Merge 6.1.120 into android14-6.1-lts

Changes in 6.1.120 ASoC: Intel: bytcr_rt5640: Add support for non ACPI instantiated codec ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet ASoC: Intel: sst: Support LPE0F28 ACPI HID wifi: iwlwifi: mvm: Use the sync timepoint API in suspend mac80211: fix user-power when emulating chanctx usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver selftests/watchdog-test: Fix system accidentally reset after watchdog-test ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13 x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB bpf: fix filed access without lock net: usb: qmi_wwan: add Quectel RG650V soc: qcom: Add check devm_kasprintf() returned value regulator: rk808: Add apply_bit for BUCK3 on RK809 platform/x86: dell-smbios-base: Extends support to Alienware products platform/x86: dell-wmi-base: Handle META key Lock/Unlock events tools/lib/thermal: Remove the thermal.h soft link when doing make clean can: j1939: fix error in J1939 documentation. platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect fan speed ASoC: amd: yc: Support dmic on another model of Lenovo Thinkpad E14 Gen 6 ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate() ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div() drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less strict proc/softirqs: replace seq_printf with seq_put_decimal_ull_width ASoC: audio-graph-card2: Purge absent supplies for device tree nodes LoongArch: Define a default value for VM_DATA_DEFAULT_FLAGS ALSA: usb-audio: Fix Yamaha P-125 Quirk Entry ARM: 9420/1: smp: Fix SMP for xip kernels ipmr: Fix access to mfc_cache_list without lock held closures: Change BUG_ON() to WARN_ON() net: fix crash when config small gso_max_size/gso_ipv4_max_size serial: sc16is7xx: fix invalid FIFO access with special register set cifs: Fix buffer overflow when parsing NFS reparse points fpga: bridge: add owner module and take its refcount fpga: manager: add owner module and take its refcount drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func drm/amd/display: Check null-initialized variables Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue Bluetooth: MGMT: Fix possible crash on mgmt_index_removed fbdev: efifb: Register sysfs groups through driver core mptcp: fix possible integer overflow in mptcp_reset_tout_timer wifi: rtw89: avoid to add interface to list twice when SER drm/amd/display: Initialize denominators' default to 1 fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name x86/barrier: Do not serialize MSR accesses on AMD kselftest/arm64: mte: fix printf type warnings about __u64 kselftest/arm64: mte: fix printf type warnings about longs s390/cio: Do not unregister the subchannel based on DNV brd: defer automatic disk creation until module initialization succeeds ext4: make 'abort' mount option handling standard ext4: avoid remount errors with 'abort' mount option mips: asm: fix warning when disabling MIPS_FP_SUPPORT initramfs: avoid filename buffer overrun nvme-pci: fix freeing of the HMB descriptor table m68k: mvme147: Fix SCSI controller IRQ numbers m68k: mvme16x: Add and use "mvme16x.h" m68k: mvme147: Reinstate early console arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block() cachefiles: Fix missing pos updates in cachefiles_ondemand_fd_write_iter() netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING block: fix bio_split_rw_at to take zone_write_granularity into account s390/syscalls: Avoid creation of arch/arch/ directory hfsplus: don't query the device logical block size multiple times nvme-pci: reverse request order in nvme_queue_rqs virtio_blk: reverse request order in virtio_queue_rqs crypto: caam - Fix the pointer passed to caam_qi_shutdown() firmware: google: Unregister driver_info on failure EDAC/bluefield: Fix potential integer overflow crypto: qat - remove faulty arbiter config reset thermal: core: Initialize thermal zones before registering them EDAC/fsl_ddr: Fix bad bit shift operations crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY crypto: cavium - Fix the if condition to exit loop after timeout crypto: hisilicon/qm - disable same error report before resetting EDAC/igen6: Avoid segmentation fault on module unload crypto: inside-secure - Fix the return value of safexcel_xcbcmac_cra_init() doc: rcu: update printed dynticks counter bits hwmon: (nct6775-core) Fix overflows seen when writing limit attributes ACPI: CPPC: Fix _CPC register setting issue crypto: caam - add error check to caam_rsa_set_priv_key_form crypto: bcm - add error check in the ahash_hmac_init function crypto: cavium - Fix an error handling path in cpt_ucode_load_fw() tools/lib/thermal: Make more generic the command encoding function thermal/lib: Fix memory leak on error in thermal_genl_auto() time: Fix references to _msecs_to_jiffies() handling of values seqlock/latch: Provide raw_read_seqcount_latch_retry() kcsan, seqlock: Support seqcount_latch_t kcsan, seqlock: Fix incorrect assumption in read_seqbegin() clocksource/drivers:sp804: Make user selectable clocksource/drivers/timer-ti-dm: Fix child node refcount handling spi: spi-fsl-lpspi: downgrade log level for pio mode spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq() drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend() microblaze: Export xmb_manager functions arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq() soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() mmc: mmc_spi: drop buggy snprintf() tpm: fix signed/unsigned bug when checking event logs arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4 arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4 arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline" cgroup/bpf: only cgroup v2 can be attached by bpf programs arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns arm64: dts: mt8183: cozmo: add i2c2's i2c-scl-internal-delay-ns arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle ARM: dts: cubieboard4: Fix DCDC5 regulator constraints pmdomain: ti-sci: Add missing of_node_put() for args.np spi: tegra210-quad: Avoid shift-out-of-bounds spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time regmap: irq: Set lockdep class for hierarchical IRQ domains arm64: dts: mt8183: jacuzzi: Move panel under aux-bus arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed regulators selftests/resctrl: Protect against array overrun during iMC config parsing firmware: arm_scpi: Check the DVFS OPP count returned by the firmware venus: venc: add handling for VIDIOC_ENCODER_CMD media: venus: provide ctx queue lock for ioctl synchronization media: atomisp: Add check for rgby_data memory allocation failure platform/x86: panasonic-laptop: Return errno correctly in show callback drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused drm/vc4: hvs: Don't write gamma luts on 2711 drm/vc4: hdmi: Avoid hang with debug registers when suspended drm/vc4: hvs: Fix dlist debug not resetting the next entry pointer drm/vc4: hvs: Remove incorrect limit from hvs_dlist debugfs function drm/vc4: hvs: Correct logic on stopping an HVS channel wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() drm/omap: Fix possible NULL dereference drm/omap: Fix locking in omap_gem_new_dmabuf() wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq() wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq() drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq() drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq() drm/v3d: Address race-condition in MMU flush wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1 wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2 dt-bindings: vendor-prefixes: Add NeoFidelity, Inc ASoC: fsl_micfil: fix regmap_write_bits usage ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode drm/bridge: anx7625: Drop EDID cache on bridge power off libbpf: Fix output .symtab byte-order during linking bpf: Fix the xdp_adjust_tail sample prog issue selftests/bpf: Add csum helpers selftests/bpf: Fix backtrace printing for selftests crashes selftests/bpf: add missing header include for htons libbpf: fix sym_is_subprog() logic for weak global subprogs libbpf: never interpret subprogs in .text as entry programs netdevsim: copy addresses for both in and out paths drm/bridge: tc358767: Fix link properties discovery selftests/bpf: Fix msg_verify_data in test_sockmap selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() drm: fsl-dcu: enable PIXCLK on LS1021A octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c drm/panfrost: Remove unused id_mask from struct panfrost_model bpf, arm64: Remove garbage frame for struct_ops trampoline drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq() drm/msm/gpu: Add devfreq tuning debugfs drm/msm/gpu: Bypass PM QoS constraint for idle clamp drm/msm/gpu: Check the status of registration to PM QoS drm/etnaviv: Request pages from DMA32 zone on addressing_limited drm/etnaviv: fix power register offset on GC300 drm/etnaviv: hold GPU lock across perfmon sampling wifi: wfx: Fix error handling in wfx_core_init() drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk() netfilter: nf_tables: skip transaction if update object is not implemented netfilter: nf_tables: must hold rcu read lock while iterating object type list netlink: typographical error in nlmsg_type constants definition selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap selftests/bpf: Fix SENDPAGE data logic in test_sockmap selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap bpf, sockmap: Several fixes to bpf_msg_push_data bpf, sockmap: Several fixes to bpf_msg_pop_data bpf, sockmap: Fix sk_msg_reset_curr sock_diag: add module pointer to "struct sock_diag_handler" sock_diag: allow concurrent operations sock_diag: allow concurrent operation in sock_diag_rcv_msg() net: use unrcu_pointer() helper ipv6: release nexthop on device removal selftests: net: really check for bg process completion drm/amdkfd: Fix wrong usage of INIT_WORK() net: rfkill: gpio: Add check for clk_enable() ALSA: usx2y: Use snd_card_free_when_closed() at disconnection ALSA: us122l: Use snd_card_free_when_closed() at disconnection ALSA: caiaq: Use snd_card_free_when_closed() at disconnection ALSA: 6fire: Release resources at card release Bluetooth: fix use-after-free in device_for_each_child() netpoll: Use rcu_access_pointer() in netpoll_poll_lock wireguard: selftests: load nf_conntrack if not present bpf: fix recursive lock when verdict program return SK_PASS unicode: Fix utf8_load() error path trace/trace_event_perf: remove duplicate samples on the first tracepoint event pinctrl: zynqmp: drop excess struct member description powerpc/vdso: Flag VDSO64 entry points as functions mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race mfd: da9052-spi: Change read-mask to write-mask mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices cpufreq: loongson2: Unregister platform_driver on failure powerpc/fadump: Refactor and prepare fadump_cma_init for late init powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() memory: renesas-rpc-if: Improve Runtime PM handling memory: renesas-rpc-if: Pass device instead of rpcif to rpcif_*() memory: renesas-rpc-if: Remove Runtime PM wrappers mtd: hyperbus: rpc-if: Convert to platform remove callback returning void mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE mtd: rawnand: atmel: Fix possible memory leak powerpc/mm/fault: Fix kfence page fault reporting powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw() cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci RDMA/hns: Add clear_hem return value to log RDMA/hns: Use dev_* printings in hem code instead of ibdev_* RDMA/hns: Remove unnecessary QP type checks RDMA/hns: Fix cpu stuck caused by printings during reset RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey clk: sunxi-ng: d1: Fix PLL_AUDIO0 preset clk: renesas: rzg2l: Fix FOUTPOSTDIV clk clk: imx: lpcg-scu: SW workaround for errata (e10858) clk: imx: fracn-gppll: correct PLL initialization flow clk: imx: fracn-gppll: fix pll power up clk: imx: clk-scu: fix clk enable state save and restore iommu/vt-d: Fix checks and print in dmar_fault_dump_ptes() iommu/vt-d: Fix checks and print in pgtable_walk() mfd: rt5033: Fix missing regmap_del_irq_chip() fs/proc/kcore.c: fix coccinelle reported ERROR instances scsi: bfa: Fix use-after-free in bfad_im_module_exit() scsi: fusion: Remove unused variable 'rc' scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() RDMA/hns: Fix out-of-order issue of requester when setting FENCE RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost() cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power() ocfs2: fix uninitialized value in ocfs2_file_read_iter() dax: delete a stale directory pmem KVM: PPC: Book3S HV: Stop using vc->dpdes for nested KVM guests KVM: PPC: Book3S HV: Avoid returning to nested hypervisor on pending doorbells powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static powerpc/kexec: Fix return of uninitialized variable fbdev/sh7760fb: Alloc DMA memory from hardware device fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() clk: clk-apple-nco: Add NULL check in applnco_probe dt-bindings: clock: axi-clkgen: include AXI clk clk: clk-axi-clkgen: make sure to enable the AXI bus clock pinctrl: k210: Undef K210_PC_DEFAULT smb: cached directories can be more than root file handle mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb() perf cs-etm: Don't flush when packet_queue fills up PCI: Fix reset_method_store() memory leak perf stat: Close cork_fd when create_perf_stat_counter() failed perf stat: Fix affinity memory leaks on error path f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks f2fs: fix to account dirty data in __get_secs_required() perf probe: Fix libdw memory leak perf probe: Correct demangled symbols in C++ program PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads PCI: cpqphp: Fix PCIBIOS_* return value confusion perf ftrace latency: Fix unit on histogram first entry when using --use-nsec f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block f2fs: remove struct segment_allocation default_salloc_ops f2fs: open code allocate_segment_by_default f2fs: remove the unused flush argument to change_curseg f2fs: check curseg->inited before write_sum_page in change_curseg f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or GC_URGENT_MID f2fs: fix to avoid forcing direct write to use buffered IO on inline_data inode perf trace: avoid garbage when not printing a trace event's arguments m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x m68k: coldfire/device.c: only build FEC when HW macros are defined svcrdma: Address an integer overflow perf trace: Do not lose last events in a race perf trace: Avoid garbage when not printing a syscall's arguments remoteproc: qcom: q6v5: Use _clk_get_optional for aggre2_clk remoteproc: qcom: pas: add minidump_id to SM8350 resources rpmsg: glink: Fix GLINK command prefix rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region NFSD: Prevent NULL dereference in nfsd4_process_cb_update() NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() sunrpc: simplify two-level sysctl registration for svcrdma_parm_table svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() NFSD: Fix nfsd4_shutdown_copy() hwmon: (tps23861) Fix reporting of negative temperatures vdpa/mlx5: Fix suboptimal range on iotlb iteration selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels vfio/pci: Properly hide first-in-list PCIe extended capability fs_parser: update mount_api doc to match function signature LoongArch: Tweak CFLAGS for Clang compatibility LoongArch: Fix build failure with GCC 15 (-std=gnu23) LoongArch: BPF: Sign-extend return values power: supply: core: Remove might_sleep() from power_supply_put() power: supply: bq27xxx: Fix registers of bq27426 net: usb: lan78xx: Fix double free issue with interrupt buffer allocation net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged net: mdio-ipq4019: add missing error check marvell: pxa168_eth: fix call balance of pep->clk handling routines net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken octeontx2-af: RPM: Fix mismatch in lmac type spi: atmel-quadspi: Fix register name in verbose logging function net: hsr: fix hsr_init_sk() vs network/transport headers. bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync crypto: api - Add crypto_tfm_get crypto: api - Add crypto_clone_tfm llc: Improve setsockopt() handling of malformed user input rxrpc: Improve setsockopt() handling of malformed user input tcp: Fix use-after-free of nreq in reqsk_timer_handler(). ip6mr: fix tables suspicious RCU usage ipmr: fix tables suspicious RCU usage iio: light: al3010: Fix an error handling path in al3010_probe() usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read() usb: yurex: make waiting on yurex_write interruptible USB: chaoskey: fail open after removal USB: chaoskey: Fix possible deadlock chaoskey_list_lock misc: apds990x: Fix missing pm_runtime_disable() counter: stm32-timer-cnt: Add check for clk_enable() counter: ti-ecap-capture: Add check for clk_enable() ALSA: hda/realtek: Update ALC256 depop procedure apparmor: fix 'Do simple duplicate message elimination' ASoC: amd: yc: Fix for enabling DMIC on acp6x via _DSD entry mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable() fs/ntfs3: Fixed overflow check in mi_enum_attr() ntfs3: Add bounds checking to mi_enum_attr() scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths xfs: add bounds checking to xlog_recover_process_data xen: Fix the issue of resource not being properly released in xenbus_dev_probe() ALSA: usb-audio: Fix out of bounds reads when finding clock sources usb: ehci-spear: fix call balance of sehci clk handling routines media: aspeed: Fix memory overwrite if timing is 1600x900 wifi: iwlwifi: mvm: avoid NULL pointer dereference drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func drm/amd/display: Check phantom_stream before it is used rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb() btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations perf/x86/intel: Hide Topdown metrics events if the feature is not enumerated mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices Revert "arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled" arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled mm/slab: decouple ARCH_KMALLOC_MINALIGN from ARCH_DMA_MINALIGN powerpc: move the ARCH_DMA_MINALIGN definition to asm/cache.h dma: allow dma_get_cache_alignment() to be overridden by the arch code ASoC: Intel: sst: Fix used of uninitialized ctx to log an error soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() ext4: supress data-race warnings in ext4_free_inodes_{count,set}() ext4: fix FS_IOC_GETFSMAP handling jfs: xattr: check invalid xattr size more strictly ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00 ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata() perf/x86/intel/pt: Fix buffer full but size is 0 case crypto: x86/aegis128 - access 32-bit arguments as 32-bit KVM: x86/mmu: Skip the "try unsync" path iff the old SPTE was a leaf SPTE powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status PCI: Fix use-after-free of slot->bus on hot remove fsnotify: fix sending inotify event with unexpected filename comedi: Flush partial mappings in error case apparmor: test: Fix memory leak for aa_unpack_strdup() tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass() pinctrl: qcom: spmi: fix debugfs drive strength dt-bindings: iio: dac: ad3552r: fix maximum spi speed exfat: fix uninit-value in __exfat_get_dentry_set Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() usb: xhci: Fix TD invalidation under pending Set TR Dequeue driver core: bus: Fix double free in driver API bus_register() wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures wifi: brcmfmac: release 'root' node in all execution paths Revert "usb: gadget: composite: fix OS descriptors w_value logic" serial: sh-sci: Clean sci_ports[0] after at earlycon exit Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit" gpio: exar: set value when external pull-up or pull-down is present netfilter: ipset: add missing range check in bitmap_ip_uadt spi: Fix acpi deferred irq probe mtd: spi-nor: core: replace dummy buswidth from addr to data cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power() parisc/ftrace: Fix function graph tracing disablement