--- /dev/null
+From 89384a2b656b9dace4c965432a209d5c9c3a2a6f Mon Sep 17 00:00:00 2001
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Date: Sat, 16 Mar 2024 23:56:57 +0100
+Subject: dt-bindings: iio: health: maxim,max30102: fix compatible check
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+commit 89384a2b656b9dace4c965432a209d5c9c3a2a6f upstream.
+
+The "maxim,green-led-current-microamp" property is only available for
+the max30105 part (it provides an extra green LED), and must be set to
+false for the max30102 part.
+
+Instead, the max30100 part has been used for that, which is not
+supported by this binding (it has its own binding).
+
+This error was introduced during the txt to yaml conversion.
+
+Fixes: 5a6a65b11e3a ("dt-bindings:iio:health:maxim,max30102: txt to yaml conversion")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://lore.kernel.org/r/20240316-max30102_binding_fix-v1-1-e8e58f69ef8a@gmail.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/iio/health/maxim,max30102.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/iio/health/maxim,max30102.yaml
++++ b/Documentation/devicetree/bindings/iio/health/maxim,max30102.yaml
+@@ -42,7 +42,7 @@ allOf:
+ properties:
+ compatible:
+ contains:
+- const: maxim,max30100
++ const: maxim,max30102
+ then:
+ properties:
+ maxim,green-led-current-microamp: false
--- /dev/null
+From 57a1592784d622ecee0b71940c65429173996b33 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 26 Mar 2024 12:36:59 +0100
+Subject: iio: accel: mxc4005: Interrupt handling fixes
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 57a1592784d622ecee0b71940c65429173996b33 upstream.
+
+There are 2 issues with interrupt handling in the mxc4005 driver:
+
+1. mxc4005_set_trigger_state() writes MXC4005_REG_INT_MASK1_BIT_DRDYE
+(0x01) to INT_MASK1 to enable the interrupt, but to disable the interrupt
+it writes ~MXC4005_REG_INT_MASK1_BIT_DRDYE which is 0xfe, so it enables
+all other interrupt sources in the INT_SRC1 register. On the MXC4005 this
+is not an issue because only bit 0 of the register is used. On the MXC6655
+OTOH this is a problem since bit7 is used as TC (Temperature Compensation)
+disable bit and writing 1 to this disables Temperature Compensation which
+should only be done when running self-tests on the chip.
+
+Write 0 instead of ~MXC4005_REG_INT_MASK1_BIT_DRDYE to disable
+the interrupts to fix this.
+
+2. The datasheets for the MXC4005 / MXC6655 do not state what the reset
+value for the INT_MASK0 and INT_MASK1 registers is and since these are
+write only we also cannot learn this from the hw. Presumably the reset
+value for both is all 0, which means all interrupts disabled.
+
+Explicitly set both registers to 0 from mxc4005_chip_init() to ensure
+both masks are actually set to 0.
+
+Fixes: 79846e33aac1 ("iio: accel: mxc4005: add support for mxc6655")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20240326113700.56725-2-hdegoede@redhat.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/accel/mxc4005.c | 24 +++++++++++++++++-------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+--- a/drivers/iio/accel/mxc4005.c
++++ b/drivers/iio/accel/mxc4005.c
+@@ -27,9 +27,13 @@
+ #define MXC4005_REG_ZOUT_UPPER 0x07
