Merge tag 'v6.1.140' of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux into linux-ms

ft-wsl-6.1.y

This is the 6.1.140 stable release

* tag 'v6.1.140' of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux:
  Linux 6.1.140
  x86/modules: Set VM_FLUSH_RESET_PERMS in module_alloc()
  drm/amdgpu: fix pm notifier handling
  spi: cadence-qspi: fix pointer reference in runtime PM hooks
  ipv4: Fix uninit-value access in __ip_make_skb()
  ipv6: Fix potential uninit-value access in __ip6_make_skb()
  bnxt_en: Fix receive ring space parameters when XDP is active
  platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it
  arm64/sme: Always exit sme_alloc() early with existing storage
  netfilter: nf_tables: do not defer rule destruction via call_rcu
  netfilter: nf_tables: wait for rcu grace period on net_device removal
  netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx
  btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()
  sctp: add mutual exclusion in proc_sctp_do_udp_port()
  hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
  LoongArch: Explicitly specify code model in Makefile
  bpf, arm64: Fix address emission with tag-based KASAN enabled
  bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
  riscv: mm: Fix the out of bound issue of vmemmap address
  mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index
  selftests/mm: compaction_test: support platform with huge mount of memory
  usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control()
  usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
  usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group
  usb: typec: ucsi: displayport: Fix deadlock
  dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe
  dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
  dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call
  dmaengine: idxd: Add missing cleanups in cleanup internals
  dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals
  dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups
  dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines
  dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs
  dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy
  dmaengine: ti: k3-udma: Add missing locking
  net: qede: Initialize qede_ll_ops with designated initializer
  wifi: mt76: disable napi on driver removal
  smb: client: fix memory leak during error handling for POSIX mkdir
  scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer
  phy: renesas: rcar-gen3-usb2: Set timing registers only once
  phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind
  phy: Fix error handling in tegra_xusb_port_init
  tracing: samples: Initialize trace_array_printk() with the correct function
  ftrace: Fix preemption accounting for stacktrace filter command
  ftrace: Fix preemption accounting for stacktrace trigger command
  Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer()
  Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges
  hv_netvsc: Remove rmsg_pgcnt
  hv_netvsc: Preserve contiguous PFN grouping in the page buffer array
  hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages
  dma-buf: insert memory barrier before updating num_fences
  ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera
  ALSA: usb-audio: Add sample rate quirk for Audioengine D1
  ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
  ACPI: PPTT: Fix processor subtable walk
  drm/amd/display: Avoid flooding unnecessary info messages
  drm/amd/display: Correct the reply value when AUX write incomplete
  btrfs: fix discard worker infinite loop after disabling discard
  LoongArch: Fix MAX_REG_OFFSET calculation
  dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"
  NFSv4/pnfs: Reset the layout state after a layoutreturn
  net/tls: fix kernel panic when alloc_page failed
  octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy
  regulator: max20086: fix invalid memory access
  qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
  net/mlx5e: Disable MACsec offload for uplink representor profile
  ALSA: sh: SND_AICA should depend on SH_DMA_API
  nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable
  nvme-pci: make nvme_pci_npages_prp() __always_inline
  net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING
  net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
  net: mctp: Ensure keys maintain only one ref to corresponding dev
  net_sched: Flush gso_skb list too during ->change()
  spi: loopback-test: Do not split 1024-byte hexdumps
  nfs: handle failure of nfs_get_lock_context in unlock path
  HID: uclogic: Add NULL check in uclogic_input_configured()
  HID: thrustmaster: fix memory leak in thrustmaster_interrupts()
  RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()
  iio: chemical: sps30: use aligned_s64 for timestamp
  iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
  Revert "drm/amd: Stop evicting resources on APUs in suspend"
  drm/amd: Add Suspend/Hibernate notification callback support
  drm/amdgpu: trigger flr_work if reading pf2vf data failed
  drm/amdgpu: Fix the runtime resume failure issue
  drm/amd: Stop evicting resources on APUs in suspend
  iio: adc: ad7266: Fix potential timestamp alignment issue.
  tpm: tis: Double the timeout B to 4s
  tracing: probes: Fix a possible race in trace_probe_log APIs
  platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
  binfmt_elf: Move brk for static PIE even if ASLR disabled
  binfmt_elf: Honor PT_LOAD alignment for static PIE
  binfmt_elf: Calculate total_size earlier
  selftests/exec: Build both static and non-static load_address tests
  binfmt_elf: Leave a gap between .bss and brk
  selftests/exec: load_address: conform test to TAP format output
  binfmt_elf: elf_bss no longer used by load_elf_binary()
  binfmt_elf: Support segments with 0 filesz and misaligned starts
  binfmt: Fix whitespace issues

