--- /dev/null
+From c1472ec1dc4419d0bae663c1a1e6cb98dc7881ad Mon Sep 17 00:00:00 2001
+From: Romain Naour <romain.naour@skf.com>
+Date: Fri, 15 Nov 2024 11:25:37 +0100
+Subject: ARM: dts: dra7: Add bus_dma_limit for l4 cfg bus
+
+From: Romain Naour <romain.naour@skf.com>
+
+commit c1472ec1dc4419d0bae663c1a1e6cb98dc7881ad upstream.
+
+A bus_dma_limit was added for l3 bus by commit cfb5d65f2595
+("ARM: dts: dra7: Add bus_dma_limit for L3 bus") to fix an issue
+observed only with SATA on DRA7-EVM with 4GB RAM and CONFIG_ARM_LPAE
+enabled.
+
+Since kernel 5.13, the SATA issue can be reproduced again following
+the SATA node move from L3 bus to L4_cfg in commit 8af15365a368
+("ARM: dts: Configure interconnect target module for dra7 sata").
+
+Fix it by adding an empty dma-ranges property to l4_cfg and
+segment@100000 nodes (parent device tree node of SATA controller) to
+inherit the 2GB dma ranges limit from l3 bus node.
+
+Note: A similar fix was applied for PCIe controller by commit
+90d4d3f4ea45 ("ARM: dts: dra7: Fix bus_dma_limit for PCIe").
+
+Fixes: 8af15365a368 ("ARM: dts: Configure interconnect target module for dra7 sata").
+Link: https://lore.kernel.org/linux-omap/c583e1bb-f56b-4489-8012-ce742e85f233@smile.fr/
+Cc: stable@vger.kernel.org # 5.13
+Signed-off-by: Romain Naour <romain.naour@skf.com>
+Link: https://lore.kernel.org/r/20241115102537.1330300-1-romain.naour@smile.fr
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/dra7-l4.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/boot/dts/dra7-l4.dtsi
++++ b/arch/arm/boot/dts/dra7-l4.dtsi
+@@ -12,6 +12,7 @@
+ ranges = <0x00000000 0x4a000000 0x100000>, /* segment 0 */
+ <0x00100000 0x4a100000 0x100000>, /* segment 1 */
+ <0x00200000 0x4a200000 0x100000>; /* segment 2 */
++ dma-ranges;
+
+ segment@0 { /* 0x4a000000 */
+ compatible = "simple-pm-bus";
+@@ -557,6 +558,7 @@
+ <0x0007e000 0x0017e000 0x001000>, /* ap 124 */
+ <0x00059000 0x00159000 0x001000>, /* ap 125 */
+ <0x0005a000 0x0015a000 0x001000>; /* ap 126 */
++ dma-ranges;
+
+ target-module@2000 { /* 0x4a102000, ap 27 3c.0 */
+ compatible = "ti,sysc";
--- /dev/null
+From 3029ad91335353a70feb42acd24d580d70ab258b Mon Sep 17 00:00:00 2001
+From: Jiaqing Zhao <jiaqing.zhao@linux.intel.com>
+Date: Mon, 24 Jul 2023 08:39:31 +0000
+Subject: can: ems_pci: move ASIX AX99100 ids to pci_ids.h
+
+From: Jiaqing Zhao <jiaqing.zhao@linux.intel.com>
+
+commit 3029ad91335353a70feb42acd24d580d70ab258b upstream.
+
+Move PCI Vendor and Device ID of ASIX AX99100 PCIe to Multi I/O
+Controller to pci_ids.h for its serial and parallel port driver
+support in subsequent patches.
+
+Signed-off-by: Jiaqing Zhao <jiaqing.zhao@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Link: https://lore.kernel.org/r/20230724083933.3173513-3-jiaqing.zhao@linux.intel.com
+[Moeko: Drop changes in drivers/net/can/sja1000/ems_pci.c]
+Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/pci_ids.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -1754,6 +1754,10 @@
+ #define PCI_SUBDEVICE_ID_AT_2700FX 0x2701
+ #define PCI_SUBDEVICE_ID_AT_2701FX 0x2703
+
++#define PCI_VENDOR_ID_ASIX 0x125b
++#define PCI_DEVICE_ID_ASIX_AX99100 0x9100
++#define PCI_DEVICE_ID_ASIX_AX99100_LB 0x9110
++
+ #define PCI_VENDOR_ID_ESS 0x125d
+ #define PCI_DEVICE_ID_ESS_ESS1968 0x1968
+ #define PCI_DEVICE_ID_ESS_ESS1978 0x1978
--- /dev/null
+From 8e65a1b7118acf6af96449e1e66b7adbc9396912 Mon Sep 17 00:00:00 2001
+From: Hersen Wu <hersenxs.wu@amd.com>
+Date: Mon, 22 Apr 2024 12:27:34 -0400
+Subject: drm/amd/display: Add NULL pointer check for kzalloc
+
+From: Hersen Wu <hersenxs.wu@amd.com>
+
+commit 8e65a1b7118acf6af96449e1e66b7adbc9396912 upstream.
