Merge tag 'v6.1.146' into orange-pi-6.1-rk35xx

This is the 6.1.146 stable release

* tag 'v6.1.146' of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux:
  Linux 6.1.146
  rseq: Fix segfault on registration when rseq_cs is non-zero
  ksmbd: fix potential use-after-free in oplock/lease break ack
  kasan: remove kasan_find_vm_area() to prevent possible deadlock
  x86: Fix X86_FEATURE_VERW_CLEAR definition
  x86/mm: Disable hugetlb page table sharing on 32-bit
  vhost-scsi: protect vq->log_used with vq->mutex
  Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
  HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
  HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
  vt: add missing notification when switching back to text mode
  btrfs: fix assertion when building free space tree
  HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
  net: usb: qmi_wwan: add SIMCom 8230C composition
  ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
  ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
  um: vector: Reduce stack usage in vector_eth_configure()
  atm: idt77252: Add missing `dma_map_error()`
  bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
  bnxt_en: Fix DCB ETS validation
  net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
  can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
  net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
  ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
  net: appletalk: Fix device refcount leak in atrtr_create()
  netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
  erofs: fix to add missing tracepoint in erofs_read_folio()
  erofs: adapt folios for z_erofs_read_folio()
  erofs: avoid on-stack pagepool directly passed by arguments
  erofs: allocate extra bvec pages directly instead of retrying
  erofs: clean up z_erofs_pcluster_readmore()
  erofs: remove the member readahead from struct z_erofs_decompress_frontend
  nbd: fix uaf in nbd_genl_connect() error path
  raid10: cleanup memleak at raid10_make_request
  md/raid1: Fix stack memory use after return in raid1_reshape
  drm/tegra: nvdec: Fix dma_alloc_coherent error check
  wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
  usb: dwc3: Abort suspend on soft disconnect failure
  usb: cdnsp: Fix issue with CV Bad Descriptor test
  usb: cdnsp: Replace snprintf() with the safer scnprintf() variant
  usb:cdnsp: remove TRB_FLUSH_ENDPOINT command
  Input: xpad - support Acer NGR 200 Controller
  usb: xhci: quirk for data loss in ISOC transfers
  xhci: Allow RPM on the USB controller (1022:43f7) by default
  btrfs: propagate last_unlink_trans earlier when doing a rmdir
  fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
  netlink: make sure we allow at least one dump skb
  netlink: Fix rmem check in netlink_broadcast_deliver().
  ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
  smb: server: make use of rdma_destroy_qp()
  pwm: mediatek: Ensure to disable clocks in error path
  maple_tree: fix mt_destroy_walk() on root leaf node
  kallsyms: fix build without execinfo
  Revert "ACPI: battery: negate current when discharging"
  usb: gadget: u_serial: Fix race condition in TTY wakeup
  drm/gem: Fix race in drm_gem_handle_create_tail()
  drm/ttm: fix error handling in ttm_buffer_object_transfer
  drm/sched: Increment job count before swapping tail spsc queue
  wifi: prevent A-MSDU attacks in mesh networks
  pinctrl: qcom: msm: mark certain pins as invalid for interrupts
  md/md-bitmap: fix GPF in bitmap_get_stats()
  gre: Fix IPv6 multicast route creation.
  KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
  KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table.
  x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
  x86/mce: Don't remove sysfs if thresholding sysfs init fails
  x86/mce/amd: Fix threshold limit reset
  ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
  x86/boot: Compile boot code with -std=gnu11 too
  rxrpc: Fix oops due to non-existence of prealloc backlog struct
  maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
  net/sched: Abort __tc_modify_qdisc if parent class does not exist
  atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
  atm: clip: Fix infinite recursive call of clip_push().
  atm: clip: Fix memory leak of struct clip_vcc.
  atm: clip: Fix potential null-ptr-deref in to_atmarpd().
  net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
  net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
  vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
  vsock: Fix transport_* TOCTOU
  vsock: Fix transport_{g2h,h2g} TOCTOU
  tipc: Fix use-after-free in tipc_conn_close().
  netlink: Fix wraparounds of sk->sk_rmem_alloc.
  fix proc_sys_compare() handling of in-lookup dentries
  Bluetooth: hci_sync: Fix not disabling advertising instance
  perf: Revert to requiring CAP_SYS_ADMIN for uprobes
  ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode
  platform/x86: ideapad-laptop: use usleep_range() for EC polling
  drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling

Signed-off-by: Khusika Dhamar Gusti <[email protected]>

Conflicts:
	drivers/usb/host/xhci.h

Author: khusika

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 1
-SUBLEVEL = 145
+SUBLEVEL = 146
 EXTRAVERSION =
 NAME = Curry Ramen
 

arch/um/drivers/vector_kern.c

@@ -1600,35 +1600,19 @@ static void vector_eth_configure(
 
 	device->dev = dev;
 
-	*vp = ((struct vector_private)
-		{
-		.list			= LIST_HEAD_INIT(vp->list),
-		.dev			= dev,
-		.unit			= n,
-		.options		= get_transport_options(def),
-		.rx_irq			= 0,
-		.tx_irq			= 0,
-		.parsed			= def,
-		.max_packet		= get_mtu(def) + ETH_HEADER_OTHER,
-		/* TODO - we need to calculate headroom so that ip header
-		 * is 16 byte aligned all the time
-		 */
-		.headroom		= get_headroom(def),
-		.form_header		= NULL,
-		.verify_header		= NULL,
-		.header_rxbuffer	= NULL,
-		.header_txbuffer	= NULL,
-		.header_size		= 0,
-		.rx_header_size		= 0,
-		.rexmit_scheduled	= false,
-		.opened			= false,
-		.transport_data		= NULL,
-		.in_write_poll		= false,
-		.coalesce		= 2,
-		.req_size		= get_req_size(def),
-		.in_error		= false,
-		.bpf			= NULL
-	});
+	INIT_LIST_HEAD(&vp->list);
+	vp->dev		= dev;
+	vp->unit	= n;
+	vp->options	= get_transport_options(def);
+	vp->parsed	= def;
+	vp->max_packet	= get_mtu(def) + ETH_HEADER_OTHER;
+	/*
+	 * TODO - we need to calculate headroom so that ip header
+	 * is 16 byte aligned all the time
+	 */
+	vp->headroom	= get_headroom(def);
+	vp->coalesce	= 2;
+	vp->req_size	= get_req_size(def);
 
 	dev->features = dev->hw_features = (NETIF_F_SG | NETIF_F_FRAGLIST);
 	INIT_WORK(&vp->reset_tx, vector_reset_tx);

arch/x86/Kconfig

@@ -124,7 +124,7 @@ config X86
 	select ARCH_WANTS_DYNAMIC_TASK_STRUCT
 	select ARCH_WANTS_NO_INSTR
 	select ARCH_WANT_GENERAL_HUGETLB
-	select ARCH_WANT_HUGE_PMD_SHARE
+	select ARCH_WANT_HUGE_PMD_SHARE		if X86_64
 	select ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP	if X86_64
 	select ARCH_WANT_LD_ORPHAN_WARN
 	select ARCH_WANTS_THP_SWAP		if X86_64

arch/x86/Makefile

@@ -43,7 +43,7 @@ endif
 
 # How to compile the 16-bit code.  Note we always compile for -march=i386;
 # that way we can complain to the user if the CPU is insufficient.
-REALMODE_CFLAGS	:= -m16 -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \
+REALMODE_CFLAGS	:= -std=gnu11 -m16 -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \
 		   -Wall -Wstrict-prototypes -march=i386 -mregparm=3 \
 		   -fno-strict-aliasing -fomit-frame-pointer -fno-pic \
 		   -mno-mmx -mno-sse $(call cc-option,-fcf-protection=none)

arch/x86/include/asm/cpufeatures.h

@@ -429,8 +429,8 @@
 #define X86_FEATURE_V_TSC_AUX		(19*32+ 9) /* "" Virtual TSC_AUX */
 #define X86_FEATURE_SME_COHERENT	(19*32+10) /* "" AMD hardware-enforced cache coherency */
 
