Merge tag 'v6.1.127' of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux into linux-msft-wsl-6.1.y

This is the 6.1.127 stable release

* tag 'v6.1.127' of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux:
  Linux 6.1.127
  net: fix data-races around sk->sk_forward_alloc
  x86/xen: fix SLS mitigation in xen_hypercall_iret()
  nfsd: add list_head nf_gc to struct nfsd_file
  erofs: handle NONHEAD !delta[1] lclusters gracefully
  erofs: tidy up EROFS on-disk naming
  wifi: ath10k: avoid NULL pointer error during sdio remove
  Revert "regmap: detach regmap from dev on regmap_exit"
  scsi: sg: Fix slab-use-after-free read in sg_release()
  RDMA/rxe: Fix the qp flush warnings in req
  Revert "drm/amdgpu: rework resume handling for display (v2)"
  block: fix uaf for flush rq while iterating tags
  drm/amdgpu: fix usage slab after free
  drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
  iio: adc: rockchip_saradc: fix information leak in triggered buffer
  iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
  iio: imu: inv_icm42600: fix spi burst write not supported
  Revert "PCI: Use preserve_config in place of pci_flags"
  drm/i915/fb: Relax clear color alignment to 64 bytes
  hrtimers: Handle CPU state correctly on hotplug
  irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()
  irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
  irqchip: Plug a OF node reference leak in platform_irqchip_probe()
  pmdomain: imx8mp-blk-ctrl: add missing loop break condition
  gpiolib: cdev: Fix use after free in lineinfo_changed_notify
  fs/proc: fix softlockup in __read_vmcore (part 2)
  filemap: avoid truncating 64-bit offset to 32 bits
  vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
  vsock: reset socket state when de-assigning the transport
  vsock/virtio: cancel close work in the destructor
  vsock/virtio: discard packets if the transport changes
  net: ethernet: xgbe: re-add aneg to supported features in PHY quirks
  selftests: mptcp: avoid spurious errors on disconnect
  mptcp: be sure to send ack when mptcp-level window re-opens
  zram: fix potential UAF of zram table
  ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA
  x86/asm: Make serialize() always_inline
  poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll()
  iomap: avoid avoid truncating 64-bit offset to 32 bits
  ACPI: resource: acpi_dev_irq_override(): Check DMI match last
  selftests: tc-testing: reduce rshift value
  scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers
  cachefiles: Parse the "secctx" immediately
  kheaders: Ignore silly-rename files
  fs: fix missing declaration of init_files
  hfs: Sanity check the root record
  mac802154: check local interfaces before deleting sdata list
  nvmet: propagate npwg topology
  i2c: rcar: fix NACK handling when being a target
  i2c: mux: demux-pinctrl: check initial mux selection, too
  Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data"
  hwmon: (tmp513) Fix division of negative numbers
  drm/v3d: Ensure job pointer is set to NULL after job completion
  net/mlx5: Clear port select structure when fail to create
  net/mlx5: Fix RDMA TX steering prio
  net: xilinx: axienet: Fix IRQ coalescing packet count overflow
  nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
  gtp: Destroy device along with udp socket's netns dismantle.
  gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
  gtp: use exit_batch_rtnl() method
  net: add exit_batch_rtnl() method
  pktgen: Avoid out-of-bounds access in get_imix_entries
  openvswitch: fix lockup on tx to unregistering netdev with carrier
  bpf: Fix bpf_sk_select_reuseport() memory leak
  net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
  Linux 6.1.126
  Partial revert of xhci: use pm_ptr() instead #ifdef for CONFIG_PM conditionals

Author: inferno0230

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 1
-SUBLEVEL = 125
+SUBLEVEL = 127
 EXTRAVERSION =
 NAME = Curry Ramen
 

arch/x86/include/asm/special_insns.h

@@ -225,7 +225,7 @@ static inline void clwb(volatile void *__p)
 
 #define nop() asm volatile ("nop")
 