+
+[Why & How]
+Check return pointer of kzalloc before using it.
+
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Acked-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Hersen Wu <hersenxs.wu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Wenshan Lan <jetlan9@163.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c | 8 ++++++++
+ drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 8 ++++++++
+ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c | 3 +++
+ drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 5 +++++
+ drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c | 5 +++++
+ drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c | 2 ++
+ drivers/gpu/drm/amd/display/dc/dcn316/dcn316_resource.c | 2 ++
+ drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c | 5 +++++
+ drivers/gpu/drm/amd/display/dc/dcn321/dcn321_resource.c | 2 ++
+ 9 files changed, 40 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c
+@@ -568,11 +568,19 @@ void dcn3_clk_mgr_construct(
+ dce_clock_read_ss_info(clk_mgr);
+
+ clk_mgr->base.bw_params = kzalloc(sizeof(*clk_mgr->base.bw_params), GFP_KERNEL);
++ if (!clk_mgr->base.bw_params) {
++ BREAK_TO_DEBUGGER();
++ return;
++ }
+
+ /* need physical address of table to give to PMFW */
+ clk_mgr->wm_range_table = dm_helpers_allocate_gpu_mem(clk_mgr->base.ctx,
+ DC_MEM_ALLOC_TYPE_GART, sizeof(WatermarksExternal_t),
+ &clk_mgr->wm_range_table_addr);
++ if (!clk_mgr->wm_range_table) {
++ BREAK_TO_DEBUGGER();
++ return;
++ }
+ }
+
+ void dcn3_clk_mgr_destroy(struct clk_mgr_internal *clk_mgr)
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c
+@@ -816,11 +816,19 @@ void dcn32_clk_mgr_construct(
+ clk_mgr->smu_present = false;
+
+ clk_mgr->base.bw_params = kzalloc(sizeof(*clk_mgr->base.bw_params), GFP_KERNEL);
++ if (!clk_mgr->base.bw_params) {
++ BREAK_TO_DEBUGGER();
++ return;
++ }
+
+ /* need physical address of table to give to PMFW */
+ clk_mgr->wm_range_table = dm_helpers_allocate_gpu_mem(clk_mgr->base.ctx,
+ DC_MEM_ALLOC_TYPE_GART, sizeof(WatermarksExternal_t),
+ &clk_mgr->wm_range_table_addr);
++ if (!clk_mgr->wm_range_table) {
++ BREAK_TO_DEBUGGER();
++ return;
++ }
+ }
+
+ void dcn32_clk_mgr_destroy(struct clk_mgr_internal *clk_mgr)
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c
+@@ -2062,6 +2062,9 @@ bool dcn30_validate_bandwidth(struct dc
+
+ BW_VAL_TRACE_COUNT();
+
++ if (!pipes)
++ goto validate_fail;
++
+ DC_FP_START();
+ out = dcn30_internal_validate_bw(dc, context, pipes, &pipe_cnt, &vlevel, fast_validate, true);
+ DC_FP_END();
+--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c
+@@ -1324,6 +1324,8 @@ static struct hpo_dp_link_encoder *dcn31
+
+ /* allocate HPO link encoder */
+ hpo_dp_enc31 = kzalloc(sizeof(struct dcn31_hpo_dp_link_encoder), GFP_KERNEL);
++ if (!hpo_dp_enc31)
++ return NULL; /* out of memory */
+
+ hpo_dp_link_encoder31_construct(hpo_dp_enc31, ctx, inst,
+ &hpo_dp_link_enc_regs[inst],
+@@ -1773,6 +1775,9 @@ bool dcn31_validate_bandwidth(struct dc
+
+ BW_VAL_TRACE_COUNT();
+
++ if (!pipes)
++ goto validate_fail;
++
+ DC_FP_START();
+ out = dcn30_internal_validate_bw(dc, context, pipes, &pipe_cnt, &vlevel, fast_validate, true);
+ DC_FP_END();
+--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c
+@@ -1372,6 +1372,8 @@ static struct hpo_dp_link_encoder *dcn31
+
+ /* allocate HPO link encoder */
+ hpo_dp_enc31 = kzalloc(sizeof(struct dcn31_hpo_dp_link_encoder), GFP_KERNEL);
++ if (!hpo_dp_enc31)
++ return NULL; /* out of memory */
+
+ hpo_dp_link_encoder31_construct(hpo_dp_enc31, ctx, inst,
+ &hpo_dp_link_enc_regs[inst],
+@@ -1743,6 +1745,9 @@ bool dcn314_validate_bandwidth(struct dc
+
+ BW_VAL_TRACE_COUNT();
+
++ if (!pipes)
++ goto validate_fail;
++
+ if (filter_modes_for_single_channel_workaround(dc, context))
+ goto validate_fail;
+
+--- a/drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c
+@@ -1325,6 +1325,8 @@ static struct hpo_dp_link_encoder *dcn31
+
+ /* allocate HPO link encoder */