+#define X86_FEATURE_VERW_CLEAR		(20*32+ 5) /* "" The memory form of VERW mitigates TSA */
 #define X86_FEATURE_AUTOIBRS		(20*32+ 8) /* "" Automatic IBRS */
-#define X86_FEATURE_VERW_CLEAR		(20*32+ 10) /* "" The memory form of VERW mitigates TSA */
 #define X86_FEATURE_SBPB		(20*32+27) /* "" Selective Branch Prediction Barrier */
 #define X86_FEATURE_IBPB_BRTYPE		(20*32+28) /* "" MSR_PRED_CMD[IBPB] flushes all branch type predictions */
 #define X86_FEATURE_SRSO_NO		(20*32+29) /* "" CPU is not affected by SRSO */

arch/x86/kernel/cpu/mce/amd.c

@@ -333,7 +333,6 @@ static void smca_configure(unsigned int bank, unsigned int cpu)
 
 struct thresh_restart {
 	struct threshold_block	*b;
-	int			reset;
 	int			set_lvt_off;
 	int			lvt_off;
 	u16			old_limit;
@@ -428,13 +427,13 @@ static void threshold_restart_bank(void *_tr)
 
 	rdmsr(tr->b->address, lo, hi);
 
-	if (tr->b->threshold_limit < (hi & THRESHOLD_MAX))
-		tr->reset = 1;	/* limit cannot be lower than err count */
-
-	if (tr->reset) {		/* reset err count and overflow bit */
-		hi =
-		    (hi & ~(MASK_ERR_COUNT_HI | MASK_OVERFLOW_HI)) |
-		    (THRESHOLD_MAX - tr->b->threshold_limit);
+	/*
+	 * Reset error count and overflow bit.
+	 * This is done during init or after handling an interrupt.
+	 */
+	if (hi & MASK_OVERFLOW_HI || tr->set_lvt_off) {
+		hi &= ~(MASK_ERR_COUNT_HI | MASK_OVERFLOW_HI);
+		hi |= THRESHOLD_MAX - tr->b->threshold_limit;
 	} else if (tr->old_limit) {	/* change limit w/o reset */
 		int new_count = (hi & THRESHOLD_MAX) +
 		    (tr->old_limit - tr->b->threshold_limit);

arch/x86/kernel/cpu/mce/core.c

@@ -2707,15 +2707,9 @@ static int mce_cpu_dead(unsigned int cpu)
 static int mce_cpu_online(unsigned int cpu)
 {
 	struct timer_list *t = this_cpu_ptr(&mce_timer);
-	int ret;
 
 	mce_device_create(cpu);
-
-	ret = mce_threshold_create_device(cpu);
-	if (ret) {
-		mce_device_remove(cpu);
-		return ret;
-	}
+	mce_threshold_create_device(cpu);
 	mce_reenable_cpu();
 	mce_start_timer(t);
 	return 0;

arch/x86/kernel/cpu/mce/intel.c

@@ -500,6 +500,7 @@ void mce_intel_feature_init(struct cpuinfo_x86 *c)
 void mce_intel_feature_clear(struct cpuinfo_x86 *c)
 {
 	intel_clear_lmce();
+	cmci_clear();
 }
 
 bool intel_filter_mce(struct mce *m)

arch/x86/kvm/svm/sev.c

@@ -1755,6 +1755,10 @@ static int sev_check_source_vcpus(struct kvm *dst, struct kvm *src)
 	struct kvm_vcpu *src_vcpu;
 	unsigned long i;
 
+	if (src->created_vcpus != atomic_read(&src->online_vcpus) ||
+	    dst->created_vcpus != atomic_read(&dst->online_vcpus))
+		return -EBUSY;
+
 	if (!sev_es_guest(src))
 		return 0;
 

arch/x86/kvm/xen.c

@@ -1536,8 +1536,19 @@ int kvm_xen_setup_evtchn(struct kvm *kvm,
 {
 	struct kvm_vcpu *vcpu;
 
-	if (ue->u.xen_evtchn.port >= max_evtchn_port(kvm))
-		return -EINVAL;
+	/*
+	 * Don't check for the port being within range of max_evtchn_port().
+	 * Userspace can configure what ever targets it likes; events just won't
+	 * be delivered if/while the target is invalid, just like userspace can
+	 * configure MSIs which target non-existent APICs.
+	 *
+	 * This allow on Live Migration and Live Update, the IRQ routing table
+	 * can be restored *independently* of other things like creating vCPUs,
+	 * without imposing an ordering dependency on userspace.  In this
+	 * particular case, the problematic ordering would be with setting the
+	 * Xen 'long mode' flag, which changes max_evtchn_port() to allow 4096
+	 * instead of 1024 event channels.
+	 */
 
 	/* We only support 2 level event channels for now */
 	if (ue->u.xen_evtchn.priority != KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL)