commit: 607424ee814a1c81bb346485da384cc5afc875f4 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Fri Mar 3 12:29:31 2023 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Fri Mar 3 12:29:31 2023 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=607424ee
Linux patch 5.15.97 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1096_linux-5.15.97.patch | 776 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 780 insertions(+) diff --git a/0000_README b/0000_README index 60fe6f95..bb0c0362 100644 --- a/0000_README +++ b/0000_README @@ -427,6 +427,10 @@ Patch: 1095_linux-5.15.96.patch From: https://www.kernel.org Desc: Linux 5.15.96 +Patch: 1096_linux-5.15.97.patch +From: https://www.kernel.org +Desc: Linux 5.15.97 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1096_linux-5.15.97.patch b/1096_linux-5.15.97.patch new file mode 100644 index 00000000..e664def0 --- /dev/null +++ b/1096_linux-5.15.97.patch @@ -0,0 +1,776 @@ +diff --git a/Makefile b/Makefile +index ca432d4fdc7a5..89e039ab5968e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 15 +-SUBLEVEL = 96 ++SUBLEVEL = 97 + EXTRAVERSION = + NAME = Trick or Treat + +diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi +index 66ff5db53c5a9..8670c948ca8da 100644 +--- a/arch/arm/boot/dts/rk3288.dtsi ++++ b/arch/arm/boot/dts/rk3288.dtsi +@@ -1180,6 +1180,7 @@ + clock-names = "dp", "pclk"; + phys = <&edp_phy>; + phy-names = "dp"; ++ power-domains = <&power RK3288_PD_VIO>; + resets = <&cru SRST_EDP>; + reset-names = "dp"; + rockchip,grf = <&grf>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts +index aa22a0c222655..5d5d9574088ca 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts +@@ -96,7 +96,6 @@ + linux,default-trigger = "heartbeat"; + gpios = <&rk805 1 GPIO_ACTIVE_LOW>; + default-state = "on"; +- mode = <0x23>; + }; + + user_led: led-1 { +@@ -104,7 +103,6 @@ + linux,default-trigger = "mmc1"; + gpios = <&rk805 0 GPIO_ACTIVE_LOW>; + default-state = "off"; +- mode = <0x05>; + }; + }; + }; +diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h +index 13922963431a0..b8e7ea9e71e20 100644 +--- a/arch/x86/include/asm/intel-family.h ++++ b/arch/x86/include/asm/intel-family.h +@@ -113,6 +113,8 @@ + #define INTEL_FAM6_ALDERLAKE 0x97 /* Golden Cove / Gracemont */ + #define INTEL_FAM6_ALDERLAKE_L 0x9A /* Golden Cove / Gracemont */ + ++#define INTEL_FAM6_LUNARLAKE_M 0xBD ++ + /* "Small Core" Processors (Atom/E-Core) */ + + #define INTEL_FAM6_ATOM_BONNELL 0x1C /* Diamondville, Pineview */ +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index 7dd80acf92c78..2575d6c51f898 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -3676,8 +3676,8 @@ void acpi_nfit_shutdown(void *data) + + mutex_lock(&acpi_desc->init_mutex); + set_bit(ARS_CANCEL, &acpi_desc->scrub_flags); +- cancel_delayed_work_sync(&acpi_desc->dwork); + mutex_unlock(&acpi_desc->init_mutex); ++ cancel_delayed_work_sync(&acpi_desc->dwork); + + /* + * Bounce the nvdimm bus lock to make sure any in-flight +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 2e475bd426b84..f1ea883db5de1 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1197,6 +1197,7 @@ int hid_open_report(struct hid_device *device) + __u8 *end; + __u8 *next; + int ret; ++ int i; + static int (*dispatch_type[])(struct hid_parser *parser, + struct hid_item *item) = { + hid_parser_main, +@@ -1247,6 +1248,8 @@ int hid_open_report(struct hid_device *device) + goto err; + } + device->collection_size = HID_DEFAULT_NUM_COLLECTIONS; ++ for (i = 0; i < HID_DEFAULT_NUM_COLLECTIONS; i++) ++ device->collection[i].parent_idx = -1; + + ret = -EINVAL; + while ((next = fetch_item(start, end, &item)) != NULL) { +diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c +index e59e9911fc370..4fa45ee77503b 100644 +--- a/drivers/hid/hid-elecom.c ++++ b/drivers/hid/hid-elecom.c +@@ -12,6 +12,7 @@ + * Copyright (c) 2017 Alex Manoussakis <ama...