+ hpo_dp_enc31 = kzalloc(sizeof(struct dcn31_hpo_dp_link_encoder), GFP_KERNEL);
++ if (!hpo_dp_enc31)
++ return NULL; /* out of memory */
+
+ hpo_dp_link_encoder31_construct(hpo_dp_enc31, ctx, inst,
+ &hpo_dp_link_enc_regs[inst],
+--- a/drivers/gpu/drm/amd/display/dc/dcn316/dcn316_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn316/dcn316_resource.c
+@@ -1322,6 +1322,8 @@ static struct hpo_dp_link_encoder *dcn31
+
+ /* allocate HPO link encoder */
+ hpo_dp_enc31 = kzalloc(sizeof(struct dcn31_hpo_dp_link_encoder), GFP_KERNEL);
++ if (!hpo_dp_enc31)
++ return NULL; /* out of memory */
+
+ hpo_dp_link_encoder31_construct(hpo_dp_enc31, ctx, inst,
+ &hpo_dp_link_enc_regs[inst],
+--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c
+@@ -1310,6 +1310,8 @@ static struct hpo_dp_link_encoder *dcn32
+
+ /* allocate HPO link encoder */
+ hpo_dp_enc31 = kzalloc(sizeof(struct dcn31_hpo_dp_link_encoder), GFP_KERNEL);
++ if (!hpo_dp_enc31)
++ return NULL; /* out of memory */
+
+ #undef REG_STRUCT
+ #define REG_STRUCT hpo_dp_link_enc_regs
+@@ -1855,6 +1857,9 @@ bool dcn32_validate_bandwidth(struct dc
+
+ BW_VAL_TRACE_COUNT();
+
++ if (!pipes)
++ goto validate_fail;
++
+ DC_FP_START();
+ out = dcn32_internal_validate_bw(dc, context, pipes, &pipe_cnt, &vlevel, fast_validate);
+ DC_FP_END();
+--- a/drivers/gpu/drm/amd/display/dc/dcn321/dcn321_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn321/dcn321_resource.c
+@@ -1296,6 +1296,8 @@ static struct hpo_dp_link_encoder *dcn32
+
+ /* allocate HPO link encoder */
+ hpo_dp_enc31 = kzalloc(sizeof(struct dcn31_hpo_dp_link_encoder), GFP_KERNEL);
++ if (!hpo_dp_enc31)
++ return NULL; /* out of memory */
+
+ #undef REG_STRUCT
+ #define REG_STRUCT hpo_dp_link_enc_regs
--- /dev/null
+From 96cfeb0389530ae32ade8a48ae3ae1ac3b6c009d Mon Sep 17 00:00:00 2001
+From: Chao Yu <chao@kernel.org>
+Date: Thu, 27 Jun 2024 15:17:11 +0800
+Subject: f2fs: fix to wait dio completion
+
+From: Chao Yu <chao@kernel.org>
+
+commit 96cfeb0389530ae32ade8a48ae3ae1ac3b6c009d upstream.
+
+It should wait all existing dio write IOs before block removal,
+otherwise, previous direct write IO may overwrite data in the
+block which may be reused by other inode.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Alva Lan <alvalan9@foxmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/file.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1048,6 +1048,13 @@ int f2fs_setattr(struct user_namespace *
+ return err;
+ }
+
++ /*
++ * wait for inflight dio, blocks should be removed after
++ * IO completion.
++ */
++ if (attr->ia_size < old_size)
++ inode_dio_wait(inode);
++
+ f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ filemap_invalidate_lock(inode->i_mapping);
+
+@@ -1880,6 +1887,12 @@ static long f2fs_fallocate(struct file *
+ if (ret)
+ goto out;
+
++ /*
++ * wait for inflight dio, blocks should be removed after IO
++ * completion.
++ */
++ inode_dio_wait(inode);
++
+ if (mode & FALLOC_FL_PUNCH_HOLE) {
+ if (offset >= inode->i_size)
+ goto out;
--- /dev/null
+From 844f104790bd69c2e4dbb9ee3eba46fde1fcea7b Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Wed, 10 Jan 2024 02:33:54 +0200
+Subject: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit 844f104790bd69c2e4dbb9ee3eba46fde1fcea7b upstream.
+
+After the blamed commit, we started doing this dereference for every
+NETDEV_CHANGEUPPER and NETDEV_PRECHANGEUPPER event in the system.
+
+static inline struct dsa_port *dsa_user_to_port(const struct net_device *dev)
+{
+ struct dsa_user_priv *p = netdev_priv(dev);
+
+ return p->dp;
+}
+
+Which is obviously bogus, because not all net_devices have a netdev_priv()
+of type struct dsa_user_priv. But struct dsa_user_priv is fairly small,
+and p->dp means dereferencing 8 bytes starting with offset 16. Most
+drivers allocate that much private memory anyway, making our access not
+fault, and we discard the bogus data quickly afterwards, so this wasn't
+caught.