Author: inferno0230

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 1
-SUBLEVEL = 139
+SUBLEVEL = 140
 EXTRAVERSION =
 NAME = Curry Ramen
 

arch/arm64/kernel/fpsimd.c

@@ -1259,8 +1259,10 @@ void fpsimd_release_task(struct task_struct *dead_task)
  */
 void sme_alloc(struct task_struct *task, bool flush)
 {
-	if (task->thread.za_state && flush) {
-		memset(task->thread.za_state, 0, za_state_size(task));
+	if (task->thread.za_state) {
+		if (flush)
+			memset(task->thread.za_state, 0,
+			       za_state_size(task));
 		return;
 	}
 

arch/arm64/net/bpf_jit_comp.c

@@ -1942,7 +1942,11 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,
 	emit(A64_STR64I(A64_R(20), A64_SP, regs_off + 8), ctx);
 
 	if (flags & BPF_TRAMP_F_CALL_ORIG) {
-		emit_addr_mov_i64(A64_R(0), (const u64)im, ctx);
+		/* for the first pass, assume the worst case */
+		if (!ctx->image)
+			ctx->idx += 4;
+		else
+			emit_a64_mov_i64(A64_R(0), (const u64)im, ctx);
 		emit_call((const u64)__bpf_tramp_enter, ctx);
 	}
 
@@ -1986,7 +1990,11 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,
 
 	if (flags & BPF_TRAMP_F_CALL_ORIG) {
 		im->ip_epilogue = ctx->image + ctx->idx;
-		emit_addr_mov_i64(A64_R(0), (const u64)im, ctx);
+		/* for the first pass, assume the worst case */
+		if (!ctx->image)
+			ctx->idx += 4;
+		else
+			emit_a64_mov_i64(A64_R(0), (const u64)im, ctx);
 		emit_call((const u64)__bpf_tramp_exit, ctx);
 	}
 

arch/loongarch/Makefile

@@ -38,7 +38,7 @@ endif
 
 ifdef CONFIG_64BIT
 ld-emul			= $(64bit-emul)
-cflags-y		+= -mabi=lp64s
+cflags-y		+= -mabi=lp64s -mcmodel=normal
 endif
 
 cflags-y			+= -pipe -msoft-float

arch/loongarch/include/asm/ptrace.h

@@ -54,7 +54,7 @@ static inline void instruction_pointer_set(struct pt_regs *regs, unsigned long v
 
 /* Query offset/name of register from its name/offset */
 extern int regs_query_register_offset(const char *name);
-#define MAX_REG_OFFSET (offsetof(struct pt_regs, __last))
+#define MAX_REG_OFFSET (offsetof(struct pt_regs, __last) - sizeof(unsigned long))
 
 /**
  * regs_get_register() - get register value from its offset

arch/riscv/include/asm/page.h

@@ -115,6 +115,7 @@ struct kernel_mapping {
 
 extern struct kernel_mapping kernel_map;
 extern phys_addr_t phys_ram_base;
+extern unsigned long vmemmap_start_pfn;
 