@gnu.org> + * Copyright (c) 2017 Tomasz Kramkowski <t...@the-tk.com> + * Copyright (c) 2020 YOSHIOKA Takuma <lo48...@hard-wi.red> ++ * Copyright (c) 2022 Takahiro Fujii <fu...@xaxxi.net> + */ + + /* +@@ -89,7 +90,7 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + case USB_DEVICE_ID_ELECOM_M_DT1URBK: + case USB_DEVICE_ID_ELECOM_M_DT1DRBK: + case USB_DEVICE_ID_ELECOM_M_HT1URBK: +- case USB_DEVICE_ID_ELECOM_M_HT1DRBK: ++ case USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D: + /* + * Report descriptor format: + * 12: button bit count +@@ -99,6 +100,16 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + */ + mouse_button_fixup(hdev, rdesc, *rsize, 12, 30, 14, 20, 8); + break; ++ case USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C: ++ /* ++ * Report descriptor format: ++ * 22: button bit count ++ * 30: padding bit count ++ * 24: button report size ++ * 16: button usage maximum ++ */ ++ mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8); ++ break; + } + return rdesc; + } +@@ -112,7 +123,8 @@ static const struct hid_device_id elecom_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, + { } + }; + MODULE_DEVICE_TABLE(hid, elecom_devices); +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index fa1aa22547ea7..b153ddc3319e8 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -410,7 +410,8 @@ + #define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe + #define USB_DEVICE_ID_ELECOM_M_DT1DRBK 0x00ff + #define USB_DEVICE_ID_ELECOM_M_HT1URBK 0x010c +-#define USB_DEVICE_ID_ELECOM_M_HT1DRBK 0x010d ++#define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d ++#define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c + + #define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34 + #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 184029cad014f..4a8c32148e58f 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -381,7 +381,8 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, + #endif + #if IS_ENABLED(CONFIG_HID_ELO) + { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) }, +diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +index ba930112c1624..1d2020c30ef3b 100644 +--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c ++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +@@ -160,16 +160,11 @@ static void unpin_rcv_pages(struct hfi1_filedata *fd, + static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf) + { + int pinned; +- unsigned int npages; ++ unsigned int npages = tidbuf->npages; + unsigned long vaddr = tidbuf->vaddr; + struct page **pages = NULL; + struct hfi1_devdata *dd = fd->uctxt->dd; + +- /* Get the number of pages the user buffer spans */ +- npages = num_user_pages(vaddr, tidbuf->length); +- if (!npages) +- return -EINVAL; +- + if (npages > fd->uctxt->expected_count) { + dd_dev_err(dd, "Expected buffer too big\n"); + return -EINVAL; +@@ -196,7 +191,6 @@ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf) + return pinned; + } + tidbuf->pages = pages; +- tidbuf->npages = npages; + fd->tid_n_pinned += pinned; + return pinned; + } +@@ -274,6 +268,7 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + mutex_init(&tidbuf->cover_mutex); + tidbuf->vaddr = tinfo->vaddr; + tidbuf->length = tinfo->length; ++ tidbuf->npages = num_user_pages(tidbuf->vaddr, tidbuf->length); + tidbuf->psets = kcalloc(uctxt->expected_count, sizeof(*tidbuf->psets), + GFP_KERNEL); + if (!tidbuf->psets) { +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +index 37c39581b6599..376f97b4008bb 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +@@ -353,16 +353,25 @@ void ionic_rx_fill(struct ionic_queue *q) + struct