+
+But the dummy interface is somewhat special in that it calls
+alloc_netdev() with a priv size of 0. So every netdev_priv() dereference
+is invalid, and we get this when we emit a NETDEV_PRECHANGEUPPER event
+with a VLAN as its new upper:
+
+$ ip link add dummy1 type dummy
+$ ip link add link dummy1 name dummy1.100 type vlan id 100
+[ 43.309174] ==================================================================
+[ 43.316456] BUG: KASAN: slab-out-of-bounds in dsa_user_prechangeupper+0x30/0xe8
+[ 43.323835] Read of size 8 at addr ffff3f86481d2990 by task ip/374
+[ 43.330058]
+[ 43.342436] Call trace:
+[ 43.366542] dsa_user_prechangeupper+0x30/0xe8
+[ 43.371024] dsa_user_netdevice_event+0xb38/0xee8
+[ 43.375768] notifier_call_chain+0xa4/0x210
+[ 43.379985] raw_notifier_call_chain+0x24/0x38
+[ 43.384464] __netdev_upper_dev_link+0x3ec/0x5d8
+[ 43.389120] netdev_upper_dev_link+0x70/0xa8
+[ 43.393424] register_vlan_dev+0x1bc/0x310
+[ 43.397554] vlan_newlink+0x210/0x248
+[ 43.401247] rtnl_newlink+0x9fc/0xe30
+[ 43.404942] rtnetlink_rcv_msg+0x378/0x580
+
+Avoid the kernel oops by dereferencing after the type check, as customary.
+
+Fixes: 4c3f80d22b2e ("net: dsa: walk through all changeupper notifier functions")
+Reported-and-tested-by: syzbot+d81bcd883824180500c8@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/0000000000001d4255060e87545c@google.com/
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/r/20240110003354.2796778-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Wenshan Lan <jetlan9@163.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/dsa/slave.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/net/dsa/slave.c
++++ b/net/dsa/slave.c
+@@ -2592,13 +2592,14 @@ EXPORT_SYMBOL_GPL(dsa_slave_dev_check);
+ static int dsa_slave_changeupper(struct net_device *dev,
+ struct netdev_notifier_changeupper_info *info)
+ {
+- struct dsa_port *dp = dsa_slave_to_port(dev);
+ struct netlink_ext_ack *extack;
+ int err = NOTIFY_DONE;
++ struct dsa_port *dp;
+
+ if (!dsa_slave_dev_check(dev))
+ return err;
+
++ dp = dsa_slave_to_port(dev);
+ extack = netdev_notifier_info_to_extack(&info->info);
+
+ if (netif_is_bridge_master(info->upper_dev)) {
+@@ -2652,11 +2653,13 @@ static int dsa_slave_changeupper(struct
+ static int dsa_slave_prechangeupper(struct net_device *dev,
+ struct netdev_notifier_changeupper_info *info)
+ {
+- struct dsa_port *dp = dsa_slave_to_port(dev);
++ struct dsa_port *dp;
+
+ if (!dsa_slave_dev_check(dev))
+ return NOTIFY_DONE;
+
++ dp = dsa_slave_to_port(dev);
++
+ if (netif_is_bridge_master(info->upper_dev) && !info->linking)
+ dsa_port_pre_bridge_leave(dp, info->upper_dev);
+ else if (netif_is_lag_master(info->upper_dev) && !info->linking)
--- /dev/null
+From c71bc6da6198a6d88df86094f1052bb581951d65 Mon Sep 17 00:00:00 2001
+From: Hangbin Liu <liuhangbin@gmail.com>
+Date: Thu, 10 Oct 2024 04:00:25 +0000
+Subject: netdevsim: print human readable IP address
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+commit c71bc6da6198a6d88df86094f1052bb581951d65 upstream.
+
+Currently, IPSec addresses are printed in hexadecimal format, which is
+not user-friendly. e.g.
+
+ # cat /sys/kernel/debug/netdevsim/netdevsim0/ports/0/ipsec
+ SA count=2 tx=20
+ sa[0] rx ipaddr=0x00000000 00000000 00000000 0100a8c0
+ sa[0] spi=0x00000101 proto=0x32 salt=0x0adecc3a crypt=1
+ sa[0] key=0x3167608a ca4f1397 43565909 941fa627
+ sa[1] tx ipaddr=0x00000000 00000000 00000000 00000000
+ sa[1] spi=0x00000100 proto=0x32 salt=0x0adecc3a crypt=1
+ sa[1] key=0x3167608a ca4f1397 43565909 941fa627
+
+This patch updates the code to print the IPSec address in a human-readable
+format for easier debug. e.g.
