Merge tag 'v6.1.125' into orange-pi-6.1-rk35xx

This is the 6.1.125 stable release

* tag 'v6.1.125' of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux:
  Linux 6.1.125
  xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals
  drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
  drm: bridge: adv7511: use dev_err_probe in probe function
  ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
  ocfs2: correct return value of ocfs2_local_free_info()
  of: address: Preserve the flags portion on 1:1 dma-ranges mapping
  of: address: Store number of bus flag cells rather than bool
  of: address: Remove duplicated functions
  of: address: Fix address translation when address-size is greater than 2
  of/address: Add support for 3 address cell bus
  of: unittest: Add bus address range parsing tests
  arm64: dts: rockchip: add hevc power domain clock to rk3328
  block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
  ARM: dts: imxrt1050: Fix clocks for mmc
  io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
  iio: adc: ad7124: Disable all channels at probe time
  iio: inkern: call iio_device_put() only on mapped devices
  iio: adc: at91: call input_free_device() on allocated iio_dev
  iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
  iio: gyro: fxas21002c: Fix missing data update in trigger handler
  iio: adc: ti-ads8688: fix information leak in triggered buffer
  iio: imu: kmx61: fix information leak in triggered buffer
  iio: light: vcnl4035: fix information leak in triggered buffer
  iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
  iio: pressure: zpa2326: fix information leak in triggered buffer
  usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
  usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints
  usb: fix reference leak in usb_new_device()
  USB: core: Disable LPM only for non-suspended ports
  USB: usblp: return error when setting unsupported protocol
  usb: dwc3-am62: Disable autosuspend during remove
  usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
  misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config
  misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
  topology: Keep the cpumask unchanged when printing cpumap
  usb: dwc3: gadget: fix writing NYET threshold
  USB: serial: cp210x: add Phoenix Contact UPS Device
  usb-storage: Add max sectors quirk for Nokia 208
  staging: iio: ad9832: Correct phase range check
  staging: iio: ad9834: Correct phase range check
  USB: serial: option: add Neoway N723-EA support
  USB: serial: option: add MeiG Smart SRM815
  bpf: Fix overloading of MEM_UNINIT's meaning
  bpf: Add MEM_WRITE attribute
  dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)
  drm/amd/display: increase MAX_SURFACES to the value supported by hw
  ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
  ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
  riscv: Fix sleeping in invalid context in die()
  thermal: of: fix OF node leak in of_thermal_zone_find()
  drm/amd/display: Add check for granularity in dml ceil/floor helpers
  sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
  sctp: sysctl: udp_port: avoid using current->nsproxy
  sctp: sysctl: auth_enable: avoid using current->nsproxy
  sctp: sysctl: rto_min/max: avoid using current->nsproxy
  sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
  dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY
  dm thin: make get_first_thin use rcu-safe list first function
  cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu
  ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
  afs: Fix the maximum cell name length
  ksmbd: fix a missing return value check bug
  drm/mediatek: Add return value check when reading DPCD
  drm/mediatek: Fix mode valid issue for dp
  drm/mediatek: Fix YCbCr422 color format issue for DP
  drm/mediatek: stop selecting foreign drivers
  net/mlx5: Fix variable not being completed when function returns
  sched: sch_cake: add bounds checks to host bulk flow fairness counts
  netfilter: conntrack: clamp maximum hashtable size to INT_MAX
  netfilter: nf_tables: imbalance in flowtable binding
  tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset
  Bluetooth: hci_sync: Fix not setting Random Address when required
  tls: Fix tls_sw_sendmsg error handling
  ice: fix incorrect PHY settings for 100 GB/s
  cxgb4: Avoid removal of uninserted tid
  bnxt_en: Fix possible memory leak when hwrm_req_replace fails
  net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
  tcp/dccp: allow a connection when sk_max_ack_backlog is zero
  tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
  net: 802: LLC+SNAP OID:PID lookup on start of skb data
  ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
  ASoC: mediatek: disable buffer pre-allocation
  scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
  exfat: fix the infinite loop in __exfat_free_cluster()
  exfat: fix the infinite loop in exfat_readdir()
  dm array: fix cursor index when skipping across block boundaries
  dm array: fix unreleased btree blocks on closing a faulty array cursor
  dm array: fix releasing a faulty array block twice in dm_array_cursor_end
  jbd2: flush filesystem device before updating tail sequence
  jbd2: increase IO priority for writing revoke records
  sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
  bpf, sockmap: Fix race between element replace and close()
  ceph: give up on paths longer than PATH_MAX