ionic_rxq_sg_desc *sg_desc; + struct ionic_rxq_sg_elem *sg_elem; + struct ionic_buf_info *buf_info; ++ unsigned int fill_threshold; + struct ionic_rxq_desc *desc; + unsigned int remain_len; + unsigned int frag_len; + unsigned int nfrags; ++ unsigned int n_fill; + unsigned int i, j; + unsigned int len; + ++ n_fill = ionic_q_space_avail(q); ++ ++ fill_threshold = min_t(unsigned int, IONIC_RX_FILL_THRESHOLD, ++ q->num_descs / IONIC_RX_FILL_DIV); ++ if (n_fill < fill_threshold) ++ return; ++ + len = netdev->mtu + ETH_HLEN + VLAN_HLEN; + +- for (i = ionic_q_space_avail(q); i; i--) { ++ for (i = n_fill; i; i--) { + nfrags = 0; + remain_len = len; + desc_info = &q->info[q->head_idx]; +@@ -518,7 +527,6 @@ int ionic_rx_napi(struct napi_struct *napi, int budget) + struct ionic_cq *cq = napi_to_cq(napi); + struct ionic_dev *idev; + struct ionic_lif *lif; +- u16 rx_fill_threshold; + u32 work_done = 0; + u32 flags = 0; + +@@ -528,10 +536,7 @@ int ionic_rx_napi(struct napi_struct *napi, int budget) + work_done = ionic_cq_service(cq, budget, + ionic_rx_service, NULL, NULL); + +- rx_fill_threshold = min_t(u16, IONIC_RX_FILL_THRESHOLD, +- cq->num_descs / IONIC_RX_FILL_DIV); +- if (work_done && ionic_q_space_avail(cq->bound_q) >= rx_fill_threshold) +- ionic_rx_fill(cq->bound_q); ++ ionic_rx_fill(cq->bound_q); + + if (work_done < budget && napi_complete_done(napi, work_done)) { + ionic_dim_update(qcq, IONIC_LIF_F_RX_DIM_INTR); +@@ -559,7 +564,6 @@ int ionic_txrx_napi(struct napi_struct *napi, int budget) + struct ionic_dev *idev; + struct ionic_lif *lif; + struct ionic_cq *txcq; +- u16 rx_fill_threshold; + u32 rx_work_done = 0; + u32 tx_work_done = 0; + u32 flags = 0; +@@ -574,10 +578,7 @@ int ionic_txrx_napi(struct napi_struct *napi, int budget) + rx_work_done = ionic_cq_service(rxcq, budget, + ionic_rx_service, NULL, NULL); + +- rx_fill_threshold = min_t(u16, IONIC_RX_FILL_THRESHOLD, +- rxcq->num_descs / IONIC_RX_FILL_DIV); +- if (rx_work_done && ionic_q_space_avail(rxcq->bound_q) >= rx_fill_threshold) +- ionic_rx_fill(rxcq->bound_q); ++ ionic_rx_fill(rxcq->bound_q); + + if (rx_work_done < budget && napi_complete_done(napi, rx_work_done)) { + ionic_dim_update(qcq, 0); +diff --git a/drivers/staging/mt7621-dts/gbpc1.dts b/drivers/staging/mt7621-dts/gbpc1.dts +index 02fd9be5e1734..cf5d6e9a9b548 100644 +--- a/drivers/staging/mt7621-dts/gbpc1.dts ++++ b/drivers/staging/mt7621-dts/gbpc1.dts +@@ -19,7 +19,7 @@ + bootargs = "console=ttyS0,57600"; + }; + +- palmbus: palmbus@1E000000 { ++ palmbus: palmbus@1e000000 { + i2c@900 { + status = "okay"; + }; +diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c +index f566eb1839dc5..71e091f879f0e 100644 +--- a/drivers/tty/vt/vc_screen.c ++++ b/drivers/tty/vt/vc_screen.c +@@ -403,10 +403,11 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) + unsigned int this_round, skip = 0; + int size; + +- ret = -ENXIO; + vc = vcs_vc(inode, &viewed); +- if (!vc) +- goto unlock_out; ++ if (!vc) { ++ ret = -ENXIO; ++ break; ++ } + + /* Check whether we are above size each round, + * as copy_to_user at the end of this loop +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index d23ccace5ca25..2295d69b4cd2d 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2382,9 +2382,8 @@ static int usb_enumerate_device_otg(struct usb_device *udev) + * usb_enumerate_device - Read device configs/intfs/otg (usbcore-internal) + * @udev: newly addressed device (in ADDRESS state) + * +- * This is only called by usb_new_device() and usb_authorize_device() +- * and FIXME -- all comments that apply to them apply here wrt to +- * environment. ++ * This is only called by usb_new_device() -- all comments that apply there ++ * apply here wrt to environment. + * + * If the device is WUSB and not