platform/chrome: cros_ec_typec: fix missing fwnode reference decrement ubi: wl: Put source PEB into correct list if trying locking LEB failed um: ubd: Do not use drvdata in release um: net: Do not use drvdata in release dt-bindings: serial: rs485: Fix rs485-rts-delay property serial: 8250_fintek: Add support for F81216E serial: 8250: omap: Move pm_runtime_get_sync um: vector: Do not use drvdata in release sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK ublk: fix ublk_ch_mmap() for 64K page size arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled block: fix ordering between checking BLK_MQ_S_STOPPED request adding HID: wacom: Interpret tilt data from Intuos Pro BT as signed values media: wl128x: Fix atomicity violation in fmc_send_cmd() soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting() media: v4l2-core: v4l2-dv-timings: check cvt/gtf result ALSA: pcm: Add sanity NULL check for the default mmap fault handler ALSA: hda/realtek: Update ALC225 depop procedure ALSA: hda/realtek: Set PCBeep to default value for ALC274 ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max ALSA: hda/realtek: Apply quirk for Medion E15433 smb3: request handle caching when caching directories usb: musb: Fix hardware lockup on first Rx endpoint request usb: dwc3: gadget: Fix checking for number of TRBs left usb: dwc3: gadget: Fix looping of queued SG entries ublk: fix error code for unsupported command lib: string_helpers: silence snprintf() output truncation warning ipc: fix memleak if msg_init_ns failed in create_ipc_ns NFSD: Prevent a potential integer overflow SUNRPC: make sure cache entry active before cache_show um: Fix potential integer overflow during physmem setup um: Fix the return value of elf_core_copy_task_fpregs um: Always dump trace for specified task in show_stack NFSv4.0: Fix a use-after-free problem in the asynchronous open() rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq() rtc: abx80x: Fix WDT bit position of the status register rtc: check if __rtc_read_time was successful in rtc_timer_do_work() ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty ubifs: Correct the total block count by deducting journal reservation ubi: fastmap: Fix duplicate slab cache names while attaching ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit jffs2: fix use of uninitialized variable rtc: rzn1: fix BCD to rtc_time conversion errors block: return unsigned int from bdev_io_min 9p/xen: fix init sequence 9p/xen: fix release of IRQ perf/arm-smmuv3: Fix lockdep assert in ->event_init() perf/arm-cmn: Ensure port and device id bits are set properly rtc: ab-eoz9: don't fail temperature reads on undervoltage notification modpost: remove incorrect code in do_eisa_entry() nfs: ignore SB_RDONLY when mounting nfs sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport sh: intc: Fix use-after-free bug in register_intc_controller() xfs: remove unknown compat feature check in superblock write validation quota: flush quota_release_work upon quota writeback btrfs: don't loop for nowait writes when checking for cross references btrfs: add might_sleep() annotations btrfs: add a sanity check for btrfs root in btrfs_search_slot() btrfs: ref-verify: fix use-after-free after invalid ref action arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delay media: amphion: Set video drvdata before register video device media: imx-jpeg: Set video drvdata before register video device media: i2c: dw9768: Fix pm_runtime_set_suspended() with runtime pm enabled arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delay media: i2c: tc358743: Fix crash in the probe error path when using polling media: imx-jpeg: Ensure power suppliers be suspended before detach them media: ts2020: fix null-ptr-deref in ts2020_probe() media: platform: exynos4-is: Fix an OF node reference leak in fimc_md_is_isp_available media: amphion: Fix pm_runtime_set_suspended() with runtime pm enabled media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate() media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal() media: uvcvideo: Stop stream during unregister media: uvcvideo: Require entities to have a non-zero unique ID ovl: Filter invalid inodes with missing lookup function maple_tree: refine mas_store_root() on storing NULL ftrace: Fix regression with module command in stack_trace_filter vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables leds: lp55xx: Remove redundant test for invalid channel number clk: qcom: gcc-qcs404: fix initial rate of GPLL3 ad7780: fix division by zero in ad7780_write_raw() ARM: 9429/1: ioremap: Sync PGDs for VMALLOC shadow s390/entry: Mark IRQ entries to fix stack depot warnings ARM: 9430/1: entry: Do a dummy read from VMAP shadow ARM: 9431/1: mm: Pair atomic_set_release() with _read_acquire() ceph: extract entity name from device id util_macros.h: fix/rework find_closest() macros scsi: ufs: exynos: Fix hibern8 notify callbacks i3c: master: svc: Fix pm_runtime_set_suspended() with runtime pm enabled i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() PCI: keystone: Set mode as Root Complex for "ti,keystone-pcie" compatible PCI: keystone: Add link up check to ks_pcie_other_map_bus() fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful iov_iter_zero thermal: int3400: Fix reading of current_uuid for active policy ovl: properly handle large files in ovl_security_fileattr dm thin: Add missing destroy_work_on_stack() PCI: rockchip-ep: Fix address translation unit programming nfsd: make sure exp active before svc_export_show nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer powerpc: Fix stack protector Kconfig test for clang powerpc: Adjust adding stack protector flags to KBUILD_CLAGS for clang btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check drm/sti: avoid potential dereference of error pointers drm/etnaviv: flush shader L1 cache after user commandstream drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7 iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call watchdog: apple: Actually flush writes after requesting watchdog restart watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart() can: gs_usb: remove leading space from goto labels can: gs_usb: gs_usb_probe(): align block comment can: gs_usb: uniformly use "parent" as variable name for struct gs_usb can: gs_usb: add VID/PID for Xylanta SAINT3 product family can: gs_usb: add usb endpoint address detection at driver probe step can: c_can: c_can_handle_bus_err(): update statistics if skb allocation fails can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL can: hi311x: hi3110_can_ist(): fix potential use-after-free can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() netfilter: x_tables: fix LED ID check in led_tg_check() netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level ptp: convert remaining drivers to adjfine interface ptp: Add error handling for adjfine callback in ptp_clock_adjtime net/sched: tbf: correct backlog statistic for GSO packets net: hsr: avoid potential out-of-bound access in fill_frame_info() can: j1939: j1939_session_new(): fix skb reference counting net-timestamp: make sk_tskey more predictable in error path net/ipv6: release expired exception dst cached in socket dccp: Fix memory leak in dccp_feat_change_recv tipc: Fix use-after-free of kernel socket in cleanup_bearer(). net/smc: fix LGR and link use-after-free issue net/qed: allow old cards not supporting "num_images" to work ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5 ixgbe: downgrade logging of unsupported VF API version to debug igb: Fix potential invalid memory access in igb_init_module() net: sched: fix erspan_opt settings in cls_flower netfilter: ipset: Hold module reference while requesting a module netfilter: nft_set_hash: skip duplicated elements pending gc run ethtool: Fix wrong mod state in case of verbose and no_mask bitset geneve: do not assume mac header is set in geneve_xmit_skb() net/mlx5e: Remove workaround to avoid syndrome for internal port KVM: arm64: Change kvm_handle_mmio_return() return polarity KVM: arm64: Don't retire aborted MMIO instruction gpio: grgpio: use a helper variable to store the address of ofdev->dev gpio: grgpio: Add NULL check in grgpio_probe serial: amba-pl011: Use port lock wrappers serial: amba-pl011: Fix RX stall when DMA is used usb: dwc3: gadget: Rewrite endpoint allocation flow usb: dwc3: ep0: Don't reset resource alloc flag (including ep0) usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED powerpc/vdso: Skip objtool from running on VDSO files powerpc/vdso: Remove unused '-s' flag from ASFLAGS powerpc/vdso: Improve linker flags powerpc/vdso: Remove an unsupported flag from vgettimeofday-32.o with clang powerpc/vdso: Include CLANG_FLAGS explicitly in ldflags-y powerpc/vdso: Refactor CFLAGS for CVDSO build powerpc/vdso: Drop -mstack-protector-guard flags in 32-bit files with clang ntp: Remove invalid cast in time offset math driver core: fw_devlink: Improve logs for cycle detection driver core: Add FWLINK_FLAG_IGNORE to completely ignore a fwnode link driver core: fw_devlink: Stop trying to optimize cycle detection logic i3c: Make i3c_master_unregister() return void i3c: master: add enable(disable) hot join in sys entry i3c: master: svc: add hot join support i3c: master: fix kernel-doc check warning i3c: master: support to adjust first broadcast address speed i3c: master: svc: use slow speed for first broadcast address i3c: master: svc: Modify enabled_events bit 7:0 to act as IBI enable counter i3c: master: Replace hard code 2 with macro I3C_ADDR_SLOT_STATUS_BITS i3c: master: Extend address status bit to 4 and add I3C_ADDR_SLOT_EXT_DESIRED i3c: master: Fix dynamic address leak when 'assigned-address' is present PCI: endpoint: Use a separate lock for protecting epc->pci_epf list PCI: endpoint: Clear secondary (not primary) EPC in pci_epc_remove_epf() device property: Constify device child node APIs device property: Add cleanup.h based fwnode_handle_put() scope based cleanup. device property: Introduce device_for_each_child_node_scoped() leds: flash: mt6360: Fix device_for_each_child_node() refcounting in error paths drm/bridge: it6505: update usleep_range for RC circuit charge time drm/bridge: it6505: Fix inverted reset polarity xsk: always clear DMA mapping information when unmapping the pool bpftool: Remove asserts from JIT disassembler bpftool: fix potential NULL pointer dereferencing in prog_dump() drm/sti: Add __iomem for mixer_dbg_mxn's parameter tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg ALSA: usb-audio: Notify xrun for low-latency mode tools: Override makefile ARCH variable if defined, but empty spi: mpc52xx: Add cancel_work_sync before module remove scsi: scsi_debug: Fix hrtimer support for ndelay drm/v3d: Enable Performance Counters before clearing them ocfs2: free inode when ocfs2_get_init_inode() fails scatterlist: fix incorrect func name in kernel-doc iio: magnetometer: yas530: use signed integer type for clamp limits bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie bpf: Remove unnecessary kfree(im_node) in lpm_trie_update_elem bpf: Handle in-place update for full LPM trie correctly bpf: Fix exact match conditions in trie_get_next_key() mm: page_alloc: move mlocked flag clearance into free_pages_prepare() HID: wacom: fix when get product name maybe null pointer LoongArch: Add architecture specific huge_pte_clear() ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write watchdog: rti: of: honor timeout-sec property can: dev: can_set_termination(): allow sleeping GPIOs can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum DS80000789E 6. tracing: Fix cmp_entries_dup() to respect sort() comparison rules arm64: Ensure bits ASID[15:8] are masked out when the kernel uses 8-bit ASIDs arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL ALSA: usb-audio: add mixer mapping for Corsair HS80 ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook 430 G8 ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360 (NP730QFG) scsi: qla2xxx: Fix abort in bsg timeout scsi: qla2xxx: Fix NVMe and NPIV connect issue scsi: qla2xxx: Supported speed displayed incorrectly for VPorts scsi: qla2xxx: Fix use after free on unload scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt scsi: ufs: core: sysfs: Prevent div by zero scsi: ufs: core: Add missing post notify for power mode change nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again drm/dp_mst: Fix MST sideband message body length check drm/dp_mst: Verify request type in the corresponding down message reply drm/dp_mst: Fix resetting msg rx state after topology removal drm/amdgpu/hdp5.2: do a posting read when flushing HDP modpost: Add .irqentry.text to OTHER_SECTIONS bpf: fix OOB devmap writes when deleting elements dma-buf: fix dma_fence_array_signaled v4 dma-fence: Fix reference leak on fence merge failure path dma-fence: Use kernel's sort for merging fences xsk: fix OOB map writes when deleting elements regmap: detach regmap from dev on regmap_exit mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet mmc: core: Further prevent card detect during shutdown ocfs2: update seq_file index in ocfs2_dlm_seq_next lib: stackinit: hide never-taken branch from compiler iommu/arm-smmu: Defer probe of clients after smmu device bound epoll: annotate racy check s390/cpum_sf: Handle CPU hotplug remove during sampling btrfs: avoid unnecessary device path update for the same device btrfs: do not clear read-only when adding sprout device kselftest/arm64: Don't leak pipe fds in pac.exec_sign_all() kcsan: Turn report_filterlist_lock into a raw_spinlock perf/x86/amd: Warn only on new bits set media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108 mmc: core: Add SD card quirk for broken poweroff notification soc: imx8m: Probe the SoC driver as platform driver HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support drm/vc4: hdmi: Avoid log spam for audio start failure drm/vc4: hvs: Set AXI panic modes for the HVS drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK drm/bridge: it6505: Enable module autoloading drm/mcde: Enable module autoloading drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check() drm/display: Fix building with GCC 15 r8169: don't apply UDP padding quirk on RTL8126A samples/bpf: Fix a resource leak net: fec_mpc52xx_phy: Use %pa to format resource_size_t net: ethernet: fs_enet: Use %pa to format resource_size_t net/sched: cbs: Fix integer overflow in cbs_set_port_rate() af_packet: avoid erroring out after sock_init_data() in packet_create() Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() net: af_can: do not leave a dangling sk pointer in can_create() net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() net: inet: do not leave a dangling sk pointer in inet_create() net: inet6: do not leave a dangling sk pointer in inet6_create() wifi: ath5k: add PCI ID for SX76X wifi: ath5k: add PCI ID for Arcadyan devices drm/panel: simple: Add Microchip AC69T88A LVDS Display panel net: sfp: change quirks for Alcatel Lucent G-010S-P drm/sched: memset() 'job' in drm_sched_job_init() drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih drm/amdgpu: Dereference the ATCS ACPI buffer drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr dma-debug: fix a possible deadlock on radix_lock jfs: array-index-out-of-bounds fix in dtReadFirst jfs: fix shift-out-of-bounds in dbSplit jfs: fix array-index-out-of-bounds in jfs_readdir jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov ALSA: usb-audio: Make mic volume workarounds globally applicable drm/amdgpu: set the right AMDGPU sg segment limitation wifi: ipw2x00: libipw_rx_any(): fix bad alignment wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() dsa: qca8k: Use nested lock to avoid splat Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet ASoC: hdmi-codec: reorder channel allocation list rocker: fix link status detection in rocker_carrier_init() net/neighbor: clear error in case strict check is not set netpoll: Use rcu_access_pointer() in __netpoll_setup pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU tracing/ftrace: disable preemption in syscall probe tracing: Use atomic64_inc_return() in trace_clock_counter() tools/rtla: fix collision with glibc sched_attr/sched_set_attr scsi: hisi_sas: Add cond_resched() for no forced preemption model scsi: ufs: core: Make DMA mask configuration more flexible leds: class: Protect brightness_show() with led_cdev->led_access mutex scsi: st: Don't modify unknown block number in MTIOCGET scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset pinctrl: qcom-pmic-gpio: add support for PM8937 pinctrl: qcom: spmi-mpp: Add PM8937 compatible nvdimm: rectify the illogical code within nd_dax_probe() smb: client: memcpy() with surrounding object base address verification/dot2: Improve dot parser robustness f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode. i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request PCI: Detect and trust built-in Thunderbolt chips PCI: Add 'reset_subordinate' to reset hierarchy below bridge PCI: Add ACS quirk for Wangxun FF5xxx NICs i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock LoongArch: Fix sleeping in atomic context for PREEMPT_RT usb: chipidea: udc: handle USB Error Interrupt if IOC not set iio: light: ltr501: Add LTER0303 to the supported devices MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6 21M1CTO1WW powerpc/prom_init: Fixup missing powermac #size-cells misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle rtc: cmos: avoid taking rtc_lock for extended period of time serial: 8250_dw: Add Sophgo SG2044 quirk io_uring/tctx: work around xa_store() allocation error issue kasan: suppress recursive reports for HW_TAGS kasan: make report_lock a raw spinlock sched/core: Remove the unnecessary need_resched() check in nohz_csd_func() sched/fair: Check idle_cpu() before need_resched() to detect ilb CPU turning busy sched/core: Prevent wakeup of ksoftirqd during idle load balance btrfs: fix missing snapshot drew unlock when root is dead during swap activation tracing/eprobe: Fix to release eprobe when failed to add dyn_event Revert "unicode: Don't special case ignorable code points" vfio/mlx5: Align the page tracking max message size with the device capability udf: Fold udf_getblk() into udf_bread() KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE KVM: x86/mmu: Ensure that kvm_release_pfn_clean() takes exact pfn from kvm_faultin_pfn() jffs2: Prevent rtime decompress memory corruption jffs2: Fix rtime decompressor mm/damon/vaddr: fix issue in damon_va_evenly_split_region() io_uring: wake up optimisations xhci: dbc: Fix STALL transfer event handling mmc: mtk-sd: Fix error handle of probe function drm/amd/display: Check BIOS images before it is used ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume" Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()" gve: Fixes for napi_poll when budget is 0 arm64/sve: Discard stale CPU state when handling SVE traps arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint ASoC: Intel: avs: Fix return status of avs_pcm_hw_constraints_init() mm: call the security_mmap_file() LSM hook in remap_file_pages() bpf: Fix helper writes to read-only maps net: Move {l,t,d}stats allocation to core and convert veth & vrf bpf: Fix dev's rx stats for bpf_redirect_peer traffic veth: Use tstats per-CPU traffic counters drm/ttm: Make sure the mapped tt pages are decrypted when needed drm/ttm: Print the memory decryption status just once drm/amdgpu: rework resume handling for display (v2) usb: dwc3: ep0: Don't reset resource alloc flag serial: amba-pl011: fix build regression i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin i3c: master: svc: fix possible assignment of the same address to two devices PM / devfreq: Fix build issues with devfreq disabled drm/msm: DEVFREQ_GOV_SIMPLE_ONDEMAND is no longer needed fs/ntfs3: Sequential field availability check in mi_enum_attr() i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition Bluetooth: MGMT: Fix possible deadlocks Linux 6.1.120 Change-Id: I24f6ce90b8645d57a8983ba58ed74b0542e6c868 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2026-06-05 18:41:58 +09:00 · 2024-12-16 10:45:43 +00:00
parent 04df8ff9ab 52f863f820
commit 4cf1dd1184
42 changed files with 401 additions and 294 deletions
--- a/2
+++ b/2
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 1
-SUBLEVEL = 119
+SUBLEVEL = 120
 EXTRAVERSION =
 NAME = Curry Ramen

