Merge 6.1.37 into android14-6.1-lts

Changes in 6.1.37
	mm/mmap: Fix error path in do_vmi_align_munmap()
	mm/mmap: Fix error return in do_vmi_align_munmap()
	mptcp: ensure listener is unhashed before updating the sk status
	mm, hwpoison: try to recover from copy-on write faults
	mm, hwpoison: when copy-on-write hits poison, take page offline
	x86/microcode/AMD: Load late on both threads too
	x86/smp: Make stop_other_cpus() more robust
	x86/smp: Dont access non-existing CPUID leaf
	x86/smp: Remove pointless wmb()s from native_stop_other_cpus()
	x86/smp: Use dedicated cache-line for mwait_play_dead()
	x86/smp: Cure kexec() vs. mwait_play_dead() breakage
	can: isotp: isotp_sendmsg(): fix return error fix on TX path
	maple_tree: fix potential out-of-bounds access in mas_wr_end_piv()
	mm: introduce new 'lock_mm_and_find_vma()' page fault helper
	mm: make the page fault mmap locking killable
	arm64/mm: Convert to using lock_mm_and_find_vma()
	powerpc/mm: Convert to using lock_mm_and_find_vma()
	mips/mm: Convert to using lock_mm_and_find_vma()
	riscv/mm: Convert to using lock_mm_and_find_vma()
	arm/mm: Convert to using lock_mm_and_find_vma()
	mm/fault: convert remaining simple cases to lock_mm_and_find_vma()
	powerpc/mm: convert coprocessor fault to lock_mm_and_find_vma()
	mm: make find_extend_vma() fail if write lock not held
	execve: expand new process stack manually ahead of time
	mm: always expand the stack with the mmap write lock held
	fbdev: fix potential OOB read in fast_imageblit()
	HID: hidraw: fix data race on device refcount
	HID: wacom: Use ktime_t rather than int when dealing with timestamps
	HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651.
	Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe"
	sparc32: fix lock_mm_and_find_vma() conversion
	parisc: fix expand_stack() conversion
	csky: fix up lock_mm_and_find_vma() conversion
	xtensa: fix NOMMU build with lock_mm_and_find_vma() conversion
	Linux 6.1.37

Change-Id: If9feca8bddd17174e6b36421286049c7a5a60487
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 1
-SUBLEVEL = 36
+SUBLEVEL = 37
 EXTRAVERSION =
 NAME = Curry Ramen
 

drivers/hid/wacom_wac.c

@@ -1309,7 +1309,7 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)
 	struct input_dev *pen_input = wacom->pen_input;
 	unsigned char *data = wacom->data;
 	int number_of_valid_frames = 0;
-	int time_interval = 15000000;
+	ktime_t time_interval = 15000000;
 	ktime_t time_packet_received = ktime_get();
 	int i;
 
@@ -1343,7 +1343,7 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)
 	if (number_of_valid_frames) {
 		if (wacom->hid_data.time_delayed)
 			time_interval = ktime_get() - wacom->hid_data.time_delayed;
-		time_interval /= number_of_valid_frames;
+		time_interval = div_u64(time_interval, number_of_valid_frames);
 		wacom->hid_data.time_delayed = time_packet_received;
 	}
 
@@ -1354,7 +1354,7 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)
 		bool range = frame[0] & 0x20;
 		bool invert = frame[0] & 0x10;
 		int frames_number_reversed = number_of_valid_frames - i - 1;
-		int event_timestamp = time_packet_received - frames_number_reversed * time_interval;
+		ktime_t event_timestamp = time_packet_received - frames_number_reversed * time_interval;
 
 		if (!valid)
 			continue;

drivers/hid/wacom_wac.h

@@ -324,7 +324,7 @@ struct hid_data {
 	int ps_connected;
 	bool pad_input_event_flag;
 	unsigned short sequence_number;
-	int time_delayed;
+	ktime_t time_delayed;
 };
 
 struct wacom_remote_data {

drivers/thermal/mtk_thermal.c

@@ -1028,12 +1028,7 @@ static int mtk_thermal_probe(struct platform_device *pdev)
 		return -ENODEV;
 	}
 
-	auxadc_base = devm_of_iomap(&pdev->dev, auxadc, 0, NULL);
+	auxadc_base = of_iomap(auxadc, 0);
-	if (IS_ERR(auxadc_base)) {
-		of_node_put(auxadc);
-		return PTR_ERR(auxadc_base);
-	}
-
 	auxadc_phys_base = of_get_phys_base(auxadc);
 
 	of_node_put(auxadc);
@@ -1049,12 +1044,7 @@ static int mtk_thermal_probe(struct platform_device *pdev)
 		return -ENODEV;
 	}
 
-	apmixed_base = devm_of_iomap(&pdev->dev, apmixedsys, 0, NULL);
+	apmixed_base = of_iomap(apmixedsys, 0);
-	if (IS_ERR(apmixed_base)) {
-		of_node_put(apmixedsys);
-		return PTR_ERR(apmixed_base);
-	}
-
 	apmixed_phys_base = of_get_phys_base(apmixedsys);
 
 	of_node_put(apmixedsys);

net/mptcp/pm_netlink.c

@@ -1039,6 +1039,7 @@ static int mptcp_pm_nl_create_listen_socket(struct sock *sk,
 		return err;
 	}
 
+	inet_sk_state_store(newsk, TCP_LISTEN);
 	err = kernel_listen(ssock, backlog);
 	if (err) {
 		pr_warn("kernel_listen error, err=%d", err);

net/mptcp/protocol.c

@@ -2400,12 +2400,6 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,
 		kfree_rcu(subflow, rcu);
 	} else {
 		/* otherwise tcp will dispose of the ssk and subflow ctx */
-		if (ssk->sk_state == TCP_LISTEN) {
-			tcp_set_state(ssk, TCP_CLOSE);
-			mptcp_subflow_queue_clean(sk, ssk);
-			inet_csk_listen_stop(ssk);
-		}
-
 		__tcp_close(ssk, 0);
 
 		/* close acquired an extra ref */
@@ -2939,6 +2933,24 @@ static __poll_t mptcp_check_readable(struct mptcp_sock *msk)
 	return EPOLLIN | EPOLLRDNORM;
 }
 
+static void mptcp_check_listen_stop(struct sock *sk)
+{
+	struct sock *ssk;
+
+	if (inet_sk_state_load(sk) != TCP_LISTEN)
+		return;
+
+	ssk = mptcp_sk(sk)->first;
+	if (WARN_ON_ONCE(!ssk || inet_sk_state_load(ssk) != TCP_LISTEN))
+		return;
+
+	lock_sock_nested(ssk, SINGLE_DEPTH_NESTING);
+	mptcp_subflow_queue_clean(sk, ssk);
+	inet_csk_listen_stop(ssk);
+	tcp_set_state(ssk, TCP_CLOSE);
+	release_sock(ssk);
+}
+
 bool __mptcp_close(struct sock *sk, long timeout)
 {
 	struct mptcp_subflow_context *subflow;
@@ -2949,6 +2961,7 @@ bool __mptcp_close(struct sock *sk, long timeout)
 	WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
 
 	if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE)) {
+		mptcp_check_listen_stop(sk);
 		inet_sk_state_store(sk, TCP_CLOSE);
 		goto cleanup;
 	}
@@ -3062,6 +3075,7 @@ static int mptcp_disconnect(struct sock *sk, int flags)
 	if (msk->fastopening)
 		return -EBUSY;
 
+	mptcp_check_listen_stop(sk);
 	inet_sk_state_store(sk, TCP_CLOSE);
 
 	mptcp_stop_timer(sk);