authorized, we don't attempt to read + * the string descriptors, as they will be errored out by the device +diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c +index fa2e49d432ff6..60ee0469d86e7 100644 +--- a/drivers/usb/core/sysfs.c ++++ b/drivers/usb/core/sysfs.c +@@ -868,11 +868,7 @@ read_descriptors(struct file *filp, struct kobject *kobj, + size_t srclen, n; + int cfgno; + void *src; +- int retval; + +- retval = usb_lock_device_interruptible(udev); +- if (retval < 0) +- return -EINTR; + /* The binary attribute begins with the device descriptor. + * Following that are the raw descriptor entries for all the + * configurations (config plus subsidiary descriptors). +@@ -897,7 +893,6 @@ read_descriptors(struct file *filp, struct kobject *kobj, + off -= srclen; + } + } +- usb_unlock_device(udev); + return count - nleft; + } + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index e55d0c7db6b5d..46ef3ae9c0dd6 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -45,6 +45,7 @@ + #define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1 + #define PCI_DEVICE_ID_INTEL_RPL 0xa70e + #define PCI_DEVICE_ID_INTEL_RPLS 0x7a61 ++#define PCI_DEVICE_ID_INTEL_MTLM 0x7eb1 + #define PCI_DEVICE_ID_INTEL_MTLP 0x7ec1 + #define PCI_DEVICE_ID_INTEL_MTL 0x7e7e + #define PCI_DEVICE_ID_INTEL_TGL 0x9a15 +@@ -427,6 +428,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_RPLS), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLM), ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, ++ + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLP), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + +diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c +index 6f68cbeeee7c0..116d2e15e9b22 100644 +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -81,6 +81,9 @@ + #define WRITE_BUF_SIZE 8192 /* TX only */ + #define GS_CONSOLE_BUF_SIZE 8192 + ++/* Prevents race conditions while accessing gser->ioport */ ++static DEFINE_SPINLOCK(serial_port_lock); ++ + /* console info */ + struct gs_console { + struct console console; +@@ -1374,8 +1377,10 @@ void gserial_disconnect(struct gserial *gser) + if (!port) + return; + ++ spin_lock_irqsave(&serial_port_lock, flags); ++ + /* tell the TTY glue not to do I/O here any more */ +- spin_lock_irqsave(&port->port_lock, flags); ++ spin_lock(&port->port_lock); + + gs_console_disconnect(port); + +@@ -1390,7 +1395,8 @@ void gserial_disconnect(struct gserial *gser) + tty_hangup(port->port.tty); + } + port->suspended = false; +- spin_unlock_irqrestore(&port->port_lock, flags); ++ spin_unlock(&port->port_lock); ++ spin_unlock_irqrestore(&serial_port_lock, flags); + + /* disable endpoints, aborting down any active I/O */ + usb_ep_disable(gser->out); +@@ -1424,10 +1430,19 @@ EXPORT_SYMBOL_GPL(gserial_suspend); + + void gserial_resume(struct gserial *gser) + { +- struct gs_port *port = gser->ioport; ++ struct gs_port *port; + unsigned long flags; + +- spin_lock_irqsave(&port->port_lock, flags); ++ spin_lock_irqsave(&serial_port_lock, flags); ++ port = gser->ioport; ++ ++ if (!port) { ++ spin_unlock_irqrestore(&serial_port_lock, flags); ++ return; ++ } ++ ++ spin_lock(&port->port_lock); ++ spin_unlock(&serial_port_lock); + port->suspended = false; + if (!port->start_delayed) { + spin_unlock_irqrestore(&port->port_lock, flags); +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 6b69d05e2fb06..a8534065e0d6d 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -402,6 +402,8 @@ static void option_instat_callback(struct urb *urb); + #define LONGCHEER_VENDOR_ID 0x1c9e + + /* 4G Systems products */ ++/* This one was sold as the VW and Skoda "Carstick LTE" */ ++#define FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE 0x7605 + /* This is the 4G XS Stick W14 a.k.a. Mobilcom