+ #define MXC4005_REG_ZOUT_LOWER 0x08
+
++#define MXC4005_REG_INT_MASK0 0x0A
++
+ #define MXC4005_REG_INT_MASK1 0x0B
+ #define MXC4005_REG_INT_MASK1_BIT_DRDYE 0x01
+
++#define MXC4005_REG_INT_CLR0 0x00
++
+ #define MXC4005_REG_INT_CLR1 0x01
+ #define MXC4005_REG_INT_CLR1_BIT_DRDYC 0x01
+
+@@ -113,7 +117,9 @@ static bool mxc4005_is_readable_reg(stru
+ static bool mxc4005_is_writeable_reg(struct device *dev, unsigned int reg)
+ {
+ switch (reg) {
++ case MXC4005_REG_INT_CLR0:
+ case MXC4005_REG_INT_CLR1:
++ case MXC4005_REG_INT_MASK0:
+ case MXC4005_REG_INT_MASK1:
+ case MXC4005_REG_CONTROL:
+ return true;
+@@ -330,17 +336,13 @@ static int mxc4005_set_trigger_state(str
+ {
+ struct iio_dev *indio_dev = iio_trigger_get_drvdata(trig);
+ struct mxc4005_data *data = iio_priv(indio_dev);
++ unsigned int val;
+ int ret;
+
+ mutex_lock(&data->mutex);
+- if (state) {
+- ret = regmap_write(data->regmap, MXC4005_REG_INT_MASK1,
+- MXC4005_REG_INT_MASK1_BIT_DRDYE);
+- } else {
+- ret = regmap_write(data->regmap, MXC4005_REG_INT_MASK1,
+- ~MXC4005_REG_INT_MASK1_BIT_DRDYE);
+- }
+
++ val = state ? MXC4005_REG_INT_MASK1_BIT_DRDYE : 0;
++ ret = regmap_write(data->regmap, MXC4005_REG_INT_MASK1, val);
+ if (ret < 0) {
+ mutex_unlock(&data->mutex);
+ dev_err(data->dev, "failed to update reg_int_mask1");
+@@ -382,6 +384,14 @@ static int mxc4005_chip_init(struct mxc4
+
+ dev_dbg(data->dev, "MXC4005 chip id %02x\n", reg);
+
++ ret = regmap_write(data->regmap, MXC4005_REG_INT_MASK0, 0);
++ if (ret < 0)
++ return dev_err_probe(data->dev, ret, "writing INT_MASK0\n");
++
++ ret = regmap_write(data->regmap, MXC4005_REG_INT_MASK1, 0);
++ if (ret < 0)
++ return dev_err_probe(data->dev, ret, "writing INT_MASK1\n");
++
+ return 0;
+ }
+
--- /dev/null
+From 6b8cffdc4a31e4a72f75ecd1bc13fbf0dafee390 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 26 Mar 2024 12:37:00 +0100
+Subject: iio: accel: mxc4005: Reset chip on probe() and resume()
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 6b8cffdc4a31e4a72f75ecd1bc13fbf0dafee390 upstream.
+
+On some designs the chip is not properly reset when powered up at boot or
+after a suspend/resume cycle.
+
+Use the sw-reset feature to ensure that the chip is in a clean state
+after probe() / resume() and in the case of resume() restore the settings
+(scale, trigger-enabled).
+
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218578
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20240326113700.56725-3-hdegoede@redhat.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/accel/mxc4005.c | 68 ++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 68 insertions(+)
+
+--- a/drivers/iio/accel/mxc4005.c
++++ b/drivers/iio/accel/mxc4005.c
+@@ -5,6 +5,7 @@
+ * Copyright (c) 2014, Intel Corporation.
+ */
+
++#include <linux/delay.h>
+ #include <linux/module.h>
+ #include <linux/i2c.h>
+ #include <linux/iio/iio.h>
+@@ -36,6 +37,7 @@
+
+ #define MXC4005_REG_INT_CLR1 0x01
+ #define MXC4005_REG_INT_CLR1_BIT_DRDYC 0x01
++#define MXC4005_REG_INT_CLR1_SW_RST 0x10
+
+ #define MXC4005_REG_CONTROL 0x0D
+ #define MXC4005_REG_CONTROL_MASK_FSR GENMASK(6, 5)
+@@ -43,6 +45,9 @@
+
+ #define MXC4005_REG_DEVICE_ID 0x0E
+
++/* Datasheet does not specify a reset time, this is a conservative guess */
