 before accessing registers
    
    commit 614ce6a2ea50068b45339257891e51e639ac9001 upstream.
    
    When the dwc3 device is runtime suspended, various required clocks are in
    disabled state and it is not guaranteed that access to any registers would
    work. Depending on the SoC glue, a register read could be as benign as
    returning 0 or be fatal enough to hang the system.
    
    In order to prevent such scenarios of fatal errors, make sure to resume
    dwc3 then allow the function to proceed.
    
    Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
    Cc: [email protected] #3.2: 30332eeefec8: debugfs: regset32: Add Runtime PM support
    Signed-off-by: Udipto Goswami <[email protected]>
    Reviewed-by: Johan Hovold <[email protected]>
    Tested-by: Johan Hovold <[email protected]>
    Acked-by: Thinh Nguyen <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

usb: gadget: u_ether: Fix host MAC address case [+ + +]
Author: Konrad Gräfe <[email protected]>
Date:   Fri May 5 16:36:40 2023 +0200

    usb: gadget: u_ether: Fix host MAC address case
    
    commit 3c0f4f09c063e143822393d99cb2b19a85451c07 upstream.
    
    The CDC-ECM specification [1] requires to send the host MAC address as
    an uppercase hexadecimal string in chapter "5.4 Ethernet Networking
    Functional Descriptor":
        The Unicode character is chosen from the set of values 30h through
        39h and 41h through 46h (0-9 and A-F).
    
    However, snprintf(.., "%pm", ..) generates a lowercase MAC address
    string. While most host drivers are tolerant to this, UsbNcm.sys on
    Windows 10 is not. Instead it uses a different MAC address with all
    bytes set to zero including and after the first byte containing a
    lowercase letter. On Windows 11 Microsoft fixed it, but apparently they
    did not backport the fix.
    
    This change fixes the issue by upper-casing the MAC to comply with the
    specification.
    
    [1]: https://www.usb.org/document-library/class-definitions-communication-devices-12, file ECM120.pdf
    
    Fixes: bcd4a1c40bee ("usb: gadget: u_ether: construct with default values and add setters/getters")
    Cc: [email protected]
    Signed-off-by: Konrad Gräfe <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

usb: typec: altmodes/displayport: fix pin_assignment_show [+ + +]
Author: Badhri Jagan Sridharan <[email protected]>
Date:   Mon May 8 21:44:43 2023 +0000

    usb: typec: altmodes/displayport: fix pin_assignment_show
    
    commit d8f28269dd4bf9b55c3fb376ae31512730a96fce upstream.
    
    This patch fixes negative indexing of buf array in pin_assignment_show
    when get_current_pin_assignments returns 0 i.e. no compatible pin
    assignments are found.
    
    BUG: KASAN: use-after-free in pin_assignment_show+0x26c/0x33c
    ...
    Call trace:
    dump_backtrace+0x110/0x204
    dump_stack_lvl+0x84/0xbc
    print_report+0x358/0x974
    kasan_report+0x9c/0xfc
    __do_kernel_fault+0xd4/0x2d4
    do_bad_area+0x48/0x168
    do_tag_check_fault+0x24/0x38
    do_mem_abort+0x6c/0x14c
    el1_abort+0x44/0x68
    el1h_64_sync_handler+0x64/0xa4
    el1h_64_sync+0x78/0x7c
    pin_assignment_show+0x26c/0x33c
    dev_attr_show+0x50/0xc0
    
    Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode")
    Cc: [email protected]
    Signed-off-by: Badhri Jagan Sridharan <[email protected]>
    Reviewed-by: Heikki Krogerus <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

usb: typec: tcpm: fix multiple times discover svids error [+ + +]
Author: Frank Wang <[email protected]>
Date:   Thu Mar 16 16:11:49 2023 +0800

    usb: typec: tcpm: fix multiple times discover svids error
    
    [ Upstream commit dac3b192107b978198e89ec0f77375738352e0c8 ]
    
    PD3.0 Spec 6.4.4.3.2 say that only Responder supports 12 or more SVIDs,
    the Discover SVIDs Command Shall be executed multiple times until a
    Discover SVIDs VDO is returned ending either with a SVID value of
    0x0000 in the last part of the last VDO or with a VDO containing two
    SVIDs with values of 0x0000.
    