+
+ # cat /sys/kernel/debug/netdevsim/netdevsim0/ports/0/ipsec
+ SA count=4 tx=40
+ sa[0] tx ipaddr=0.0.0.0
+ sa[0] spi=0x00000100 proto=0x32 salt=0x0adecc3a crypt=1
+ sa[0] key=0x3167608a ca4f1397 43565909 941fa627
+ sa[1] rx ipaddr=192.168.0.1
+ sa[1] spi=0x00000101 proto=0x32 salt=0x0adecc3a crypt=1
+ sa[1] key=0x3167608a ca4f1397 43565909 941fa627
+ sa[2] tx ipaddr=::
+ sa[2] spi=0x00000100 proto=0x32 salt=0x0adecc3a crypt=1
+ sa[2] key=0x3167608a ca4f1397 43565909 941fa627
+ sa[3] rx ipaddr=2000::1
+ sa[3] spi=0x00000101 proto=0x32 salt=0x0adecc3a crypt=1
+ sa[3] key=0x3167608a ca4f1397 43565909 941fa627
+
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Link: https://patch.msgid.link/20241010040027.21440-2-liuhangbin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/netdevsim/ipsec.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/netdevsim/ipsec.c
++++ b/drivers/net/netdevsim/ipsec.c
+@@ -39,10 +39,14 @@ static ssize_t nsim_dbg_netdev_ops_read(
+ if (!sap->used)
+ continue;
+
+- p += scnprintf(p, bufsize - (p - buf),
+- "sa[%i] %cx ipaddr=0x%08x %08x %08x %08x\n",
+- i, (sap->rx ? 'r' : 't'), sap->ipaddr[0],
+- sap->ipaddr[1], sap->ipaddr[2], sap->ipaddr[3]);
++ if (sap->xs->props.family == AF_INET6)
++ p += scnprintf(p, bufsize - (p - buf),
++ "sa[%i] %cx ipaddr=%pI6c\n",
++ i, (sap->rx ? 'r' : 't'), &sap->ipaddr);
++ else
++ p += scnprintf(p, bufsize - (p - buf),
++ "sa[%i] %cx ipaddr=%pI4\n",
++ i, (sap->rx ? 'r' : 't'), &sap->ipaddr[3]);
+ p += scnprintf(p, bufsize - (p - buf),
+ "sa[%i] spi=0x%08x proto=0x%x salt=0x%08x crypt=%d\n",
+ i, be32_to_cpu(sap->xs->id.spi),
--- /dev/null
+From f8c989a0c89a75d30f899a7cabdc14d72522bb8d Mon Sep 17 00:00:00 2001
+From: Yang Erkun <yangerkun@huawei.com>
+Date: Mon, 21 Oct 2024 22:23:43 +0800
+Subject: nfsd: release svc_expkey/svc_export with rcu_work
+
+From: Yang Erkun <yangerkun@huawei.com>
+
+commit f8c989a0c89a75d30f899a7cabdc14d72522bb8d upstream.
+
+The last reference for `cache_head` can be reduced to zero in `c_show`
+and `e_show`(using `rcu_read_lock` and `rcu_read_unlock`). Consequently,
+`svc_export_put` and `expkey_put` will be invoked, leading to two
+issues:
+
+1. The `svc_export_put` will directly free ex_uuid. However,
+ `e_show`/`c_show` will access `ex_uuid` after `cache_put`, which can
+ trigger a use-after-free issue, shown below.
+
+ ==================================================================
+ BUG: KASAN: slab-use-after-free in svc_export_show+0x362/0x430 [nfsd]
+ Read of size 1 at addr ff11000010fdc120 by task cat/870
+
+ CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
+ 1.16.1-2.fc37 04/01/2014
+ Call Trace:
+ <TASK>
+ dump_stack_lvl+0x53/0x70
+ print_address_description.constprop.0+0x2c/0x3a0
+ print_report+0xb9/0x280
+ kasan_report+0xae/0xe0
+ svc_export_show+0x362/0x430 [nfsd]
+ c_show+0x161/0x390 [sunrpc]
+ seq_read_iter+0x589/0x770
+ seq_read+0x1e5/0x270
+ proc_reg_read+0xe1/0x140
+ vfs_read+0x125/0x530
+ ksys_read+0xc1/0x160
+ do_syscall_64+0x5f/0x170
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+ Allocated by task 830:
+ kasan_save_stack+0x20/0x40
+ kasan_save_track+0x14/0x30
+ __kasan_kmalloc+0x8f/0xa0
+ __kmalloc_node_track_caller_noprof+0x1bc/0x400
+ kmemdup_noprof+0x22/0x50
+ svc_export_parse+0x8a9/0xb80 [nfsd]
+ cache_do_downcall+0x71/0xa0 [sunrpc]
+ cache_write_procfs+0x8e/0xd0 [sunrpc]
+ proc_reg_write+0xe1/0x140
+ vfs_write+0x1a5/0x6d0
+ ksys_write+0xc1/0x160
+ do_syscall_64+0x5f/0x170
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+ Freed by task 868:
+ kasan_save_stack+0x20/0x40
+ kasan_save_track+0x14/0x30
+ kasan_save_free_info+0x3b/0x60
+ __kasan_slab_free+0x37/0x50
+ kfree+0xf3/0x3e0
+ svc_export_put+0x87/0xb0 [nfsd]
+ cache_purge+0x17f/0x1f0 [sunrpc]
+ nfsd_destroy_serv+0x226/0x2d0 [nfsd]
+ nfsd_svc+0x125/0x1e0 [nfsd]
+ write_threads+0x16a/0x2a0 [nfsd]
+ nfsctl_transaction_write+0x74/0xa0 [nfsd]
+ vfs_write+0x1a5/0x6d0
+ ksys_write+0xc1/0x160
+ do_syscall_64+0x5f/0x170
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+2. We cannot sleep while using `rcu_read_lock`/`rcu_read_unlock`.
