Changelog in Linux kernel 6.1.108

 
apparmor: fix policy_unpack_test on big endian systems [+ + +]
Author: Guenter Roeck <linux@roeck-us.net>
Date:   Thu Aug 8 08:50:03 2024 -0700

    apparmor: fix policy_unpack_test on big endian systems
    
    [ Upstream commit 98c0cc48e27e9d269a3e4db2acd72b486c88ec77 ]
    
    policy_unpack_test fails on big endian systems because data byte order
    is expected to be little endian but is generated in host byte order.
    This results in test failures such as:
    
     # policy_unpack_test_unpack_array_with_null_name: EXPECTATION FAILED at security/apparmor/policy_unpack_test.c:150
        Expected array_size == (u16)16, but
            array_size == 4096 (0x1000)
            (u16)16 == 16 (0x10)
        # policy_unpack_test_unpack_array_with_null_name: pass:0 fail:1 skip:0 total:1
        not ok 3 policy_unpack_test_unpack_array_with_null_name
        # policy_unpack_test_unpack_array_with_name: EXPECTATION FAILED at security/apparmor/policy_unpack_test.c:164
        Expected array_size == (u16)16, but
            array_size == 4096 (0x1000)
            (u16)16 == 16 (0x10)
        # policy_unpack_test_unpack_array_with_name: pass:0 fail:1 skip:0 total:1
    
    Add the missing endianness conversions when generating test data.
    
    Fixes: 4d944bcd4e73 ("apparmor: add AppArmor KUnit tests for policy unpack")
    Cc: Brendan Higgins <brendanhiggins@google.com>
    Cc: Kees Cook <keescook@chromium.org>
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
ASoC: amd: acp: fix module autoloading [+ + +]
Author: Yuntao Liu <liuyuntao12@huawei.com>
Date:   Thu Aug 15 08:49:23 2024 +0000

    ASoC: amd: acp: fix module autoloading
    
    [ Upstream commit 164199615ae230ace4519141285f06766d6d8036 ]
    
    Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded
    based on the alias from platform_device_id table.
    
    Fixes: 9d8a7be88b336 ("ASoC: amd: acp: Add legacy sound card support for Chrome audio")
    Signed-off-by: Yuntao Liu <liuyuntao12@huawei.com>
    Link: https://patch.msgid.link/20240815084923.756476-1-liuyuntao12@huawei.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ASoC: SOF: amd: Fix for acp init sequence [+ + +]
Author: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Date:   Fri Aug 16 12:33:28 2024 +0530

    ASoC: SOF: amd: Fix for acp init sequence
    
    [ Upstream commit a42db293e5983aa1508d12644f23d73f0553b32c ]
    
    When ACP is not powered on by default, acp power on sequence explicitly
    invoked by programming pgfsm control mask. The existing implementation
    checks the same PGFSM status mask and programs the same PGFSM control mask
    in all ACP variants which breaks acp power on sequence for ACP6.0 and
    ACP6.3 variants. So to fix this issue, update ACP pgfsm control mask and
    status mask based on acp descriptor rev field, which will vary based on
    acp variant.
    
    Fixes: 846aef1d7cc0 ("ASoC: SOF: amd: Add Renoir ACP HW support")
    Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
    Link: https://patch.msgid.link/20240816070328.610360-1-Vijendar.Mukunda@amd.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
ata: libata-core: Fix null pointer dereference on error [+ + +]
Author: Niklas Cassel <cassel@kernel.org>
Date:   Sat Jun 29 14:42:11 2024 +0200

    ata: libata-core: Fix null pointer dereference on error
    
    commit 5d92c7c566dc76d96e0e19e481d926bbe6631c1e upstream.
    
    If the ata_port_alloc() call in ata_host_alloc() fails,
    ata_host_release() will get called.
    
    However, the code in ata_host_release() tries to free ata_port struct
    members unconditionally, which can lead to the following:
    
    BUG: unable to handle page fault for address: 0000000000003990
    PGD 0 P4D 0
    Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
    CPU: 10 PID: 594 Comm: (udev-worker) Not tainted 6.10.0-rc5 #44
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014
    RIP: 0010:ata_host_release.cold+0x2f/0x6e [libata]
    Code: e4 4d 63 f4 44 89 e2 48 c7 c6 90 ad 32 c0 48 c7 c7 d0 70 33 c0 49 83 c6 0e 41
    RSP: 0018:ffffc90000ebb968 EFLAGS: 00010246
    RAX: 0000000000000041 RBX: ffff88810fb52e78 RCX: 0000000000000000
    RDX: 0000000000000000 RSI: ffff88813b3218c0 RDI: ffff88813b3218c0
    RBP: ffff88810fb52e40 R08: 0000000000000000 R09: 6c65725f74736f68
    R10: ffffc90000ebb738 R11: 73692033203a746e R12: 0000000000000004
    R13: 0000000000000000 R14: 0000000000000011 R15: 0000000000000006
    FS:  00007f6cc55b9980(0000) GS:ffff88813b300000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000003990 CR3: 00000001122a2000 CR4: 0000000000750ef0
    PKRU: 55555554
    Call Trace:
     <TASK>
     ? __die_body.cold+0x19/0x27
     ? page_fault_oops+0x15a/0x2f0
     ? exc_page_fault+0x7e/0x180
     ? asm_exc_page_fault+0x26/0x30
     ? ata_host_release.cold+0x2f/0x6e [libata]
     ? ata_host_release.cold+0x2f/0x6e [libata]
     release_nodes+0x35/0xb0
     devres_release_group+0x113/0x140
     ata_host_alloc+0xed/0x120 [libata]
     ata_host_alloc_pinfo+0x14/0xa0 [libata]
     ahci_init_one+0x6c9/0xd20 [ahci]
    
    Do not access ata_port struct members unconditionally.
    
    Fixes: 633273a3ed1c ("libata-pmp: hook PMP support and enable it")
    Cc: stable@vger.kernel.org
    Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
    Reviewed-by: Hannes Reinecke <hare@suse.de>
    Reviewed-by: John Garry <john.g.garry@oracle.com>
    Link: https://lore.kernel.org/r/20240629124210.181537-7-cassel@kernel.org
    Signed-off-by: Niklas Cassel <cassel@kernel.org>
    Signed-off-by: Oleksandr Tymoshenko <ovt@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
Bluetooth: hci_core: Fix not handling hibernation actions [+ + +]
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date:   Wed Aug 21 14:41:52 2024 -0400

    Bluetooth: hci_core: Fix not handling hibernation actions
    
    [ Upstream commit 18b3256db76bd1130965acd99fbd38f87c3e6950 ]
    
    This fixes not handling hibernation actions on suspend notifier so they
    are treated in the same way as regular suspend actions.
    
    Fixes: 9952d90ea288 ("Bluetooth: Handle PM_SUSPEND_PREPARE and PM_POST_SUSPEND")
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
bonding: implement xdo_dev_state_free and call it after deletion [+ + +]
Author: Jianbo Liu <jianbol@nvidia.com>
Date:   Fri Aug 23 06:10:54 2024 +0300

    bonding: implement xdo_dev_state_free and call it after deletion
    
    [ Upstream commit ec13009472f4a756288eb4e18e20a7845da98d10 ]
    
    Add this implementation for bonding, so hardware resources can be
    freed from the active slave after xfrm state is deleted. The netdev
    used to invoke xdo_dev_state_free callback, is saved in the xfrm state
    (xs->xso.real_dev), which is also the bond's active slave. To prevent
    it from being freed, acquire netdev reference before leaving RCU
    read-side critical section, and release it after callback is done.
    
    And call it when deleting all SAs from old active real interface while
    switching current active slave.
    
    Fixes: 9a5605505d9c ("bonding: Add struct bond_ipesc to manage SA")
    Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
    Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
    Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
    Acked-by: Jay Vosburgh <jv@jvosburgh.net>
    Link: https://patch.msgid.link/20240823031056.110999-2-jianbol@nvidia.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
btrfs: fix extent map use-after-free when adding pages to compressed bio [+ + +]
Author: Filipe Manana <fdmanana@suse.com>
Date:   Thu Jul 4 16:11:20 2024 +0100

    btrfs: fix extent map use-after-free when adding pages to compressed bio
    
    commit 8e7860543a94784d744c7ce34b78a2e11beefa5c upstream.
    
    At add_ra_bio_pages() we are accessing the extent map to calculate
    'add_size' after we dropped our reference on the extent map, resulting
    in a use-after-free. Fix this by computing 'add_size' before dropping our
    extent map reference.
    
    Reported-by: syzbot+853d80cba98ce1157ae6@syzkaller.appspotmail.com
    Link: https://lore.kernel.org/linux-btrfs/000000000000038144061c6d18f2@google.com/
    Fixes: 6a4049102055 ("btrfs: subpage: make add_ra_bio_pages() compatible")
    CC: stable@vger.kernel.org # 6.1+
    Signed-off-by: Filipe Manana <fdmanana@suse.com>
    Reviewed-by: David Sterba <dsterba@suse.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Brennan Lamoreaux <brennan.lamoreaux@broadcom.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

btrfs: run delayed iputs when flushing delalloc [+ + +]
Author: Josef Bacik <josef@toxicpanda.com>
Date:   Wed Aug 21 15:53:18 2024 -0400

    btrfs: run delayed iputs when flushing delalloc
    
    commit 2d3447261031503b181dacc549fe65ffe2d93d65 upstream.
    
    We have transient failures with btrfs/301, specifically in the part
    where we do
    
      for i in $(seq 0 10); do
              write 50m to file
              rm -f file
      done
    
    Sometimes this will result in a transient quota error, and it's because
    sometimes we start writeback on the file which results in a delayed
    iput, and thus the rm doesn't actually clean the file up.  When we're
    flushing the quota space we need to run the delayed iputs to make sure
    all the unlinks that we think have completed have actually completed.
    This removes the small window where we could fail to find enough space
    in our quota.
    
    CC: stable@vger.kernel.org # 5.15+
    Reviewed-by: Qu Wenruo <wqu@suse.com>
    Signed-off-by: Josef Bacik <josef@toxicpanda.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller [+ + +]
Author: Ian Ray <ian.ray@gehealthcare.com>
Date:   Wed Aug 14 10:29:05 2024 +0300

    cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
    
    commit 0b00583ecacb0b51712a5ecd34cf7e6684307c67 upstream.
    
    USB_DEVICE(0x1901, 0x0006) may send data before cdc_acm is ready, which
    may be misinterpreted in the default N_TTY line discipline.
    