Debitel Surf-Stick * + * It seems to contain a Qualcomm QSC6240/6290 chipset */ + #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603 +@@ -1976,6 +1978,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(2) }, + { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, + { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) }, ++ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE), ++ .driver_info = RSVD(0) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), + .driver_info = NCTRL(0) | NCTRL(1) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100), +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index 9250a17731bdb..692ae2e2f8cc5 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -7549,10 +7549,10 @@ long btrfs_ioctl_send(struct file *mnt_file, struct btrfs_ioctl_send_args *arg) + /* + * Check that we don't overflow at later allocations, we request + * clone_sources_count + 1 items, and compare to unsigned long inside +- * access_ok. ++ * access_ok. Also set an upper limit for allocation size so this can't ++ * easily exhaust memory. Max number of clone sources is about 200K. + */ +- if (arg->clone_sources_count > +- ULONG_MAX / sizeof(struct clone_root) - 1) { ++ if (arg->clone_sources_count > SZ_8M / sizeof(struct clone_root)) { + ret = -EINVAL; + goto out; + } +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index cae78f37d7093..7857b3d9d6a76 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -1095,7 +1095,8 @@ static int __io_register_rsrc_update(struct io_ring_ctx *ctx, unsigned type, + unsigned nr_args); + static void io_clean_op(struct io_kiocb *req); + static struct file *io_file_get(struct io_ring_ctx *ctx, +- struct io_kiocb *req, int fd, bool fixed); ++ struct io_kiocb *req, int fd, bool fixed, ++ unsigned int issue_flags); + static void __io_queue_sqe(struct io_kiocb *req); + static void io_rsrc_put_work(struct work_struct *work); + +@@ -4121,7 +4122,7 @@ static int io_tee(struct io_kiocb *req, unsigned int issue_flags) + return -EAGAIN; + + in = io_file_get(req->ctx, req, sp->splice_fd_in, +- (sp->flags & SPLICE_F_FD_IN_FIXED)); ++ (sp->flags & SPLICE_F_FD_IN_FIXED), issue_flags); + if (!in) { + ret = -EBADF; + goto done; +@@ -4161,7 +4162,7 @@ static int io_splice(struct io_kiocb *req, unsigned int issue_flags) + return -EAGAIN; + + in = io_file_get(req->ctx, req, sp->splice_fd_in, +- (sp->flags & SPLICE_F_FD_IN_FIXED)); ++ (sp->flags & SPLICE_F_FD_IN_FIXED), issue_flags); + if (!in) { + ret = -EBADF; + goto done; +@@ -7047,13 +7048,16 @@ static void io_fixed_file_set(struct io_fixed_file *file_slot, struct file *file + } + + static inline struct file *io_file_get_fixed(struct io_ring_ctx *ctx, +- struct io_kiocb *req, int fd) ++ struct io_kiocb *req, int fd, ++ unsigned int issue_flags) + { +- struct file *file; ++ struct file *file = NULL; + unsigned long file_ptr; + ++ io_ring_submit_lock(ctx, !(issue_flags & IO_URING_F_NONBLOCK)); ++ + if (unlikely((unsigned int)fd >= ctx->nr_user_files)) +- return NULL; ++ goto out; + fd = array_index_nospec(fd, ctx->nr_user_files); + file_ptr = io_fixed_file_slot(&ctx->file_table, fd)->file_ptr; + file = (struct file *) (file_ptr & FFS_MASK); +@@ -7061,6 +7065,8 @@ static inline struct file *io_file_get_fixed(struct io_ring_ctx *ctx, + /* mask in overlapping REQ_F and FFS bits */ + req->flags |= (file_ptr << REQ_F_NOWAIT_READ_BIT); + io_req_set_rsrc_node(req); ++out: ++ io_ring_submit_unlock(ctx, !