 #define is_kernel_mapping(x)	\
 	((x) >= kernel_map.virt_addr && (x) < (kernel_map.virt_addr + kernel_map.size))

arch/riscv/include/asm/pgtable.h

@@ -79,7 +79,7 @@
  * Define vmemmap for pfn_to_page & page_to_pfn calls. Needed if kernel
  * is configured with CONFIG_SPARSEMEM_VMEMMAP enabled.
  */
-#define vmemmap		((struct page *)VMEMMAP_START - (phys_ram_base >> PAGE_SHIFT))
+#define vmemmap		((struct page *)VMEMMAP_START - vmemmap_start_pfn)
 
 #define PCI_IO_SIZE      SZ_16M
 #define PCI_IO_END       VMEMMAP_START

arch/riscv/mm/init.c

@@ -22,6 +22,7 @@
 #include <linux/hugetlb.h>
 
 #include <asm/fixmap.h>
+#include <asm/sparsemem.h>
 #include <asm/tlbflush.h>
 #include <asm/sections.h>
 #include <asm/soc.h>
@@ -52,6 +53,13 @@ EXPORT_SYMBOL(pgtable_l5_enabled);
 phys_addr_t phys_ram_base __ro_after_init;
 EXPORT_SYMBOL(phys_ram_base);
 
+#ifdef CONFIG_SPARSEMEM_VMEMMAP
+#define VMEMMAP_ADDR_ALIGN	(1ULL << SECTION_SIZE_BITS)
+
+unsigned long vmemmap_start_pfn __ro_after_init;
+EXPORT_SYMBOL(vmemmap_start_pfn);
+#endif
+
 unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]
 							__page_aligned_bss;
 EXPORT_SYMBOL(empty_zero_page);
@@ -210,8 +218,12 @@ static void __init setup_bootmem(void)
 	memblock_reserve(vmlinux_start, vmlinux_end - vmlinux_start);
 
 	phys_ram_end = memblock_end_of_DRAM();
-	if (!IS_ENABLED(CONFIG_XIP_KERNEL))
+	if (!IS_ENABLED(CONFIG_XIP_KERNEL)) {
 		phys_ram_base = memblock_start_of_DRAM();
+#ifdef CONFIG_SPARSEMEM_VMEMMAP
+		vmemmap_start_pfn = round_down(phys_ram_base, VMEMMAP_ADDR_ALIGN) >> PAGE_SHIFT;
+#endif
+}
 	/*
 	 * Reserve physical address space that would be mapped to virtual
 	 * addresses greater than (void *)(-PAGE_SIZE) because:
@@ -946,6 +958,9 @@ asmlinkage void __init setup_vm(uintptr_t dtb_pa)
 	kernel_map.xiprom_sz = (uintptr_t)(&_exiprom) - (uintptr_t)(&_xiprom);
 
 	phys_ram_base = CONFIG_PHYS_RAM_BASE;
+#ifdef CONFIG_SPARSEMEM_VMEMMAP
+	vmemmap_start_pfn = round_down(phys_ram_base, VMEMMAP_ADDR_ALIGN) >> PAGE_SHIFT;
+#endif
 	kernel_map.phys_addr = (uintptr_t)CONFIG_PHYS_RAM_BASE;
 	kernel_map.size = (uintptr_t)(&_end) - (uintptr_t)(&_start);
 

arch/x86/kernel/ftrace.c

@@ -415,8 +415,6 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
 	/* ALLOC_TRAMP flags lets us know we created it */
 	ops->flags |= FTRACE_OPS_FL_ALLOC_TRAMP;
 
-	set_vm_flush_reset_perms(trampoline);
-
 	if (likely(system_state != SYSTEM_BOOTING))
 		set_memory_ro((unsigned long)trampoline, npages);
 	set_memory_x((unsigned long)trampoline, npages);

arch/x86/kernel/kprobes/core.c

@@ -427,7 +427,6 @@ void *alloc_insn_page(void)
 	if (!page)
 		return NULL;
 
-	set_vm_flush_reset_perms(page);
 	/*
 	 * First make the page read-only, and only then make it executable to
 	 * prevent it from being W+X in between.