    Signed-off-by: Ian Ray <ian.ray@gehealthcare.com>
    Acked-by: Oliver Neuku <oneukum@suse.com>
    Cc: stable <stable@kernel.org>
    Link: https://lore.kernel.org/r/20240814072905.2501-1-ian.ray@gehealthcare.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
dmaengine: dw: Add memory bus width verification [+ + +]
Author: Serge Semin <fancer.lancer@gmail.com>
Date:   Fri Aug 2 10:50:47 2024 +0300

    dmaengine: dw: Add memory bus width verification
    
    [ Upstream commit d04b21bfa1c50a2ade4816cab6fdc91827b346b1 ]
    
    Currently in case of the DEV_TO_MEM or MEM_TO_DEV DMA transfers the memory
    data width (single transfer width) is determined based on the buffer
    length, buffer base address or DMA master-channel max address width
    capability. It isn't enough in case of the channel disabling prior the
    block transfer is finished. Here is what DW AHB DMA IP-core databook says
    regarding the port suspension (DMA-transfer pause) implementation in the
    controller:
    
    "When CTLx.SRC_TR_WIDTH < CTLx.DST_TR_WIDTH and the CFGx.CH_SUSP bit is
    high, the CFGx.FIFO_EMPTY is asserted once the contents of the FIFO do not
    permit a single word of CTLx.DST_TR_WIDTH to be formed. However, there may
    still be data in the channel FIFO, but not enough to form a single
    transfer of CTLx.DST_TR_WIDTH. In this scenario, once the channel is
    disabled, the remaining data in the channel FIFO is not transferred to the
    destination peripheral."
    
    So in case if the port gets to be suspended and then disabled it's
    possible to have the data silently discarded even though the controller
    reported that FIFO is empty and the CTLx.BLOCK_TS indicated the dropped
    data already received from the source device. This looks as if the data
    somehow got lost on a way from the peripheral device to memory and causes
    problems for instance in the DW APB UART driver, which pauses and disables
    the DMA-transfer as soon as the recv data timeout happens. Here is the way
    it looks:
    
     Memory <------- DMA FIFO <------ UART FIFO <---------------- UART
      DST_TR_WIDTH -+--------|       |         |
                    |        |       |         |                No more data
       Current lvl -+--------|       |---------+- DMA-burst lvl
                    |        |       |---------+- Leftover data
                    |        |       |---------+- SRC_TR_WIDTH
                   -+--------+-------+---------+
    
    In the example above: no more data is getting received over the UART port
    and BLOCK_TS is not even close to be fully received; some data is left in
    the UART FIFO, but not enough to perform a bursted DMA-xfer to the DMA
    FIFO; some data is left in the DMA FIFO, but not enough to be passed
    further to the system memory in a single transfer. In this situation the
    8250 UART driver catches the recv timeout interrupt, pauses the
    DMA-transfer and terminates it completely, after which the IRQ handler
    manually fetches the leftover data from the UART FIFO into the
    recv-buffer. But since the DMA-channel has been disabled with the data
    left in the DMA FIFO, that data will be just discarded and the recv-buffer
    will have a gap of the "current lvl" size in the recv-buffer at the tail
    of the lately received data portion. So the data will be lost just due to
    the misconfigured DMA transfer.
    
    Note this is only relevant for the case of the transfer suspension and
    _disabling_. No problem will happen if the transfer will be re-enabled
    afterwards or the block transfer is fully completed. In the later case the
    "FIFO flush mode" will be executed at the transfer final stage in order to
    push out the data left in the DMA FIFO.
    
    In order to fix the denoted problem the DW AHB DMA-engine driver needs to
    make sure that the _bursted_ source transfer width is greater or equal to
    the single destination transfer (note the HW databook describes more
    strict constraint than actually required). Since the peripheral-device
    side is prescribed by the client driver logic, the memory-side can be only
    used for that. The solution can be easily implemented for the DEV_TO_MEM
    transfers just by adjusting the memory-channel address width. Sadly it's
    not that easy for the MEM_TO_DEV transfers since the mem-to-dma burst size
    is normally dynamically determined by the controller. So the only thing
    that can be done is to make sure that memory-side address width is greater
    than the peripheral device address width.
    
    Fixes: a09820043c9e ("dw_dmac: autoconfigure data_width or get it via platform data")
    Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
    Acked-by: Andy Shevchenko <andy@kernel.org>
    Link: https://lore.kernel.org/r/20240802075100.6475-3-fancer.lancer@gmail.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

dmaengine: dw: Add peripheral bus width verification [+ + +]
Author: Serge Semin <fancer.lancer@gmail.com>
Date:   Fri Aug 2 10:50:46 2024 +0300

    dmaengine: dw: Add peripheral bus width verification
    
    [ Upstream commit b336268dde75cb09bd795cb24893d52152a9191f ]
    
    Currently the src_addr_width and dst_addr_width fields of the
    dma_slave_config structure are mapped to the CTLx.SRC_TR_WIDTH and
    CTLx.DST_TR_WIDTH fields of the peripheral bus side in order to have the
    properly aligned data passed to the target device. It's done just by
    converting the passed peripheral bus width to the encoded value using the
    __ffs() function. This implementation has several problematic sides:
    
    1. __ffs() is undefined if no bit exist in the passed value. Thus if the
    specified addr-width is DMA_SLAVE_BUSWIDTH_UNDEFINED, __ffs() may return
    unexpected value depending on the platform-specific implementation.
    
    2. DW AHB DMA-engine permits having the power-of-2 transfer width limited
    by the DMAH_Mk_HDATA_WIDTH IP-core synthesize parameter. Specifying
    bus-width out of that constraints scope will definitely cause unexpected
    result since the destination reg will be only partly touched than the
    client driver implied.
    
    Let's fix all of that by adding the peripheral bus width verification
    method and calling it in dwc_config() which is supposed to be executed
    before preparing any transfer. The new method will make sure that the
    passed source or destination address width is valid and if undefined then
    the driver will just fallback to the 1-byte width transfer.
    
    Fixes: 029a40e97d0d ("dmaengine: dw: provide DMA capabilities")
    Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
    Acked-by: Andy Shevchenko <andy@kernel.org>
    Link: https://lore.kernel.org/r/20240802075100.6475-2-fancer.lancer@gmail.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
drm/amd/display: avoid using null object of framebuffer [+ + +]
Author: Ma Ke <make24@iscas.ac.cn>
Date:   Wed Aug 21 12:27:24 2024 +0800

    drm/amd/display: avoid using null object of framebuffer
    
    [ Upstream commit 3b9a33235c773c7a3768060cf1d2cf8a9153bc37 ]
    
    Instead of using state->fb->obj[0] directly, get object from framebuffer
    by calling drm_gem_fb_get_obj() and return error code when object is
    null to avoid using null object of framebuffer.
    
    Fixes: 5d945cbcd4b1 ("drm/amd/display: Create a file dedicated to planes")
    Signed-off-by: Ma Ke <make24@iscas.ac.cn>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    (cherry picked from commit 73dd0ad9e5dad53766ea3e631303430116f834b3)
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
drm/amdgpu/swsmu: always force a state reprogram on init [+ + +]
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Thu Aug 22 21:54:24 2024 -0400

    drm/amdgpu/swsmu: always force a state reprogram on init
    
    commit d420c857d85777663e8d16adfc24463f5d5c2dbc upstream.
    
    Always reprogram the hardware state on init.  This ensures
    the PMFW state is explicitly programmed and we are not relying
    on the default PMFW state.
    
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3131
    Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    (cherry picked from commit c50fe289ed7207f71df3b5f1720512a9620e84fb)
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/amdgpu: align pp_power_profile_mode with kernel docs [+ + +]
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Wed Aug 21 14:32:02 2024 -0400

    drm/amdgpu: align pp_power_profile_mode with kernel docs
    
    commit 8f614469de248a4bc55fb07e55d5f4c340c75b11 upstream.
    
    The kernel doc says you need to select manual mode to
    adjust this, but the code only allows you to adjust it when
    manual mode is not selected.  Remove the manual mode check.
    
    Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    (cherry picked from commit bbb05f8a9cd87f5046d05a0c596fddfb714ee457)
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc [+ + +]
Author: Jesse Zhang <jesse.zhang@amd.com>
Date:   Wed Apr 24 17:10:46 2024 +0800

    drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
    
    commit 88a9a467c548d0b3c7761b4fd54a68e70f9c0944 upstream.
    
    Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001.
    V2: To really improve the handling we would actually
       need to have a separate value of 0xffffffff.(Christian)
    
    Signed-off-by: Jesse Zhang <jesse.zhang@amd.com>
    Suggested-by: Christian König <christian.koenig@amd.com>
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Vamsi Krishna Brahmajosyula <vamsi-krishna.brahmajosyula@broadcom.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
ethtool: check device is present when getting link settings [+ + +]
Author: Jamie Bainbridge <jamie.bainbridge@gmail.com>
Date:   Fri Aug 23 16:26:58 2024 +1000

    ethtool: check device is present when getting link settings
    
    [ Upstream commit a699781c79ecf6cfe67fb00a0331b4088c7c8466 ]
    
    A sysfs reader can race with a device reset or removal, attempting to
    read device state when the device is not actually present. eg:
    
         [exception RIP: qed_get_current_link+17]
      #8 [ffffb9e4f2907c48] qede_get_link_ksettings at ffffffffc07a994a [qede]
      #9 [ffffb9e4f2907cd8] __rh_call_get_link_ksettings at ffffffff992b01a3
     #10 [ffffb9e4f2907d38] __ethtool_get_link_ksettings at ffffffff992b04e4
     #11 [ffffb9e4f2907d90] duplex_show at ffffffff99260300
     #12 [ffffb9e4f2907e38] dev_attr_show at ffffffff9905a01c
     #13 [ffffb9e4f2907e50] sysfs_kf_seq_show at ffffffff98e0145b
     #14 [ffffb9e4f2907e68] seq_read at ffffffff98d902e3
     #15 [ffffb9e4f2907ec8] vfs_read at ffffffff98d657d1
     #16 [ffffb9e4f2907f00] ksys_read at ffffffff98d65c3f
     #17 [ffffb9e4f2907f38] do_syscall_64 at ffffffff98a052fb
    
     crash> struct net_device.state ffff9a9d21336000
        state = 5,
    
    state 5 is __LINK_STATE_START (0b1) and __LINK_STATE_NOCARRIER (0b100).
    The device is not present, note lack of __LINK_STATE_PRESENT (0b10).
    
    This is the same sort of panic as observed in commit 4224cfd7fb65
    ("net-sysfs: add check for netdevice being present to speed_show").
    
    There are many other callers of __ethtool_get_link_ksettings() which
    don't have a device presence check.
    
    Move this check into ethtool to protect all callers.
    
    Fixes: d519e17e2d01 ("net: export device speed and duplex via sysfs")
    Fixes: 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show")
    Signed-off-by: Jamie Bainbridge <jamie.bainbridge@gmail.com>
    Link: https://patch.msgid.link/8bae218864beaa44ed01628140475b9bf641c5b0.1724393671.git.jamie.bainbridge@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
fbdev: offb: fix up missing cleanup.h [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sun Sep 1 17:58:23 2024 +0200

    fbdev: offb: fix up missing cleanup.h
    
    In commit 96ee5c5712ef ("fbdev: offb: replace of_node_put with
    __free(device_node)"), __free() was added, but not cleanup.h so it broke
    the build.  Fix this up.
    