--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -1383,6 +1383,7 @@ static void sve_init_regs(void)
 		fpsimd_bind_task_to_cpu();
 	} else {
 		fpsimd_to_sve(current);
+		fpsimd_flush_task_state(current);
 	}
 }

--- a/arch/arm64/kernel/smccc-call.S
+++ b/arch/arm64/kernel/smccc-call.S
@@ -7,48 +7,19 @@

 #include <asm/asm-offsets.h>
 #include <asm/assembler.h>
-#include <asm/thread_info.h>
-
-/*
- * If we have SMCCC v1.3 and (as is likely) no SVE state in
- * the registers then set the SMCCC hint bit to say there's no
- * need to preserve it.  Do this by directly adjusting the SMCCC
- * function value which is already stored in x0 ready to be called.
- */
-SYM_FUNC_START(__arm_smccc_sve_check)
-
-	ldr_l	x16, smccc_has_sve_hint
-	cbz	x16, 2f
-
-	get_current_task x16
-	ldr	x16, [x16, #TSK_TI_FLAGS]
-	tbnz	x16, #TIF_FOREIGN_FPSTATE, 1f	// Any live FP state?
-	tbnz	x16, #TIF_SVE, 2f		// Does that state include SVE?
-
-1:	orr	x0, x0, ARM_SMCCC_1_3_SVE_HINT
-
-2:	ret
-SYM_FUNC_END(__arm_smccc_sve_check)
-EXPORT_SYMBOL(__arm_smccc_sve_check)