+ However, `svc_export_put`/`expkey_put` will call path_put, which
+ subsequently triggers a sleeping operation due to the following
+ `dput`.
+
+ =============================
+ WARNING: suspicious RCU usage
+ 5.10.0-dirty #141 Not tainted
+ -----------------------------
+ ...
+ Call Trace:
+ dump_stack+0x9a/0xd0
+ ___might_sleep+0x231/0x240
+ dput+0x39/0x600
+ path_put+0x1b/0x30
+ svc_export_put+0x17/0x80
+ e_show+0x1c9/0x200
+ seq_read_iter+0x63f/0x7c0
+ seq_read+0x226/0x2d0
+ vfs_read+0x113/0x2c0
+ ksys_read+0xc9/0x170
+ do_syscall_64+0x33/0x40
+ entry_SYSCALL_64_after_hwframe+0x67/0xd1
+
+Fix these issues by using `rcu_work` to help release
+`svc_expkey`/`svc_export`. This approach allows for an asynchronous
+context to invoke `path_put` and also facilitates the freeing of
+`uuid/exp/key` after an RCU grace period.
+
+Fixes: 9ceddd9da134 ("knfsd: Allow lockless lookups of the exports")
+Signed-off-by: Yang Erkun <yangerkun@huawei.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Bin Lan <lanbincn@qq.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfsd/export.c | 31 +++++++++++++++++++++++++------
+ fs/nfsd/export.h | 4 ++--
+ 2 files changed, 27 insertions(+), 8 deletions(-)
+
+--- a/fs/nfsd/export.c
++++ b/fs/nfsd/export.c
+@@ -40,15 +40,24 @@
+ #define EXPKEY_HASHMAX (1 << EXPKEY_HASHBITS)
+ #define EXPKEY_HASHMASK (EXPKEY_HASHMAX -1)
+
+-static void expkey_put(struct kref *ref)
++static void expkey_put_work(struct work_struct *work)
+ {
+- struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref);
++ struct svc_expkey *key =
++ container_of(to_rcu_work(work), struct svc_expkey, ek_rcu_work);
+
+ if (test_bit(CACHE_VALID, &key->h.flags) &&
+ !test_bit(CACHE_NEGATIVE, &key->h.flags))
+ path_put(&key->ek_path);
+ auth_domain_put(key->ek_client);
+- kfree_rcu(key, ek_rcu);
++ kfree(key);
++}
++
++static void expkey_put(struct kref *ref)
++{
++ struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref);
++
++ INIT_RCU_WORK(&key->ek_rcu_work, expkey_put_work);
++ queue_rcu_work(system_wq, &key->ek_rcu_work);
+ }
+
+ static int expkey_upcall(struct cache_detail *cd, struct cache_head *h)
+@@ -351,16 +360,26 @@ static void export_stats_destroy(struct
+ EXP_STATS_COUNTERS_NUM);
+ }
+
+-static void svc_export_put(struct kref *ref)
++static void svc_export_put_work(struct work_struct *work)
+ {
+- struct svc_export *exp = container_of(ref, struct svc_export, h.ref);
++ struct svc_export *exp =
++ container_of(to_rcu_work(work), struct svc_export, ex_rcu_work);
++
+ path_put(&exp->ex_path);
+ auth_domain_put(exp->ex_client);
+ nfsd4_fslocs_free(&exp->ex_fslocs);
+ export_stats_destroy(exp->ex_stats);
+ kfree(exp->ex_stats);
+ kfree(exp->ex_uuid);
+- kfree_rcu(exp, ex_rcu);
++ kfree(exp);
++}
++
++static void svc_export_put(struct kref *ref)
++{
++ struct svc_export *exp = container_of(ref, struct svc_export, h.ref);
++
++ INIT_RCU_WORK(&exp->ex_rcu_work, svc_export_put_work);
++ queue_rcu_work(system_wq, &exp->ex_rcu_work);
+ }
+
+ static int svc_export_upcall(struct cache_detail *cd, struct cache_head *h)
+--- a/fs/nfsd/export.h
++++ b/fs/nfsd/export.h
+@@ -75,7 +75,7 @@ struct svc_export {
+ u32 ex_layout_types;
+ struct nfsd4_deviceid_map *ex_devid_map;
+ struct cache_detail *cd;
+- struct rcu_head ex_rcu;
++ struct rcu_work ex_rcu_work;
+ struct export_stats *ex_stats;
+ };
+
+@@ -91,7 +91,7 @@ struct svc_expkey {
+ u32 ek_fsid[6];
+
+ struct path ek_path;
+- struct rcu_head ek_rcu;
++ struct rcu_work ek_rcu_work;
+ };
+
+ #define EX_ISSYNC(exp) (!((exp)->ex_flags & NFSEXP_ASYNC))
--- /dev/null
+From 16aae4c64600a6319a6f10dbff833fa198bf9599 Mon Sep 17 00:00:00 2001
+From: Jiaqing Zhao <jiaqing.zhao@linux.intel.com>
+Date: Mon, 24 Jul 2023 08:39:33 +0000
+Subject: parport_pc: add support for ASIX AX99100
+
+From: Jiaqing Zhao <jiaqing.zhao@linux.intel.com>
+
+commit 16aae4c64600a6319a6f10dbff833fa198bf9599 upstream.