++#define MXC4005_RESET_TIME_US 2000
++
+ enum mxc4005_axis {
+ AXIS_X,
+ AXIS_Y,
+@@ -66,6 +71,8 @@ struct mxc4005_data {
+ s64 timestamp __aligned(8);
+ } scan;
+ bool trigger_enabled;
++ unsigned int control;
++ unsigned int int_mask1;
+ };
+
+ /*
+@@ -349,6 +356,7 @@ static int mxc4005_set_trigger_state(str
+ return ret;
+ }
+
++ data->int_mask1 = val;
+ data->trigger_enabled = state;
+ mutex_unlock(&data->mutex);
+
+@@ -384,6 +392,13 @@ static int mxc4005_chip_init(struct mxc4
+
+ dev_dbg(data->dev, "MXC4005 chip id %02x\n", reg);
+
++ ret = regmap_write(data->regmap, MXC4005_REG_INT_CLR1,
++ MXC4005_REG_INT_CLR1_SW_RST);
++ if (ret < 0)
++ return dev_err_probe(data->dev, ret, "resetting chip\n");
++
++ fsleep(MXC4005_RESET_TIME_US);
++
+ ret = regmap_write(data->regmap, MXC4005_REG_INT_MASK0, 0);
+ if (ret < 0)
+ return dev_err_probe(data->dev, ret, "writing INT_MASK0\n");
+@@ -479,6 +494,58 @@ static int mxc4005_probe(struct i2c_clie
+ return devm_iio_device_register(&client->dev, indio_dev);
+ }
+
++static int mxc4005_suspend(struct device *dev)
++{
++ struct iio_dev *indio_dev = dev_get_drvdata(dev);
++ struct mxc4005_data *data = iio_priv(indio_dev);
++ int ret;
++
++ /* Save control to restore it on resume */
++ ret = regmap_read(data->regmap, MXC4005_REG_CONTROL, &data->control);
++ if (ret < 0)
++ dev_err(data->dev, "failed to read reg_control\n");
++
++ return ret;
++}
++
++static int mxc4005_resume(struct device *dev)
++{
++ struct iio_dev *indio_dev = dev_get_drvdata(dev);
++ struct mxc4005_data *data = iio_priv(indio_dev);
++ int ret;
++
++ ret = regmap_write(data->regmap, MXC4005_REG_INT_CLR1,
++ MXC4005_REG_INT_CLR1_SW_RST);
++ if (ret) {
++ dev_err(data->dev, "failed to reset chip: %d\n", ret);
++ return ret;
++ }
++
++ fsleep(MXC4005_RESET_TIME_US);
++
++ ret = regmap_write(data->regmap, MXC4005_REG_CONTROL, data->control);
++ if (ret) {
++ dev_err(data->dev, "failed to restore control register\n");
++ return ret;
++ }
++
++ ret = regmap_write(data->regmap, MXC4005_REG_INT_MASK0, 0);
++ if (ret) {
++ dev_err(data->dev, "failed to restore interrupt 0 mask\n");
++ return ret;
++ }
++
++ ret = regmap_write(data->regmap, MXC4005_REG_INT_MASK1, data->int_mask1);
++ if (ret) {
++ dev_err(data->dev, "failed to restore interrupt 1 mask\n");
++ return ret;
++ }
++
++ return 0;
++}
++
++static DEFINE_SIMPLE_DEV_PM_OPS(mxc4005_pm_ops, mxc4005_suspend, mxc4005_resume);
++
+ static const struct acpi_device_id mxc4005_acpi_match[] = {
+ {"MXC4005", 0},
+ {"MXC6655", 0},
+@@ -505,6 +572,7 @@ static struct i2c_driver mxc4005_driver
+ .name = MXC4005_DRV_NAME,
+ .acpi_match_table = ACPI_PTR(mxc4005_acpi_match),
+ .of_match_table = mxc4005_of_match,
++ .pm = pm_sleep_ptr(&mxc4005_pm_ops),
+ },
+ .probe = mxc4005_probe,
+ .id_table = mxc4005_id,
--- /dev/null
+From 74a72baf204fd509bbe8b53eec35e39869d94341 Mon Sep 17 00:00:00 2001
+From: Ramona Gradinariu <ramona.bolboaca13@gmail.com>
+Date: Fri, 5 Apr 2024 07:53:09 +0300
+Subject: iio:imu: adis16475: Fix sync mode setting
+
+From: Ramona Gradinariu <ramona.bolboaca13@gmail.com>
+
+commit 74a72baf204fd509bbe8b53eec35e39869d94341 upstream.
+
+Fix sync mode setting by applying the necessary shift bits.