 	.macro SMCCC instr
-	stp     x29, x30, [sp, #-16]!
-	mov	x29, sp
-alternative_if ARM64_SVE
-	bl	__arm_smccc_sve_check
-alternative_else_nop_endif
 	\instr	#0
-	ldr	x4, [sp, #16]
+	ldr	x4, [sp]
 	stp	x0, x1, [x4, #ARM_SMCCC_RES_X0_OFFS]
 	stp	x2, x3, [x4, #ARM_SMCCC_RES_X2_OFFS]
-	ldr	x4, [sp, #24]
+	ldr	x4, [sp, #8]
 	cbz	x4, 1f /* no quirk structure */
 	ldr	x9, [x4, #ARM_SMCCC_QUIRK_ID_OFFS]
 	cmp	x9, #ARM_SMCCC_QUIRK_QCOM_A6
 	b.ne	1f
 	str	x6, [x4, ARM_SMCCC_QUIRK_STATE_OFFS]
-1:	ldp     x29, x30, [sp], #16
-	ret
+1:	ret
 	.endm

 /*
--- a/drivers/firmware/smccc/smccc.c
+++ b/drivers/firmware/smccc/smccc.c
@@ -16,7 +16,6 @@ static u32 smccc_version = ARM_SMCCC_VERSION_1_0;
 static enum arm_smccc_conduit smccc_conduit = SMCCC_CONDUIT_NONE;

 bool __ro_after_init smccc_trng_available = false;
-u64 __ro_after_init smccc_has_sve_hint = false;

 void __init arm_smccc_version_init(u32 version, enum arm_smccc_conduit conduit)
 {
@@ -24,9 +23,6 @@ void __init arm_smccc_version_init(u32 version, enum arm_smccc_conduit conduit)
 	smccc_conduit = conduit;

 	smccc_trng_available = smccc_probe_trng();
-	if (IS_ENABLED(CONFIG_ARM64_SVE) &&
-	    smccc_version >= ARM_SMCCC_VERSION_1_3)
-		smccc_has_sve_hint = true;
 }

 enum arm_smccc_conduit arm_smccc_1_1_get_conduit(void)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
@@ -419,7 +419,7 @@ static ssize_t amdgpu_debugfs_regs_pcie_write(struct file *f, const char __user
 	ssize_t result = 0;
 	int r;

-	if (size > 4096 || size & 0x3 || *pos & 0x3)
+	if (size & 0x3 || *pos & 0x3)
 		return -EINVAL;

 	r = pm_runtime_get_sync(adev_to_drm(adev)->dev);
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -3242,7 +3242,7 @@ static int amdgpu_device_ip_resume_phase1(struct amdgpu_device *adev)
 *
 * @adev: amdgpu_device pointer
 *
- * First resume function for hardware IPs.  The list of all the hardware
+ * Second resume function for hardware IPs.  The list of all the hardware
 * IPs that make up the asic is walked and the resume callbacks are run for
 * all blocks except COMMON, GMC, and IH.  resume puts the hardware into a
 * functional state after a suspend and updates the software state as
@@ -3260,6 +3260,7 @@ static int amdgpu_device_ip_resume_phase2(struct amdgpu_device *adev)
 		if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_COMMON ||
 		    adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GMC ||
 		    adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_IH ||
+		    adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_DCE ||
 		    adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_PSP)
 			continue;
 		r = adev->ip_blocks[i].version->funcs->resume(adev);
@@ -3283,6 +3284,36 @@ static int amdgpu_device_ip_resume_phase2(struct amdgpu_device *adev)
 	return 0;
 }

+/**
+ * amdgpu_device_ip_resume_phase3 - run resume for hardware IPs
+ *
+ * @adev: amdgpu_device pointer
+ *
+ * Third resume function for hardware IPs.  The list of all the hardware
+ * IPs that make up the asic is walked and the resume callbacks are run for
+ * all DCE.  resume puts the hardware into a functional state after a suspend
+ * and updates the software state as necessary.  This function is also used
+ * for restoring the GPU after a GPU reset.
+ *
+ * Returns 0 on success, negative error code on failure.
+ */
+static int amdgpu_device_ip_resume_phase3(struct amdgpu_device *adev)
+{
+	int i, r;
+
+	for (i = 0; i < adev->num_ip_blocks; i++) {
+		if (!adev->ip_blocks[i].status.valid || adev->ip_blocks[i].status.hw)
+			continue;
+		if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_DCE) {
+			r = adev->ip_blocks[i].version->funcs->resume(adev);
+			if (r)
+				return r;
+		}
+	}
+
+	return 0;
+}
+
 /**
 * amdgpu_device_ip_resume - run resume for hardware IPs
 *
@@ -3313,6 +3344,13 @@ static int amdgpu_device_ip_resume(struct amdgpu_device *adev)

 	r = amdgpu_device_ip_resume_phase2(adev);

+	if (r)
+		return r;
+
+	amdgpu_fence_driver_hw_init(adev);
+
+	r = amdgpu_device_ip_resume_phase3(adev);
+
 	return r;
 }

@@ -4311,7 +4349,6 @@ int amdgpu_device_resume(struct drm_device *dev, bool fbcon)
 		dev_err(adev->dev, "amdgpu_device_ip_resume failed (%d).\n", r);
 		return r;
 	}
-	amdgpu_fence_driver_hw_init(adev);

 	r = amdgpu_device_ip_late_init(adev);
 	if (r)
@@ -5065,6 +5102,10 @@ int amdgpu_do_asic_reset(struct list_head *device_list_handle,
 				if (r)
 					goto out;

+				r = amdgpu_device_ip_resume_phase3(tmp_adev);
+				if (r)
+					goto out;
+
 				if (vram_lost)
 					amdgpu_device_fill_reset_magic(tmp_adev);

--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c
+++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c
@@ -664,6 +664,9 @@ static enum bp_result get_ss_info_v3_1(

 	ss_table_header_include = GET_IMAGE(ATOM_ASIC_INTERNAL_SS_INFO_V3,
 		DATA_TABLES(ASIC_InternalSS_Info));
+	if (!ss_table_header_include)
+		return BP_RESULT_UNSUPPORTED;
+
 	table_size =
 		(le16_to_cpu(ss_table_header_include->sHeader.usStructureSize)
 				- sizeof(ATOM_COMMON_TABLE_HEADER))
@@ -1031,6 +1034,8 @@ static enum bp_result get_ss_info_from_internal_ss_info_tbl_V2_1(

 	header = GET_IMAGE(ATOM_ASIC_INTERNAL_SS_INFO_V2,
 		DATA_TABLES(ASIC_InternalSS_Info));
+	if (!header)
+		return result;

 	memset(info, 0, sizeof(struct spread_spectrum_info));

@@ -1104,6 +1109,8 @@ static enum bp_result get_ss_info_from_ss_info_table(
 	get_atom_data_table_revision(header, &revision);

 	tbl = GET_IMAGE(ATOM_SPREAD_SPECTRUM_INFO, DATA_TABLES(SS_Info));
+	if (!tbl)
+		return result;

 	if (1 != revision.major || 2 > revision.minor)
 		return result;
@@ -1631,6 +1638,8 @@ static uint32_t get_ss_entry_number_from_ss_info_tbl(

 	tbl = GET_IMAGE(ATOM_SPREAD_SPECTRUM_INFO,
 			DATA_TABLES(SS_Info));
+	if (!tbl)
+		return number;

 	if (1 != revision.major || 2 > revision.minor)
 		return number;
@@ -1711,6 +1720,8 @@ static uint32_t get_ss_entry_number_from_internal_ss_info_tbl_v2_1(

 	header_include = GET_IMAGE(ATOM_ASIC_INTERNAL_SS_INFO_V2,
 			DATA_TABLES(ASIC_InternalSS_Info));
+	if (!header_include)
+		return 0;

 	size = (le16_to_cpu(header_include->sHeader.usStructureSize)
 			- sizeof(ATOM_COMMON_TABLE_HEADER))
@@ -1748,6 +1759,9 @@ static uint32_t get_ss_entry_number_from_internal_ss_info_tbl_V3_1(

 	header_include = GET_IMAGE(ATOM_ASIC_INTERNAL_SS_INFO_V3,
 			DATA_TABLES(ASIC_InternalSS_Info));
+	if (!header_include)
+		return number;
+
 	size = (le16_to_cpu(header_include->sHeader.usStructureSize) -
 			sizeof(ATOM_COMMON_TABLE_HEADER)) /
 					sizeof(ATOM_ASIC_SS_ASSIGNMENT_V3);
--- a/drivers/gpu/drm/msm/Kconfig
+++ b/drivers/gpu/drm/msm/Kconfig
@@ -23,7 +23,6 @@ config DRM_MSM
 	select SHMEM
 	select TMPFS
 	select QCOM_SCM
-	select DEVFREQ_GOV_SIMPLE_ONDEMAND
 	select WANT_DEV_COREDUMP
 	select SND_SOC_HDMI_CODEC if SND_SOC
 	select SYNC_FILE
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -274,7 +274,13 @@ pgprot_t ttm_io_prot(struct ttm_buffer_object *bo, struct ttm_resource *res,
 	enum ttm_caching caching;

 	man = ttm_manager_type(bo->bdev, res->mem_type);
-	caching = man->use_tt ? bo->ttm->caching : res->bus.caching;
+	if (man->use_tt) {
+		caching = bo->ttm->caching;
+		if (bo->ttm->page_flags & TTM_TT_FLAG_DECRYPTED)
+			tmp = pgprot_decrypted(tmp);
+	} else  {
+		caching = res->bus.caching;
+	}

 	return ttm_prot_from_caching(caching, tmp);
 }
@@ -317,6 +323,8 @@ static int ttm_bo_kmap_ttm(struct ttm_buffer_object *bo,
 		.no_wait_gpu = false
 	};
 	struct ttm_tt *ttm = bo->ttm;
+	struct ttm_resource_manager *man =
+			ttm_manager_type(bo->bdev, bo->resource->mem_type);
 	pgprot_t prot;
 	int ret;

@@ -326,7 +334,8 @@ static int ttm_bo_kmap_ttm(struct ttm_buffer_object *bo,
 	if (ret)
 		return ret;

-	if (num_pages == 1 && ttm->caching == ttm_cached) {
+	if (num_pages == 1 && ttm->caching == ttm_cached &&
+	    !(man->use_tt && (ttm->page_flags & TTM_TT_FLAG_DECRYPTED))) {
 		/*
 		 * We're mapping a single page, and the desired
 		 * page protection is consistent with the bo.
--- a/drivers/gpu/drm/ttm/ttm_tt.c
+++ b/drivers/gpu/drm/ttm/ttm_tt.c
@@ -31,11 +31,13 @@

 #define pr_fmt(fmt) "[TTM] " fmt

+#include <linux/cc_platform.h>
 #include <linux/sched.h>
 #include <linux/shmem_fs.h>
 #include <linux/file.h>
 #include <linux/module.h>
 #include <drm/drm_cache.h>
+#include <drm/drm_device.h>
 #include <drm/ttm/ttm_bo_driver.h>

 #include "ttm_module.h"
@@ -59,6 +61,7 @@ static atomic_long_t ttm_dma32_pages_allocated;
 int ttm_tt_create(struct ttm_buffer_object *bo, bool zero_alloc)
 {
 	struct ttm_device *bdev = bo->bdev;
+	struct drm_device *ddev = bo->base.dev;
 	uint32_t page_flags = 0;

 	dma_resv_assert_held(bo->base.resv);
@@ -80,6 +83,15 @@ int ttm_tt_create(struct ttm_buffer_object *bo, bool zero_alloc)
 		pr_err("Illegal buffer object type\n");
 		return -EINVAL;
 	}
+	/*
+	 * When using dma_alloc_coherent with memory encryption the
+	 * mapped TT pages need to be decrypted or otherwise the drivers
+	 * will end up sending encrypted mem to the gpu.
+	 */
+	if (bdev->pool.use_dma_alloc && cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT)) {
+		page_flags |= TTM_TT_FLAG_DECRYPTED;
+		drm_info_once(ddev, "TT memory decryption enabled.");
+	}

 	bo->ttm = bdev->funcs->ttm_tt_create(bo, page_flags);
 	if (unlikely(bo->ttm == NULL))
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -1899,11 +1899,16 @@ int i3c_master_add_i3c_dev_locked(struct i3c_master_controller *master,
 			ibireq.max_payload_len = olddev->ibi->max_payload_len;
 			ibireq.num_slots = olddev->ibi->num_slots;

-			if (olddev->ibi->enabled) {
+			if (olddev->ibi->enabled)
 				enable_ibi = true;
-				i3c_dev_disable_ibi_locked(olddev);
-			}
-
+			/*
+			 * The olddev should not receive any commands on the
+			 * i3c bus as it does not exist and has been assigned
+			 * a new address. This will result in NACK or timeout.
+			 * So, update the olddev->ibi->enabled flag to false
+			 * to avoid DISEC with OldAddr.
+			 */
+			olddev->ibi->enabled = false;
 			i3c_dev_free_ibi_locked(olddev);
 		}
 		mutex_unlock(&olddev->ibi_lock);
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -944,12 +944,27 @@ static int svc_i3c_master_do_daa(struct i3c_master_controller *m)
 		goto rpm_out;
 	}