-static inline void serialize(void)
+static __always_inline void serialize(void)
 {
 	/* Instruction opcode for SERIALIZE; supported in binutils >= 2.35. */
 	asm volatile(".byte 0xf, 0x1, 0xe8" ::: "memory");

arch/x86/xen/xen-asm.S

@@ -221,7 +221,7 @@ SYM_CODE_END(xen_early_idt_handler_array)
 	push %rax
 	mov  $__HYPERVISOR_iret, %eax
 	syscall		/* Do the IRET. */
-#ifdef CONFIG_MITIGATION_SLS
+#ifdef CONFIG_SLS
 	int3
 #endif
 .endm

block/blk-sysfs.c

@@ -858,10 +858,8 @@ int blk_register_queue(struct gendisk *disk)
 	 * faster to shut down and is made fully functional here as
 	 * request_queues for non-existent devices never get registered.
 	 */
-	if (!blk_queue_init_done(q)) {
-		blk_queue_flag_set(QUEUE_FLAG_INIT_DONE, q);
-		percpu_ref_switch_to_percpu(&q->q_usage_counter);
-	}
+	blk_queue_flag_set(QUEUE_FLAG_INIT_DONE, q);
+	percpu_ref_switch_to_percpu(&q->q_usage_counter);
 
 	return ret;
 

block/genhd.c

@@ -685,13 +685,10 @@ void del_gendisk(struct gendisk *disk)
 	 * If the disk does not own the queue, allow using passthrough requests
 	 * again.  Else leave the queue frozen to fail all I/O.
 	 */
-	if (!test_bit(GD_OWNS_QUEUE, &disk->state)) {
-		blk_queue_flag_clear(QUEUE_FLAG_INIT_DONE, q);
+	if (!test_bit(GD_OWNS_QUEUE, &disk->state))
 		__blk_mq_unfreeze_queue(q, true);
-	} else {
-		if (queue_is_mq(q))
-			blk_mq_exit_queue(q);
-	}
+	else if (queue_is_mq(q))
+		blk_mq_exit_queue(q);
 }
 EXPORT_SYMBOL(del_gendisk);
 

drivers/acpi/resource.c

@@ -663,11 +663,11 @@ static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity,
 	for (i = 0; i < ARRAY_SIZE(override_table); i++) {
 		const struct irq_override_cmp *entry = &override_table[i];
 
-		if (dmi_check_system(entry->system) &&
-		    entry->irq == gsi &&
+		if (entry->irq == gsi &&
 		    entry->triggering == triggering &&
 		    entry->polarity == polarity &&
-		    entry->shareable == shareable)
+		    entry->shareable == shareable &&
+		    dmi_check_system(entry->system))
 			return entry->override;
 	}
 

drivers/base/regmap/regmap.c

@@ -652,17 +652,6 @@ int regmap_attach_dev(struct device *dev, struct regmap *map,
 }
 EXPORT_SYMBOL_GPL(regmap_attach_dev);
 
-static int dev_get_regmap_match(struct device *dev, void *res, void *data);
-
-static int regmap_detach_dev(struct device *dev, struct regmap *map)
-{
-	if (!dev)
-		return 0;
-
-	return devres_release(dev, dev_get_regmap_release,
-			      dev_get_regmap_match, (void *)map->name);
-}
-
 static enum regmap_endian regmap_get_reg_endian(const struct regmap_bus *bus,
 					const struct regmap_config *config)
 {
@@ -1513,7 +1502,6 @@ int regmap_reinit_cache(struct regmap *map, const struct regmap_config *config)
 {
 	int ret;
 
-	regmap_detach_dev(map->dev, map);
 	regcache_exit(map);
 	regmap_debugfs_exit(map);
 

drivers/block/zram/zram_drv.c

@@ -1192,6 +1192,7 @@ static bool zram_meta_alloc(struct zram *zram, u64 disksize)
 	zram->mem_pool = zs_create_pool(zram->disk->disk_name);
 	if (!zram->mem_pool) {
 		vfree(zram->table);
+		zram->table = NULL;
 		return false;
 	}
 

drivers/gpio/gpiolib-cdev.c

@@ -2860,9 +2860,9 @@ static int gpio_chrdev_release(struct inode *inode, struct file *file)
 	struct gpio_chardev_data *cdev = file->private_data;
 	struct gpio_device *gdev = cdev->gdev;
 