+
+The PCI function 2 on ASIX AX99100 PCIe to Multi I/O Controller can be
+configured as a single-port parallel port controller. The subvendor id
+is 0x2000 when configured as parallel port. It supports IEEE-1284 EPP /
+ECP with its ECR on BAR1.
+
+Signed-off-by: Jiaqing Zhao <jiaqing.zhao@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Link: https://lore.kernel.org/r/20230724083933.3173513-5-jiaqing.zhao@linux.intel.com
+Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/parport/parport_pc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/parport/parport_pc.c
++++ b/drivers/parport/parport_pc.c
+@@ -2612,6 +2612,7 @@ enum parport_pc_pci_cards {
+ netmos_9815,
+ netmos_9901,
+ netmos_9865,
++ asix_ax99100,
+ quatech_sppxp100,
+ wch_ch382l,
+ brainboxes_uc146,
+@@ -2678,6 +2679,7 @@ static struct parport_pc_pci {
+ /* netmos_9815 */ { 2, { { 0, 1 }, { 2, 3 }, } },
+ /* netmos_9901 */ { 1, { { 0, -1 }, } },
+ /* netmos_9865 */ { 1, { { 0, -1 }, } },
++ /* asix_ax99100 */ { 1, { { 0, 1 }, } },
+ /* quatech_sppxp100 */ { 1, { { 0, 1 }, } },
+ /* wch_ch382l */ { 1, { { 2, -1 }, } },
+ /* brainboxes_uc146 */ { 1, { { 3, -1 }, } },
+@@ -2770,6 +2772,9 @@ static const struct pci_device_id parpor
+ 0xA000, 0x1000, 0, 0, netmos_9865 },
+ { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9865,
+ 0xA000, 0x2000, 0, 0, netmos_9865 },
++ /* ASIX AX99100 PCIe to Multi I/O Controller */
++ { PCI_VENDOR_ID_ASIX, PCI_DEVICE_ID_ASIX_AX99100,
++ 0xA000, 0x2000, 0, 0, asix_ax99100 },
+ /* Quatech SPPXP-100 Parallel port PCI ExpressCard */
+ { PCI_VENDOR_ID_QUATECH, PCI_DEVICE_ID_QUATECH_SPPXP_100,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, quatech_sppxp100 },
--- /dev/null
+From 3ec920bb978ccdc68a7dfb304d303d598d038cb1 Mon Sep 17 00:00:00 2001
+From: Hangbin Liu <liuhangbin@gmail.com>
+Date: Thu, 10 Oct 2024 04:00:27 +0000
+Subject: selftests: rtnetlink: update netdevsim ipsec output format
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+commit 3ec920bb978ccdc68a7dfb304d303d598d038cb1 upstream.
+
+After the netdevsim update to use human-readable IP address formats for
+IPsec, we can now use the source and destination IPs directly in testing.
+Here is the result:
+ # ./rtnetlink.sh -t kci_test_ipsec_offload
+ PASS: ipsec_offload
+
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/20241010040027.21440-4-liuhangbin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/rtnetlink.sh | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/tools/testing/selftests/net/rtnetlink.sh
++++ b/tools/testing/selftests/net/rtnetlink.sh
+@@ -813,10 +813,10 @@ kci_test_ipsec_offload()
+ # does driver have correct offload info
+ diff $sysfsf - << EOF
+ SA count=2 tx=3
+-sa[0] tx ipaddr=0x00000000 00000000 00000000 00000000
++sa[0] tx ipaddr=$dstip
+ sa[0] spi=0x00000009 proto=0x32 salt=0x61626364 crypt=1
+ sa[0] key=0x34333231 38373635 32313039 36353433
+-sa[1] rx ipaddr=0x00000000 00000000 00000000 037ba8c0
++sa[1] rx ipaddr=$srcip
+ sa[1] spi=0x00000009 proto=0x32 salt=0x61626364 crypt=1
+ sa[1] key=0x34333231 38373635 32313039 36353433
+ EOF
--- /dev/null
+From 0b32216557ce3b2a468d1282d99b428bf72ff532 Mon Sep 17 00:00:00 2001
+From: Jiaqing Zhao <jiaqing.zhao@linux.intel.com>
+Date: Mon, 24 Jul 2023 08:39:32 +0000
+Subject: serial: 8250_pci: add support for ASIX AX99100
+
+From: Jiaqing Zhao <jiaqing.zhao@linux.intel.com>
+
+commit 0b32216557ce3b2a468d1282d99b428bf72ff532 upstream.
