Merge tag 'v6.1.134' of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux into HEAD

This is the 6.1.134 stable release

* tag 'v6.1.134' of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux:
  Linux 6.1.134
  tracing: Do not use PERF enums when perf is not defined
  NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up
  nfsd: put dl_stid if fail to queue dl_recall
  media: streamzap: fix race between device disconnection and urb callback
  jfs: add index corruption check to DT_GETPAGE()
  jfs: fix slab-out-of-bounds read in ea_get()
  ext4: fix OOB read when checking dotdot dir
  ext4: don't over-report free space or inodes in statvfs
  arm64: Don't call NULL in do_compat_alignment_fixup()
  tracing/osnoise: Fix possible recursive locking for cpus_read_lock()
  tracing: Fix synth event printk format for str fields
  tracing: Ensure module defining synth event cannot be unloaded while tracing
  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
  ksmbd: validate zero num_subauth before sub_auth is accessed
  ksmbd: fix session use-after-free in multichannel connection
  ksmbd: fix use-after-free in ksmbd_sessions_deregister()
  ksmbd: add bounds check for create lease context
  mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD
  mmc: sdhci-pxav3: set NEED_RSP_BUSY capability
  ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP
  acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
  x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
  x86/tsc: Always save/restore TSC sched_clock() on suspend/resume
  btrfs: handle errors from btrfs_dec_ref() properly
  kunit/overflow: Fix UB in overflow_allocation_test
  perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read
  perf/x86/intel: Apply static call for drain_pebs
  ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()
  platform/x86: ISST: Correct command storage data length
  LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC
  LoongArch: BPF: Fix off-by-one error in build_prologue()
  LoongArch: Increase ARCH_DMA_MINALIGN up to 16
  usbnet:fix NPE during rx_complete
  tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers
  tty: serial: fsl_lpuart: use UARTMODIR register bits for lpuart32 platform
  drm/amdgpu/gfx11: fix num_mec
  io_uring/filetable: ensure node switch is always done, if needed
  arcnet: Add NULL check in com20020pci_probe()
  ipv6: Do not consider link down nexthops in path selection
  ipv6: Start path selection from the first nexthop
  net: fix geneve_opt length integer overflow
  net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy
  ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS
  netfilter: nft_tunnel: fix geneve_opt type confusion addition
  tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu().
  vsock: avoid timeout during connect() if the socket is closing
  udp: Fix memory accounting leak.
  net: mvpp2: Prevent parser TCAM memory corruption
  net_sched: skbprio: Remove overly strict queue assertions
  netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
  netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only
  ASoC: imx-card: Add NULL check in imx_card_probe()
  ntb: intel: Fix using link status DB's
  ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
  riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra
  spufs: fix a leak in spufs_create_context()
  spufs: fix gang directory lifetimes
  spufs: fix a leak on spufs_new_file() failure
  hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}
  memory: omap-gpmc: drop no compatible check
  can: statistics: use atomic access in hot path
  ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx
  drm/amd: Keep display off while going into S4
  x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled
  locking/semaphore: Use wake_q to wake up processes outside lock critical section
  sched/deadline: Use online cpus for validating runtime
  ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA
  ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA
  HID: i2c-hid: improve i2c_hid_get_report error message
  platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet
  ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0
  ALSA: hda/realtek: Fix Asus Z13 2025 audio
  affs: don't write overlarge OFS data block size fields
  affs: generate OFS sequence numbers starting at 1