-	bitmap_free(cdev->watched_lines);
 	blocking_notifier_chain_unregister(&gdev->notifier,
 					   &cdev->lineinfo_changed_nb);
+	bitmap_free(cdev->watched_lines);
 	put_device(&gdev->dev);
 	kfree(cdev);
 

drivers/gpu/drm/amd/amdgpu/amdgpu_device.c

@@ -3242,7 +3242,7 @@ static int amdgpu_device_ip_resume_phase1(struct amdgpu_device *adev)
  *
  * @adev: amdgpu_device pointer
  *
- * Second resume function for hardware IPs.  The list of all the hardware
+ * First resume function for hardware IPs.  The list of all the hardware
  * IPs that make up the asic is walked and the resume callbacks are run for
  * all blocks except COMMON, GMC, and IH.  resume puts the hardware into a
  * functional state after a suspend and updates the software state as
@@ -3260,7 +3260,6 @@ static int amdgpu_device_ip_resume_phase2(struct amdgpu_device *adev)
 		if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_COMMON ||
 		    adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GMC ||
 		    adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_IH ||
-		    adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_DCE ||
 		    adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_PSP)
 			continue;
 		r = adev->ip_blocks[i].version->funcs->resume(adev);
@@ -3284,36 +3283,6 @@ static int amdgpu_device_ip_resume_phase2(struct amdgpu_device *adev)
 	return 0;
 }
 
-/**
- * amdgpu_device_ip_resume_phase3 - run resume for hardware IPs
- *
- * @adev: amdgpu_device pointer
- *
- * Third resume function for hardware IPs.  The list of all the hardware
- * IPs that make up the asic is walked and the resume callbacks are run for
- * all DCE.  resume puts the hardware into a functional state after a suspend
- * and updates the software state as necessary.  This function is also used
- * for restoring the GPU after a GPU reset.
- *
- * Returns 0 on success, negative error code on failure.
- */
-static int amdgpu_device_ip_resume_phase3(struct amdgpu_device *adev)
-{
-	int i, r;
-
-	for (i = 0; i < adev->num_ip_blocks; i++) {
-		if (!adev->ip_blocks[i].status.valid || adev->ip_blocks[i].status.hw)
-			continue;
-		if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_DCE) {
-			r = adev->ip_blocks[i].version->funcs->resume(adev);
-			if (r)
-				return r;
-		}
-	}
-
-	return 0;
-}
-
 /**
  * amdgpu_device_ip_resume - run resume for hardware IPs
  *
@@ -3344,13 +3313,6 @@ static int amdgpu_device_ip_resume(struct amdgpu_device *adev)
 
 	r = amdgpu_device_ip_resume_phase2(adev);
 
-	if (r)
-		return r;
-
-	amdgpu_fence_driver_hw_init(adev);
-
-	r = amdgpu_device_ip_resume_phase3(adev);
-
 	return r;
 }
 
@@ -4131,8 +4093,8 @@ void amdgpu_device_fini_sw(struct amdgpu_device *adev)
 	int idx;
 	bool px;
 
-	amdgpu_fence_driver_sw_fini(adev);
 	amdgpu_device_ip_fini(adev);
+	amdgpu_fence_driver_sw_fini(adev);
 	release_firmware(adev->firmware.gpu_info_fw);
 	adev->firmware.gpu_info_fw = NULL;
 	adev->accel_working = false;
@@ -4349,6 +4311,7 @@ int amdgpu_device_resume(struct drm_device *dev, bool fbcon)
 		dev_err(adev->dev, "amdgpu_device_ip_resume failed (%d).\n", r);
 		return r;
 	}
+	amdgpu_fence_driver_hw_init(adev);
 
 	r = amdgpu_device_ip_late_init(adev);
 	if (r)
@@ -5102,10 +5065,6 @@ int amdgpu_do_asic_reset(struct list_head *device_list_handle,
 				if (r)
 					goto out;
 
-				r = amdgpu_device_ip_resume_phase3(tmp_adev);
-				if (r)
-					goto out;
-
 				if (vram_lost)
 					amdgpu_device_fill_reset_magic(tmp_adev);