Merge tag 'v6.1.130' of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux into linux-msft-wsl-6.1.y

This is the 6.1.130 stable release

* tag 'v6.1.130' of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux:
  Linux 6.1.130
  media: mtk-vcodec: potential null pointer deference in SCP
  pfifo_tail_enqueue: Drop new packet when sch->limit == 0
  Squashfs: check the inode number is not the invalid value of zero
  mm/memory: Use exception ip to search exception tables
  ptrace: Introduce exception_ip arch hook
  intel_idle: Handle older CPUs, which stop the TSC in deeper C states, correctly
  amdgpu/pm/legacy: fix suspend/resume issues
  drm/amd/display: fixed integer types and null check locations
  riscv/futex: sign extend compare value in atomic cmpxchg
  sched/core: Prevent rescheduling when interrupts are disabled
  vmlinux.lds: Ensure that const vars with relocations are mapped R/O
  mptcp: reset when MPTCP opts are dropped after join
  mptcp: always handle address removal under msk socket lock
  phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks in refclk
  phy: tegra: xusb: reset VBUS & ID OVERRIDE
  net: enetc: fix the off-by-one issue in enetc_map_tx_tso_buffs()
  net: enetc: correct the xdp_tx statistics
  net: enetc: update UDP checksum when updating originTimestamp field
  net: enetc: keep track of correct Tx BD count in enetc_map_tx_tso_buffs()
  net: enetc: fix the off-by-one issue in enetc_map_tx_buffs()
  usbnet: gl620a: fix endpoint checking in genelink_bind()
  i2c: npcm: disable interrupt enable bit before devm_request_irq
  drm/amd/display: Fix HPD after gpu reset
  drm/amd/display: Disable PSR-SU on eDP panels
  perf/core: Fix low freq setting via IOC_PERIOD
  perf/x86: Fix low freqency setting issue
  ALSA: usb-audio: Re-add sample rate quirk for Pioneer DJM-900NXS2
  ftrace: Avoid potential division by zero in function_stat_show()
  tracing: Fix bad hist from corrupting named_triggers list
  phy: rockchip: naneng-combphy: compatible reset with old DT
  x86/CPU: Fix warm boot hang regression on AMD SC1100 SoC systems
  io_uring/net: save msg_control for compat
  uprobes: Reject the shared zeropage in uprobe_write_opcode()
  mm: Don't pin ZERO_PAGE in pin_user_pages()
  net: ipv6: fix dst ref loop on input in rpl lwt
  net: ipv6: rpl_iptunnel: mitigate 2-realloc issue
  net: ipv6: fix dst ref loop on input in seg6 lwt
  net: ipv6: seg6_iptunnel: mitigate 2-realloc issue
  include: net: add static inline dst_dev_overhead() to dst.h
  net/mlx5: IRQ, Fix null string in debug print
  net: mvpp2: cls: Fixed Non IP flow, with vlan tag flow defination.
  net: Clear old fragment checksum value in napi_reuse_skb
  tcp: Defer ts_recent changes until req is owned
  ipvs: Always clear ipvs_property flag in skb_scrub_packet()
  ASoC: es8328: fix route from DAC to output
  net: cadence: macb: Synchronize stats calculations
  ipvlan: ensure network headers are in skb linear part
  ipvlan: Prepare ipvlan_process_v4_outbound() to future .flowi4_tos conversion.
  ipv4: Convert ip_route_input() to dscp_t.
  ipv4: Convert icmp_route_lookup() to dscp_t.
  ipvlan: Unmask upper DSCP bits in ipvlan_process_v4_outbound()
  ipv4: icmp: Unmask upper DSCP bits in icmp_route_lookup()
  ipv4: icmp: Pass full DS field to ip_route_input()
  net/ipv4: add tracepoint for icmp_send
  net: set the minimum for net_hotdata.netdev_budget_usecs
  net: loopback: Avoid sending IP packets without an Ethernet header
  afs: Fix the server_list to unuse a displaced server rather than putting it
  afs: Make it possible to find the volumes that are using a server
  afs: remove variable nr_servers
  Bluetooth: L2CAP: Fix L2CAP_ECRED_CONN_RSP response
  ALSA: usb-audio: Avoid dropping MIDI events at closing multiple ports
  sunrpc: suppress warnings for unused procfs functions
  RDMA/mlx5: Fix bind QP error cleanup flow
  scsi: core: Clear driver private data when retrying request
  SUNRPC: Prevent looping due to rpc_signal_task() races
  SUNRPC: convert RPC_TASK_* constants to enum
  ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
  IB/mlx5: Set and get correct qp_num for a DCT QP
  netfilter: allow exp not to be removed in nf_ct_find_expectation
  spi: atmel-quadspi: Fix wrong register value written to MR
  spi: atmel-quadspi: Avoid overwriting delay register settings
  media: mediatek: vcodec: Fix H264 multi stateless decoder smatch warning
  block, bfq: fix bfqq uaf in bfq_limit_depth()
  block, bfq: split sync bfq_queues on a per-actuator basis
  x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit
  ftrace: Do not add duplicate entries in subops manager ops
  ftrace: Correct preemption accounting for function tracing.
  EDAC/qcom: Correct interrupt enable register configuration
  smb: client: Add check for next_buffer in receive_encrypted_standard()
  mtd: rawnand: cadence: fix incorrect device in dma_unmap_single
  mtd: rawnand: cadence: use dma_map_resource for sdma address
  mtd: rawnand: cadence: fix error code in cadence_nand_init()
  mm,madvise,hugetlb: check for 0-length range after end address adjustment
  acct: block access to kernel internal filesystems
  acct: perform last write from workqueue
  ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED
  ALSA: hda: Add error check for snd_ctl_rename_id() in snd_hda_create_dig_out_ctls()
  ASoC: fsl_micfil: Enable default case in micfil_set_quality()
  nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()
  drop_monitor: fix incorrect initialization order
  tee: optee: Fix supplicant wait loop
  drm/i915: Make sure all planes in use by the joiner have their crtc included
  drm/msm/dpu: Disable dither in phys encoder cleanup
  bpf: skip non exist keys in generic_map_lookup_batch
  nvme/ioctl: add missing space in err message
  drm/msm/dpu: Don't leak bits_per_component into random DSC_ENC fields
  nouveau/svm: fix missing folio unlock + put after make_device_exclusive_range()
  power: supply: da9150-fg: fix potential overflow
  bpf: Fix wrong copied_seq calculation
  strparser: Add read_sock callback
  bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
  drm/rcar-du: dsi: Fix PHY lock bit check
  drm/tidss: Fix race condition while handling interrupt registers
  drm/tidss: Add simple K2G manual reset
  tcp: drop secpath at the same time as we currently drop dst
  net: axienet: Set mac_managed_pm
  arp: switch to dev_getbyhwaddr() in arp_req_set_public()
  net: Add non-RCU dev_getbyhwaddr() helper
  flow_dissector: Fix port range key handling in BPF conversion
  flow_dissector: Fix handling of mixed port and port-range keys
  geneve: Suppress list corruption splat in geneve_destroy_tunnels().
  gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
  ibmvnic: Don't reference skb after sending to VIOS
  ibmvnic: Add stat for tx direct vs tx batched
  ibmvnic: Introduce send sub-crq direct
  ibmvnic: Return error code on TX scrq flush fail
  ALSA: hda/cirrus: Correct the full scale volume set logic
  geneve: Fix use-after-free in geneve_find_dev().
  powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC
  ALSA: hda/realtek: Fixup ALC225 depop procedure
  powerpc/64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline
  powerpc/64s/mm: Move __real_pte stubs into hash-4k.h
  ASoC: rockchip: i2s-tdm: fix shift config for SND_SOC_DAIFMT_DSP_[AB]
  USB: gadget: f_midi: f_midi_complete to call queue_work
  usb: gadget: core: flush gadget workqueue after device removal
  USB: gadget: core: create sysfs link between udc and gadget
  media: uvcvideo: Remove dangling pointers
  media: uvcvideo: Only save async fh if success
  media: uvcvideo: Refactor iterators
  media: uvcvideo: Fix crash during unbind if gpio unit is in use
  media: Switch to use dev_err_probe() helper
  soc: mediatek: mtk-devapc: Fix leaking IO map on driver remove
  soc/mediatek: mtk-devapc: Convert to platform remove callback returning void
  soc: mediatek: mtk-devapc: Fix leaking IO map on error paths
  soc: mediatek: mtk-devapc: Switch to devm_clk_get_enabled()
  tpm: Change to kvalloc() in eventlog/acpi.c
  tpm: Use managed allocation for bios event log
  arm64: dts: qcom: sm8450: Fix CDSP memory length
  arm64: dts: qcom: trim addresses to 8 digits
  arm64: dts: mediatek: mt8183: Disable DSI display output by default
  scsi: core: Do not retry I/Os during depopulation
  scsi: core: Handle depopulation and restoration in progress
  ASoC: renesas: rz-ssi: Add a check for negative sample_space
  clk: mediatek: mt2701-img: add missing dummy clk
  clk: mediatek: mt2701-bdp: add missing dummy clk
  clk: mediatek: mt2701-vdec: fix conversion to mtk_clk_simple_probe
  clk: mediatek: clk-mtk: Add dummy clock ops
  Bluetooth: qca: Fix poor RF performance for WCN6855
  Bluetooth: qca: Update firmware-name to support board specific nvm
  Bluetooth: qca: Support downloading board id specific NVM for WCN7850
  spi: atmel-qspi: Memory barriers after memory-mapped I/O
  spi: atmel-quadspi: Create `atmel_qspi_ops` to support newer SoC families
  spi: atmel-quadspi: switch to use modern name
  spi: atmel-quadspi: Add support for configuring CS timing
  memcg: fix soft lockup in the OOM process
  mm: update mark_victim tracepoints fields
  md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime
  md/md-bitmap: add 'sync_size' into struct md_bitmap_stats
  md/md-cluster: fix spares warnings for __le64
  md/md-bitmap: replace md_bitmap_status() with a new helper md_bitmap_get_stats()
  arm64: mte: Do not allow PROT_MTE on MAP_HUGETLB user mappings

Author: inferno0230

Documentation/core-api/pin_user_pages.rst

@@ -113,6 +113,12 @@ pages:
 This also leads to limitations: there are only 31-10==21 bits available for a
 counter that increments 10 bits at a time.
 
+* Because of that limitation, special handling is applied to the zero pages
+  when using FOLL_PIN.  We only pretend to pin a zero page - we don't alter its
+  refcount or pincount at all (it is permanent, so there's no need).  The
+  unpinning functions also don't do anything to a zero page.  This is
+  transparent to the caller.
+
 * Callers must specifically request "dma-pinned tracking of pages". In other
   words, just calling get_user_pages() will not suffice; a new set of functions,
   pin_user_page() and related, must be used.

Documentation/networking/strparser.rst

@@ -112,7 +112,7 @@ Functions
 Callbacks
 =========
 
-There are six callbacks:
+There are seven callbacks:
 
     ::
 
@@ -182,6 +182,13 @@ There are six callbacks:
     the length of the message. skb->len - offset may be greater
     then full_len since strparser does not trim the skb.
 
+    ::
+
+	int (*read_sock)(struct strparser *strp, read_descriptor_t *desc,
+                     sk_read_actor_t recv_actor);
+
+    The read_sock callback is used by strparser instead of
+    sock->ops->read_sock, if provided.
     ::
 
 	int (*read_sock_done)(struct strparser *strp, int err);

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 1
-SUBLEVEL = 129
+SUBLEVEL = 130
 EXTRAVERSION =
 NAME = Curry Ramen
 

arch/arm64/boot/dts/mediatek/mt8183.dtsi

@@ -1753,6 +1753,7 @@
 			resets = <&mmsys MT8183_MMSYS_SW0_RST_B_DISP_DSI0>;
 			phys = <&mipi_tx0>;
 			phy-names = "dphy";
+			status = "disabled";
 		};
 
 		mutex: mutex@14016000 {

arch/arm64/boot/dts/qcom/sm8350.dtsi

@@ -2226,7 +2226,7 @@
 
 		cdsp: remoteproc@98900000 {
 			compatible = "qcom,sm8350-cdsp-pas";
-			reg = <0 0x098900000 0 0x1400000>;
+			reg = <0 0x98900000 0 0x1400000>;
 