+
+Fixes: fff7352bf7a3 ("iio: imu: Add support for adis16475")
+Signed-off-by: Ramona Gradinariu <ramona.bolboaca13@gmail.com>
+Reviewed-by: Nuno Sa <nuno.sa@analog.com>
+Link: https://lore.kernel.org/r/20240405045309.816328-2-ramona.bolboaca13@gmail.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/adis16475.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/imu/adis16475.c
++++ b/drivers/iio/imu/adis16475.c
+@@ -1289,6 +1289,7 @@ static int adis16475_config_sync_mode(st
+ struct device *dev = &st->adis.spi->dev;
+ const struct adis16475_sync *sync;
+ u32 sync_mode;
++ u16 val;
+
+ /* default to internal clk */
+ st->clk_freq = st->info->int_clk * 1000;
+@@ -1350,8 +1351,9 @@ static int adis16475_config_sync_mode(st
+ * I'm keeping this for simplicity and avoiding extra variables
+ * in chip_info.
+ */
++ val = ADIS16475_SYNC_MODE(sync->sync_mode);
+ ret = __adis_update_bits(&st->adis, ADIS16475_REG_MSG_CTRL,
+- ADIS16475_SYNC_MODE_MASK, sync->sync_mode);
++ ADIS16475_SYNC_MODE_MASK, val);
+ if (ret)
+ return ret;
+
--- /dev/null
+From 546a4f4b5f4d930ea57f5510e109acf08eca5e87 Mon Sep 17 00:00:00 2001
+From: Vasileios Amoiridis <vassilisamir@gmail.com>
+Date: Sat, 16 Mar 2024 12:07:42 +0100
+Subject: iio: pressure: Fixes BME280 SPI driver data
+
+From: Vasileios Amoiridis <vassilisamir@gmail.com>
+
+commit 546a4f4b5f4d930ea57f5510e109acf08eca5e87 upstream.
+
+Use bme280_chip_info structure instead of bmp280_chip_info
+in SPI support for the BME280 sensor.
+
+Fixes: 0b0b772637cd ("iio: pressure: bmp280: Use chip_info pointers for each chip as driver data")
+Signed-off-by: Vasileios Amoiridis <vassilisamir@gmail.com>
+Link: https://lore.kernel.org/r/20240316110743.1998400-2-vassilisamir@gmail.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/pressure/bmp280-spi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/pressure/bmp280-spi.c
++++ b/drivers/iio/pressure/bmp280-spi.c
+@@ -127,7 +127,7 @@ static const struct of_device_id bmp280_
+ { .compatible = "bosch,bmp180", .data = &bmp180_chip_info },
+ { .compatible = "bosch,bmp181", .data = &bmp180_chip_info },
+ { .compatible = "bosch,bmp280", .data = &bmp280_chip_info },
+- { .compatible = "bosch,bme280", .data = &bmp280_chip_info },
++ { .compatible = "bosch,bme280", .data = &bme280_chip_info },
+ { .compatible = "bosch,bmp380", .data = &bmp380_chip_info },
+ { .compatible = "bosch,bmp580", .data = &bmp580_chip_info },
+ { },
+@@ -139,7 +139,7 @@ static const struct spi_device_id bmp280
+ { "bmp180", (kernel_ulong_t)&bmp180_chip_info },
+ { "bmp181", (kernel_ulong_t)&bmp180_chip_info },
+ { "bmp280", (kernel_ulong_t)&bmp280_chip_info },
+- { "bme280", (kernel_ulong_t)&bmp280_chip_info },
++ { "bme280", (kernel_ulong_t)&bme280_chip_info },
+ { "bmp380", (kernel_ulong_t)&bmp380_chip_info },
+ { "bmp580", (kernel_ulong_t)&bmp580_chip_info },
+ { }
--- /dev/null
+From 5ca29ea4e4073b3caba750efe155b1bd4c597ca9 Mon Sep 17 00:00:00 2001
+From: Vasileios Amoiridis <vassilisamir@gmail.com>
+Date: Sat, 16 Mar 2024 12:07:43 +0100
+Subject: iio: pressure: Fixes SPI support for BMP3xx devices
+
+From: Vasileios Amoiridis <vassilisamir@gmail.com>
+
+commit 5ca29ea4e4073b3caba750efe155b1bd4c597ca9 upstream.
+
+Bosch does not use unique BMPxxx_CHIP_ID for the different versions
+of the device which leads to misidentification of devices if their
+ID is used. Use a new value in the chip_info structure instead of
+the BMPxxx_CHIP_ID, in order to choose the correct regmap_bus to
+be used.