    Reported-by: Guenter Roeck <linux@roeck-us.net>
    Link: https://lore.kernel.org/r/4f4ac35e-e31c-4f67-b809-a5de4d4b273a@roeck-us.net
    Fixes: 96ee5c5712ef ("fbdev: offb: replace of_node_put with __free(device_node)")
    Cc: Julia Lawall <julia.lawall@inria.fr>
    Cc: Abdulrasaq Lawani <abdulrasaqolawani@gmail.com>
    Cc: Helge Deller <deller@gmx.de>
    Cc: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
gtp: fix a potential NULL pointer dereference [+ + +]
Author: Cong Wang <cong.wang@bytedance.com>
Date:   Sun Aug 25 12:16:38 2024 -0700

    gtp: fix a potential NULL pointer dereference
    
    [ Upstream commit defd8b3c37b0f9cb3e0f60f47d3d78d459d57fda ]
    
    When sockfd_lookup() fails, gtp_encap_enable_socket() returns a
    NULL pointer, but its callers only check for error pointers thus miss
    the NULL pointer case.
    
    Fix it by returning an error pointer with the error code carried from
    sockfd_lookup().
    
    (I found this bug during code inspection.)
    
    Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional")
    Cc: Andreas Schultz <aschultz@tpip.net>
    Cc: Harald Welte <laforge@gnumonks.org>
    Signed-off-by: Cong Wang <cong.wang@bytedance.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Link: https://patch.msgid.link/20240825191638.146748-1-xiyou.wangcong@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
igc: Fix qbv tx latency by setting gtxoffset [+ + +]
Author: Faizal Rahim <faizal.abdul.rahim@linux.intel.com>
Date:   Sun Jul 7 08:53:18 2024 -0400

    igc: Fix qbv tx latency by setting gtxoffset
    
    commit 6c3fc0b1c3d073bd6fc3bf43dbd0e64240537464 upstream.
    
    A large tx latency issue was discovered during testing when only QBV was
    enabled. The issue occurs because gtxoffset was not set when QBV is
    active, it was only set when launch time is active.
    
    The patch "igc: Correct the launchtime offset" only sets gtxoffset when
    the launchtime_enable field is set by the user. Enabling launchtime_enable
    ultimately sets the register IGC_TXQCTL_QUEUE_MODE_LAUNCHT (referred to as
    LaunchT in the SW user manual).
    
    Section 7.5.2.6 of the IGC i225/6 SW User Manual Rev 1.2.4 states:
    "The latency between transmission scheduling (launch time) and the
    time the packet is transmitted to the network is listed in Table 7-61."
    
    However, the patch misinterprets the phrase "launch time" in that section
    by assuming it specifically refers to the LaunchT register, whereas it
    actually denotes the generic term for when a packet is released from the
    internal buffer to the MAC transmit logic.
    
    This launch time, as per that section, also implicitly refers to the QBV
    gate open time, where a packet waits in the buffer for the QBV gate to
    open. Therefore, latency applies whenever QBV is in use. TSN features such
    as QBU and QAV reuse QBV, making the latency universal to TSN features.
    
    Discussed with i226 HW owner (Shalev, Avi) and we were in agreement that
    the term "launch time" used in Section 7.5.2.6 is not clear and can be
    easily misinterpreted. Avi will update this section to:
    "When TQAVCTRL.TRANSMIT_MODE = TSN, the latency between transmission
    scheduling and the time the packet is transmitted to the network is listed
    in Table 7-61."
    
    Fix this issue by using igc_tsn_is_tx_mode_in_tsn() as a condition to
    write to gtxoffset, aligning with the newly updated SW User Manual.
    
    Tested:
    1. Enrol taprio on talker board
       base-time 0
       cycle-time 1000000
       flags 0x2
       index 0 cmd S gatemask 0x1 interval1
       index 0 cmd S gatemask 0x1 interval2
    
       Note:
       interval1 = interval for a 64 bytes packet to go through
       interval2 = cycle-time - interval1
    
    2. Take tcpdump on listener board
    
    3. Use udp tai app on talker to send packets to listener
    
    4. Check the timestamp on listener via wireshark
    
    Test Result:
    100 Mbps: 113 ~193 ns
    1000 Mbps: 52 ~ 84 ns
    2500 Mbps: 95 ~ 223 ns
    
    Note that the test result is similar to the patch "igc: Correct the
    launchtime offset".
    
    Fixes: 790835fcc0cb ("igc: Correct the launchtime offset")
    Signed-off-by: Faizal Rahim <faizal.abdul.rahim@linux.intel.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
    Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

igc: Fix reset adapter logics when tx mode change [+ + +]
Author: Faizal Rahim <faizal.abdul.rahim@linux.intel.com>
Date:   Sun Jul 7 08:53:17 2024 -0400

    igc: Fix reset adapter logics when tx mode change
    
    commit 0afeaeb5dae86aceded0d5f0c3a54d27858c0c6f upstream.
    
    Following the "igc: Fix TX Hang issue when QBV Gate is close" changes,
    remaining issues with the reset adapter logic in igc_tsn_offload_apply()
    have been observed:
    
    1. The reset adapter logics for i225 and i226 differ, although they should
       be the same according to the guidelines in I225/6 HW Design Section
       7.5.2.1 on software initialization during tx mode changes.
    2. The i225 resets adapter every time, even though tx mode doesn't change.
       This occurs solely based on the condition  igc_is_device_id_i225() when
       calling schedule_work().
    3. i226 doesn't reset adapter for tsn->legacy tx mode changes. It only
       resets adapter for legacy->tsn tx mode transitions.
    4. qbv_count introduced in the patch is actually not needed; in this
       context, a non-zero value of qbv_count is used to indicate if tx mode
       was unconditionally set to tsn in igc_tsn_enable_offload(). This could
       be replaced by checking the existing register
       IGC_TQAVCTRL_TRANSMIT_MODE_TSN bit.
    
    This patch resolves all issues and enters schedule_work() to reset the
    adapter only when changing tx mode. It also removes reliance on qbv_count.
    
    qbv_count field will be removed in a future patch.
    
    Test ran:
    
    1. Verify reset adapter behaviour in i225/6:
       a) Enrol a new GCL
          Reset adapter observed (tx mode change legacy->tsn)
       b) Enrol a new GCL without deleting qdisc
          No reset adapter observed (tx mode remain tsn->tsn)
       c) Delete qdisc
          Reset adapter observed (tx mode change tsn->legacy)
    
    2. Tested scenario from "igc: Fix TX Hang issue when QBV Gate is closed"
       to confirm it remains resolved.
    
    Fixes: 175c241288c0 ("igc: Fix TX Hang issue when QBV Gate is closed")
    Signed-off-by: Faizal Rahim <faizal.abdul.rahim@linux.intel.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
    Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
    [ Only want the igc_tsn_is_tx_mode_in_tsn() portion of this for older stable
      kernels - gregkh ]
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
iommu: Do not return 0 from map_pages if it doesn't do anything [+ + +]
Author: Jason Gunthorpe <jgg@ziepe.ca>
Date:   Thu Aug 22 11:45:55 2024 -0300

    iommu: Do not return 0 from map_pages if it doesn't do anything
    
    [ Upstream commit 6093cd582f8e027117a8d4ad5d129a1aacdc53d2 ]
    
    These three implementations of map_pages() all succeed if a mapping is
    requested with no read or write. Since they return back to __iommu_map()
    leaving the mapped output as 0 it triggers an infinite loop. Therefore
    nothing is using no-access protection bits.
    
    Further, VFIO and iommufd rely on iommu_iova_to_phys() to get back PFNs
    stored by map, if iommu_map() succeeds but iommu_iova_to_phys() fails that
    will create serious bugs.
    
    Thus remove this never used "nothing to do" concept and just fail map
    immediately.
    
    Fixes: e5fc9753b1a8 ("iommu/io-pgtable: Add ARMv7 short descriptor support")
    Fixes: e1d3c0fd701d ("iommu: add ARM LPAE page table allocator")
    Fixes: 745ef1092bcf ("iommu/io-pgtable: Move Apple DART support to its own file")
    Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
    Acked-by: Will Deacon <will@kernel.org>
    Reviewed-by: Kevin Tian <kevin.tian@intel.com>
    Link: https://lore.kernel.org/r/2-v1-1211e1294c27+4b1-iommu_no_prot_jgg@nvidia.com
    Signed-off-by: Joerg Roedel <jroedel@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
Linux: Linux 6.1.108 [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Wed Sep 4 13:25:05 2024 +0200

    Linux 6.1.108
    
    Link: https://lore.kernel.org/r/20240901160801.879647959@linuxfoundation.org
    Tested-by: Pavel Machek (CIP) <pavel@denx.de>
    Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
    Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
    Tested-by: Ron Economos <re@w6rz.net>
    Tested-by: Jon Hunter <jonathanh@nvidia.com>
    Tested-by: Mark Brown <broonie@kernel.org>
    Tested-by: Yann Sionneau <ysionneau@kalrayinc.com>
    Tested-by: Salvatore Bonaccorso <carnil@debian.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
LoongArch: Remove the unused dma-direct.h [+ + +]
Author: Miao Wang <shankerwangmiao@gmail.com>
Date:   Sun Aug 25 22:17:39 2024 +0800

    LoongArch: Remove the unused dma-direct.h
    
    commit 58aec91efb93338d1cc7acc0a93242613a2a4e5f upstream.
    
    dma-direct.h is introduced in commit d4b6f1562a3c3284 ("LoongArch: Add
    Non-Uniform Memory Access (NUMA) support"). In commit c78c43fe7d42524c
    ("LoongArch: Use acpi_arch_dma_setup() and remove ARCH_HAS_PHYS_TO_DMA"),
    ARCH_HAS_PHYS_TO_DMA was deselected and the coresponding phys_to_dma()/
    dma_to_phys() functions were removed. However, the unused dma-direct.h
    was left behind, which is removed by this patch.
    
    Cc: <stable@vger.kernel.org>
    Fixes: c78c43fe7d42 ("LoongArch: Use acpi_arch_dma_setup() and remove ARCH_HAS_PHYS_TO_DMA")
    Signed-off-by: Miao Wang <shankerwangmiao@gmail.com>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mm: Fix missing folio invalidation calls during truncation [+ + +]
Author: David Howells <dhowells@redhat.com>
Date:   Fri Aug 23 21:08:09 2024 +0100

    mm: Fix missing folio invalidation calls during truncation
    
    [ Upstream commit 0aa2e1b2fb7a75aa4b5b4347055ccfea6f091769 ]
    
    When AS_RELEASE_ALWAYS is set on a mapping, the ->release_folio() and
    ->invalidate_folio() calls should be invoked even if PG_private and
    PG_private_2 aren't set.  This is used by netfslib to keep track of the
    point above which reads can be skipped in favour of just zeroing pagecache
    locally.
    