    In the current implementation, if the last VDO does not find that the
    Discover SVIDs Command would be executed multiple times even if the
    Responder SVIDs are less than 12, and we found some odd dockers just
    meet this case. So fix it.
    
    Acked-by: Heikki Krogerus <[email protected]>
    Signed-off-by: Frank Wang <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value [+ + +]
Author: Weitao Wang <[email protected]>
Date:   Sun Apr 23 18:59:52 2023 +0800

    USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value
    
    commit dddb342b5b9e482bb213aecc08cbdb201ea4f8da upstream.
    
    OverCurrent condition is not standardized in the UHCI spec.
    Zhaoxin UHCI controllers report OverCurrent bit active off.
    In order to handle OverCurrent condition correctly, the uhci-hcd
    driver needs to be told to expect the active-off behavior.
    
    Suggested-by: Alan Stern <[email protected]>
    Cc: [email protected]
    Signed-off-by: Weitao Wang <[email protected]>
    Acked-by: Alan Stern <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

USB: usbtmc: Fix direction for 0-length ioctl control messages [+ + +]
Author: Alan Stern <[email protected]>
Date:   Mon May 1 14:22:35 2023 -0400

    USB: usbtmc: Fix direction for 0-length ioctl control messages
    
    commit 94d25e9128988c6a1fc9070f6e98215a95795bd8 upstream.
    
    The syzbot fuzzer found a problem in the usbtmc driver: When a user
    submits an ioctl for a 0-length control transfer, the driver does not
    check that the direction is set to OUT:
    
    ------------[ cut here ]------------
    usb 3-1: BOGUS control dir, pipe 80000b80 doesn't match bRequestType fd
    WARNING: CPU: 0 PID: 5100 at drivers/usb/core/urb.c:411 usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411
    Modules linked in:
    CPU: 0 PID: 5100 Comm: syz-executor428 Not tainted 6.3.0-syzkaller-12049-g58390c8ce1bd #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
    RIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411
    Code: 7c 24 40 e8 1b 13 5c fb 48 8b 7c 24 40 e8 21 1d f0 fe 45 89 e8 44 89 f1 4c 89 e2 48 89 c6 48 c7 c7 e0 b5 fc 8a e8 19 c8 23 fb <0f> 0b e9 9f ee ff ff e8 ed 12 5c fb 0f b6 1d 12 8a 3c 08 31 ff 41
    RSP: 0018:ffffc90003d2fb00 EFLAGS: 00010282
    RAX: 0000000000000000 RBX: ffff8880789e9058 RCX: 0000000000000000
    RDX: ffff888029593b80 RSI: ffffffff814c1447 RDI: 0000000000000001
    RBP: ffff88801ea742f8 R08: 0000000000000001 R09: 0000000000000000
    R10: 0000000000000001 R11: 0000000000000001 R12: ffff88802915e528
    R13: 00000000000000fd R14: 0000000080000b80 R15: ffff8880222b3100
    FS:  0000555556ca63c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007f9ef4d18150 CR3: 0000000073e5b000 CR4: 00000000003506f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
     <TASK>
     usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58
     usb_internal_control_msg drivers/usb/core/message.c:102 [inline]
     usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153
     usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1954 [inline]
     usbtmc_ioctl+0x1b3d/0x2840 drivers/usb/class/usbtmc.c:2097
    
    To fix this, we must override the direction in the bRequestType field
    of the control request structure when the length is 0.
    
    Reported-and-tested-by: [email protected]
    Signed-off-by: Alan Stern <[email protected]>
    Link: https://lore.kernel.org/linux-usb/[email protected]/
    CC: <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF [+ + +]
Author: George Kennedy <[email protected]>
Date:   Fri May 12 06:08:48 2023 -0500

    vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF
    
    commit 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 upstream.
    
    After a call to console_unlock() in vcs_write() the vc_data struct can be
    freed by vc_port_destruct(). Because of that, the struct vc_data pointer
    must be reloaded in the while loop in vcs_write() after console_lock() to
    avoid a UAF when vcs_size() is called.
    
    Syzkaller reported a UAF in vcs_size().
    