-	/* Register all devices who participated to the core */
-	for (i = 0; i < dev_nb; i++) {
-		ret = i3c_master_add_i3c_dev_locked(m, addrs[i]);
-		if (ret)
-			goto rpm_out;
-	}
+	/*
+	 * Register all devices who participated to the core
+	 *
+	 * If two devices (A and B) are detected in DAA and address 0xa is assigned to
+	 * device A and 0xb to device B, a failure in i3c_master_add_i3c_dev_locked()
+	 * for device A (addr: 0xa) could prevent device B (addr: 0xb) from being
+	 * registered on the bus. The I3C stack might still consider 0xb a free
+	 * address. If a subsequent Hotjoin occurs, 0xb might be assigned to Device A,
+	 * causing both devices A and B to use the same address 0xb, violating the I3C
+	 * specification.
+	 *
+	 * The return value for i3c_master_add_i3c_dev_locked() should not be checked
+	 * because subsequent steps will scan the entire I3C bus, independent of
+	 * whether i3c_master_add_i3c_dev_locked() returns success.
+	 *
+	 * If device A registration fails, there is still a chance to register device
+	 * B. i3c_master_add_i3c_dev_locked() can reset DAA if a failure occurs while
+	 * retrieving device information.
+	 */
+	for (i = 0; i < dev_nb; i++)
+		i3c_master_add_i3c_dev_locked(m, addrs[i]);

 	/* Configure IBI auto-rules */
 	ret = svc_i3c_update_ibirules(master);
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -2755,7 +2755,7 @@ static int msdc_drv_probe(struct platform_device *pdev)
 	ret = msdc_ungate_clock(host);
 	if (ret) {
 		dev_err(&pdev->dev, "Cannot ungate clocks!\n");
-		goto release_mem;
+		goto release_clk;
 	}
 	msdc_init_hw(host);

@@ -2765,14 +2765,14 @@ static int msdc_drv_probe(struct platform_device *pdev)
 					     GFP_KERNEL);
 		if (!host->cq_host) {
 			ret = -ENOMEM;
-			goto host_free;
+			goto release;
 		}
 		host->cq_host->caps |= CQHCI_TASK_DESC_SZ_128;
 		host->cq_host->mmio = host->base + 0x800;
 		host->cq_host->ops = &msdc_cmdq_ops;
 		ret = cqhci_init(host->cq_host, mmc, true);
 		if (ret)
-			goto host_free;
+			goto release;
 		mmc->max_segs = 128;
 		/* cqhci 16bit length */
 		/* 0 size, means 65536 so we don't have to -1 here */
@@ -2797,9 +2797,10 @@ static int msdc_drv_probe(struct platform_device *pdev)
 end:
 	pm_runtime_disable(host->dev);
 release:
-	platform_set_drvdata(pdev, NULL);
 	msdc_deinit_hw(host);
+release_clk:
 	msdc_gate_clock(host);
+	platform_set_drvdata(pdev, NULL);
 release_mem:
 	if (host->dma.gpd)
 		dma_free_coherent(&pdev->dev,
--- a/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -202,6 +202,10 @@ static int gve_napi_poll(struct napi_struct *napi, int budget)

 	if (block->tx)
 		reschedule |= gve_tx_poll(block, budget);
+
+	if (!budget)
+		return 0;
+
 	if (block->rx) {
 		work_done = gve_rx_poll(block, budget);
 		reschedule |= work_done == budget;
@@ -242,6 +246,9 @@ static int gve_napi_poll_dqo(struct napi_struct *napi, int budget)
 	if (block->tx)
 		reschedule |= gve_tx_poll_dqo(block, /*do_clean=*/true);

+	if (!budget)
+		return 0;
+
 	if (block->rx) {
 		work_done = gve_rx_poll_dqo(block, budget);
 		reschedule |= work_done == budget;
--- a/drivers/net/ethernet/google/gve/gve_rx.c
+++ b/drivers/net/ethernet/google/gve/gve_rx.c
@@ -778,10 +778,6 @@ int gve_rx_poll(struct gve_notify_block *block, int budget)

 	feat = block->napi.dev->features;

-	/* If budget is 0, do all the work */
-	if (budget == 0)
-		budget = INT_MAX;
-
 	if (budget > 0)
 		work_done = gve_clean_rx_done(rx, budget, feat);

--- a/drivers/net/ethernet/google/gve/gve_tx.c
+++ b/drivers/net/ethernet/google/gve/gve_tx.c
@@ -725,10 +725,6 @@ bool gve_tx_poll(struct gve_notify_block *block, int budget)
 	u32 nic_done;
 	u32 to_do;

-	/* If budget is 0, do all the work */
-	if (budget == 0)
-		budget = INT_MAX;
-
 	/* In TX path, it may try to clean completed pkts in order to xmit,
 	 * to avoid cleaning conflict, use spin_lock(), it yields better
 	 * concurrency between xmit/clean than netif's lock.
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -342,7 +342,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev)
 	skb_tx_timestamp(skb);
 	if (likely(veth_forward_skb(rcv, skb, rq, use_napi) == NET_RX_SUCCESS)) {
 		if (!use_napi)
-			dev_lstats_add(dev, length);
+			dev_sw_netstats_tx_add(dev, 1, length);
 	} else {
 drop:
 		atomic64_inc(&priv->dropped);
@@ -357,14 +357,6 @@ drop:
 	return ret;
 }

-static u64 veth_stats_tx(struct net_device *dev, u64 *packets, u64 *bytes)
-{
-	struct veth_priv *priv = netdev_priv(dev);
-
-	dev_lstats_read(dev, packets, bytes);
-	return atomic64_read(&priv->dropped);
-}
-
 static void veth_stats_rx(struct veth_stats *result, struct net_device *dev)
 {
 	struct veth_priv *priv = netdev_priv(dev);
@@ -402,24 +394,24 @@ static void veth_get_stats64(struct net_device *dev,
 	struct veth_priv *priv = netdev_priv(dev);
 	struct net_device *peer;
 	struct veth_stats rx;
-	u64 packets, bytes;

-	tot->tx_dropped = veth_stats_tx(dev, &packets, &bytes);
-	tot->tx_bytes = bytes;
-	tot->tx_packets = packets;
+	tot->tx_dropped = atomic64_read(&priv->dropped);
+	dev_fetch_sw_netstats(tot, dev->tstats);

 	veth_stats_rx(&rx, dev);
 	tot->tx_dropped += rx.xdp_tx_err;
 	tot->rx_dropped = rx.rx_drops + rx.peer_tq_xdp_xmit_err;
-	tot->rx_bytes = rx.xdp_bytes;
-	tot->rx_packets = rx.xdp_packets;
+	tot->rx_bytes += rx.xdp_bytes;
+	tot->rx_packets += rx.xdp_packets;

 	rcu_read_lock();
 	peer = rcu_dereference(priv->peer);
 	if (peer) {
-		veth_stats_tx(peer, &packets, &bytes);
-		tot->rx_bytes += bytes;
-		tot->rx_packets += packets;
+		struct rtnl_link_stats64 tot_peer = {};
+
+		dev_fetch_sw_netstats(&tot_peer, peer->tstats);
+		tot->rx_bytes += tot_peer.tx_bytes;
+		tot->rx_packets += tot_peer.tx_packets;

 		veth_stats_rx(&rx, peer);
 		tot->tx_dropped += rx.peer_tq_xdp_xmit_err;
@@ -1381,25 +1373,12 @@ static void veth_free_queues(struct net_device *dev)

 static int veth_dev_init(struct net_device *dev)
 {
-	int err;
-
-	dev->lstats = netdev_alloc_pcpu_stats(struct pcpu_lstats);
-	if (!dev->lstats)
-		return -ENOMEM;
-
-	err = veth_alloc_queues(dev);
-	if (err) {
-		free_percpu(dev->lstats);
-		return err;
-	}
-
-	return 0;
+	return veth_alloc_queues(dev);
 }

 static void veth_dev_free(struct net_device *dev)
 {
 	veth_free_queues(dev);
-	free_percpu(dev->lstats);
 }

 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -1625,6 +1604,7 @@ static void veth_setup(struct net_device *dev)
 			       NETIF_F_HW_VLAN_STAG_RX);
 	dev->needs_free_netdev = true;
 	dev->priv_destructor = veth_dev_free;
+	dev->pcpu_stat_type = NETDEV_PCPU_STAT_TSTATS;
 	dev->max_mtu = ETH_MAX_MTU;

 	dev->hw_features = VETH_FEATURES;
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -121,22 +121,12 @@ struct net_vrf {
 	int			ifindex;
 };

-struct pcpu_dstats {
-	u64			tx_pkts;
-	u64			tx_bytes;
-	u64			tx_drps;
-	u64			rx_pkts;
-	u64			rx_bytes;
-	u64			rx_drps;
-	struct u64_stats_sync	syncp;
-};
-
 static void vrf_rx_stats(struct net_device *dev, int len)
 {
 	struct pcpu_dstats *dstats = this_cpu_ptr(dev->dstats);

 	u64_stats_update_begin(&dstats->syncp);
-	dstats->rx_pkts++;
+	dstats->rx_packets++;
 	dstats->rx_bytes += len;
 	u64_stats_update_end(&dstats->syncp);
 }
@@ -161,10 +151,10 @@ static void vrf_get_stats64(struct net_device *dev,
 		do {
 			start = u64_stats_fetch_begin_irq(&dstats->syncp);
 			tbytes = dstats->tx_bytes;
-			tpkts = dstats->tx_pkts;
-			tdrops = dstats->tx_drps;
+			tpkts = dstats->tx_packets;
+			tdrops = dstats->tx_drops;
 			rbytes = dstats->rx_bytes;
-			rpkts = dstats->rx_pkts;
+			rpkts = dstats->rx_packets;
 		} while (u64_stats_fetch_retry_irq(&dstats->syncp, start));
 		stats->tx_bytes += tbytes;
 		stats->tx_packets += tpkts;
@@ -421,7 +411,7 @@ static int vrf_local_xmit(struct sk_buff *skb, struct net_device *dev,
 	if (likely(__netif_rx(skb) == NET_RX_SUCCESS))
 		vrf_rx_stats(dev, len);
 	else
-		this_cpu_inc(dev->dstats->rx_drps);
+		this_cpu_inc(dev->dstats->rx_drops);

 	return NETDEV_TX_OK;
 }
@@ -616,11 +606,11 @@ static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev)
 		struct pcpu_dstats *dstats = this_cpu_ptr(dev->dstats);

 		u64_stats_update_begin(&dstats->syncp);
-		dstats->tx_pkts++;
+		dstats->tx_packets++;
 		dstats->tx_bytes += len;
 		u64_stats_update_end(&dstats->syncp);
 	} else {
-		this_cpu_inc(dev->dstats->tx_drps);
+		this_cpu_inc(dev->dstats->tx_drops);
 	}

 	return ret;
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1837,10 +1837,12 @@ static void pl011_unthrottle_rx(struct uart_port *port)

 	pl011_write(uap->im, uap, REG_IMSC);

+#ifdef CONFIG_DMA_ENGINE
 	if (uap->using_rx_dma) {
 		uap->dmacr |= UART011_RXDMAE;
 		pl011_write(uap->dmacr, uap, REG_DMACR);
 	}
+#endif

 	uart_port_unlock_irqrestore(&uap->port, flags);
 }
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -224,7 +224,8 @@ void dwc3_ep0_stall_and_restart(struct dwc3 *dwc)

 	/* reinitialize physical ep1 */
 	dep = dwc->eps[1];
-	dep->flags = DWC3_EP_ENABLED;
+	dep->flags &= DWC3_EP_RESOURCE_ALLOCATED;
+	dep->flags |= DWC3_EP_ENABLED;

 	/* stall is always issued on EP0 */
 	dep = dwc->eps[0];
--- a/drivers/usb/host/xhci-dbgcap.c
+++ b/drivers/usb/host/xhci-dbgcap.c
@@ -158,16 +158,18 @@ static void xhci_dbc_giveback(struct dbc_request *req, int status)
 	spin_lock(&dbc->lock);
 }

-static void xhci_dbc_flush_single_request(struct dbc_request *req)
+static void trb_to_noop(union xhci_trb *trb)
 {
-	union xhci_trb	*trb = req->trb;
-
 	trb->generic.field[0]	= 0;
 	trb->generic.field[1]	= 0;
 	trb->generic.field[2]	= 0;
 	trb->generic.field[3]	&= cpu_to_le32(TRB_CYCLE);
 	trb->generic.field[3]	|= cpu_to_le32(TRB_TYPE(TRB_TR_NOOP));
+}