  wifi: brcmfmac: keep power during suspend if board requires it
  nvme-pci: skip CMB blocks incompatible with PCI P2P DMA
  nvme-pci: clean up CMBMSC when registering CMB fails
  nvme-tcp: fix possible UAF in nvme_tcp_poll
  wifi: iwlwifi: mvm: use the right version of the rate API
  wifi: iwlwifi: fw: allocate chained SG tables for dump
  rcu-tasks: Always inline rcu_irq_work_resched()
  context_tracking: Always inline ct_{nmi,irq}_{enter,exit}()
  sched/smt: Always inline sched_smt_active()
  octeontx2-af: Free NIX_AF_INT_VEC_GEN irq
  octeontx2-af: Fix mbox INTR handler when num VFs > 64
  ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid
  LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig
  ring-buffer: Fix bytes_dropped calculation issue
  net/mlx5e: SHAMPO, Make reserved size independent of page size
  ksmbd: fix multichannel connection failure
  ksmbd: use aead_request_free to match aead_request_alloc
  rndis_host: Flag RNDIS modems as WWAN devices
  rtnetlink: Allocate vfinfo size for VF GUIDs when supported
  exfat: fix the infinite loop in exfat_find_last_cluster()
  objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
  perf tools: annotate asm_pure_loop.S
  fs/procfs: fix the comment above proc_pid_wchan()
  staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES
  perf python: Check if there is space to copy all the event
  perf python: Don't keep a raw_data pointer to consumed ring buffer space
  perf python: Decrement the refcount of just created event on failure
  perf python: Fixup description of sample.id event member
  i3c: master: svc: Fix missing the IBI rules
  um: remove copy_from_kernel_nofault_allowed
  fuse: fix dax truncate/punch_hole fault path
  NFSv4: Don't trigger uneccessary scans for return-on-close delegations
  arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig
  ocfs2: validate l_tree_depth to avoid out-of-bounds access
  kexec: initialize ELF lowest address to ULONG_MAX
  perf units: Fix insufficient array space
  perf evlist: Add success path to evlist__create_syswide_maps
  iio: adc: ad7124: Fix comparison of channel configs
  fs/ntfs3: Fix a couple integer overflows on 32bit systems
  usb: xhci: correct debug message page size calculation
  iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails.
  iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio
  coresight-etm4x: add isb() before reading the TRCSTATR
  coresight: catu: Fix number of pages while using 64k pages
  soundwire: slave: fix an OF node reference leak in soundwire slave device
  isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
  clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock
  crypto: hisilicon/sec2 - fix for aead auth key length
  x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
  mfd: sm501: Switch to BIT() to mitigate integer overflows
  pinctrl: renesas: rzv2m: Fix missing of_node_put() call
  RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
  crypto: nx - Fix uninitialised hv_nxc on error
  power: supply: max77693: Fix wrong conversion of charge input threshold value
  x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
  clk: amlogic: g12a: fix mmc A peripheral clock
  selftests/bpf: Select NUMA_NO_NODE to create map
  clk: amlogic: gxbb: drop non existing 32k clock parent
  clk: amlogic: g12b: fix cluster A parent data
  pinctrl: tegra: Set SFIO mode to Mux Register
  IB/mad: Check available slots before posting receive WRs
  remoteproc: qcom_q6v5_mss: Handle platforms with one power domain
  RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
  RDMA/mlx5: Fix calculation of total invalidated pages
  RDMA/core: Don't expose hw_counters outside of init net namespace
  clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
  pinctrl: renesas: rzg2l: Fix missing of_node_put() call
  pinctrl: renesas: rza2: Fix missing of_node_put() call
  lib: 842: Improve error handling in sw842_compress()
  bpf: Use preempt_count() directly in bpf_send_signal_common()
  clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock
  clk: samsung: Fix UBSAN panic in samsung_clk_init()
  selftests/bpf: Fix string read in strncmp benchmark
  libbpf: Fix hypothetical STT_SECTION extern NULL deref case
  remoteproc: qcom_q6v5_pas: Make single-PD handling more robust
  of: property: Increase NR_FWNODE_REFERENCE_ARGS
  remoteproc: core: Clear table_sz when rproc_shutdown