    BUG: KASAN: slab-use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215)
    Read of size 4 at addr ffff8880beab89a8 by task repro_vcs_size/4119
    
    Call Trace:
     <TASK>
    __asan_report_load4_noabort (mm/kasan/report_generic.c:380)
    vcs_size (drivers/tty/vt/vc_screen.c:215)
    vcs_write (drivers/tty/vt/vc_screen.c:664)
    vfs_write (fs/read_write.c:582 fs/read_write.c:564)
    ...
     <TASK>
    
    Allocated by task 1213:
    kmalloc_trace (mm/slab_common.c:1064)
    vc_allocate (./include/linux/slab.h:559 ./include/linux/slab.h:680
        drivers/tty/vt/vt.c:1078 drivers/tty/vt/vt.c:1058)
    con_install (drivers/tty/vt/vt.c:3334)
    tty_init_dev (drivers/tty/tty_io.c:1303 drivers/tty/tty_io.c:1415
        drivers/tty/tty_io.c:1392)
    tty_open (drivers/tty/tty_io.c:2082 drivers/tty/tty_io.c:2128)
    chrdev_open (fs/char_dev.c:415)
    do_dentry_open (fs/open.c:921)
    vfs_open (fs/open.c:1052)
    ...
    
    Freed by task 4116:
    kfree (mm/slab_common.c:1016)
    vc_port_destruct (drivers/tty/vt/vt.c:1044)
    tty_port_destructor (drivers/tty/tty_port.c:296)
    tty_port_put (drivers/tty/tty_port.c:312)
    vt_disallocate_all (drivers/tty/vt/vt_ioctl.c:662 (discriminator 2))
    vt_ioctl (drivers/tty/vt/vt_ioctl.c:903)
    tty_ioctl (drivers/tty/tty_io.c:2778)
    ...
    
    The buggy address belongs to the object at ffff8880beab8800
     which belongs to the cache kmalloc-1k of size 1024
    The buggy address is located 424 bytes inside of
     freed 1024-byte region [ffff8880beab8800, ffff8880beab8c00)
    
    The buggy address belongs to the physical page:
    page:00000000afc77580 refcount:1 mapcount:0 mapping:0000000000000000
        index:0x0 pfn:0xbeab8
    head:00000000afc77580 order:3 entire_mapcount:0 nr_pages_mapped:0
        pincount:0
    flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff)
    page_type: 0xffffffff()
    raw: 000fffffc0010200 ffff888100042dc0 ffffea000426de00 dead000000000002
    raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
    page dumped because: kasan: bad access detected
    
    Memory state around the buggy address:
     ffff8880beab8880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
     ffff8880beab8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    >ffff8880beab8980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                      ^
     ffff8880beab8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
     ffff8880beab8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    ==================================================================
    Disabling lock debugging due to kernel taint
    
    Fixes: ac751efa6a0d ("console: rename acquire/release_console_sem() to console_lock/unlock()")
    Cc: stable <[email protected]>
    Reported-by: syzkaller <[email protected]>
    Signed-off-by: George Kennedy <[email protected]>
    Reviewed-by: Thomas Weißschuh <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
virtio-net: Maintain reverse cleanup order [+ + +]
Author: Parav Pandit <[email protected]>
Date:   Fri Feb 3 15:37:38 2023 +0200

    virtio-net: Maintain reverse cleanup order
    
    [ Upstream commit 27369c9c2b722617063d6b80c758ab153f1d95d4 ]
    
    To easily audit the code, better to keep the device stop()
    sequence to be mirror of the device open() sequence.
    
    Acked-by: Michael S. Tsirkin <[email protected]>
    Reviewed-by: Jiri Pirko <[email protected]>
    Signed-off-by: Parav Pandit <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Stable-dep-of: 5306623a9826 ("virtio_net: Fix error unwinding of XDP initialization")
    Signed-off-by: Sasha Levin <[email protected]>

 
virtio_net: Fix error unwinding of XDP initialization [+ + +]
Author: Feng Liu <[email protected]>
Date:   Fri May 12 11:18:12 2023 -0400

    virtio_net: Fix error unwinding of XDP initialization
    
    [ Upstream commit 5306623a9826aa7d63b32c6a3803c798a765474d ]
    
    When initializing XDP in virtnet_open(), some rq xdp initialization
    may hit an error causing net device open failed. However, previous
    rqs have already initialized XDP and enabled NAPI, which is not the
    expected behavior. Need to roll back the previous rq initialization
    to avoid leaks in error unwinding of init code.
    
    Also extract helper functions of disable and enable queue pairs.
    Use newly introduced disable helper function in error unwinding and
    virtnet_close. Use enable helper function in virtnet_open.
    