+static void xhci_dbc_flush_single_request(struct dbc_request *req)
+{
+	trb_to_noop(req->trb);
 	xhci_dbc_giveback(req, -ESHUTDOWN);
 }

@@ -637,7 +639,6 @@ static void xhci_dbc_stop(struct xhci_dbc *dbc)
 	case DS_DISABLED:
 		return;
 	case DS_CONFIGURED:
-	case DS_STALLED:
 		if (dbc->driver->disconnect)
 			dbc->driver->disconnect(dbc);
 		break;
@@ -657,6 +658,23 @@ static void xhci_dbc_stop(struct xhci_dbc *dbc)
 	}
 }

+static void
+handle_ep_halt_changes(struct xhci_dbc *dbc, struct dbc_ep *dep, bool halted)
+{
+	if (halted) {
+		dev_info(dbc->dev, "DbC Endpoint halted\n");
+		dep->halted = 1;
+
+	} else if (dep->halted) {
+		dev_info(dbc->dev, "DbC Endpoint halt cleared\n");
+		dep->halted = 0;
+
+		if (!list_empty(&dep->list_pending))
+			writel(DBC_DOOR_BELL_TARGET(dep->direction),
+			       &dbc->regs->doorbell);
+	}
+}
+
 static void
 dbc_handle_port_status(struct xhci_dbc *dbc, union xhci_trb *event)
 {
@@ -685,6 +703,7 @@ static void dbc_handle_xfer_event(struct xhci_dbc *dbc, union xhci_trb *event)
 	struct xhci_ring	*ring;
 	int			ep_id;
 	int			status;
+	struct xhci_ep_ctx	*ep_ctx;
 	u32			comp_code;
 	size_t			remain_length;
 	struct dbc_request	*req = NULL, *r;
@@ -694,8 +713,30 @@ static void dbc_handle_xfer_event(struct xhci_dbc *dbc, union xhci_trb *event)
 	ep_id		= TRB_TO_EP_ID(le32_to_cpu(event->generic.field[3]));
 	dep		= (ep_id == EPID_OUT) ?
 				get_out_ep(dbc) : get_in_ep(dbc);
+	ep_ctx		= (ep_id == EPID_OUT) ?
+				dbc_bulkout_ctx(dbc) : dbc_bulkin_ctx(dbc);
 	ring		= dep->ring;

+	/* Match the pending request: */
+	list_for_each_entry(r, &dep->list_pending, list_pending) {
+		if (r->trb_dma == event->trans_event.buffer) {
+			req = r;
+			break;
+		}
+		if (r->status == -COMP_STALL_ERROR) {
+			dev_warn(dbc->dev, "Give back stale stalled req\n");
+			ring->num_trbs_free++;
+			xhci_dbc_giveback(r, 0);
+		}
+	}
+
+	if (!req) {
+		dev_warn(dbc->dev, "no matched request\n");
+		return;
+	}
+
+	trace_xhci_dbc_handle_transfer(ring, &req->trb->generic);
+
 	switch (comp_code) {
 	case COMP_SUCCESS:
 		remain_length = 0;
@@ -706,31 +747,49 @@ static void dbc_handle_xfer_event(struct xhci_dbc *dbc, union xhci_trb *event)
 	case COMP_TRB_ERROR:
 	case COMP_BABBLE_DETECTED_ERROR:
 	case COMP_USB_TRANSACTION_ERROR:
-	case COMP_STALL_ERROR:
 		dev_warn(dbc->dev, "tx error %d detected\n", comp_code);
 		status = -comp_code;
 		break;
+	case COMP_STALL_ERROR:
+		dev_warn(dbc->dev, "Stall error at bulk TRB %llx, remaining %zu, ep deq %llx\n",
+			 event->trans_event.buffer, remain_length, ep_ctx->deq);
+		status = 0;
+		dep->halted = 1;
+
+		/*
+		 * xHC DbC may trigger a STALL bulk xfer event when host sends a
+		 * ClearFeature(ENDPOINT_HALT) request even if there wasn't an
+		 * active bulk transfer.
+		 *
+		 * Don't give back this transfer request as hardware will later
+		 * start processing TRBs starting from this 'STALLED' TRB,
+		 * causing TRBs and requests to be out of sync.
+		 *
+		 * If STALL event shows some bytes were transferred then assume
+		 * it's an actual transfer issue and give back the request.
+		 * In this case mark the TRB as No-Op to avoid hw from using the
+		 * TRB again.
+		 */
+
+		if ((ep_ctx->deq & ~TRB_CYCLE) == event->trans_event.buffer) {
+			dev_dbg(dbc->dev, "Ep stopped on Stalled TRB\n");
+			if (remain_length == req->length) {
+				dev_dbg(dbc->dev, "Spurious stall event, keep req\n");
+				req->status = -COMP_STALL_ERROR;
+				req->actual = 0;
+				return;
+			}
+			dev_dbg(dbc->dev, "Give back stalled req, but turn TRB to No-op\n");
+			trb_to_noop(req->trb);
+		}
+		break;
+
 	default:
 		dev_err(dbc->dev, "unknown tx error %d\n", comp_code);
 		status = -comp_code;
 		break;
 	}

-	/* Match the pending request: */
-	list_for_each_entry(r, &dep->list_pending, list_pending) {
-		if (r->trb_dma == event->trans_event.buffer) {
-			req = r;
-			break;
-		}
-	}
-
-	if (!req) {
-		dev_warn(dbc->dev, "no matched request\n");
-		return;
-	}
-
-	trace_xhci_dbc_handle_transfer(ring, &req->trb->generic);
-
 	ring->num_trbs_free++;
 	req->actual = req->length - remain_length;
 	xhci_dbc_giveback(req, status);
@@ -750,7 +809,6 @@ static void inc_evt_deq(struct xhci_ring *ring)
 static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc)
 {
 	dma_addr_t		deq;
-	struct dbc_ep		*dep;
 	union xhci_trb		*evt;
 	u32			ctrl, portsc;
 	bool			update_erdp = false;
@@ -802,43 +860,17 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc)
 			return EVT_DISC;
 		}

-		/* Handle endpoint stall event: */
+		/* Check and handle changes in endpoint halt status */
 		ctrl = readl(&dbc->regs->control);
-		if ((ctrl & DBC_CTRL_HALT_IN_TR) ||
-		    (ctrl & DBC_CTRL_HALT_OUT_TR)) {
-			dev_info(dbc->dev, "DbC Endpoint stall\n");
-			dbc->state = DS_STALLED;
-
-			if (ctrl & DBC_CTRL_HALT_IN_TR) {
-				dep = get_in_ep(dbc);
-				xhci_dbc_flush_endpoint_requests(dep);
-			}
-
-			if (ctrl & DBC_CTRL_HALT_OUT_TR) {
-				dep = get_out_ep(dbc);
-				xhci_dbc_flush_endpoint_requests(dep);
-			}
-
-			return EVT_DONE;
-		}
+		handle_ep_halt_changes(dbc, get_in_ep(dbc), ctrl & DBC_CTRL_HALT_IN_TR);
+		handle_ep_halt_changes(dbc, get_out_ep(dbc), ctrl & DBC_CTRL_HALT_OUT_TR);

 		/* Clear DbC run change bit: */
 		if (ctrl & DBC_CTRL_DBC_RUN_CHANGE) {
 			writel(ctrl, &dbc->regs->control);
 			ctrl = readl(&dbc->regs->control);
 		}
-
 		break;
-	case DS_STALLED:
-		ctrl = readl(&dbc->regs->control);
-		if (!(ctrl & DBC_CTRL_HALT_IN_TR) &&
-		    !(ctrl & DBC_CTRL_HALT_OUT_TR) &&
-		    (ctrl & DBC_CTRL_DBC_RUN)) {
-			dbc->state = DS_CONFIGURED;
-			break;
-		}
-
-		return EVT_DONE;
 	default:
 		dev_err(dbc->dev, "Unknown DbC state %d\n", dbc->state);
 		break;
@@ -941,9 +973,6 @@ static ssize_t dbc_show(struct device *dev,
 	case DS_CONFIGURED:
 		p = "configured";
 		break;
-	case DS_STALLED:
-		p = "stalled";
-		break;
 	default:
 		p = "unknown";
 	}
--- a/drivers/usb/host/xhci-dbgcap.h
+++ b/drivers/usb/host/xhci-dbgcap.h
@@ -81,7 +81,6 @@ enum dbc_state {
 	DS_ENABLED,
 	DS_CONNECTED,
 	DS_CONFIGURED,
-	DS_STALLED,
 };

 struct dbc_ep {
@@ -89,6 +88,7 @@ struct dbc_ep {
 	struct list_head		list_pending;
 	struct xhci_ring		*ring;
 	unsigned int			direction:1;
+	unsigned int			halted:1;
 };

 #define DBC_QUEUE_SIZE			16
--- a/fs/jffs2/compr_rtime.c
+++ b/fs/jffs2/compr_rtime.c
@@ -95,6 +95,9 @@ static int jffs2_rtime_decompress(unsigned char *data_in,

 		positions[value]=outpos;
 		if (repeat) {
+			if ((outpos + repeat) > destlen) {
+				return 1;
+			}
 			if (backoffs + repeat >= outpos) {
 				while(repeat) {
 					cpage_out[outpos++] = cpage_out[backoffs++];
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -231,6 +231,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
 	}

 	/* Can we use the first field (attr->type). */
+	/* NOTE: this code also checks attr->size availability. */
 	if (off + 8 > used) {
 		static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8);
 		return NULL;
@@ -251,10 +252,6 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
 		return NULL;

 	asize = le32_to_cpu(attr->size);
-	if (asize < SIZEOF_RESIDENT) {
-		/* Impossible 'cause we should not return such attribute. */
-		return NULL;
-	}

 	/* Check overflow and boundary. */
 	if (off + asize < off || off + asize > used)
@@ -285,6 +282,10 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
 	if (attr->non_res != 1)
 		return NULL;

+	/* Can we use memory including attr->nres.valid_size? */
+	if (asize < SIZEOF_NONRESIDENT)
+		return NULL;
+
 	t16 = le16_to_cpu(attr->nres.run_off);
 	if (t16 > asize)
 		return NULL;
@@ -311,7 +312,8 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)

 	if (!attr->nres.svcn && is_attr_ext(attr)) {
 		/* First segment of sparse/compressed attribute */
-		if (asize + 8 < SIZEOF_NONRESIDENT_EX)
+		/* Can we use memory including attr->nres.total_size? */
+		if (asize < SIZEOF_NONRESIDENT_EX)
 			return NULL;

 		tot_size = le64_to_cpu(attr->nres.total_size);
@@ -321,9 +323,6 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
 		if (tot_size > alloc_size)
 			return NULL;
 	} else {
-		if (asize + 8 < SIZEOF_NONRESIDENT)
-			return NULL;
-
 		if (attr->nres.c_unit)
 			return NULL;
 	}
--- a/fs/ocfs2/localalloc.c
+++ b/fs/ocfs2/localalloc.c
@@ -1008,25 +1008,6 @@ static int ocfs2_sync_local_to_main(struct ocfs2_super *osb,
 		start = bit_off + 1;
 	}

-	/* clear the contiguous bits until the end boundary */
-	if (count) {
-		blkno = la_start_blk +
-			ocfs2_clusters_to_blocks(osb->sb,
-					start - count);
-
-		trace_ocfs2_sync_local_to_main_free(
-				count, start - count,
-				(unsigned long long)la_start_blk,
-				(unsigned long long)blkno);
-
-		status = ocfs2_release_clusters(handle,
-				main_bm_inode,
-				main_bm_bh, blkno,
-				count);
-		if (status < 0)
-			mlog_errno(status);
-	}
-
 bail:
 	if (status)
 		mlog_errno(status);
--- a/include/drm/ttm/ttm_tt.h
+++ b/include/drm/ttm/ttm_tt.h
@@ -79,6 +79,12 @@ struct ttm_tt {
 	 *   page_flags = TTM_TT_FLAG_EXTERNAL |
 	 *		  TTM_TT_FLAG_EXTERNAL_MAPPABLE;
 	 *
+	 * TTM_TT_FLAG_DECRYPTED: The mapped ttm pages should be marked as
+	 * not encrypted. The framework will try to match what the dma layer
+	 * is doing, but note that it is a little fragile because ttm page
+	 * fault handling abuses the DMA api a bit and dma_map_attrs can't be
+	 * used to assure pgprot always matches.
+	 *
 	 * TTM_TT_FLAG_PRIV_POPULATED: TTM internal only. DO NOT USE. This is
 	 * set by TTM after ttm_tt_populate() has successfully returned, and is
 	 * then unset when TTM calls ttm_tt_unpopulate().
@@ -87,6 +93,7 @@ struct ttm_tt {
 #define TTM_TT_FLAG_ZERO_ALLOC		(1 << 1)
 #define TTM_TT_FLAG_EXTERNAL		(1 << 2)
 #define TTM_TT_FLAG_EXTERNAL_MAPPABLE	(1 << 3)
+#define TTM_TT_FLAG_DECRYPTED		(1 << 4)