    There are a couple of places in truncation in which invalidation is only
    called when folio_has_private() is true.  Fix these to check
    folio_needs_release() instead.
    
    Without this, the generic/075 and generic/112 xfstests (both fsx-based
    tests) fail with minimum folio size patches applied[1].
    
    Fixes: b4fa966f03b7 ("mm, netfs, fscache: stop read optimisation when folio removed from pagecache")
    Signed-off-by: David Howells <dhowells@redhat.com>
    Link: https://lore.kernel.org/r/20240815090849.972355-1-kernel@pankajraghav.com/ [1]
    Link: https://lore.kernel.org/r/20240823200819.532106-2-dhowells@redhat.com
    Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
    cc: Matthew Wilcox (Oracle) <willy@infradead.org>
    cc: Pankaj Raghav <p.raghav@samsung.com>
    cc: Jeff Layton <jlayton@kernel.org>
    cc: Marc Dionne <marc.dionne@auristor.com>
    cc: linux-afs@lists.infradead.org
    cc: netfs@lists.linux.dev
    cc: linux-mm@kvack.org
    cc: linux-fsdevel@vger.kernel.org
    Signed-off-by: Christian Brauner <brauner@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
mmc: Avoid open coding by using mmc_op_tuning() [+ + +]
Author: ChanWoo Lee <cw9316.lee@samsung.com>
Date:   Thu Nov 24 17:00:31 2022 +0900

    mmc: Avoid open coding by using mmc_op_tuning()
    
    [ Upstream commit b98e7e8daf0ebab9dcc36812378a71e1be0b5089 ]
    
    Replace code with the already defined function. No functional changes.
    
    Signed-off-by: ChanWoo Lee <cw9316.lee@samsung.com>
    Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
    Link: https://lore.kernel.org/r/20221124080031.14690-1-cw9316.lee@samsung.com
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Stable-dep-of: 9374ae912dbb ("mmc: mtk-sd: receive cmd8 data when hs400 tuning fail")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

mmc: mtk-sd: receive cmd8 data when hs400 tuning fail [+ + +]
Author: Mengqi Zhang <mengqi.zhang@mediatek.com>
Date:   Tue Jul 16 09:37:04 2024 +0800

    mmc: mtk-sd: receive cmd8 data when hs400 tuning fail
    
    [ Upstream commit 9374ae912dbb1eed8139ed75fd2c0f1b30ca454d ]
    
    When we use cmd8 as the tuning command in hs400 mode, the command
    response sent back by some eMMC devices cannot be correctly sampled
    by MTK eMMC controller at some weak sample timing. In this case,
    command timeout error may occur. So we must receive the following
    data to make sure the next cmd8 send correctly.
    
    Signed-off-by: Mengqi Zhang <mengqi.zhang@mediatek.com>
    Fixes: c4ac38c6539b ("mmc: mtk-sd: Add HS400 online tuning support")
    Cc: stable@vger.stable.com
    Link: https://lore.kernel.org/r/20240716013704.10578-1-mengqi.zhang@mediatek.com
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
mptcp: close subflow when receiving TCP+FIN [+ + +]
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date:   Mon Aug 26 19:11:18 2024 +0200

    mptcp: close subflow when receiving TCP+FIN
    
    commit f09b0ad55a1196f5891663f8888463c0541059cb upstream.
    
    When a peer decides to close one subflow in the middle of a connection
    having multiple subflows, the receiver of the first FIN should accept
    that, and close the subflow on its side as well. If not, the subflow
    will stay half closed, and would even continue to be used until the end
    of the MPTCP connection or a reset from the network.
    
    The issue has not been seen before, probably because the in-kernel
    path-manager always sends a RM_ADDR before closing the subflow. Upon the
    reception of this RM_ADDR, the other peer will initiate the closure on
    its side as well. On the other hand, if the RM_ADDR is lost, or if the
    path-manager of the other peer only closes the subflow without sending a
    RM_ADDR, the subflow would switch to TCP_CLOSE_WAIT, but that's it,
    leaving the subflow half-closed.
    
    So now, when the subflow switches to the TCP_CLOSE_WAIT state, and if
    the MPTCP connection has not been closed before with a DATA_FIN, the
    kernel owning the subflow schedules its worker to initiate the closure
    on its side as well.
    
    This issue can be easily reproduced with packetdrill, as visible in [1],
    by creating an additional subflow, injecting a FIN+ACK before sending
    the DATA_FIN, and expecting a FIN+ACK in return.
    
    Fixes: 40947e13997a ("mptcp: schedule worker when subflow is closed")
    Cc: stable@vger.kernel.org
    Link: https://github.com/multipath-tcp/packetdrill/pull/154 [1]
    Reviewed-by: Mat Martineau <martineau@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://patch.msgid.link/20240826-net-mptcp-close-extra-sf-fin-v1-1-905199fe1172@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mptcp: pm: ADD_ADDR 0 is not a new address [+ + +]
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date:   Wed Aug 28 08:14:37 2024 +0200

    mptcp: pm: ADD_ADDR 0 is not a new address
    
    commit 57f86203b41c98b322119dfdbb1ec54ce5e3369b upstream.
    
    The ADD_ADDR 0 with the address from the initial subflow should not be
    considered as a new address: this is not something new. If the host
    receives it, it simply means that the address is available again.
    
    When receiving an ADD_ADDR for the ID 0, the PM already doesn't consider
    it as new by not incrementing the 'add_addr_accepted' counter. But the
    'accept_addr' might not be set if the limit has already been reached:
    this can be bypassed in this case. But before, it is important to check
    that this ADD_ADDR for the ID 0 is for the same address as the initial
    subflow. If not, it is not something that should happen, and the
    ADD_ADDR can be ignored.
    
    Note that if an ADD_ADDR is received while there is already a subflow
    opened using the same address, this ADD_ADDR is ignored as well. It
    means that if multiple ADD_ADDR for ID 0 are received, there will not be
    any duplicated subflows created by the client.
    
    Fixes: d0876b2284cf ("mptcp: add the incoming RM_ADDR support")
    Cc: stable@vger.kernel.org
    Reviewed-by: Mat Martineau <martineau@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR [+ + +]
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date:   Mon Aug 19 21:45:28 2024 +0200

    mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR
    
    [ Upstream commit 0137a3c7c2ea3f9df8ebfc65d78b4ba712a187bb ]
    
    The limits might have changed in between, it is best to check them
    before accepting new ADD_ADDR.
    
    Fixes: d0876b2284cf ("mptcp: add the incoming RM_ADDR support")
    Cc: stable@vger.kernel.org
    Reviewed-by: Mat Martineau <martineau@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-10-38035d40de5b@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

mptcp: pm: do not remove already closed subflows [+ + +]
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date:   Wed Aug 28 08:14:32 2024 +0200

    mptcp: pm: do not remove already closed subflows
    
    commit 58e1b66b4e4b8a602d3f2843e8eba00a969ecce2 upstream.
    
    It is possible to have in the list already closed subflows, e.g. the
    initial subflow has been already closed, but still in the list. No need
    to try to close it again, and increments the related counters again.
    
    Fixes: 0ee4261a3681 ("mptcp: implement mptcp_pm_remove_subflow")
    Cc: stable@vger.kernel.org
    Reviewed-by: Mat Martineau <martineau@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mptcp: pm: only mark 'subflow' endp as available [+ + +]
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date:   Mon Aug 19 21:45:26 2024 +0200

    mptcp: pm: only mark 'subflow' endp as available
    
    [ Upstream commit 322ea3778965da72862cca2a0c50253aacf65fe6 ]
    
    Adding the following warning ...
    
      WARN_ON_ONCE(msk->pm.local_addr_used == 0)
    
    ... before decrementing the local_addr_used counter helped to find a bug
    when running the "remove single address" subtest from the mptcp_join.sh
    selftests.
    
    Removing a 'signal' endpoint will trigger the removal of all subflows
    linked to this endpoint via mptcp_pm_nl_rm_addr_or_subflow() with
    rm_type == MPTCP_MIB_RMSUBFLOW. This will decrement the local_addr_used
    counter, which is wrong in this case because this counter is linked to
    'subflow' endpoints, and here it is a 'signal' endpoint that is being
    removed.
    
    Now, the counter is decremented, only if the ID is being used outside
    of mptcp_pm_nl_rm_addr_or_subflow(), only for 'subflow' endpoints, and
    if the ID is not 0 -- local_addr_used is not taking into account these
    ones. This marking of the ID as being available, and the decrement is
    done no matter if a subflow using this ID is currently available,
    because the subflow could have been closed before.
    
    Fixes: 06faa2271034 ("mptcp: remove multi addresses and subflows in PM")
    Cc: stable@vger.kernel.org
    Reviewed-by: Mat Martineau <martineau@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-8-38035d40de5b@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

mptcp: pm: remove mptcp_pm_remove_subflow() [+ + +]
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date:   Mon Aug 19 21:45:25 2024 +0200

    mptcp: pm: remove mptcp_pm_remove_subflow()
    
    [ Upstream commit f448451aa62d54be16acb0034223c17e0d12bc69 ]
    
    This helper is confusing. It is in pm.c, but it is specific to the
    in-kernel PM and it cannot be used by the userspace one. Also, it simply
    calls one in-kernel specific function with the PM lock, while the
    similar mptcp_pm_remove_addr() helper requires the PM lock.
    
    What's left is the pr_debug(), which is not that useful, because a
    similar one is present in the only function called by this helper:
    
      mptcp_pm_nl_rm_subflow_received()
    
    After these modifications, this helper can be marked as 'static', and
    the lock can be taken only once in mptcp_pm_flush_addrs_and_subflows().
    
    Note that it is not a bug fix, but it will help backporting the
    following commits.
    
    Fixes: 0ee4261a3681 ("mptcp: implement mptcp_pm_remove_subflow")
    Cc: stable@vger.kernel.org
    Reviewed-by: Mat Martineau <martineau@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-7-38035d40de5b@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

mptcp: pm: reset MPC endp ID when re-added [+ + +]
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date:   Wed Aug 28 08:14:29 2024 +0200

    mptcp: pm: reset MPC endp ID when re-added
    
    commit dce1c6d1e92535f165219695a826caedcca4e9b9 upstream.
    
    The initial subflow has a special local ID: 0. It is specific per
    connection.
    
    When a global endpoint is deleted and re-added later, it can have a
    different ID -- most services managing the endpoints automatically don't
    force the ID to be the same as before. It is then important to track
    these modifications to be consistent with the ID being used for the
    address used by the initial subflow, not to confuse the other peer or to
    send the ID 0 for the wrong address.
    
    Now when removing an endpoint, msk->mpc_endpoint_id is reset if it
    corresponds to this endpoint. When adding a new endpoint, the same
    variable is updated if the address match the one of the initial subflow.
    