Signed-off-by: Khusika Dhamar Gusti <[email protected]>

Author: khusika

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 1
-SUBLEVEL = 124
+SUBLEVEL = 125
 EXTRAVERSION =
 NAME = Curry Ramen
 

arch/arm/boot/dts/imxrt1050.dtsi

@@ -87,7 +87,7 @@
 			reg = <0x402c0000 0x4000>;
 			interrupts = <110>;
 			clocks = <&clks IMXRT1050_CLK_IPG_PDOF>,
-				<&clks IMXRT1050_CLK_OSC>,
+				<&clks IMXRT1050_CLK_AHB_PODF>,
 				<&clks IMXRT1050_CLK_USDHC1>;
 			clock-names = "ipg", "ahb", "per";
 			bus-width = <4>;

arch/arm64/boot/dts/rockchip/rk3328.dtsi

@@ -524,6 +524,7 @@
 
 			power-domain@RK3328_PD_HEVC {
 				reg = <RK3328_PD_HEVC>;
+				clocks = <&cru SCLK_VENC_CORE>;
 				#power-domain-cells = <0>;
 			};
 			power-domain@RK3328_PD_VIDEO {

arch/riscv/kernel/traps.c

@@ -27,7 +27,7 @@
 
 int show_unhandled_signals = 1;
 
-static DEFINE_SPINLOCK(die_lock);
+static DEFINE_RAW_SPINLOCK(die_lock);
 
 void die(struct pt_regs *regs, const char *str)
 {
@@ -38,7 +38,7 @@ void die(struct pt_regs *regs, const char *str)
 
 	oops_enter();
 
-	spin_lock_irqsave(&die_lock, flags);
+	raw_spin_lock_irqsave(&die_lock, flags);
 	console_verbose();
 	bust_spinlocks(1);
 
@@ -55,7 +55,7 @@ void die(struct pt_regs *regs, const char *str)
 
 	bust_spinlocks(0);
 	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
-	spin_unlock_irqrestore(&die_lock, flags);
+	raw_spin_unlock_irqrestore(&die_lock, flags);
 	oops_exit();
 
 	if (in_interrupt())

block/bfq-iosched.c

@@ -6733,16 +6733,24 @@ static struct bfq_queue *bfq_waker_bfqq(struct bfq_queue *bfqq)
 		if (new_bfqq == waker_bfqq) {
 			/*
 			 * If waker_bfqq is in the merge chain, and current
-			 * is the only procress.
+			 * is the only process, waker_bfqq can be freed.
 			 */
 			if (bfqq_process_refs(waker_bfqq) == 1)
 				return NULL;
-			break;
+
+			return waker_bfqq;
 		}
 
 		new_bfqq = new_bfqq->new_bfqq;
 	}
 
+	/*
+	 * If waker_bfqq is not in the merge chain, and it's procress reference
+	 * is 0, waker_bfqq can be freed.
+	 */
+	if (bfqq_process_refs(waker_bfqq) == 0)
+		return NULL;
+
 	return waker_bfqq;
 }
 

drivers/acpi/resource.c

@@ -439,6 +439,13 @@ static const struct dmi_system_id asus_laptop[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
 		},
 	},
+	{
+		/* Asus Vivobook X1504VAP */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_BOARD_NAME, "X1504VAP"),
+		},
+	},
 	{
 		/* Asus Vivobook X1704VAP */
 		.matches = {
@@ -615,6 +622,17 @@ static const struct dmi_system_id lg_laptop[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"),
 		},
 	},
+	{
+		/*
+		 * TongFang GM5HG0A in case of the SKIKK Vanaheim relabel the
+		 * board-name is changed, so check OEM strings instead. Note
+		 * OEM string matches are always exact matches.
+		 * https://bugzilla.kernel.org/show_bug.cgi?id=219614
+		 */
+		.matches = {
+			DMI_EXACT_MATCH(DMI_OEM_STRING, "GM5HG0A"),
+		},
+	},
 	{ }
 };
 