  crypto: hisilicon/sec2 - fix for aead authsize alignment
  clk: amlogic: gxbb: drop incorrect flag on 32k clock
  fbdev: sm501fb: Add some geometry checks.
  mdacon: rework dependency list
  fbdev: au1100fb: Move a variable assignment behind a null pointer check
  PCI: pciehp: Don't enable HPIE when resuming in poll mode
  drm/amd/display: avoid NPD when ASIC does not support DMUB
  drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer()
  PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe
  PCI: Remove stray put_device() in pci_register_host_bridge()
  drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters()
  PCI: Avoid reset when disabled via sysfs
  PCI/portdrv: Only disable pciehp interrupts early when needed
  PCI: brcmstb: Fix potential premature regulator disabling
  PCI: brcmstb: Fix error path after a call to regulator_bulk_get()
  PCI: brcmstb: Use internal register to change link capability
  PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload
  drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host
  PCI/ASPM: Fix link state exit during switch upstream function removal
  drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
  drm/mediatek: mtk_hdmi: Unregister audio platform device on failure
  PCI: Use downstream bridges for distributing resources
  drm/vkms: Fix use after free and double free on init error
  drm: xlnx: zynqmp: Fix max dma segment size
  drm/bridge: it6505: fix HDCP V match check is not performed correctly
  drm/dp_mst: Fix drm RAD print
  drm/bridge: ti-sn65dsi86: Fix multiple instances
  ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible
  ALSA: hda/realtek: Always honor no_shutup_pins
  HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER
  ASoC: cs35l41: check the return value from spi_setup()
  media: platform: allgro-dvt: unregister v4l2_device on the error path
  media: verisilicon: HEVC: Initialize start_bit field
  x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures
  perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
  lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*()
  PM: sleep: Fix handling devices with direct_complete set on errors
  thermal: int340x: Add NULL check for adev
  EDAC/ie31200: Fix the error path order of ie31200_init()
  EDAC/ie31200: Fix the DIMM size mask for several SoCs
  EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
  selinux: Chain up tool resolving errors in install_policy.sh
  PM: sleep: Adjust check before setting power.must_resume
  lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock
  x86/sev: Add missing RIP_REL_REF() invocations during sme_enable()
  x86/platform: Only allow CONFIG_EISA for 32-bit
  x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
  x86/fpu: Fix guest FPU state buffer allocation size
  cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
  smack: dont compile ipv6 code unless ipv6 is configured
  cpufreq: scpi: compare kHz instead of Hz
  x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
  watch_queue: fix pipe accounting mismatch
  Linux 6.1.133
  ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6
  media: i2c: et8ek8: Don't strip remove function when driver is builtin
  usb: typec: ucsi: Fix NULL pointer access
  usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c
  serial: 8250_dma: terminate correct DMA in tx_dma_flush()
  memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
  net: usb: usbnet: restore usb%d name exception for local mac addresses
  net: usb: qmi_wwan: add Telit Cinterion FE990B composition
  net: usb: qmi_wwan: add Telit Cinterion FN990B composition
  tty: serial: 8250: Add Brainboxes XC devices
  tty: serial: 8250: Add some more device IDs
  counter: microchip-tcb-capture: Fix undefined counter channel state on probe
  counter: stm32-lptimer-cnt: fix error handling when enabling
  ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx
  netfilter: socket: Lookup orig tuple for IPv6 SNAT
  drm/amd/display: Check denominator crb_pipes before used
  ARM: Remove address checking for MMUless devices
  ARM: 9351/1: fault: Add "cut here" line for prefetch aborts
  ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed()
  atm: Fix NULL pointer dereference
  HID: hid-plantronics: Add mic mute mapping and generalize quirks
  ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names