    Fixes: 3ad14f54bd74 ("mptcp: more accurate MPC endpoint tracking")
    Cc: stable@vger.kernel.org
    Reviewed-by: Mat Martineau <martineau@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mptcp: pm: send ACK on an active subflow [+ + +]
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date:   Wed Aug 28 08:14:27 2024 +0200

    mptcp: pm: send ACK on an active subflow
    
    commit c07cc3ed895f9bfe0c53b5ed6be710c133b4271c upstream.
    
    Taking the first one on the list doesn't work in some cases, e.g. if the
    initial subflow is being removed. Pick another one instead of not
    sending anything.
    
    Fixes: 84dfe3677a6f ("mptcp: send out dedicated ADD_ADDR packet")
    Cc: stable@vger.kernel.org
    Reviewed-by: Mat Martineau <martineau@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mptcp: pm: skip connecting to already established sf [+ + +]
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date:   Wed Aug 28 08:14:28 2024 +0200

    mptcp: pm: skip connecting to already established sf
    
    commit bc19ff57637ff563d2bdf2b385b48c41e6509e0d upstream.
    
    The lookup_subflow_by_daddr() helper checks if there is already a
    subflow connected to this address. But there could be a subflow that is
    closing, but taking time due to some reasons: latency, losses, data to
    process, etc.
    
    If an ADD_ADDR is received while the endpoint is being closed, it is
    better to try connecting to it, instead of rejecting it: the peer which
    has sent the ADD_ADDR will not be notified that the ADD_ADDR has been
    rejected for this reason, and the expected subflow will not be created
    at the end.
    
    This helper should then only look for subflows that are established, or
    going to be, but not the ones being closed.
    
    Fixes: d84ad04941c3 ("mptcp: skip connecting the connected address")
    Cc: stable@vger.kernel.org
    Reviewed-by: Mat Martineau <martineau@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mptcp: sched: check both backup in retrans [+ + +]
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date:   Mon Aug 26 19:11:20 2024 +0200

    mptcp: sched: check both backup in retrans
    
    commit 2a1f596ebb23eadc0f9b95a8012e18ef76295fc8 upstream.
    
    The 'mptcp_subflow_context' structure has two items related to the
    backup flags:
    
     - 'backup': the subflow has been marked as backup by the other peer
    
     - 'request_bkup': the backup flag has been set by the host
    
    Looking only at the 'backup' flag can make sense in some cases, but it
    is not the behaviour of the default packet scheduler when selecting
    paths.
    
    As explained in the commit b6a66e521a20 ("mptcp: sched: check both
    directions for backup"), the packet scheduler should look at both flags,
    because that was the behaviour from the beginning: the 'backup' flag was
    set by accident instead of the 'request_bkup' one. Now that the latter
    has been fixed, get_retrans() needs to be adapted as well.
    
    Fixes: b6a66e521a20 ("mptcp: sched: check both directions for backup")
    Cc: stable@vger.kernel.org
    Reviewed-by: Mat Martineau <martineau@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://patch.msgid.link/20240826-net-mptcp-close-extra-sf-fin-v1-3-905199fe1172@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mptcp: unify pm get_local_id interfaces [+ + +]
Author: Geliang Tang <geliang@kernel.org>
Date:   Thu Jun 8 15:20:50 2023 +0200

    mptcp: unify pm get_local_id interfaces
    
    [ Upstream commit 9bbec87ecfe8a5c06710100a93e6b7e66f2cbbaf ]
    
    This patch unifies the three PM get_local_id() interfaces:
    
    mptcp_pm_nl_get_local_id() in mptcp/pm_netlink.c for the in-kernel PM and
    mptcp_userspace_pm_get_local_id() in mptcp/pm_userspace.c for the
    userspace PM.
    
    They'll be switched in the common PM infterface mptcp_pm_get_local_id()
    in mptcp/pm.c based on whether mptcp_pm_is_userspace() or not.
    
    Also put together the declarations of these three functions in protocol.h.
    
    Signed-off-by: Geliang Tang <geliang.tang@suse.com>
    Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
    Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
    Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Stable-dep-of: f448451aa62d ("mptcp: pm: remove mptcp_pm_remove_subflow()")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
net: busy-poll: use ktime_get_ns() instead of local_clock() [+ + +]
Author: Eric Dumazet <edumazet@google.com>
Date:   Tue Aug 27 11:49:16 2024 +0000

    net: busy-poll: use ktime_get_ns() instead of local_clock()
    
    [ Upstream commit 0870b0d8b393dde53106678a1e2cec9dfa52f9b7 ]
    
    Typically, busy-polling durations are below 100 usec.
    
    When/if the busy-poller thread migrates to another cpu,
    local_clock() can be off by +/-2msec or more for small
    values of HZ, depending on the platform.
    
    Use ktimer_get_ns() to ensure deterministic behavior,
    which is the whole point of busy-polling.
    
    Fixes: 060212928670 ("net: add low latency socket poll")
    Fixes: 9a3c71aa8024 ("net: convert low latency sockets to sched_clock()")
    Fixes: 37089834528b ("sched, net: Fixup busy_loop_us_clock()")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Mina Almasry <almasrymina@google.com>
    Cc: Willem de Bruijn <willemb@google.com>
    Reviewed-by: Joe Damato <jdamato@fastly.com>
    Link: https://patch.msgid.link/20240827114916.223377-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response [+ + +]
Author: Haiyang Zhang <haiyangz@microsoft.com>
Date:   Wed Aug 21 13:42:29 2024 -0700

    net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response
    
    commit 8af174ea863c72f25ce31cee3baad8a301c0cf0f upstream.
    
    The mana_hwc_rx_event_handler() / mana_hwc_handle_resp() calls
    complete(&ctx->comp_event) before posting the wqe back. It's
    possible that other callers, like mana_create_txq(), start the
    next round of mana_hwc_send_request() before the posting of wqe.
    And if the HW is fast enough to respond, it can hit no_wqe error
    on the HW channel, then the response message is lost. The mana
    driver may fail to create queues and open, because of waiting for
    the HW response and timed out.
    Sample dmesg:
    [  528.610840] mana 39d4:00:02.0: HWC: Request timed out!
    [  528.614452] mana 39d4:00:02.0: Failed to send mana message: -110, 0x0
    [  528.618326] mana 39d4:00:02.0 enP14804s2: Failed to create WQ object: -110
    
    To fix it, move posting of rx wqe before complete(&ctx->comp_event).
    
    Cc: stable@vger.kernel.org
    Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)")
    Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
    Reviewed-by: Long Li <longli@microsoft.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
netfilter: nf_tables: restore IP sanity checks for netdev/egress [+ + +]
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Mon Aug 26 12:45:22 2024 +0200

    netfilter: nf_tables: restore IP sanity checks for netdev/egress
    
    [ Upstream commit 5fd0628918977a0afdc2e6bc562d8751b5d3b8c5 ]
    
    Subtract network offset to skb->len before performing IPv4 header sanity
    checks, then adjust transport offset from offset from mac header.
    
    Jorge Ortiz says:
    
    When small UDP packets (< 4 bytes payload) are sent from eth0,
    `meta l4proto udp` condition is not met because `NFT_PKTINFO_L4PROTO` is
    not set. This happens because there is a comparison that checks if the
    transport header offset exceeds the total length.  This comparison does
    not take into account the fact that the skb network offset might be
    non-zero in egress mode (e.g., 14 bytes for Ethernet header).
    
    Fixes: 0ae8e4cca787 ("netfilter: nf_tables: set transport offset from mac header for netdev/egress")
    Reported-by: Jorge Ortiz <jorge.ortiz.escribano@gmail.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation [+ + +]
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Mon Aug 26 15:03:23 2024 +0200

    netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation
    
    [ Upstream commit 70c261d500951cf3ea0fcf32651aab9a65a91471 ]
    
    From netdev/egress, skb->len can include the ethernet header, therefore,
    subtract network offset from skb->len when validating IPv6 packet length.
    
    Fixes: 42df6e1d221d ("netfilter: Introduce egress hook")
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
nfc: pn533: Add poll mod list filling check [+ + +]
Author: Aleksandr Mishin <amishin@t-argos.ru>
Date:   Tue Aug 27 11:48:22 2024 +0300

    nfc: pn533: Add poll mod list filling check
    
    [ Upstream commit febccb39255f9df35527b88c953b2e0deae50e53 ]
    
    In case of im_protocols value is 1 and tm_protocols value is 0 this
    combination successfully passes the check
    'if (!im_protocols && !tm_protocols)' in the nfc_start_poll().
    But then after pn533_poll_create_mod_list() call in pn533_start_poll()
    poll mod list will remain empty and dev->poll_mod_count will remain 0
    which lead to division by zero.
    
    Normally no im protocol has value 1 in the mask, so this combination is
    not expected by driver. But these protocol values actually come from
    userspace via Netlink interface (NFC_CMD_START_POLL operation). So a
    broken or malicious program may pass a message containing a "bad"
    combination of protocol parameter values so that dev->poll_mod_count
    is not incremented inside pn533_poll_create_mod_list(), thus leading
    to division by zero.
    Call trace looks like:
    nfc_genl_start_poll()
      nfc_start_poll()
        ->start_poll()
        pn533_start_poll()
    
    Add poll mod list filling check.
    
    Found by Linux Verification Center (linuxtesting.org) with SVACE.
    
    Fixes: dfccd0f58044 ("NFC: pn533: Add some polling entropy")
    Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
    Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Link: https://patch.msgid.link/20240827084822.18785-1-amishin@t-argos.ru
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
of: Add cleanup.h based auto release via __free(device_node) markings [+ + +]
Author: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date:   Sun Feb 25 14:27:11 2024 +0000

    of: Add cleanup.h based auto release via __free(device_node) markings
    
    commit 9448e55d032d99af8e23487f51a542d51b2f1a48 upstream.
    
    The recent addition of scope based cleanup support to the kernel
    provides a convenient tool to reduce the chances of leaking reference
    counts where of_node_put() should have been called in an error path.
    
    This enables
            struct device_node *child __free(device_node) = NULL;
    
            for_each_child_of_node(np, child) {
                    if (test)
                            return test;
            }
    
    with no need for a manual call of of_node_put().
    A following patch will reduce the scope of the child variable to the
    for loop, to avoid an issues with ordering of autocleanup, and make it
    obvious when this assigned a non NULL value.
    
    In this simple example the gains are small but there are some very
    complex error handling cases buried in these loops that will be
    greatly simplified by enabling early returns with out the need
    for this manual of_node_put() call.
    
    Note that there are coccinelle checks in
    scripts/coccinelle/iterators/for_each_child.cocci to detect a failure
    to call of_node_put(). This new approach does not cause false positives.
    Longer term we may want to add scripting to check this new approach is
    done correctly with no double of_node_put() calls being introduced due
    to the auto cleanup. It may also be useful to script finding places
    this new approach is useful.
    