+
+Fixes: a9dd9ba32311 ("iio: pressure: Fixes BMP38x and BMP390 SPI support")
+Signed-off-by: Vasileios Amoiridis <vassilisamir@gmail.com>
+Link: https://lore.kernel.org/r/20240316110743.1998400-3-vassilisamir@gmail.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/pressure/bmp280-core.c | 1 +
+ drivers/iio/pressure/bmp280-spi.c | 9 ++-------
+ drivers/iio/pressure/bmp280.h | 1 +
+ 3 files changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
+index fe8734468ed3..62e9e93d915d 100644
+--- a/drivers/iio/pressure/bmp280-core.c
++++ b/drivers/iio/pressure/bmp280-core.c
+@@ -1233,6 +1233,7 @@ const struct bmp280_chip_info bmp380_chip_info = {
+ .chip_id = bmp380_chip_ids,
+ .num_chip_id = ARRAY_SIZE(bmp380_chip_ids),
+ .regmap_config = &bmp380_regmap_config,
++ .spi_read_extra_byte = true,
+ .start_up_time = 2000,
+ .channels = bmp380_channels,
+ .num_channels = 2,
+diff --git a/drivers/iio/pressure/bmp280-spi.c b/drivers/iio/pressure/bmp280-spi.c
+index 038d36aad3eb..4e19ea0b4d39 100644
+--- a/drivers/iio/pressure/bmp280-spi.c
++++ b/drivers/iio/pressure/bmp280-spi.c
+@@ -96,15 +96,10 @@ static int bmp280_spi_probe(struct spi_device *spi)
+
+ chip_info = spi_get_device_match_data(spi);
+
+- switch (chip_info->chip_id[0]) {
+- case BMP380_CHIP_ID:
+- case BMP390_CHIP_ID:
++ if (chip_info->spi_read_extra_byte)
+ bmp_regmap_bus = &bmp380_regmap_bus;
+- break;
+- default:
++ else
+ bmp_regmap_bus = &bmp280_regmap_bus;
+- break;
+- }
+
+ regmap = devm_regmap_init(&spi->dev,
+ bmp_regmap_bus,
+diff --git a/drivers/iio/pressure/bmp280.h b/drivers/iio/pressure/bmp280.h
+index 4012387d7956..5812a344ed8e 100644
+--- a/drivers/iio/pressure/bmp280.h
++++ b/drivers/iio/pressure/bmp280.h
+@@ -423,6 +423,7 @@ struct bmp280_chip_info {
+ int num_chip_id;
+
+ const struct regmap_config *regmap_config;
++ bool spi_read_extra_byte;
+
+ const struct iio_chan_spec *channels;
+ int num_channels;
+--
+2.45.0
+
--- /dev/null
+From 90d1f14cbb9ddbfc532e2da13bf6e0ed8320e792 Mon Sep 17 00:00:00 2001
+From: Alexander Potapenko <glider@google.com>
+Date: Fri, 26 Apr 2024 11:16:22 +0200
+Subject: kmsan: compiler_types: declare __no_sanitize_or_inline
+
+From: Alexander Potapenko <glider@google.com>
+
+commit 90d1f14cbb9ddbfc532e2da13bf6e0ed8320e792 upstream.
+
+It turned out that KMSAN instruments READ_ONCE_NOCHECK(), resulting in
+false positive reports, because __no_sanitize_or_inline enforced inlining.
+
+Properly declare __no_sanitize_or_inline under __SANITIZE_MEMORY__, so
+that it does not __always_inline the annotated function.
+
+Link: https://lkml.kernel.org/r/20240426091622.3846771-1-glider@google.com
+Fixes: 5de0ce85f5a4 ("kmsan: mark noinstr as __no_sanitize_memory")
+Signed-off-by: Alexander Potapenko <glider@google.com>
+Reported-by: syzbot+355c5bb8c1445c871ee8@syzkaller.appspotmail.com
+Link: https://lkml.kernel.org/r/000000000000826ac1061675b0e3@google.com
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Marco Elver <elver@google.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/compiler_types.h | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/include/linux/compiler_types.h
++++ b/include/linux/compiler_types.h
+@@ -278,6 +278,17 @@ struct ftrace_likely_data {
+ # define __no_kcsan
+ #endif
+
++#ifdef __SANITIZE_MEMORY__
++/*
++ * Similarly to KASAN and KCSAN, KMSAN loses function attributes of inlined
++ * functions, therefore disabling KMSAN checks also requires disabling inlining.