    Fixes: 754b8a21a96d ("virtio_net: setup xdp_rxq_info")
    Signed-off-by: Feng Liu <[email protected]>
    Reviewed-by: Jiri Pirko <[email protected]>
    Reviewed-by: William Tu <[email protected]>
    Acked-by: Michael S. Tsirkin <[email protected]>
    Acked-by: Jason Wang <[email protected]>
    Reviewed-by: Xuan Zhuo <[email protected]>
    Acked-by: Michael S. Tsirkin <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() [+ + +]
Author: Eric Dumazet <[email protected]>
Date:   Tue May 16 14:23:42 2023 +0000

    vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()
    
    [ Upstream commit dacab578c7c6cd06c50c89dfa36b0e0f10decd4e ]
    
    syzbot triggered the following splat [1], sending an empty message
    through pppoe_sendmsg().
    
    When VLAN_FLAG_REORDER_HDR flag is set, vlan_dev_hard_header()
    does not push extra bytes for the VLAN header, because vlan is offloaded.
    
    Unfortunately vlan_dev_hard_start_xmit() first reads veth->h_vlan_proto
    before testing (vlan->flags & VLAN_FLAG_REORDER_HDR).
    
    We need to swap the two conditions.
    
    [1]
    BUG: KMSAN: uninit-value in vlan_dev_hard_start_xmit+0x171/0x7f0 net/8021q/vlan_dev.c:111
    vlan_dev_hard_start_xmit+0x171/0x7f0 net/8021q/vlan_dev.c:111
    __netdev_start_xmit include/linux/netdevice.h:4883 [inline]
    netdev_start_xmit include/linux/netdevice.h:4897 [inline]
    xmit_one net/core/dev.c:3580 [inline]
    dev_hard_start_xmit+0x253/0xa20 net/core/dev.c:3596
    __dev_queue_xmit+0x3c7f/0x5ac0 net/core/dev.c:4246
    dev_queue_xmit include/linux/netdevice.h:3053 [inline]
    pppoe_sendmsg+0xa93/0xb80 drivers/net/ppp/pppoe.c:900
    sock_sendmsg_nosec net/socket.c:724 [inline]
    sock_sendmsg net/socket.c:747 [inline]
    ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501
    ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555
    __sys_sendmmsg+0x411/0xa50 net/socket.c:2641
    __do_sys_sendmmsg net/socket.c:2670 [inline]
    __se_sys_sendmmsg net/socket.c:2667 [inline]
    __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2667
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    Uninit was created at:
    slab_post_alloc_hook+0x12d/0xb60 mm/slab.h:774
    slab_alloc_node mm/slub.c:3452 [inline]
    kmem_cache_alloc_node+0x543/0xab0 mm/slub.c:3497
    kmalloc_reserve+0x148/0x470 net/core/skbuff.c:520
    __alloc_skb+0x3a7/0x850 net/core/skbuff.c:606
    alloc_skb include/linux/skbuff.h:1277 [inline]
    sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2583
    pppoe_sendmsg+0x3af/0xb80 drivers/net/ppp/pppoe.c:867
    sock_sendmsg_nosec net/socket.c:724 [inline]
    sock_sendmsg net/socket.c:747 [inline]
    ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501
    ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555
    __sys_sendmmsg+0x411/0xa50 net/socket.c:2641
    __do_sys_sendmmsg net/socket.c:2670 [inline]
    __se_sys_sendmmsg net/socket.c:2667 [inline]
    __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2667
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    CPU: 0 PID: 29770 Comm: syz-executor.0 Not tainted 6.3.0-rc6-syzkaller-gc478e5b17829 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-by: syzbot <[email protected]>
    Signed-off-by: Eric Dumazet <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
vsock: avoid to close connected socket after the timeout [+ + +]
Author: Zhuang Shengen <[email protected]>
Date:   Thu May 11 19:34:30 2023 +0800

    vsock: avoid to close connected socket after the timeout
    
    [ Upstream commit 6d4486efe9c69626cab423456169e250a5cd3af5 ]
    
    When client and server establish a connection through vsock,
    the client send a request to the server to initiate the connection,
    then start a timer to wait for the server's response. When the server's
    RESPONSE message arrives, the timer also times out and exits. The
    server's RESPONSE message is processed first, and the connection is
    established. However, the client's timer also times out, the original
    processing logic of the client is to directly set the state of this vsock
    to CLOSE and return ETIMEDOUT. It will not notify the server when the port
    is released, causing the server port remain.
    when client's vsock_connect timeout,it should check sk state is
    ESTABLISHED or not. if sk state is ESTABLISHED, it means the connection
    is established, the client should not set the sk state to CLOSE
    
    Note: I encountered this issue on kernel-4.18, which can be fixed by
    this patch. Then I checked the latest code in the community
    and found similar issue.
    
    Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
    Signed-off-by: Zhuang Shengen <[email protected]>
    Reviewed-by: Stefano Garzarella <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
wifi: ath11k: Fix SKB corruption in REO destination ring [+ + +]
Author: Nagarajan Maran <[email protected]>
Date:   Mon Apr 17 13:35:02 2023 +0300

    wifi: ath11k: Fix SKB corruption in REO destination ring
    
    [ Upstream commit f9fff67d2d7ca6fa8066132003a3deef654c55b1 ]
    
    While running traffics for a long time, randomly an RX descriptor
    filled with value "0" from REO destination ring is received.
    This descriptor which is invalid causes the wrong SKB (SKB stored in
    the IDR lookup with buffer id "0") to be fetched which in turn
    causes SKB memory corruption issue and the same leads to crash
    after some time.
    
    Changed the start id for idr allocation to "1" and the buffer id "0"
    is reserved for error validation. Introduced Sanity check to validate
    the descriptor, before processing the SKB.
    
    Crash Signature :
    
    Unable to handle kernel paging request at virtual address 3f004900
    PC points to "b15_dma_inv_range+0x30/0x50"
    LR points to "dma_cache_maint_page+0x8c/0x128".
    The Backtrace obtained is as follows:
    [<8031716c>] (b15_dma_inv_range) from [<80313a4c>] (dma_cache_maint_page+0x8c/0x128)
    [<80313a4c>] (dma_cache_maint_page) from [<80313b90>] (__dma_page_dev_to_cpu+0x28/0xcc)
    [<80313b90>] (__dma_page_dev_to_cpu) from [<7fb5dd68>] (ath11k_dp_process_rx+0x1e8/0x4a4 [ath11k])
    [<7fb5dd68>] (ath11k_dp_process_rx [ath11k]) from [<7fb53c20>] (ath11k_dp_service_srng+0xb0/0x2ac [ath11k])
    [<7fb53c20>] (ath11k_dp_service_srng [ath11k]) from [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll+0x1c/0x78 [ath11k_pci])
    [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll [ath11k_pci]) from [<807d5cf4>] (__napi_poll+0x28/0xb8)
    [<807d5cf4>] (__napi_poll) from [<807d5f28>] (net_rx_action+0xf0/0x280)
    [<807d5f28>] (net_rx_action) from [<80302148>] (__do_softirq+0xd0/0x280)
    [<80302148>] (__do_softirq) from [<80320408>] (irq_exit+0x74/0xd4)
    [<80320408>] (irq_exit) from [<803638a4>] (__handle_domain_irq+0x90/0xb4)
    [<803638a4>] (__handle_domain_irq) from [<805bedec>] (gic_handle_irq+0x58/0x90)
    [<805bedec>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c)
    
    Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Nagarajan Maran <[email protected]>
    Signed-off-by: Kalle Valo <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Sasha Levin <[email protected]>

wifi: ath: Silence memcpy run-time false positive warning [+ + +]
Author: Kees Cook <[email protected]>
Date:   Wed Feb 15 20:31:38 2023 +0200

    wifi: ath: Silence memcpy run-time false positive warning
    
    [ Upstream commit bfcc8ba45eb87bfaaff900bbad2b87b204899d41 ]
    
    The memcpy() in ath_key_config() was attempting to write across
    neighboring struct members in struct ath_keyval. Introduce a wrapping
    struct_group, kv_values, to be the addressable target of the memcpy
    without overflowing an individual member. Silences the false positive
    run-time warning:
    
      memcpy: detected field-spanning write (size 32) of single field "hk.kv_val" at drivers/net/wireless/ath/key.c:506 (size 16)
    