(issue_flags & IO_URING_F_NONBLOCK)); + return file; + } + +@@ -7078,10 +7084,11 @@ static struct file *io_file_get_normal(struct io_ring_ctx *ctx, + } + + static inline struct file *io_file_get(struct io_ring_ctx *ctx, +- struct io_kiocb *req, int fd, bool fixed) ++ struct io_kiocb *req, int fd, bool fixed, ++ unsigned int issue_flags) + { + if (fixed) +- return io_file_get_fixed(ctx, req, fd); ++ return io_file_get_fixed(ctx, req, fd, issue_flags); + else + return io_file_get_normal(ctx, req, fd); + } +@@ -7303,7 +7310,7 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, + + if (io_op_defs[req->opcode].needs_file) { + req->file = io_file_get(ctx, req, READ_ONCE(sqe->fd), +- (sqe_flags & IOSQE_FIXED_FILE)); ++ (sqe_flags & IOSQE_FIXED_FILE), 0); + if (unlikely(!req->file)) + ret = -EBADF; + } +diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c +index e12fd3cad6194..997c4ebdce6f6 100644 +--- a/net/caif/caif_socket.c ++++ b/net/caif/caif_socket.c +@@ -1020,6 +1020,7 @@ static void caif_sock_destructor(struct sock *sk) + return; + } + sk_stream_kill_queues(&cf_sk->sk); ++ WARN_ON(sk->sk_forward_alloc); + caif_free_client(&cf_sk->layer); + } + +diff --git a/net/core/filter.c b/net/core/filter.c +index b2031148dd8b4..519315a1acf3a 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -5506,7 +5506,7 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params, + neigh = __ipv6_neigh_lookup_noref_stub(dev, dst); + } + +- if (!neigh) ++ if (!neigh || !(neigh->nud_state & NUD_VALID)) + return BPF_FIB_LKUP_RET_NO_NEIGH; + + return bpf_fib_set_fwd_params(params, neigh, dev, mtu); +@@ -5621,7 +5621,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params, + * not needed here. + */ + neigh = __ipv6_neigh_lookup_noref_stub(dev, dst); +- if (!neigh) ++ if (!neigh || !(neigh->nud_state & NUD_VALID)) + return BPF_FIB_LKUP_RET_NO_NEIGH; + + return bpf_fib_set_fwd_params(params, neigh, dev, mtu); +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 0e22ecb469771..95f588b2fd159 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -241,7 +241,7 @@ static int neigh_forced_gc(struct neigh_table *tbl) + (n->nud_state == NUD_NOARP) || + (tbl->is_multicast && + tbl->is_multicast(n->primary_key)) || +- time_after(tref, n->updated)) ++ !time_in_range(n->updated, tref, jiffies)) + remove = true; + write_unlock(&n->lock); + +@@ -261,7 +261,17 @@ static int neigh_forced_gc(struct neigh_table *tbl) + + static void neigh_add_timer(struct neighbour *n, unsigned long when) + { ++ /* Use safe distance from the jiffies - LONG_MAX point while timer ++ * is running in DELAY/PROBE state but still show to user space ++ * large times in the past. ++ */ ++ unsigned long mint = jiffies - (LONG_MAX - 86400 * HZ); ++ + neigh_hold(n); ++ if (!time_in_range(n->confirmed, mint, jiffies)) ++ n->confirmed = mint; ++ if (time_before(n->used, n->confirmed)) ++ n->used = n->confirmed; + if (unlikely(mod_timer(&n->timer, when))) { + printk("NEIGH: BUG, double timer add, state is %x\n", + n->nud_state); +@@ -943,12 +953,14 @@ static void neigh_periodic_work(struct work_struct *work) + goto next_elt; + } + +- if (time_before(n->used, n->confirmed)) ++ if (time_before(n->used, n->confirmed) && ++ time_is_before_eq_jiffies(n->confirmed)) + n->used = n->confirmed; + + if (refcount_read(&n->refcnt) == 1 && + (state == NUD_FAILED || +- time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) { ++ !time_in_range_open(jiffies, n->used, ++ n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) { + *np = n->next; + neigh_mark_dead(n); + write_unlock(&n->lock); +diff --git a/net/core/stream.c b/net/core/stream.c +index d7c5413d16d57..cd60746877b1e 100644 +--- a/net/core/stream.c ++++ b/net/core/stream.c +@@ -209,7 +209,6 @@ void sk_stream_kill_queues(struct sock *sk) + sk_mem_reclaim(sk); + + WARN_ON(sk->sk_wmem_queued); +- WARN_ON(sk->sk_forward_alloc); + + /* It is _impossible_ for the backlog to contain anything + * when we get here. All user references to this socket +diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c +index 