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Reviewed-by: Rob Herring <robh@kernel.org>
    Link: https://lore.kernel.org/r/20240225142714.286440-2-jic23@kernel.org
    Signed-off-by: Rob Herring <robh@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

of: Introduce for_each_*_child_of_node_scoped() to automate of_node_put() handling [+ + +]
Author: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date:   Sun Feb 25 14:27:12 2024 +0000

    of: Introduce for_each_*_child_of_node_scoped() to automate of_node_put() handling
    
    [ Upstream commit 34af4554fb0ce164e2c4876683619eb1e23848d4 ]
    
    To avoid issues with out of order cleanup, or ambiguity about when the
    auto freed data is first instantiated, do it within the for loop definition.
    
    The disadvantage is that the struct device_node *child variable creation
    is not immediately obvious where this is used.
    However, in many cases, if there is another definition of
    struct device_node *child; the compiler / static analysers will notify us
    that it is unused, or uninitialized.
    
    Note that, in the vast majority of cases, the _available_ form should be
    used and as code is converted to these scoped handers, we should confirm
    that any cases that do not check for available have a good reason not
    to.
    
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Reviewed-by: Rob Herring <robh@kernel.org>
    Link: https://lore.kernel.org/r/20240225142714.286440-3-jic23@kernel.org
    Signed-off-by: Rob Herring <robh@kernel.org>
    Stable-dep-of: afc954fd223d ("thermal: of: Fix OF node leak in thermal_of_trips_init() error path")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
phy: xilinx: add runtime PM support [+ + +]
Author: Piyush Mehta <piyush.mehta@amd.com>
Date:   Tue Jun 13 19:32:49 2023 +0530

    phy: xilinx: add runtime PM support
    
    [ Upstream commit b3db66f624468ab4a0385586bc7f4221e477d6b2 ]
    
    Added Runtime power management support to the xilinx phy driver and using
    DEFINE_RUNTIME_DEV_PM_OPS new macros allows the compiler to remove the
    unused dev_pm_ops structure and related functions if !CONFIG_PM without
    the need to mark the functions __maybe_unused.
    
    Signed-off-by: Piyush Mehta <piyush.mehta@amd.com>
    Link: https://lore.kernel.org/r/20230613140250.3018947-2-piyush.mehta@amd.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Stable-dep-of: 5af9b304bc60 ("phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

phy: xilinx: phy-zynqmp: dynamic clock support for power-save [+ + +]
Author: Piyush Mehta <piyush.mehta@amd.com>
Date:   Tue Jun 13 19:32:50 2023 +0530

    phy: xilinx: phy-zynqmp: dynamic clock support for power-save
    
    [ Upstream commit 25d70083351318b44ae699d92c042dcb18a738ea ]
    
    Enabling clock for all the lanes consumes power even PHY is active or
    inactive. To resolve this, enable/disable clocks in phy_init/phy_exit.
    
    By default clock is disabled for all the lanes. Whenever phy_init called
    from USB, SATA, or display driver, etc. It enabled the required clock
    for requested lane. On phy_exit cycle, it disabled clock for the active
    PHYs.
    
    During the suspend/resume cycle, each USB/ SATA/ display driver called
    phy_exit/phy_init individually. It disabled clock on exit, and enabled
    on initialization for the active PHYs.
    
    Signed-off-by: Piyush Mehta <piyush.mehta@amd.com>
    Link: https://lore.kernel.org/r/20230613140250.3018947-3-piyush.mehta@amd.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Stable-dep-of: 5af9b304bc60 ("phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume [+ + +]
Author: Piyush Mehta <piyush.mehta@amd.com>
Date:   Mon Aug 5 11:29:07 2024 +0530

    phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume
    
    [ Upstream commit 5af9b304bc6010723c02f74de0bfd24ff19b1a10 ]
    
    On a few Kria KR260 Robotics Starter Kit the PS-GEM SGMII linkup is not
    happening after the resume. This is because serdes registers are reset
    when FPD is off (in suspend state) and needs to be reprogrammed in the
    resume path with the same default initialization as done in the first
    stage bootloader psu_init routine.
    
    To address the failure introduce a set of serdes registers to be saved in
    the suspend path and then restore it on resume.
    
    Fixes: 4a33bea00314 ("phy: zynqmp: Add PHY driver for the Xilinx ZynqMP Gigabit Transceiver")
    Signed-off-by: Piyush Mehta <piyush.mehta@amd.com>
    Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
    Link: https://lore.kernel.org/r/1722837547-2578381-1-git-send-email-radhey.shyam.pandey@amd.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

phy: zynqmp: Enable reference clock correctly [+ + +]
Author: Sean Anderson <sean.anderson@linux.dev>
Date:   Fri Jun 28 16:55:36 2024 -0400

    phy: zynqmp: Enable reference clock correctly
    
    commit 687d6bccb28238fcfa65f7c1badfdfeac498c428 upstream.
    
    Lanes can use other lanes' reference clocks, as determined by refclk.
    Use refclk to determine the clock to enable/disable instead of always
    using the lane's own reference clock. This ensures the clock selected in
    xpsgtr_configure_pll is the one enabled.
    
    For the other half of the equation, always program REF_CLK_SEL even when
    we are selecting the lane's own clock. This ensures that Linux's idea of
    the reference clock matches the hardware. We use the "local" clock mux
    for this instead of going through the ref clock network.
    
    Fixes: 25d700833513 ("phy: xilinx: phy-zynqmp: dynamic clock support for power-save")
    Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
    Link: https://lore.kernel.org/r/20240628205540.3098010-2-sean.anderson@linux.dev
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE [+ + +]
Author: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Date:   Thu Aug 8 19:27:09 2024 -0400

    pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE
    
    [ Upstream commit 166bf8af91225576f85208a31eaedbadd182d1ea ]
    
    Despite its name, commit fed74d75277d ("pinctrl: mediatek: common-v2:
    Fix bias-disable for PULL_PU_PD_RSEL_TYPE") actually broke bias-disable
    for PULL_PU_PD_RSEL_TYPE.
    
    mtk_pinconf_bias_set_combo() tries every bias method supported by the
    pin until one succeeds. For PULL_PU_PD_RSEL_TYPE pins, before the
    breaking commit, mtk_pinconf_bias_set_rsel() would be called first to
    try and set the RSEL value (as well as PU and PD), and if that failed,
    the only other valid option was that bias-disable was specified, which
    would then be handled by calling mtk_pinconf_bias_set_pu_pd() and
    disabling both PU and PD.
    
    The breaking commit misunderstood this logic and added an early "return
    0" in mtk_pinconf_bias_set_rsel(). The result was that in the
    bias-disable case, the bias was left unchanged, since by returning
    success, mtk_pinconf_bias_set_combo() no longer tried calling
    mtk_pinconf_bias_set_pu_pd() to disable the bias.
    
    Since the logic for configuring bias-disable on PULL_PU_PD_RSEL_TYPE
    pins required mtk_pinconf_bias_set_rsel() to fail first, in that case,
    an error was printed to the log, eg:
    
      mt8195-pinctrl 10005000.pinctrl: Not support rsel value 0 Ohm for pin = 29 (GPIO29)
    
    This is what the breaking commit actually got rid of, and likely part of
    the reason why that commit was thought to be fixing functionality, while
    in reality it was breaking it.
    
    Instead of simply reverting that commit, restore the functionality but
    in a way that avoids the error from being printed and makes the code
    less confusing:
    * Return 0 explicitly if a bias method was successful
    * Introduce an extra function mtk_pinconf_bias_set_pu_pd_rsel() that
      calls both mtk_pinconf_bias_set_rsel() (only if needed) and
      mtk_pinconf_bias_set_pu_pd()
      * And analogously for the corresponding getters
    
    Fixes: fed74d75277d ("pinctrl: mediatek: common-v2: Fix bias-disable for PULL_PU_PD_RSEL_TYPE")
    Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
    Link: https://lore.kernel.org/20240808-mtk-rsel-bias-disable-fix-v1-1-1b4e85bf596c@collabora.com
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins [+ + +]
Author: Huang-Huang Bao <i@eh5.me>
Date:   Tue Jul 9 18:54:28 2024 +0800

    pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins
    
    commit 128f71fe014fc91efa1407ce549f94a9a9f1072c upstream.
    
    The base iomux offsets for each GPIO pin line are accumulatively
    calculated based off iomux width flag in rockchip_pinctrl_get_soc_data.
    If the iomux width flag is one of IOMUX_WIDTH_4BIT, IOMUX_WIDTH_3BIT or
    IOMUX_WIDTH_2BIT, the base offset for next pin line would increase by 8
    bytes, otherwise it would increase by 4 bytes.
    
    Despite most of GPIO2-B iomux have 2-bit data width, which can be fit
    into 4 bytes space with write mask, it actually take 8 bytes width for
    whole GPIO2-B line.
    
    Commit e8448a6c817c ("pinctrl: rockchip: fix pinmux bits for RK3328
    GPIO2-B pins") wrongly set iomux width flag to 0, causing all base
    iomux offset for line after GPIO2-B to be calculated wrong. Fix the
    iomux width flag to IOMUX_WIDTH_2BIT so the offset after GPIO2-B is
    correctly increased by 8, matching the actual width of GPIO2-B iomux.
    
    Fixes: e8448a6c817c ("pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins")
    Cc: stable@vger.kernel.org
    Reported-by: Richard Kojedzinszky <richard@kojedz.in>
    Closes: https://lore.kernel.org/linux-rockchip/4f29b743202397d60edfb3c725537415@kojedz.in/
    Tested-by: Richard Kojedzinszky <richard@kojedz.in>
    Signed-off-by: Huang-Huang Bao <i@eh5.me>
    Reviewed-by: Heiko Stuebner <heiko@sntech.de>
    Tested-by: Daniel Golle <daniel@makrotopia.org>
    Tested-by: Trevor Woerner <twoerner@gmail.com>
    Link: https://lore.kernel.org/20240709105428.1176375-1-i@eh5.me
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

pinctrl: single: fix potential NULL dereference in pcs_get_function() [+ + +]
Author: Ma Ke <make24@iscas.ac.cn>
Date:   Thu Aug 8 12:13:55 2024 +0800

    pinctrl: single: fix potential NULL dereference in pcs_get_function()
    
    commit 1c38a62f15e595346a1106025722869e87ffe044 upstream.
    
    pinmux_generic_get_function() can return NULL and the pointer 'function'
    was dereferenced without checking against NULL. Add checking of pointer
    'function' in pcs_get_function().
    
    Found by code review.
    