++ *
++ * __no_sanitize_or_inline effectively prevents KMSAN from reporting errors
++ * within the function and marks all its outputs as initialized.
++ */
++# define __no_sanitize_or_inline __no_kmsan_checks notrace __maybe_unused
++#endif
++
+ #ifndef __no_sanitize_or_inline
+ #define __no_sanitize_or_inline __always_inline
+ #endif
--- /dev/null
+From fb7a0d334894206ae35f023a82cad5a290fd7386 Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Mon, 29 Apr 2024 20:00:31 +0200
+Subject: mptcp: ensure snd_nxt is properly initialized on connect
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit fb7a0d334894206ae35f023a82cad5a290fd7386 upstream.
+
+Christoph reported a splat hinting at a corrupted snd_una:
+
+ WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 __mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005
+ Modules linked in:
+ CPU: 1 PID: 38 Comm: kworker/1:1 Not tainted 6.9.0-rc1-gbbeac67456c9 #59
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
+ Workqueue: events mptcp_worker
+ RIP: 0010:__mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005
+ Code: be 06 01 00 00 bf 06 01 00 00 e8 a8 12 e7 fe e9 00 fe ff ff e8
+ 8e 1a e7 fe 0f b7 ab 3e 02 00 00 e9 d3 fd ff ff e8 7d 1a e7 fe
+ <0f> 0b 4c 8b bb e0 05 00 00 e9 74 fc ff ff e8 6a 1a e7 fe 0f 0b e9
+ RSP: 0018:ffffc9000013fd48 EFLAGS: 00010293
+ RAX: 0000000000000000 RBX: ffff8881029bd280 RCX: ffffffff82382fe4
+ RDX: ffff8881003cbd00 RSI: ffffffff823833c3 RDI: 0000000000000001
+ RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
+ R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888138ba8000
+ R13: 0000000000000106 R14: ffff8881029bd908 R15: ffff888126560000
+ FS: 0000000000000000(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007f604a5dae38 CR3: 0000000101dac002 CR4: 0000000000170ef0
+ Call Trace:
+ <TASK>
+ __mptcp_clean_una_wakeup net/mptcp/protocol.c:1055 [inline]
+ mptcp_clean_una_wakeup net/mptcp/protocol.c:1062 [inline]
+ __mptcp_retrans+0x7f/0x7e0 net/mptcp/protocol.c:2615
+ mptcp_worker+0x434/0x740 net/mptcp/protocol.c:2767
+ process_one_work+0x1e0/0x560 kernel/workqueue.c:3254
+ process_scheduled_works kernel/workqueue.c:3335 [inline]
+ worker_thread+0x3c7/0x640 kernel/workqueue.c:3416
+ kthread+0x121/0x170 kernel/kthread.c:388
+ ret_from_fork+0x44/0x50 arch/x86/kernel/process.c:147
+ ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
+ </TASK>
+
+When fallback to TCP happens early on a client socket, snd_nxt
+is not yet initialized and any incoming ack will copy such value
+into snd_una. If the mptcp worker (dumbly) tries mptcp-level
+re-injection after such ack, that would unconditionally trigger a send
+buffer cleanup using 'bad' snd_una values.
+
+We could easily disable re-injection for fallback sockets, but such
+dumb behavior already helped catching a few subtle issues and a very
+low to zero impact in practice.
+
+Instead address the issue always initializing snd_nxt (and write_seq,
+for consistency) at connect time.