drivers/base/topology.c

@@ -27,19 +27,35 @@ static ssize_t name##_read(struct file *file, struct kobject *kobj,		\
 			   loff_t off, size_t count)				\
 {										\
 	struct device *dev = kobj_to_dev(kobj);                                 \
+	cpumask_var_t mask;							\
+	ssize_t n;								\
 										\
-	return cpumap_print_bitmask_to_buf(buf, topology_##mask(dev->id),	\
-					   off, count);                         \
+	if (!alloc_cpumask_var(&mask, GFP_KERNEL))				\
+		return -ENOMEM;							\
+										\
+	cpumask_copy(mask, topology_##mask(dev->id));				\
+	n = cpumap_print_bitmask_to_buf(buf, mask, off, count);			\
+	free_cpumask_var(mask);							\
+										\
+	return n;								\
 }										\
 										\
 static ssize_t name##_list_read(struct file *file, struct kobject *kobj,	\
 				struct bin_attribute *attr, char *buf,		\
 				loff_t off, size_t count)			\
 {										\
 	struct device *dev = kobj_to_dev(kobj);					\
+	cpumask_var_t mask;							\
+	ssize_t n;								\
+										\
+	if (!alloc_cpumask_var(&mask, GFP_KERNEL))				\
+		return -ENOMEM;							\
+										\
+	cpumask_copy(mask, topology_##mask(dev->id));				\
+	n = cpumap_print_list_to_buf(buf, mask, off, count);			\
+	free_cpumask_var(mask);							\
 										\
-	return cpumap_print_list_to_buf(buf, topology_##mask(dev->id),		\
-					off, count);				\
+	return n;								\
 }
 
 define_id_show_func(physical_package_id, "%d");

drivers/cpuidle/cpuidle-riscv-sbi.c

@@ -540,12 +540,12 @@ static int sbi_cpuidle_probe(struct platform_device *pdev)
 	int cpu, ret;
 	struct cpuidle_driver *drv;
 	struct cpuidle_device *dev;
-	struct device_node *np, *pds_node;
+	struct device_node *pds_node;
 
 	/* Detect OSI support based on CPU DT nodes */
 	sbi_cpuidle_use_osi = true;
 	for_each_possible_cpu(cpu) {
-		np = of_cpu_device_node_get(cpu);
+		struct device_node *np __free(device_node) = of_cpu_device_node_get(cpu);
 		if (np &&
 		    of_find_property(np, "power-domains", NULL) &&
 		    of_find_property(np, "power-domain-names", NULL)) {

drivers/gpu/drm/amd/display/dc/dc.h

@@ -49,7 +49,7 @@ struct dmub_notification;
 
 #define DC_VER "3.2.207"
 
-#define MAX_SURFACES 3
+#define MAX_SURFACES 4
 #define MAX_PLANES 6
 #define MAX_STREAMS 6
 #define MAX_SINKS_PER_LINK 4

drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h

@@ -66,11 +66,15 @@ static inline double dml_max5(double a, double b, double c, double d, double e)
 
 static inline double dml_ceil(double a, double granularity)
 {
+	if (granularity == 0)
+		return 0;
 	return (double) dcn_bw_ceil2(a, granularity);
 }
 
 static inline double dml_floor(double a, double granularity)
 {
+	if (granularity == 0)
+		return 0;
 	return (double) dcn_bw_floor2(a, granularity);
 }
 
@@ -114,11 +118,15 @@ static inline double dml_ceil_2(double f)
 
 static inline double dml_ceil_ex(double x, double granularity)
 {
+	if (granularity == 0)
+		return 0;
 	return (double) dcn_bw_ceil2(x, granularity);
 }
 
 static inline double dml_floor_ex(double x, double granularity)
 {
+	if (granularity == 0)
+		return 0;
 	return (double) dcn_bw_floor2(x, granularity);
 }