 #define TTM_TT_FLAG_PRIV_POPULATED  (1U << 31)
 	uint32_t page_flags;
--- a/include/linux/arm-smccc.h
+++ b/include/linux/arm-smccc.h
@@ -280,8 +280,6 @@ u32 arm_smccc_get_version(void);

 void __init arm_smccc_version_init(u32 version, enum arm_smccc_conduit conduit);

-extern u64 smccc_has_sve_hint;
-
 /**
 * struct arm_smccc_res - Result from SMC/HVC call
 * @a0-a3 result values from registers 0 to 3
@@ -361,15 +359,6 @@ struct arm_smccc_quirk {
 	} state;
 };

-/**
- * __arm_smccc_sve_check() - Set the SVE hint bit when doing SMC calls
- *
- * Sets the SMCCC hint bit to indicate if there is live state in the SVE
- * registers, this modifies x0 in place and should never be called from C
- * code.
- */
-asmlinkage unsigned long __arm_smccc_sve_check(unsigned long x0);
-
 /**
 * __arm_smccc_smc() - make SMC calls
 * @a0-a7: arguments passed in registers 0 to 7
@@ -437,20 +426,6 @@ asmlinkage void __arm_smccc_hvc(unsigned long a0, unsigned long a1,

 #endif

-/* nVHE hypervisor doesn't have a current thread so needs separate checks */
-#if defined(CONFIG_ARM64_SVE) && !defined(__KVM_NVHE_HYPERVISOR__)
-
-#define SMCCC_SVE_CHECK ALTERNATIVE("nop \n",  "bl __arm_smccc_sve_check \n", \
-				    ARM64_SVE)
-#define smccc_sve_clobbers "x16", "x30", "cc",
-
-#else
-
-#define SMCCC_SVE_CHECK
-#define smccc_sve_clobbers
-
-#endif
-
 #define ___count_args(_0, _1, _2, _3, _4, _5, _6, _7, _8, x, ...) x

 #define __count_args(...)						\
@@ -518,7 +493,7 @@ asmlinkage void __arm_smccc_hvc(unsigned long a0, unsigned long a1,

 #define ___constraints(count)						\
 	: __constraint_read_ ## count					\
-	: smccc_sve_clobbers "memory"
+	: "memory"
 #define __constraints(count)	___constraints(count)

 /*
@@ -533,8 +508,7 @@ asmlinkage void __arm_smccc_hvc(unsigned long a0, unsigned long a1,
 		register unsigned long r2 asm("r2");			\
 		register unsigned long r3 asm("r3"); 			\
 		__declare_args(__count_args(__VA_ARGS__), __VA_ARGS__);	\
-		asm volatile(SMCCC_SVE_CHECK				\
-			     inst "\n" :				\
+		asm volatile(inst "\n" :				\
 			     "=r" (r0), "=r" (r1), "=r" (r2), "=r" (r3)	\
 			     __constraints(__count_args(__VA_ARGS__)));	\
 		if (___res)						\
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -471,6 +471,11 @@ enum bpf_type_flag {
 	/* Size is known at compile time. */
 	MEM_FIXED_SIZE		= BIT(10 + BPF_BASE_TYPE_BITS),

+	/* Memory must be aligned on some architectures, used in combination with
+	 * MEM_FIXED_SIZE.
+	 */
+	MEM_ALIGNED		= BIT(17 + BPF_BASE_TYPE_BITS),
+
 	__BPF_TYPE_FLAG_MAX,
 	__BPF_TYPE_LAST_FLAG	= __BPF_TYPE_FLAG_MAX - 1,
 };
@@ -506,8 +511,6 @@ enum bpf_arg_type {
 	ARG_ANYTHING,		/* any (initialized) argument is ok */
 	ARG_PTR_TO_SPIN_LOCK,	/* pointer to bpf_spin_lock */
 	ARG_PTR_TO_SOCK_COMMON,	/* pointer to sock_common */
-	ARG_PTR_TO_INT,		/* pointer to int */
-	ARG_PTR_TO_LONG,	/* pointer to long */
 	ARG_PTR_TO_SOCKET,	/* pointer to bpf_sock (fullsock) */
 	ARG_PTR_TO_BTF_ID,	/* pointer to in-kernel struct */
 	ARG_PTR_TO_ALLOC_MEM,	/* pointer to dynamically allocated memory */
--- a/include/linux/devfreq.h
+++ b/include/linux/devfreq.h
@@ -273,8 +273,8 @@ void devm_devfreq_unregister_notifier(struct device *dev,
 struct devfreq *devfreq_get_devfreq_by_node(struct device_node *node);
 struct devfreq *devfreq_get_devfreq_by_phandle(struct device *dev,
 				const char *phandle_name, int index);
+#endif /* CONFIG_PM_DEVFREQ */

-#if IS_ENABLED(CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND)
 /**
 * struct devfreq_simple_ondemand_data - ``void *data`` fed to struct devfreq
 *	and devfreq_add_device
@@ -292,9 +292,7 @@ struct devfreq_simple_ondemand_data {
 	unsigned int upthreshold;
 	unsigned int downdifferential;
 };
-#endif

-#if IS_ENABLED(CONFIG_DEVFREQ_GOV_PASSIVE)
 enum devfreq_parent_dev_type {
 	DEVFREQ_PARENT_DEV,
 	CPUFREQ_PARENT_DEV,
@@ -337,9 +335,8 @@ struct devfreq_passive_data {
 	struct notifier_block nb;
 	struct list_head cpu_data_list;
 };
-#endif

-#else /* !CONFIG_PM_DEVFREQ */
+#if !defined(CONFIG_PM_DEVFREQ)
 static inline struct devfreq *devfreq_add_device(struct device *dev,
 					struct devfreq_dev_profile *profile,
 					const char *governor_name,
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1780,6 +1780,13 @@ enum netdev_ml_priv_type {
 	ML_PRIV_CAN,
 };

+enum netdev_stat_type {
+	NETDEV_PCPU_STAT_NONE,
+	NETDEV_PCPU_STAT_LSTATS, /* struct pcpu_lstats */
+	NETDEV_PCPU_STAT_TSTATS, /* struct pcpu_sw_netstats */
+	NETDEV_PCPU_STAT_DSTATS, /* struct pcpu_dstats */
+};
+
 /**
 *	struct net_device - The DEVICE structure.
 *
@@ -1974,10 +1981,14 @@ enum netdev_ml_priv_type {
 *
 * 	@ml_priv:	Mid-layer private
 *	@ml_priv_type:  Mid-layer private type
- * 	@lstats:	Loopback statistics
- * 	@tstats:	Tunnel statistics
- * 	@dstats:	Dummy statistics
- * 	@vstats:	Virtual ethernet statistics
+ *
+ *	@pcpu_stat_type:	Type of device statistics which the core should
+ *				allocate/free: none, lstats, tstats, dstats. none
+ *				means the driver is handling statistics allocation/
+ *				freeing internally.
+ *	@lstats:		Loopback statistics: packets, bytes
+ *	@tstats:		Tunnel statistics: RX/TX packets, RX/TX bytes
+ *	@dstats:		Dummy statistics: RX/TX/drop packets, RX/TX bytes
 *
 *	@garp_port:	GARP
 *	@mrp_port:	MRP
@@ -2328,6 +2339,7 @@ struct net_device {
 	void				*ml_priv;
 	enum netdev_ml_priv_type	ml_priv_type;

+	enum netdev_stat_type		pcpu_stat_type:8;
 	union {
 		struct pcpu_lstats __percpu		*lstats;
 		struct pcpu_sw_netstats __percpu	*tstats;
@@ -2725,6 +2737,16 @@ struct pcpu_sw_netstats {
 	struct u64_stats_sync   syncp;
 } __aligned(4 * sizeof(u64));

+struct pcpu_dstats {
+	u64			rx_packets;
+	u64			rx_bytes;
+	u64			rx_drops;
+	u64			tx_packets;
+	u64			tx_bytes;
+	u64			tx_drops;
+	struct u64_stats_sync	syncp;
+} __aligned(8 * sizeof(u64));
+
 struct pcpu_lstats {
 	u64_stats_t packets;
 	u64_stats_t bytes;
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -582,6 +582,16 @@ static inline void __io_cq_unlock_post(struct io_ring_ctx *ctx)
 	io_cqring_ev_posted(ctx);
 }

+static inline void __io_cq_unlock_post_flush(struct io_ring_ctx *ctx)
+	__releases(ctx->completion_lock)
+{
+	io_commit_cqring(ctx);
+	spin_unlock(&ctx->completion_lock);
+	io_commit_cqring_flush(ctx);
+	if (!(ctx->flags & IORING_SETUP_DEFER_TASKRUN))
+		__io_cqring_wake(ctx);
+}
+
 void io_cq_unlock_post(struct io_ring_ctx *ctx)
 {
 	__io_cq_unlock_post(ctx);
@@ -1339,7 +1349,7 @@ static void __io_submit_flush_completions(struct io_ring_ctx *ctx)
 		if (!(req->flags & REQ_F_CQE_SKIP))
 			__io_fill_cqe_req(ctx, req);
 	}
-	__io_cq_unlock_post(ctx);
+	__io_cq_unlock_post_flush(ctx);

 	io_free_batch_list(ctx, state->compl_reqs.first);
 	INIT_WQ_LIST(&state->compl_reqs);
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -531,7 +531,8 @@ const struct bpf_func_proto bpf_strtol_proto = {
 	.arg1_type	= ARG_PTR_TO_MEM | MEM_RDONLY,
 	.arg2_type	= ARG_CONST_SIZE,
 	.arg3_type	= ARG_ANYTHING,
-	.arg4_type	= ARG_PTR_TO_LONG,
+	.arg4_type	= ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED,
+	.arg4_size	= sizeof(s64),
 };

 BPF_CALL_4(bpf_strtoul, const char *, buf, size_t, buf_len, u64, flags,
@@ -560,7 +561,8 @@ const struct bpf_func_proto bpf_strtoul_proto = {
 	.arg1_type	= ARG_PTR_TO_MEM | MEM_RDONLY,
 	.arg2_type	= ARG_CONST_SIZE,
 	.arg3_type	= ARG_ANYTHING,
-	.arg4_type	= ARG_PTR_TO_LONG,
+	.arg4_type	= ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED,
+	.arg4_size	= sizeof(u64),
 };

 BPF_CALL_3(bpf_strncmp, const char *, s1, u32, s1_sz, const char *, s2)
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -5242,7 +5242,8 @@ static const struct bpf_func_proto bpf_kallsyms_lookup_name_proto = {
 	.arg1_type	= ARG_PTR_TO_MEM,
 	.arg2_type	= ARG_CONST_SIZE_OR_ZERO,
 	.arg3_type	= ARG_ANYTHING,
-	.arg4_type	= ARG_PTR_TO_LONG,
+	.arg4_type	= ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED,
+	.arg4_size	= sizeof(u64),
 };

 static const struct bpf_func_proto *
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5801,16 +5801,6 @@ static bool arg_type_is_dynptr(enum bpf_arg_type type)
 	return base_type(type) == ARG_PTR_TO_DYNPTR;
 }

-static int int_ptr_type_to_size(enum bpf_arg_type type)
-{
-	if (type == ARG_PTR_TO_INT)
-		return sizeof(u32);
-	else if (type == ARG_PTR_TO_LONG)
-		return sizeof(u64);
-
-	return -EINVAL;
-}
-
 static int resolve_map_arg_type(struct bpf_verifier_env *env,
 				 const struct bpf_call_arg_meta *meta,
 				 enum bpf_arg_type *arg_type)
@@ -5891,16 +5881,6 @@ static const struct bpf_reg_types mem_types = {
 	},
 };