    Link: https://bbs.archlinux.org/viewtopic.php?id=282254
    Cc: Kalle Valo <[email protected]>
    Cc: "David S. Miller" <[email protected]>
    Cc: Eric Dumazet <[email protected]>
    Cc: Jakub Kicinski <[email protected]>
    Cc: Paolo Abeni <[email protected]>
    Cc: [email protected]
    Cc: [email protected]
    Signed-off-by: Kees Cook <[email protected]>
    Signed-off-by: Kalle Valo <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Sasha Levin <[email protected]>

wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex [+ + +]
Author: Hector Martin <[email protected]>
Date:   Tue Feb 14 18:24:19 2023 +0900

    wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
    
    [ Upstream commit 89b89e52153fda2733562776c7c9d9d3ebf8dd6d ]
    
    Apparently the hex passphrase mechanism does not work on newer
    chips/firmware (e.g. BCM4387). It seems there was a simple way of
    passing it in binary all along, so use that and avoid the hexification.
    
    OpenBSD has been doing it like this from the beginning, so this should
    work on all chips.
    
    Also clear the structure before setting the PMK. This was leaking
    uninitialized stack contents to the device.
    
    Reviewed-by: Linus Walleij <[email protected]>
    Reviewed-by: Arend van Spriel <[email protected]>
    Signed-off-by: Hector Martin <[email protected]>
    Signed-off-by: Kalle Valo <[email protected]>
    Link: https://lore.kernel.org/r/20[email protected]
    Signed-off-by: Sasha Levin <[email protected]>

wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace [+ + +]
Author: Hans de Goede <[email protected]>
Date:   Tue Apr 18 15:25:46 2023 +0200

    wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
    
    [ Upstream commit ef16799640865f937719f0771c93be5dca18adc6 ]
    
    A received TKIP key may be up to 32 bytes because it may contain
    MIC rx/tx keys too. These are not used by iwl and copying these
    over overflows the iwl_keyinfo.key field.
    
    Add a check to not copy more data to iwl_keyinfo.key then will fit.
    
    This fixes backtraces like this one:
    
     memcpy: detected field-spanning write (size 32) of single field "sta_cmd.key.key" at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 (size 16)
     WARNING: CPU: 1 PID: 946 at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 iwlagn_send_sta_key+0x375/0x390 [iwldvm]
     <snip>
     Hardware name: Dell Inc. Latitude E6430/0H3MT5, BIOS A21 05/08/2017
     RIP: 0010:iwlagn_send_sta_key+0x375/0x390 [iwldvm]
     <snip>
     Call Trace:
      <TASK>
      iwl_set_dynamic_key+0x1f0/0x220 [iwldvm]
      iwlagn_mac_set_key+0x1e4/0x280 [iwldvm]
      drv_set_key+0xa4/0x1b0 [mac80211]
      ieee80211_key_enable_hw_accel+0xa8/0x2d0 [mac80211]
      ieee80211_key_replace+0x22d/0x8e0 [mac80211]
     <snip>
    
    Link: https://www.alionet.org/index.php?topic=1469.0
    Link: https://lore.kernel.org/linux-wireless/[email protected]/
    Link: https://lore.kernel.org/linux-wireless/[email protected]/
    Cc: Kees Cook <[email protected]>
    Suggested-by: Johannes Berg <[email protected]>
    Signed-off-by: Hans de Goede <[email protected]>
    Reviewed-by: Kees Cook <[email protected]>
    Signed-off-by: Johannes Berg <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

wifi: iwlwifi: mvm: don't trust firmware n_channels [+ + +]
Author: Johannes Berg <[email protected]>
Date:   Sun May 14 12:15:53 2023 +0300

    wifi: iwlwifi: mvm: don't trust firmware n_channels
    
    [ Upstream commit 682b6dc29d98e857e6ca4bbc077c7dc2899b7473 ]
    
    If the firmware sends us a corrupted MCC response with
    n_channels much larger than the command response can be,
    we might copy far too much (uninitialized) memory and
    even crash if the n_channels is large enough to make it
    run out of the one page allocated for the FW response.
    
    Fix that by checking the lengths. Doing a < comparison
    would be sufficient, but the firmware should be doing
    it correctly, so check more strictly.
    