    Cc: stable@vger.kernel.org
    Fixes: 571aec4df5b7 ("pinctrl: single: Use generic pinmux helpers for managing functions")
    Signed-off-by: Ma Ke <make24@iscas.ac.cn>
    Link: https://lore.kernel.org/20240808041355.2766009-1-make24@iscas.ac.cn
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
scsi: aacraid: Fix double-free on probe failure [+ + +]
Author: Ben Hutchings <benh@debian.org>
Date:   Thu Aug 22 00:51:42 2024 +0200

    scsi: aacraid: Fix double-free on probe failure
    
    [ Upstream commit 919ddf8336f0b84c0453bac583808c9f165a85c2 ]
    
    aac_probe_one() calls hardware-specific init functions through the
    aac_driver_ident::init pointer, all of which eventually call down to
    aac_init_adapter().
    
    If aac_init_adapter() fails after allocating memory for aac_dev::queues,
    it frees the memory but does not clear that member.
    
    After the hardware-specific init function returns an error,
    aac_probe_one() goes down an error path that frees the memory pointed to
    by aac_dev::queues, resulting.in a double-free.
    
    Reported-by: Michael Gordon <m.gordon.zelenoborsky@gmail.com>
    Link: https://bugs.debian.org/1075855
    Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support")
    Signed-off-by: Ben Hutchings <benh@debian.org>
    Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
sctp: fix association labeling in the duplicate COOKIE-ECHO case [+ + +]
Author: Ondrej Mosnacek <omosnace@redhat.com>
Date:   Mon Aug 26 15:07:11 2024 +0200

    sctp: fix association labeling in the duplicate COOKIE-ECHO case
    
    [ Upstream commit 3a0504d54b3b57f0d7bf3d9184a00c9f8887f6d7 ]
    
    sctp_sf_do_5_2_4_dupcook() currently calls security_sctp_assoc_request()
    on new_asoc, but as it turns out, this association is always discarded
    and the LSM labels never get into the final association (asoc).
    
    This can be reproduced by having two SCTP endpoints try to initiate an
    association with each other at approximately the same time and then peel
    off the association into a new socket, which exposes the unitialized
    labels and triggers SELinux denials.
    
    Fix it by calling security_sctp_assoc_request() on asoc instead of
    new_asoc. Xin Long also suggested limit calling the hook only to cases
    A, B, and D, since in cases C and E the COOKIE ECHO chunk is discarded
    and the association doesn't enter the ESTABLISHED state, so rectify that
    as well.
    
    One related caveat with SELinux and peer labeling: When an SCTP
    connection is set up simultaneously in this way, we will end up with an
    association that is initialized with security_sctp_assoc_request() on
    both sides, so the MLS component of the security context of the
    association will get swapped between the peers, instead of just one side
    setting it to the other's MLS component. However, at that point
    security_sctp_assoc_request() had already been called on both sides in
    sctp_sf_do_unexpected_init() (on a temporary association) and thus if
    the exchange didn't fail before due to MLS, it won't fail now either
    (most likely both endpoints have the same MLS range).
    
    Tested by:
     - reproducer from https://src.fedoraproject.org/tests/selinux/pull-request/530
     - selinux-testsuite (https://github.com/SELinuxProject/selinux-testsuite/)
     - sctp-tests (https://github.com/sctp/sctp-tests) - no tests failed
       that wouldn't fail also without the patch applied
    
    Fixes: c081d53f97a1 ("security: pass asoc to sctp_assoc_request and sctp_sk_clone")
    Suggested-by: Xin Long <lucien.xin@gmail.com>
    Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
    Acked-by: Xin Long <lucien.xin@gmail.com>
    Acked-by: Paul Moore <paul@paul-moore.com> (LSM/SELinux)
    Link: https://patch.msgid.link/20240826130711.141271-1-omosnace@redhat.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
selftests: forwarding: local_termination: Down ports on cleanup [+ + +]
Author: Petr Machata <petrm@nvidia.com>
Date:   Mon Aug 26 19:15:11 2024 +0200

    selftests: forwarding: local_termination: Down ports on cleanup
    
    [ Upstream commit 65a3cce43d5b4c53cf16b0be1a03991f665a0806 ]
    
    This test neglects to put ports down on cleanup. Fix it.
    
    Fixes: 90b9566aa5cd ("selftests: forwarding: add a test for local_termination.sh")
    Signed-off-by: Petr Machata <petrm@nvidia.com>
    Link: https://patch.msgid.link/bf9b79f45de378f88344d44550f0a5052b386199.1724692132.git.petrm@nvidia.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

selftests: forwarding: no_forwarding: Down ports on cleanup [+ + +]
Author: Petr Machata <petrm@nvidia.com>
Date:   Fri Aug 23 18:25:37 2024 +0200

    selftests: forwarding: no_forwarding: Down ports on cleanup
    
    [ Upstream commit e8497d6951ee8541d73784f9aac9942a7f239980 ]
    
    This test neglects to put ports down on cleanup. Fix it.
    
    Fixes: 476a4f05d9b8 ("selftests: forwarding: add a no_forwarding.sh test")
    Signed-off-by: Petr Machata <petrm@nvidia.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/0baf91dc24b95ae0cadfdf5db05b74888e6a228a.1724430120.git.petrm@nvidia.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() [+ + +]
Author: Stefan Metzmacher <metze@samba.org>
Date:   Wed Aug 21 17:18:23 2024 +0200

    smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req()
    
    commit c724b2ab6a46435b4e7d58ad2fbbdb7a318823cf upstream.
    
    This happens when called from SMB2_read() while using rdma
    and reaching the rdma_readwrite_threshold.
    
    Cc: stable@vger.kernel.org
    Fixes: a6559cc1d35d ("cifs: split out smb3_use_rdma_offload() helper")
    Reviewed-by: David Howells <dhowells@redhat.com>
    Signed-off-by: Stefan Metzmacher <metze@samba.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
soc: qcom: cmd-db: Map shared memory as WC, not WB [+ + +]
Author: Volodymyr Babchuk <Volodymyr_Babchuk@epam.com>
Date:   Thu Jul 18 11:33:23 2024 +0530

    soc: qcom: cmd-db: Map shared memory as WC, not WB
    
    commit f9bb896eab221618927ae6a2f1d566567999839d upstream.
    
    Linux does not write into cmd-db region. This region of memory is write
    protected by XPU. XPU may sometime falsely detect clean cache eviction
    as "write" into the write protected region leading to secure interrupt
    which causes an endless loop somewhere in Trust Zone.
    
    The only reason it is working right now is because Qualcomm Hypervisor
    maps the same region as Non-Cacheable memory in Stage 2 translation
    tables. The issue manifests if we want to use another hypervisor (like
    Xen or KVM), which does not know anything about those specific mappings.
    
    Changing the mapping of cmd-db memory from MEMREMAP_WB to MEMREMAP_WT/WC
    removes dependency on correct mappings in Stage 2 tables. This patch
    fixes the issue by updating the mapping to MEMREMAP_WC.
    
    I tested this on SA8155P with Xen.
    
    Fixes: 312416d9171a ("drivers: qcom: add command DB driver")
    Cc: stable@vger.kernel.org # 5.4+
    Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
    Tested-by: Nikita Travkin <nikita@trvn.ru> # sc7180 WoA in EL2
    Signed-off-by: Maulik Shah <quic_mkshah@quicinc.com>
    Tested-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
    Reviewed-by: Caleb Connolly <caleb.connolly@linaro.org>
    Link: https://lore.kernel.org/r/20240718-cmd_db_uncached-v2-1-f6cf53164c90@quicinc.com
    Signed-off-by: Bjorn Andersson <andersson@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
soundwire: stream: fix programming slave ports for non-continous port maps [+ + +]
Author: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date:   Mon Jul 29 16:01:57 2024 +0200

    soundwire: stream: fix programming slave ports for non-continous port maps
    
    commit ab8d66d132bc8f1992d3eb6cab8d32dda6733c84 upstream.
    
    Two bitmasks in 'struct sdw_slave_prop' - 'source_ports' and
    'sink_ports' - define which ports to program in
    sdw_program_slave_port_params().  The masks are used to get the
    appropriate data port properties ('struct sdw_get_slave_dpn_prop') from
    an array.
    
    Bitmasks can be non-continuous or can start from index different than 0,
    thus when looking for matching port property for given port, we must
    iterate over mask bits, not from 0 up to number of ports.
    
    This fixes allocation and programming slave ports, when a source or sink
    masks start from further index.
    
    Fixes: f8101c74aa54 ("soundwire: Add Master and Slave port programming")
    Cc: stable@vger.kernel.org
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    Link: https://lore.kernel.org/r/20240729140157.326450-1-krzysztof.kozlowski@linaro.org
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
thermal: of: Fix OF node leak in of_thermal_zone_find() error paths [+ + +]
Author: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date:   Wed Aug 14 21:58:23 2024 +0200

    thermal: of: Fix OF node leak in of_thermal_zone_find() error paths
    
    [ Upstream commit c0a1ef9c5be72ff28a5413deb1b3e1a066593c13 ]
    
    Terminating for_each_available_child_of_node() loop requires dropping OF
    node reference, so bailing out on errors misses this.  Solve the OF node
    reference leak with scoped for_each_available_child_of_node_scoped().
    
    Fixes: 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization")
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
    Reviewed-by: Daniel Lezcano <daniel.lezcano@linaro.org>
    Link: https://patch.msgid.link/20240814195823.437597-3-krzysztof.kozlowski@linaro.org
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

thermal: of: Fix OF node leak in thermal_of_trips_init() error path [+ + +]
Author: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date:   Wed Aug 14 21:58:21 2024 +0200

    thermal: of: Fix OF node leak in thermal_of_trips_init() error path
    
    [ Upstream commit afc954fd223ded70b1fa000767e2531db55cce58 ]
    
    Terminating for_each_child_of_node() loop requires dropping OF node
    reference, so bailing out after thermal_of_populate_trip() error misses
    this.  Solve the OF node reference leak with scoped
    for_each_child_of_node_scoped().
    
    Fixes: d0c75fa2c17f ("thermal/of: Initialize trip points separately")
    Cc: All applicable <stable@vger.kernel.org>
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
    Reviewed-by: Daniel Lezcano <daniel.lezcano@linaro.org>
    Link: https://patch.msgid.link/20240814195823.437597-1-krzysztof.kozlowski@linaro.org
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
usb: cdnsp: fix for Link TRB with TC [+ + +]
Author: Pawel Laszczak <pawell@cadence.com>
Date:   Wed Aug 21 06:07:42 2024 +0000

    usb: cdnsp: fix for Link TRB with TC
    
    commit 740f2e2791b98e47288b3814c83a3f566518fed2 upstream.
    
    Stop Endpoint command on LINK TRB with TC bit set to 1 causes that
    internal cycle bit can have incorrect state after command complete.
    In consequence empty transfer ring can be incorrectly detected
    when EP is resumed.
    NOP TRB before LINK TRB avoid such scenario. Stop Endpoint command
    is then on NOP TRB and internal cycle bit is not changed and have
    correct value.
    
    Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
    cc: <stable@vger.kernel.org>
    Signed-off-by: Pawel Laszczak <pawell@cadence.com>
    Reviewed-by: Peter Chen <peter.chen@kernel.org>
    Link: https://lore.kernel.org/r/PH7PR07MB953878279F375CCCE6C6F40FDD8E2@PH7PR07MB9538.namprd07.prod.outlook.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function [+ + +]
Author: Pawel Laszczak <pawell@cadence.com>
Date:   Tue Aug 20 08:21:19 2024 +0000

    usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
    
    commit 0497a356d3c498221eb0c1edc1e8985816092f12 upstream.
    
    Patch fixes the incorrect "stream_id" table index instead of
    "ep_index" used in cdnsp_get_hw_deq function.
    
    Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
    cc: stable@vger.kernel.org
    Signed-off-by: Pawel Laszczak <pawell@cadence.com>
    Reviewed-by: Peter Chen <peter.chen@kernel.org>
    Link: https://lore.kernel.org/r/PH7PR07MB95381F2182688811D5C711CEDD8D2@PH7PR07MB9538.namprd07.prod.outlook.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() [+ + +]
Author: Zijun Hu <quic_zijuhu@quicinc.com>
Date:   Tue Aug 20 19:01:27 2024 +0800

    usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()
    
    commit 3a8839bbb86da7968a792123ed2296d063871a52 upstream.
    
    Device attribute group @usb3_hardware_lpm_attr_group is merged by
    add_power_attributes(), but it is not unmerged explicitly, fixed by
    unmerging it in remove_power_attributes().
    
    Fixes: 655fe4effe0f ("usbcore: add sysfs support to xHCI usb3 hardware LPM")
    Cc: stable@vger.kernel.org
    Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
    Link: https://lore.kernel.org/r/20240820-sysfs_fix-v2-1-a9441487077e@quicinc.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: dwc3: core: Prevent USB core invalid event buffer address access [+ + +]
Author: Selvarasu Ganesan <selvarasu.g@samsung.com>
Date:   Thu Aug 15 12:18:31 2024 +0530

    usb: dwc3: core: Prevent USB core invalid event buffer address access
    
    commit 14e497183df28c006603cc67fd3797a537eef7b9 upstream.
    
    This commit addresses an issue where the USB core could access an
    invalid event buffer address during runtime suspend, potentially causing
    SMMU faults and other memory issues in Exynos platforms. The problem
    arises from the following sequence.
            1. In dwc3_gadget_suspend, there is a chance of a timeout when
            moving the USB core to the halt state after clearing the
            run/stop bit by software.
            2. In dwc3_core_exit, the event buffer is cleared regardless of
            the USB core's status, which may lead to an SMMU faults and
            other memory issues. if the USB core tries to access the event
            buffer address.
    
    To prevent this hardware quirk on Exynos platforms, this commit ensures
    that the event buffer address is not cleared by software  when the USB
    core is active during runtime suspend by checking its status before
    clearing the buffer address.
    
    Cc: stable <stable@kernel.org>
    Signed-off-by: Selvarasu Ganesan <selvarasu.g@samsung.com>
    Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
    Link: https://lore.kernel.org/r/20240815064836.1491-1-selvarasu.g@samsung.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: dwc3: omap: add missing depopulate in probe error path [+ + +]
Author: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date:   Fri Aug 16 09:54:08 2024 +0200

    usb: dwc3: omap: add missing depopulate in probe error path
    
    commit 2aa765a43817ec8add990f83c8e54a9a5d87aa9c upstream.
    
    Depopulate device in probe error paths to fix leak of children
    resources.
    
    Fixes: ee249b455494 ("usb: dwc3: omap: remove IRQ_NOAUTOEN used with shared irq")
    Cc: stable@vger.kernel.org
    Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
    Link: https://lore.kernel.org/r/20240816075409.23080-1-krzysztof.kozlowski@linaro.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: dwc3: st: add missing depopulate in probe error path [+ + +]
Author: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date:   Wed Aug 14 11:39:57 2024 +0200

    usb: dwc3: st: add missing depopulate in probe error path
    
    commit cd4897bfd14f6a5388b21ba45a066541a0425199 upstream.
    
    Depopulate device in probe error paths to fix leak of children
    resources.
    
    Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC")
    Cc: stable@vger.kernel.org
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
    Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
    Link: https://lore.kernel.org/r/20240814093957.37940-2-krzysztof.kozlowski@linaro.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: dwc3: st: fix probed platform device ref count on probe error path [+ + +]
Author: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date:   Wed Aug 14 11:39:56 2024 +0200

    usb: dwc3: st: fix probed platform device ref count on probe error path
    
    commit ddfcfeba891064b88bb844208b43bef2ef970f0c upstream.
    
    The probe function never performs any paltform device allocation, thus
    error path "undo_platform_dev_alloc" is entirely bogus.  It drops the
    reference count from the platform device being probed.  If error path is
    triggered, this will lead to unbalanced device reference counts and
    premature release of device resources, thus possible use-after-free when
    releasing remaining devm-managed resources.
    
    Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC")
    Cc: stable@vger.kernel.org
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
    Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
    Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
USB: serial: option: add MeiG Smart SRM825L [+ + +]
Author: ZHANG Yuntian <yt@radxa.com>
Date:   Sat Aug 3 15:46:07 2024 +0800

    USB: serial: option: add MeiG Smart SRM825L
    
    commit 9a471de516c35219d1722c13367191ce1f120fe9 upstream.
    
    Add support for MeiG Smart SRM825L which is based on Qualcomm 315 chip.
    
    T:  Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=5000 MxCh= 0
    D:  Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs=  1
    P:  Vendor=2dee ProdID=4d22 Rev= 4.14
    S:  Manufacturer=MEIG
    S:  Product=LTE-A Module
    S:  SerialNumber=6f345e48
    C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=896mA
    I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
    E:  Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
    E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
    E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
    I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
    E:  Ad=85(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
    E:  Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
    E:  Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
    I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
    E:  Ad=87(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
    E:  Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
    E:  Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
    I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
    E:  Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
    E:  Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
    I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
    E:  Ad=89(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
    E:  Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
    E:  Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
    
    Signed-off-by: ZHANG Yuntian <yt@radxa.com>
    Link: https://lore.kernel.org/0041DFA5200EFB1B+20240803074619.563116-1-yt@radxa.com/
    Cc: stable@vger.kernel.org
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
usb: typec: fix up incorrectly backported "usb: typec: tcpm: unregister existing source caps before re-registration" [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Fri Aug 30 15:47:42 2024 +0200

    usb: typec: fix up incorrectly backported "usb: typec: tcpm: unregister existing source caps before re-registration"
    
    In commit cfcd544a9974 ("usb: typec: tcpm: unregister existing source
    caps before re-registration"), quilt, and git, applied the diff to the
    incorrect function, which would cause bad problems if exercised in a
    device with these capabilities.
    
    Fix this all up (including the follow-up fix in commit 4053696594d7
    ("usb: typec: tcpm: fix use-after-free case in
    tcpm_register_source_caps") to be in the correct function.
    
    Fixes: 4053696594d7 ("usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps")
    Fixes: cfcd544a9974 ("usb: typec: tcpm: unregister existing source caps before re-registration")
    Reported-by: Charles Yo <charlesyo@google.com>
    Cc: Kyle Tso <kyletso@google.com>
    Cc: Amit Sunil Dhamne <amitsd@google.com>
    Cc: Ondrej Jirman <megi@xff.cz>
    Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
wifi: iwlwifi: fw: fix wgds rev 3 exact size [+ + +]
Author: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Date:   Sun Aug 25 19:17:08 2024 +0300

    wifi: iwlwifi: fw: fix wgds rev 3 exact size
    
    [ Upstream commit 3ee22f07a35b76939c5b8d17d6af292f5fafb509 ]
    
    Check size of WGDS revision 3 is equal to 8 entries size with some header,
    but doesn't depend on the number of used entries. Check that used entries
    are between min and max but allow more to be present than are used to fix
    operation with some BIOSes that have such data.
    
    Fixes: 97f8a3d1610b ("iwlwifi: ACPI: support revision 3 WGDS tables")
    Signed-off-by: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
    Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
    Link: https://patch.msgid.link/20240825191257.cc71dfc67ec3.Ic27ee15ac6128b275c210b6de88f2145bd83ca7b@changeid
    [edit commit message]
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

wifi: mwifiex: duplicate static structs used in driver instances [+ + +]
Author: Sascha Hauer <s.hauer@pengutronix.de>
Date:   Fri Aug 9 10:11:33 2024 +0200

    wifi: mwifiex: duplicate static structs used in driver instances
    
    commit 27ec3c57fcadb43c79ed05b2ea31bc18c72d798a upstream.
    
    mwifiex_band_2ghz and mwifiex_band_5ghz are statically allocated, but
    used and modified in driver instances. Duplicate them before using
    them in driver instances so that different driver instances do not
    influence each other.
    
    This was observed on a board which has one PCIe and one SDIO mwifiex
    adapter. It blew up in mwifiex_setup_ht_caps(). This was called with
    the statically allocated struct which is modified in this function.
    
    Cc: stable@vger.kernel.org
    Fixes: d6bffe8bb520 ("mwifiex: support for creation of AP interface")
    Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
    Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
    Acked-by: Brian Norris <briannorris@chromium.org>
    Signed-off-by: Kalle Valo <kvalo@kernel.org>
    Link: https://patch.msgid.link/20240809-mwifiex-duplicate-static-structs-v1-1-6837b903b1a4@pengutronix.de
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

wifi: wfx: repair open network AP mode [+ + +]
Author: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Date:   Fri Aug 23 15:15:20 2024 +0200

    wifi: wfx: repair open network AP mode
    
    commit 6d30bb88f623526197c0e18a366e68a4254a2c83 upstream.
    
    RSN IE missing in beacon is normal in open networks.
    Avoid returning -EINVAL in this case.
    
    Steps to reproduce:
    
    $ cat /etc/wpa_supplicant.conf
    network={
            ssid="testNet"
            mode=2
            key_mgmt=NONE
    }
    
    $ wpa_supplicant -iwlan0 -c /etc/wpa_supplicant.conf
    nl80211: Beacon set failed: -22 (Invalid argument)
    Failed to set beacon parameters
    Interface initialization failed
    wlan0: interface state UNINITIALIZED->DISABLED
    wlan0: AP-DISABLED
    wlan0: Unable to setup interface.
    Failed to initialize AP interface
    
    After the change:
    
    $ wpa_supplicant -iwlan0 -c /etc/wpa_supplicant.conf
    Successfully initialized wpa_supplicant
    wlan0: interface state UNINITIALIZED->ENABLED
    wlan0: AP-ENABLED
    
    Cc: stable@vger.kernel.org
    Fixes: fe0a7776d4d1 ("wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()")
    Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
    Reviewed-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
    Signed-off-by: Kalle Valo <kvalo@kernel.org>
    Link: https://patch.msgid.link/20240823131521.3309073-1-alexander.sverdlin@siemens.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>