-static const struct bpf_reg_types int_ptr_types = {
-	.types = {
-		PTR_TO_STACK,
-		PTR_TO_PACKET,
-		PTR_TO_PACKET_META,
-		PTR_TO_MAP_KEY,
-		PTR_TO_MAP_VALUE,
-	},
-};
-
 static const struct bpf_reg_types fullsock_types = { .types = { PTR_TO_SOCKET } };
 static const struct bpf_reg_types scalar_types = { .types = { SCALAR_VALUE } };
 static const struct bpf_reg_types context_types = { .types = { PTR_TO_CTX } };
@@ -5938,8 +5918,6 @@ static const struct bpf_reg_types *compatible_reg_types[__BPF_ARG_TYPE_MAX] = {
 	[ARG_PTR_TO_SPIN_LOCK]		= &spin_lock_types,
 	[ARG_PTR_TO_MEM]		= &mem_types,
 	[ARG_PTR_TO_ALLOC_MEM]		= &alloc_mem_types,
-	[ARG_PTR_TO_INT]		= &int_ptr_types,
-	[ARG_PTR_TO_LONG]		= &int_ptr_types,
 	[ARG_PTR_TO_PERCPU_BTF_ID]	= &percpu_btf_ptr_types,
 	[ARG_PTR_TO_FUNC]		= &func_ptr_types,
 	[ARG_PTR_TO_STACK]		= &stack_ptr_types,
@@ -6286,9 +6264,11 @@ skip_type_check:
 		 */
 		meta->raw_mode = arg_type & MEM_UNINIT;
 		if (arg_type & MEM_FIXED_SIZE) {
-			err = check_helper_mem_access(env, regno,
-						      fn->arg_size[arg], false,
-						      meta);
+			err = check_helper_mem_access(env, regno, fn->arg_size[arg], false, meta);
+			if (err)
+				return err;
+			if (arg_type & MEM_ALIGNED)
+				err = check_ptr_alignment(env, reg, 0, fn->arg_size[arg], true);
 		}
 		break;
 	case ARG_CONST_SIZE:
@@ -6356,17 +6336,6 @@ skip_type_check:
 		if (err)
 			return err;
 		break;
-	case ARG_PTR_TO_INT:
-	case ARG_PTR_TO_LONG:
-	{
-		int size = int_ptr_type_to_size(arg_type);
-
-		err = check_helper_mem_access(env, regno, size, false, meta);
-		if (err)
-			return err;
-		err = check_ptr_alignment(env, reg, 0, size, true);
-		break;
-	}
 	case ARG_PTR_TO_CONST_STR:
 	{
 		struct bpf_map *map = reg->map_ptr;
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -1192,7 +1192,8 @@ static const struct bpf_func_proto bpf_get_func_arg_proto = {
 	.ret_type	= RET_INTEGER,
 	.arg1_type	= ARG_PTR_TO_CTX,
 	.arg2_type	= ARG_ANYTHING,
-	.arg3_type	= ARG_PTR_TO_LONG,
+	.arg3_type	= ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED,
+	.arg3_size	= sizeof(u64),
 };

 BPF_CALL_2(get_func_ret, void *, ctx, u64 *, value)
@@ -1208,7 +1209,8 @@ static const struct bpf_func_proto bpf_get_func_ret_proto = {
 	.func		= get_func_ret,
 	.ret_type	= RET_INTEGER,
 	.arg1_type	= ARG_PTR_TO_CTX,
-	.arg2_type	= ARG_PTR_TO_LONG,
+	.arg2_type	= ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED,
+	.arg2_size	= sizeof(u64),
 };

 BPF_CALL_1(get_func_arg_cnt, void *, ctx)
--- a/mm/damon/vaddr-test.h
+++ b/mm/damon/vaddr-test.h
@@ -292,6 +292,7 @@ static void damon_test_split_evenly(struct kunit *test)
 	damon_test_split_evenly_fail(test, 0, 100, 0);
 	damon_test_split_evenly_succ(test, 0, 100, 10);
 	damon_test_split_evenly_succ(test, 5, 59, 5);
+	damon_test_split_evenly_succ(test, 0, 3, 2);
 	damon_test_split_evenly_fail(test, 5, 6, 2);
 }

--- a/mm/damon/vaddr.c
+++ b/mm/damon/vaddr.c
@@ -67,6 +67,7 @@ static int damon_va_evenly_split_region(struct damon_target *t,
 	unsigned long sz_orig, sz_piece, orig_end;
 	struct damon_region *n = NULL, *next;
 	unsigned long start;
+	unsigned int i;

 	if (!r || !nr_pieces)
 		return -EINVAL;
@@ -80,8 +81,7 @@ static int damon_va_evenly_split_region(struct damon_target *t,

 	r->ar.end = r->ar.start + sz_piece;
 	next = damon_next_region(r);
-	for (start = r->ar.end; start + sz_piece <= orig_end;
-			start += sz_piece) {
+	for (start = r->ar.end, i = 1; i < nr_pieces; start += sz_piece, i++) {
 		n = damon_new_region(start, start + sz_piece);
 		if (!n)
 			return -ENOMEM;
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -3123,8 +3123,12 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
 		flags |= MAP_LOCKED;

 	file = get_file(vma->vm_file);
+	ret = security_mmap_file(vma->vm_file, prot, flags);
+	if (ret)
+		goto out_fput;
 	ret = do_mmap(vma->vm_file, start, size,
 			prot, flags, pgoff, &populate, NULL);
+out_fput:
 	fput(file);
 out:
 	mmap_write_unlock(mm);
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1521,7 +1521,8 @@ static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
 	bt_dev_dbg(hdev, "err %d", err);

 	/* Make sure cmd still outstanding. */
-	if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
 		return;

 	hci_dev_lock(hdev);
@@ -1695,7 +1696,8 @@ static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
 	bt_dev_dbg(hdev, "err %d", err);

 	/* Make sure cmd still outstanding. */
-	if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
 		return;

 	hci_dev_lock(hdev);
@@ -1928,7 +1930,7 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
 	bool changed;

 	/* Make sure cmd still outstanding. */
-	if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
+	if (err == -ECANCELED || cmd != pending_find(MGMT_OP_SET_SSP, hdev))
 		return;

 	if (err) {
@@ -3853,7 +3855,8 @@ static void set_name_complete(struct hci_dev *hdev, void *data, int err)

 	bt_dev_dbg(hdev, "err %d", err);

-	if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
 		return;

 	if (status) {
@@ -4028,7 +4031,8 @@ static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
 	struct sk_buff *skb = cmd->skb;
 	u8 status = mgmt_status(err);

-	if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
 		return;

 	if (!status) {
@@ -5919,13 +5923,16 @@ static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
 {
 	struct mgmt_pending_cmd *cmd = data;

+	bt_dev_dbg(hdev, "err %d", err);
+
+	if (err == -ECANCELED)
+		return;
+
 	if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
 	    cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
 	    cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
 		return;

-	bt_dev_dbg(hdev, "err %d", err);
-
 	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
 			  cmd->param, 1);
 	mgmt_pending_remove(cmd);
@@ -6158,7 +6165,8 @@ static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
 {
 	struct mgmt_pending_cmd *cmd = data;

-	if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
 		return;

 	bt_dev_dbg(hdev, "err %d", err);
@@ -8105,7 +8113,8 @@ static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
 	u8 status = mgmt_status(err);
 	u16 eir_len;

-	if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
 		return;

 	if (!status) {
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -10007,6 +10007,54 @@ void netif_tx_stop_all_queues(struct net_device *dev)
 }
 EXPORT_SYMBOL(netif_tx_stop_all_queues);

+static int netdev_do_alloc_pcpu_stats(struct net_device *dev)
+{
+	void __percpu *v;
+
+	/* Drivers implementing ndo_get_peer_dev must support tstat
+	 * accounting, so that skb_do_redirect() can bump the dev's
+	 * RX stats upon network namespace switch.
+	 */
+	if (dev->netdev_ops->ndo_get_peer_dev &&
+	    dev->pcpu_stat_type != NETDEV_PCPU_STAT_TSTATS)
+		return -EOPNOTSUPP;
+
+	switch (dev->pcpu_stat_type) {
+	case NETDEV_PCPU_STAT_NONE:
+		return 0;
+	case NETDEV_PCPU_STAT_LSTATS:
+		v = dev->lstats = netdev_alloc_pcpu_stats(struct pcpu_lstats);
+		break;
+	case NETDEV_PCPU_STAT_TSTATS:
+		v = dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
+		break;
+	case NETDEV_PCPU_STAT_DSTATS:
+		v = dev->dstats = netdev_alloc_pcpu_stats(struct pcpu_dstats);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return v ? 0 : -ENOMEM;
+}
+
+static void netdev_do_free_pcpu_stats(struct net_device *dev)
+{
+	switch (dev->pcpu_stat_type) {
+	case NETDEV_PCPU_STAT_NONE:
+		return;
+	case NETDEV_PCPU_STAT_LSTATS:
+		free_percpu(dev->lstats);
+		break;
+	case NETDEV_PCPU_STAT_TSTATS:
+		free_percpu(dev->tstats);
+		break;
+	case NETDEV_PCPU_STAT_DSTATS:
+		free_percpu(dev->dstats);
+		break;
+	}
+}
+
 /**
 * register_netdevice() - register a network device
 * @dev: device to register
@@ -10067,11 +10115,15 @@ int register_netdevice(struct net_device *dev)
 		goto err_uninit;
 	}

+	ret = netdev_do_alloc_pcpu_stats(dev);
+	if (ret)
+		goto err_uninit;
+
 	ret = -EBUSY;
 	if (!dev->ifindex)
 		dev->ifindex = dev_new_index(net);
 	else if (__dev_get_by_index(net, dev->ifindex))
-		goto err_uninit;
+		goto err_free_pcpu;

 	/* Transfer changeable features to wanted_features and enable
 	 * software offloads (GSO and GRO).
@@ -10118,14 +10170,14 @@ int register_netdevice(struct net_device *dev)
 	ret = call_netdevice_notifiers(NETDEV_POST_INIT, dev);
 	ret = notifier_to_errno(ret);
 	if (ret)
-		goto err_uninit;
+		goto err_free_pcpu;

 	ret = netdev_register_kobject(dev);
 	write_lock(&dev_base_lock);
 	dev->reg_state = ret ? NETREG_UNREGISTERED : NETREG_REGISTERED;
 	write_unlock(&dev_base_lock);
 	if (ret)
-		goto err_uninit;
+		goto err_free_pcpu;

 	__netdev_update_features(dev);

@@ -10172,6 +10224,8 @@ int register_netdevice(struct net_device *dev)
 out:
 	return ret;

+err_free_pcpu:
+	netdev_do_free_pcpu_stats(dev);
 err_uninit:
 	if (dev->netdev_ops->ndo_uninit)
 		dev->netdev_ops->ndo_uninit(dev);
@@ -10425,6 +10479,7 @@ void netdev_run_todo(void)
 		WARN_ON(rcu_access_pointer(dev->ip_ptr));
 		WARN_ON(rcu_access_pointer(dev->ip6_ptr));

+		netdev_do_free_pcpu_stats(dev);
 		if (dev->priv_destructor)
 			dev->priv_destructor(dev);
 		if (dev->needs_free_netdev)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2491,6 +2491,7 @@ int skb_do_redirect(struct sk_buff *skb)
 			     net_eq(net, dev_net(dev))))
 			goto out_drop;
 		skb->dev = dev;
+		dev_sw_netstats_rx_add(dev, skb->len);
 		return -EAGAIN;
 	}
 	return flags & BPF_F_NEIGH ?
@@ -6233,7 +6234,8 @@ static const struct bpf_func_proto bpf_skb_check_mtu_proto = {
 	.ret_type	= RET_INTEGER,
 	.arg1_type      = ARG_PTR_TO_CTX,
 	.arg2_type      = ARG_ANYTHING,
-	.arg3_type      = ARG_PTR_TO_INT,
+	.arg3_type      = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED,
+	.arg3_size	= sizeof(u32),
 	.arg4_type      = ARG_ANYTHING,
 	.arg5_type      = ARG_ANYTHING,
 };
@@ -6244,7 +6246,8 @@ static const struct bpf_func_proto bpf_xdp_check_mtu_proto = {
 	.ret_type	= RET_INTEGER,
 	.arg1_type      = ARG_PTR_TO_CTX,
 	.arg2_type      = ARG_ANYTHING,
-	.arg3_type      = ARG_PTR_TO_INT,
+	.arg3_type      = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED,
+	.arg3_size	= sizeof(u32),
 	.arg4_type      = ARG_ANYTHING,
 	.arg5_type      = ARG_ANYTHING,
 };
--- a/sound/soc/intel/avs/pcm.c
+++ b/sound/soc/intel/avs/pcm.c
@@ -540,7 +540,7 @@ static int avs_dai_fe_hw_free(struct snd_pcm_substream *substream, struct snd_so
 	if (ret < 0)
 		dev_dbg(dai->dev, "Failed to free pages!\n");

-	return ret;
+	return 0;
 }

 static int avs_dai_fe_prepare(struct snd_pcm_substream *substream, struct snd_soc_dai *dai)