1e8b26eecb3f8..694eec6ca147e 100644 +--- a/net/xfrm/xfrm_interface.c ++++ b/net/xfrm/xfrm_interface.c +@@ -207,6 +207,52 @@ static void xfrmi_scrub_packet(struct sk_buff *skb, bool xnet) + skb->mark = 0; + } + ++static int xfrmi_input(struct sk_buff *skb, int nexthdr, __be32 spi, ++ int encap_type, unsigned short family) ++{ ++ struct sec_path *sp; ++ ++ sp = skb_sec_path(skb); ++ if (sp && (sp->len || sp->olen) && ++ !xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family)) ++ goto discard; ++ ++ XFRM_SPI_SKB_CB(skb)->family = family; ++ if (family == AF_INET) { ++ XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); ++ XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL; ++ } else { ++ XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr); ++ XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL; ++ } ++ ++ return xfrm_input(skb, nexthdr, spi, encap_type); ++discard: ++ kfree_skb(skb); ++ return 0; ++} ++ ++static int xfrmi4_rcv(struct sk_buff *skb) ++{ ++ return xfrmi_input(skb, ip_hdr(skb)->protocol, 0, 0, AF_INET); ++} ++ ++static int xfrmi6_rcv(struct sk_buff *skb) ++{ ++ return xfrmi_input(skb, skb_network_header(skb)[IP6CB(skb)->nhoff], ++ 0, 0, AF_INET6); ++} ++ ++static int xfrmi4_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) ++{ ++ return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET); ++} ++ ++static int xfrmi6_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) ++{ ++ return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET6); ++} ++ + static int xfrmi_rcv_cb(struct sk_buff *skb, int err) + { + const struct xfrm_mode *inner_mode; +@@ -774,8 +820,8 @@ static struct pernet_operations xfrmi_net_ops = { + }; + + static struct xfrm6_protocol xfrmi_esp6_protocol __read_mostly = { +- .handler = xfrm6_rcv, +- .input_handler = xfrm_input, ++ .handler = xfrmi6_rcv, ++ .input_handler = xfrmi6_input, + .cb_handler = xfrmi_rcv_cb, + .err_handler = xfrmi6_err, + .priority = 10, +@@ -825,8 +871,8 @@ static struct xfrm6_tunnel xfrmi_ip6ip_handler __read_mostly = { + #endif + + static struct xfrm4_protocol xfrmi_esp4_protocol __read_mostly = { +- .handler = xfrm4_rcv, +- .input_handler = xfrm_input, ++ .handler = xfrmi4_rcv, ++ .input_handler = xfrmi4_input, + .cb_handler = xfrmi_rcv_cb, + .err_handler = xfrmi4_err, + .priority = 10, +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index ba58b963f4827..0540e9f72b2fe 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -3669,6 +3669,9 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, + goto reject; + } + ++ if (if_id) ++ secpath_reset(skb); ++ + xfrm_pols_put(pols, npols); + return 1; + } +diff --git a/scripts/tags.sh b/scripts/tags.sh +index db8ba411860a5..91413d45f0fa1 100755 +--- a/scripts/tags.sh ++++ b/scripts/tags.sh +@@ -95,10 +95,13 @@ all_sources() + + all_compiled_sources() + { +- realpath -es $([ -z "$KBUILD_ABS_SRCTREE" ] && echo --relative-to=.) \ +- include/generated/autoconf.h $(find $ignore -name "*.cmd" -exec \ +- grep -Poh '(?(?=^source_.* \K).*|(?=^ \K\S).*(?= \\))' {} \+ | +- awk '!a[$0]++') | sort -u ++ { ++ echo include/generated/autoconf.h ++ find $ignore -name "*.cmd" -exec \ ++ sed -n -E 's/^source_.* (.*)/\1/p; s/^ (\S.*) \\/\1/p' {} \+ | ++ awk '!a[$0]++' ++ } | xargs realpath -es $([ -z "$KBUILD_ABS_SRCTREE" ] && echo --relative-to=.) | ++ sort -u + } + + all_target_sources() +diff --git a/sound/soc/codecs/rt715-sdca-sdw.c b/sound/soc/codecs/rt715-sdca-sdw.c +index 0f4354eafef25..85abf8073c278 100644 +--- a/sound/soc/codecs/rt715-sdca-sdw.c ++++ b/sound/soc/codecs/rt715-sdca-sdw.c +@@ -167,7 +167,7 @@ static int rt715_sdca_read_prop(struct sdw_slave *slave) + } + + /* set the timeout values */ +- prop->clk_stop_timeout = 20; ++ prop->clk_stop_timeout = 200; + + return 0; + }