    Fixes: dcaf9f5ecb6f ("iwlwifi: mvm: add MCC update FW API")
    Signed-off-by: Johannes Berg <[email protected]>
    Signed-off-by: Gregory Greenman <[email protected]>
    Link: https://lore.kernel.org/r/20230514120631.d7b233139eb4.I5[email protected]
    Signed-off-by: Johannes Berg <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

wifi: iwlwifi: mvm: fix cancel_delayed_work_sync() deadlock [+ + +]
Author: Johannes Berg <[email protected]>
Date:   Sun May 14 12:15:46 2023 +0300

    wifi: iwlwifi: mvm: fix cancel_delayed_work_sync() deadlock
    
    [ Upstream commit c2d8b7f257b2398f2d866205365895e038beca12 ]
    
    Lockdep points out that we can deadlock here by calling
    cancel_delayed_work_sync() because that might be already
    running and gotten interrupted by the NAPI soft-IRQ.
    Even just calling something that can sleep is wrong in
    this context though.
    
    Luckily, it doesn't even really matter since the things
    we need to do are idempotent, so just drop the _sync().
    
    Fixes: e5d153ec54f0 ("iwlwifi: mvm: fix CSA AP side")
    Signed-off-by: Johannes Berg <[email protected]>
    Signed-off-by: Gregory Greenman <[email protected]>
    Link: https://lore.kernel.org/r/20230514120631.b1813c823b4d.I9d20cc06d24fa40b6774d3dd95ea5e2bf8dd015b@changeid
    Signed-off-by: Johannes Berg <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf [+ + +]
Author: Hyunwoo Kim <[email protected]>
Date:   Fri Apr 14 13:11:59 2023 +0300

    wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
    
    [ Upstream commit 58d1b717879bfeabe09b35e41ad667c79933eb2e ]
    
    An integer overflow occurs in the iwl_write_to_user_buf() function,
    which is called by the iwl_dbgfs_monitor_data_read() function.
    
    static bool iwl_write_to_user_buf(char __user *user_buf, ssize_t count,
                                      void *buf, ssize_t *size,
                                      ssize_t *bytes_copied)
    {
            int buf_size_left = count - *bytes_copied;
    
            buf_size_left = buf_size_left - (buf_size_left % sizeof(u32));
            if (*size > buf_size_left)
                    *size = buf_size_left;
    
    If the user passes a SIZE_MAX value to the "ssize_t count" parameter,
    the ssize_t count parameter is assigned to "int buf_size_left".
    Then compare "*size" with "buf_size_left" . Here, "buf_size_left" is a
    negative number, so "*size" is assigned "buf_size_left" and goes into
    the third argument of the copy_to_user function, causing a heap overflow.
    
    This is not a security vulnerability because iwl_dbgfs_monitor_data_read()
    is a debugfs operation with 0400 privileges.
    
    Signed-off-by: Hyunwoo Kim <[email protected]>
    Signed-off-by: Gregory Greenman <[email protected]>
    Link: https://lore.kernel.org/r/20230414130637.2d80ace81532.Iecfba549e0e0be21bbb0324675392e42e75bd5ad@changeid
    Signed-off-by: Johannes Berg <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

wifi: iwlwifi: pcie: fix possible NULL pointer dereference [+ + +]
Author: Daniel Gabay <[email protected]>
Date:   Thu Apr 13 21:40:32 2023 +0300

    wifi: iwlwifi: pcie: fix possible NULL pointer dereference
    
    [ Upstream commit b655b9a9f8467684cfa8906713d33b71ea8c8f54 ]
    
    It is possible that iwl_pci_probe() will fail and free the trans,
    then afterwards iwl_pci_remove() will be called and crash by trying
    to access trans which is already freed, fix it.
    
    iwlwifi 0000:01:00.0: Detected crf-id 0xa5a5a5a2, cnv-id 0xa5a5a5a2
                          wfpm id 0xa5a5a5a2
    iwlwifi 0000:01:00.0: Can't find a correct rfid for crf id 0x5a2
    ...
    BUG: kernel NULL pointer dereference, address: 0000000000000028
    ...
    RIP: 0010:iwl_pci_remove+0x12/0x30 [iwlwifi]
    pci_device_remove+0x3e/0xb0
    device_release_driver_internal+0x103/0x1f0
    driver_detach+0x4c/0x90
    bus_remove_driver+0x5c/0xd0
    driver_unregister+0x31/0x50
    pci_unregister_driver+0x40/0x90
    iwl_pci_unregister_driver+0x15/0x20 [iwlwifi]
    __exit_compat+0x9/0x98 [iwlwifi]
    __x64_sys_delete_module+0x147/0x260
    