Author: inferno0230

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 1
-SUBLEVEL = 132
+SUBLEVEL = 134
 EXTRAVERSION =
 NAME = Curry Ramen
 

arch/arm/boot/dts/imx6qdl-apalis.dtsi

@@ -101,6 +101,11 @@
 		};
 	};
 
+	poweroff {
+		compatible = "regulator-poweroff";
+		cpu-supply = <&vgen2_reg>;
+	};
+
 	reg_module_3v3: regulator-module-3v3 {
 		compatible = "regulator-fixed";
 		regulator-always-on;
@@ -220,10 +225,6 @@
 	status = "disabled";
 };
 
-&clks {
-	fsl,pmic-stby-poweroff;
-};
-
 /* Apalis SPI1 */
 &ecspi1 {
 	cs-gpios = <&gpio5 25 GPIO_ACTIVE_LOW>;
@@ -511,7 +512,6 @@
 
 	pmic: pmic@8 {
 		compatible = "fsl,pfuze100";
-		fsl,pmic-stby-poweroff;
 		reg = <0x08>;
 
 		regulators {

arch/arm/mm/fault.c

@@ -27,6 +27,13 @@
 
 #ifdef CONFIG_MMU
 
+bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size)
+{
+	unsigned long addr = (unsigned long)unsafe_src;
+
+	return addr >= TASK_SIZE && ULONG_MAX - addr >= size;
+}
+
 /*
  * This is useful to dump out the page tables associated with
  * 'addr' in mm 'mm'.
@@ -552,6 +559,7 @@ do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs)
 	if (!inf->fn(addr, ifsr | FSR_LNX_PF, regs))
 		return;
 
+	pr_alert("8<--- cut here ---\n");
 	pr_alert("Unhandled prefetch abort: %s (0x%03x) at 0x%08lx\n",
 		inf->name, ifsr, addr);
 

arch/arm64/kernel/compat_alignment.c

@@ -368,6 +368,8 @@ int do_compat_alignment_fixup(unsigned long addr, struct pt_regs *regs)
 		return 1;
 	}
 
+	if (!handler)
+		return 1;
 	type = handler(addr, instr, regs);
 
 	if (type == TYPE_ERROR || type == TYPE_FAULT)

arch/loongarch/Kconfig

@@ -310,8 +310,8 @@ config CMDLINE_BOOTLOADER
 config CMDLINE_EXTEND
 	bool "Use built-in to extend bootloader kernel arguments"
 	help
-	  The command-line arguments provided during boot will be
-	  appended to the built-in command line. This is useful in
+	  The built-in command line will be appended to the command-
+	  line arguments provided during boot. This is useful in
 	  cases where the provided arguments are insufficient and
 	  you don't want to or cannot modify them.
 

arch/loongarch/include/asm/cache.h

@@ -8,6 +8,8 @@
 #define L1_CACHE_SHIFT		CONFIG_L1_CACHE_SHIFT
 #define L1_CACHE_BYTES		(1 << L1_CACHE_SHIFT)
 
+#define ARCH_DMA_MINALIGN	(16)
+
 #define __read_mostly __section(".data..read_mostly")
 
 #endif /* _ASM_CACHE_H */

arch/loongarch/net/bpf_jit.c

@@ -142,6 +142,8 @@ static void build_prologue(struct jit_ctx *ctx)
 	 */
 	if (seen_tail_call(ctx) && seen_call(ctx))
 		move_reg(ctx, TCC_SAVED, REG_TCC);
+	else
+		emit_insn(ctx, nop);
 
 	ctx->stack_size = stack_adjust;
 }
@@ -808,7 +810,10 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
 	{
 		const u64 imm64 = (u64)(insn + 1)->imm << 32 | (u32)insn->imm;
 
-		move_imm(ctx, dst, imm64, is32);
+		if (bpf_pseudo_func(insn))
+			move_addr(ctx, dst, imm64);
+		else
+			move_imm(ctx, dst, imm64, is32);
 		return 1;
 	}
 

arch/loongarch/net/bpf_jit.h

@@ -25,6 +25,11 @@ struct jit_data {
 	struct jit_ctx ctx;
 };
 
+static inline void emit_nop(union loongarch_instruction *insn)
+{
+	insn->word = INSN_NOP;
+}
+
 #define emit_insn(ctx, func, ...)						\
 do {										\
 	if (ctx->image != NULL) {						\

arch/powerpc/configs/mpc885_ads_defconfig

@@ -78,4 +78,4 @@ CONFIG_DEBUG_VM_PGTABLE=y
 CONFIG_DETECT_HUNG_TASK=y
 CONFIG_BDI_SWITCH=y
 CONFIG_PPC_EARLY_DEBUG=y
-CONFIG_GENERIC_PTDUMP=y
+CONFIG_PTDUMP_DEBUGFS=y

arch/powerpc/platforms/cell/spufs/gang.c

@@ -25,6 +25,7 @@ struct spu_gang *alloc_spu_gang(void)
 	mutex_init(&gang->aff_mutex);
 	INIT_LIST_HEAD(&gang->list);
 	INIT_LIST_HEAD(&gang->aff_list_head);
+	gang->alive = 1;
 
 out:
 	return gang;