+
+Fixes: 8fd738049ac3 ("mptcp: fallback in case of simultaneous connect")
+Cc: stable@vger.kernel.org
+Reported-by: Christoph Paasch <cpaasch@apple.com>
+Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/485
+Tested-by: Christoph Paasch <cpaasch@apple.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://lore.kernel.org/r/20240429-upstream-net-20240429-mptcp-snd_nxt-init-connect-v1-1-59ceac0a7dcb@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -3703,6 +3703,9 @@ static int mptcp_connect(struct sock *sk
+ MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_TOKENFALLBACKINIT);
+ mptcp_subflow_early_fallback(msk, subflow);
+ }
++
++ WRITE_ONCE(msk->write_seq, subflow->idsn);
++ WRITE_ONCE(msk->snd_nxt, subflow->idsn);
+ if (likely(!__mptcp_check_fallback(msk)))
+ MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPCAPABLEACTIVE);
+
--- /dev/null
+From 6963c508fd7ab66ae0b7ae3db9a62ca6267f1ae8 Mon Sep 17 00:00:00 2001
+From: Gregory Detal <gregory.detal@gmail.com>
+Date: Mon, 6 May 2024 17:35:28 +0200
+Subject: mptcp: only allow set existing scheduler for net.mptcp.scheduler
+
+From: Gregory Detal <gregory.detal@gmail.com>
+
+commit 6963c508fd7ab66ae0b7ae3db9a62ca6267f1ae8 upstream.
+
+The current behavior is to accept any strings as inputs, this results in
+an inconsistent result where an unexisting scheduler can be set:
+
+ # sysctl -w net.mptcp.scheduler=notdefault
+ net.mptcp.scheduler = notdefault
+
+This patch changes this behavior by checking for existing scheduler
+before accepting the input.
+
+Fixes: e3b2870b6d22 ("mptcp: add a new sysctl scheduler")
+Cc: stable@vger.kernel.org
+Signed-off-by: Gregory Detal <gregory.detal@gmail.com>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Tested-by: Geliang Tang <geliang@kernel.org>
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://lore.kernel.org/r/20240506-upstream-net-20240506-mptcp-sched-exist-v1-1-2ed1529e521e@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/ctrl.c | 39 ++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 38 insertions(+), 1 deletion(-)
+
+--- a/net/mptcp/ctrl.c
++++ b/net/mptcp/ctrl.c
+@@ -96,6 +96,43 @@ static void mptcp_pernet_set_defaults(st
+ }
+
+ #ifdef CONFIG_SYSCTL
++static int mptcp_set_scheduler(const struct net *net, const char *name)
++{
++ struct mptcp_pernet *pernet = mptcp_get_pernet(net);
++ struct mptcp_sched_ops *sched;
++ int ret = 0;
++
++ rcu_read_lock();
++ sched = mptcp_sched_find(name);
++ if (sched)
++ strscpy(pernet->scheduler, name, MPTCP_SCHED_NAME_MAX);
++ else
++ ret = -ENOENT;
++ rcu_read_unlock();
++
++ return ret;
++}
++
++static int proc_scheduler(struct ctl_table *ctl, int write,
++ void *buffer, size_t *lenp, loff_t *ppos)
++{
++ const struct net *net = current->nsproxy->net_ns;
++ char val[MPTCP_SCHED_NAME_MAX];
++ struct ctl_table tbl = {
++ .data = val,
++ .maxlen = MPTCP_SCHED_NAME_MAX,
++ };
++ int ret;
++
++ strscpy(val, mptcp_get_scheduler(net), MPTCP_SCHED_NAME_MAX);
++
++ ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
++ if (write && ret == 0)
++ ret = mptcp_set_scheduler(net, val);
++
++ return ret;
++}
++
+ static struct ctl_table mptcp_sysctl_table[] = {
+ {
+ .procname = "enabled",
+@@ -148,7 +185,7 @@ static struct ctl_table mptcp_sysctl_tab
+ .procname = "scheduler",
+ .maxlen = MPTCP_SCHED_NAME_MAX,
+ .mode = 0644,
+- .proc_handler = proc_dostring,
++ .proc_handler = proc_scheduler,
+ },
+ {
+ .procname = "close_timeout",
btrfs-make-sure-that-written-is-set-on-all-metadata-blocks.patch
maple_tree-fix-mas_empty_area_rev-null-pointer-dereference.patch
mm-slab-make-__free-kfree-accept-error-pointers.patch
+mptcp-ensure-snd_nxt-is-properly-initialized-on-connect.patch
+mptcp-only-allow-set-existing-scheduler-for-net.mptcp.scheduler.patch
+workqueue-fix-selection-of-wake_cpu-in-kick_pool.patch
+dt-bindings-iio-health-maxim-max30102-fix-compatible-check.patch
+iio-imu-adis16475-fix-sync-mode-setting.patch
+iio-pressure-fixes-bme280-spi-driver-data.patch
+iio-pressure-fixes-spi-support-for-bmp3xx-devices.patch
+iio-accel-mxc4005-interrupt-handling-fixes.patch
+iio-accel-mxc4005-reset-chip-on-probe-and-resume.patch
+kmsan-compiler_types-declare-__no_sanitize_or_inline.patch
--- /dev/null
+From 57a01eafdcf78f6da34fad9ff075ed5dfdd9f420 Mon Sep 17 00:00:00 2001
+From: Sven Schnelle <svens@linux.ibm.com>
+Date: Tue, 23 Apr 2024 08:19:05 +0200
+Subject: workqueue: Fix selection of wake_cpu in kick_pool()
+
+From: Sven Schnelle <svens@linux.ibm.com>
+
+commit 57a01eafdcf78f6da34fad9ff075ed5dfdd9f420 upstream.