    Signed-off-by: Daniel Gabay <[email protected]>
    Signed-off-by: Gregory Greenman <[email protected]>
    Link: https://lore.kernel.org/r/20230413213309.082f6e21341b.I0db21d7fa9a828d571ca886713bd0b5d0b6e1e5c@changeid
    Signed-off-by: Johannes Berg <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

wifi: mac80211: fix min center freq offset tracing [+ + +]
Author: Johannes Berg <[email protected]>
Date:   Thu May 4 16:45:01 2023 +0300

    wifi: mac80211: fix min center freq offset tracing
    
    [ Upstream commit 248e4776514bf70236e6b1a54c65aa5324c8b1eb ]
    
    We need to set the correct trace variable, otherwise we're
    overwriting something else instead and the right one that
    we print later is not initialized.
    
    Fixes: b6011960f392 ("mac80211: handle channel frequency offset")
    Signed-off-by: Johannes Berg <[email protected]>
    Signed-off-by: Gregory Greenman <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Johannes Berg <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
xfrm: don't check the default policy if the policy allows the packet [+ + +]
Author: Sabrina Dubroca <[email protected]>
Date:   Tue Apr 4 15:12:16 2023 +0200

    xfrm: don't check the default policy if the policy allows the packet
    
    [ Upstream commit 430cac487400494c19a8b85299e979bb07b4671f ]
    
    The current code doesn't let a simple "allow" policy counteract a
    default policy blocking all incoming packets:
    
        ip x p setdefault in block
        ip x p a src 192.168.2.1/32 dst 192.168.2.2/32 dir in action allow
    
    At this stage, we have an allow policy (with or without transforms)
    for this packet. It doesn't matter what the default policy says, since
    the policy we looked up lets the packet through. The case of a
    blocking policy is already handled separately, so we can remove this
    check.
    
    Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy")
    Signed-off-by: Sabrina Dubroca <[email protected]>
    Signed-off-by: Steffen Klassert <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
xhci-pci: Only run d3cold avoidance quirk for s2idle [+ + +]
Author: Mario Limonciello <[email protected]>
Date:   Mon May 15 16:40:58 2023 +0300

    xhci-pci: Only run d3cold avoidance quirk for s2idle
    
    commit 2a821fc3136d5d99dcb9de152be8a052ca27d870 upstream.
    
    Donghun reports that a notebook that has an AMD Ryzen 5700U but supports
    S3 has problems with USB after resuming from suspend. The issue was
    bisected down to commit d1658268e439 ("usb: pci-quirks: disable D3cold on
    xhci suspend for s2idle on AMD Renoir").
    
    As this issue only happens on S3, narrow the broken D3cold quirk to only
    run in s2idle.
    
    Fixes: d1658268e439 ("usb: pci-quirks: disable D3cold on xhci suspend for s2idle on AMD Renoir")
    Reported-and-tested-by: Donghun Yoon <[email protected]>
    Cc: [email protected]
    Signed-off-by: Mario Limonciello <[email protected]>
    Signed-off-by: Mathias Nyman <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
xhci: Fix incorrect tracking of free space on transfer rings [+ + +]
Author: Mathias Nyman <[email protected]>
Date:   Mon May 15 16:40:59 2023 +0300

    xhci: Fix incorrect tracking of free space on transfer rings
    
    commit fe82f16aafdaf8002281d3b9524291d4a4a28460 upstream.
    
    This incorrect tracking caused unnecessary ring expansion in some
    usecases which over days of use consume a lot of memory.
    
    xhci driver tries to keep track of free transfer blocks (TRBs) on the
    ring buffer, but failed to add back some cancelled transfers that were
    turned into no-op operations instead of just moving past them.
    
    This can happen if there are several queued pending transfers which
    then are cancelled in reverse order.
    
    Solve this by counting the numer of steps we move the dequeue pointer
    once we complete a transfer, and add it to the number of free trbs
    instead of just adding the trb number of the current transfer.
    This way we ensure we count the no-op trbs on the way as well.
    
    Fixes: 55f6153d8cc8 ("xhci: remove extra loop in interrupt context")
    Cc: [email protected]
    Reported-by: Miller Hunter <[email protected]>
    Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217242
    Tested-by: Miller Hunter <[email protected]>
    Signed-off-by: Mathias Nyman <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>