 			interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_LEVEL_HIGH>,
 					      <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>,

arch/arm64/boot/dts/qcom/sm8450.dtsi

@@ -2093,7 +2093,7 @@
 
 		remoteproc_adsp: remoteproc@30000000 {
 			compatible = "qcom,sm8450-adsp-pas";
-			reg = <0 0x030000000 0 0x100>;
+			reg = <0 0x30000000 0 0x100>;
 
 			interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
@@ -2159,7 +2159,7 @@
 
 		remoteproc_cdsp: remoteproc@32300000 {
 			compatible = "qcom,sm8450-cdsp-pas";
-			reg = <0 0x032300000 0 0x1400000>;
+			reg = <0 0x32300000 0 0x10000>;
 
 			interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>,
 					      <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>,

arch/arm64/include/asm/mman.h

@@ -31,9 +31,12 @@ static inline unsigned long arch_calc_vm_flag_bits(struct file *file,
 	 * backed by tags-capable memory. The vm_flags may be overridden by a
 	 * filesystem supporting MTE (RAM-based).
 	 */
-	if (system_supports_mte() &&
-	    ((flags & MAP_ANONYMOUS) || shmem_file(file)))
-		return VM_MTE_ALLOWED;
+	if (system_supports_mte()) {
+		if ((flags & MAP_ANONYMOUS) && !(flags & MAP_HUGETLB))
+			return VM_MTE_ALLOWED;
+		if (shmem_file(file))
+			return VM_MTE_ALLOWED;
+	}
 
 	return 0;
 }

arch/mips/include/asm/ptrace.h

@@ -155,6 +155,8 @@ static inline long regs_return_value(struct pt_regs *regs)
 }
 
 #define instruction_pointer(regs) ((regs)->cp0_epc)
+extern unsigned long exception_ip(struct pt_regs *regs);
+#define exception_ip(regs) exception_ip(regs)
 #define profile_pc(regs) instruction_pointer(regs)
 
 extern asmlinkage long syscall_trace_enter(struct pt_regs *regs);

arch/mips/kernel/ptrace.c

@@ -31,6 +31,7 @@
 #include <linux/seccomp.h>
 #include <linux/ftrace.h>
 
+#include <asm/branch.h>
 #include <asm/byteorder.h>
 #include <asm/cpu.h>
 #include <asm/cpu-info.h>
@@ -48,6 +49,12 @@
 #define CREATE_TRACE_POINTS
 #include <trace/events/syscalls.h>
 
+unsigned long exception_ip(struct pt_regs *regs)
+{
+	return exception_epc(regs);
+}
+EXPORT_SYMBOL(exception_ip);
+
 /*
  * Called by kernel/ptrace.c when detaching..
  *

arch/powerpc/include/asm/book3s/64/hash-4k.h

@@ -89,6 +89,34 @@ static inline int hash__hugepd_ok(hugepd_t hpd)
 }
 #endif
 
+/*
+ * With 4K page size the real_pte machinery is all nops.
+ */
+static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep, int offset)
+{
+	return (real_pte_t){pte};
+}
+
+#define __rpte_to_pte(r)	((r).pte)
+
+static inline unsigned long __rpte_to_hidx(real_pte_t rpte, unsigned long index)
+{
+	return pte_val(__rpte_to_pte(rpte)) >> H_PAGE_F_GIX_SHIFT;
+}
+
+#define pte_iterate_hashed_subpages(rpte, psize, va, index, shift)       \
+	do {							         \
+		index = 0;					         \
+		shift = mmu_psize_defs[psize].shift;		         \
+
+#define pte_iterate_hashed_end() } while(0)
+
+/*
+ * We expect this to be called only for user addresses or kernel virtual
+ * addresses other than the linear mapping.
+ */
+#define pte_pagesize_index(mm, addr, pte)	MMU_PAGE_4K
+
 /*
  * 4K PTE format is different from 64K PTE format. Saving the hash_slot is just
  * a matter of returning the PTE bits that need to be modified. On 64K PTE,