+
+With cpu_possible_mask=0-63 and cpu_online_mask=0-7 the following
+kernel oops was observed:
+
+smp: Bringing up secondary CPUs ...
+smp: Brought up 1 node, 8 CPUs
+Unable to handle kernel pointer dereference in virtual kernel address space
+Failing address: 0000000000000000 TEID: 0000000000000803
+[..]
+ Call Trace:
+arch_vcpu_is_preempted+0x12/0x80
+select_idle_sibling+0x42/0x560
+select_task_rq_fair+0x29a/0x3b0
+try_to_wake_up+0x38e/0x6e0
+kick_pool+0xa4/0x198
+__queue_work.part.0+0x2bc/0x3a8
+call_timer_fn+0x36/0x160
+__run_timers+0x1e2/0x328
+__run_timer_base+0x5a/0x88
+run_timer_softirq+0x40/0x78
+__do_softirq+0x118/0x388
+irq_exit_rcu+0xc0/0xd8
+do_ext_irq+0xae/0x168
+ext_int_handler+0xbe/0xf0
+psw_idle_exit+0x0/0xc
+default_idle_call+0x3c/0x110
+do_idle+0xd4/0x158
+cpu_startup_entry+0x40/0x48
+rest_init+0xc6/0xc8
+start_kernel+0x3c4/0x5e0
+startup_continue+0x3c/0x50
+
+The crash is caused by calling arch_vcpu_is_preempted() for an offline
+CPU. To avoid this, select the cpu with cpumask_any_and_distribute()
+to mask __pod_cpumask with cpu_online_mask. In case no cpu is left in
+the pool, skip the assignment.
+
+tj: This doesn't fully fix the bug as CPUs can still go down between picking
+the target CPU and the wake call. Fixing that likely requires adding
+cpu_online() test to either the sched or s390 arch code. However, regardless
+of how that is fixed, workqueue shouldn't be picking a CPU which isn't
+online as that would result in unpredictable and worse behavior.
+
+Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
+Fixes: 8639ecebc9b1 ("workqueue: Implement non-strict affinity scope for unbound workqueues")
+Cc: stable@vger.kernel.org # v6.6+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/workqueue.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1141,8 +1141,12 @@ static bool kick_pool(struct worker_pool
+ !cpumask_test_cpu(p->wake_cpu, pool->attrs->__pod_cpumask)) {
+ struct work_struct *work = list_first_entry(&pool->worklist,
+ struct work_struct, entry);
+- p->wake_cpu = cpumask_any_distribute(pool->attrs->__pod_cpumask);
+- get_work_pwq(work)->stats[PWQ_STAT_REPATRIATED]++;
++ int wake_cpu = cpumask_any_and_distribute(pool->attrs->__pod_cpumask,
++ cpu_online_mask);
++ if (wake_cpu < nr_cpu_ids) {
++ p->wake_cpu = wake_cpu;
++ get_work_pwq(work)->stats[PWQ_STAT_REPATRIATED]++;
++ }
+ }
+ #endif
+ wake_up_process(p);
projects / thirdparty / kernel / stable-queue.git / commitdiff