+
+Each of the 4 PCI functions on ASIX AX99100 PCIe to Multi I/O
+Controller can be configured as a single-port serial port controller.
+The subvendor id is 0x1000 when configured as serial port and MSI
+interrupts are supported.
+
+Signed-off-by: Jiaqing Zhao <jiaqing.zhao@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20230724083933.3173513-4-jiaqing.zhao@linux.intel.com
+Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_pci.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -66,6 +66,8 @@ static const struct pci_device_id pci_us
+ 0xA000, 0x1000) },
+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9922,
+ 0xA000, 0x1000) },
++ { PCI_DEVICE_SUB(PCI_VENDOR_ID_ASIX, PCI_DEVICE_ID_ASIX_AX99100,
++ 0xA000, 0x1000) },
+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_HP_3PAR, PCI_DEVICE_ID_HPE_PCI_SERIAL,
+ PCI_ANY_ID, PCI_ANY_ID) },
+ { }
+@@ -5890,6 +5892,14 @@ static const struct pci_device_id serial
+ { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9865,
+ 0xA000, 0x3004,
+ 0, 0, pbn_b0_bt_4_115200 },
++
++ /*
++ * ASIX AX99100 PCIe to Multi I/O Controller
++ */
++ { PCI_VENDOR_ID_ASIX, PCI_DEVICE_ID_ASIX_AX99100,
++ 0xA000, 0x1000,
++ 0, 0, pbn_b0_1_115200 },
++
+ /* Intel CE4100 */
+ { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CE4100_UART,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
nilfs2-do-not-output-warnings-when-clearing-dirty-buffers.patch
nilfs2-do-not-force-clear-folio-if-buffer-is-referenced.patch
nilfs2-protect-access-to-buffers-with-no-active-references.patch
+can-ems_pci-move-asix-ax99100-ids-to-pci_ids.h.patch
+serial-8250_pci-add-support-for-asix-ax99100.patch
+parport_pc-add-support-for-asix-ax99100.patch
+net-dsa-fix-netdev_priv-dereference-before-check-on-non-dsa-netdevice-events.patch
+netdevsim-print-human-readable-ip-address.patch
+selftests-rtnetlink-update-netdevsim-ipsec-output-format.patch
+nfsd-release-svc_expkey-svc_export-with-rcu_work.patch
+arm-dts-dra7-add-bus_dma_limit-for-l4-cfg-bus.patch
+f2fs-fix-to-wait-dio-completion.patch
+drm-amd-display-add-null-pointer-check-for-kzalloc.patch
+x86-i8253-disable-pit-timer-0-when-not-in-use.patch
--- /dev/null
+From 70e6b7d9ae3c63df90a7bba7700e8d5c300c3c60 Mon Sep 17 00:00:00 2001
+From: David Woodhouse <dwmw@amazon.co.uk>
+Date: Fri, 2 Aug 2024 14:55:54 +0100
+Subject: x86/i8253: Disable PIT timer 0 when not in use
+
+From: David Woodhouse <dwmw@amazon.co.uk>
+
+commit 70e6b7d9ae3c63df90a7bba7700e8d5c300c3c60 upstream.
+
+Leaving the PIT interrupt running can cause noticeable steal time for
+virtual guests. The VMM generally has a timer which toggles the IRQ input
+to the PIC and I/O APIC, which takes CPU time away from the guest. Even
+on real hardware, running the counter may use power needlessly (albeit
+not much).
+
+Make sure it's turned off if it isn't going to be used.
+
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Michael Kelley <mhkelley@outlook.com>
+Link: https://lore.kernel.org/all/20240802135555.564941-1-dwmw2@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/i8253.c | 11 +++++++++--
+ drivers/clocksource/i8253.c | 13 +++++++++----
+ include/linux/i8253.h | 1 +
+ 3 files changed, 19 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/kernel/i8253.c
++++ b/arch/x86/kernel/i8253.c
+@@ -8,6 +8,7 @@
+ #include <linux/timex.h>
+ #include <linux/i8253.h>
+
++#include <asm/hypervisor.h>
+ #include <asm/apic.h>
+ #include <asm/hpet.h>
+ #include <asm/time.h>
+@@ -39,9 +40,15 @@ static bool __init use_pit(void)
+
+ bool __init pit_timer_init(void)
+ {
+- if (!use_pit())
++ if (!use_pit()) {
++ /*
++ * Don't just ignore the PIT. Ensure it's stopped, because
++ * VMMs otherwise steal CPU time just to pointlessly waggle
++ * the (masked) IRQ.
++ */
++ clockevent_i8253_disable();
+ return false;
+-
++ }
+ clockevent_i8253_init(true);
+ global_clock_event = &i8253_clockevent;
+ return true;
+--- a/drivers/clocksource/i8253.c
++++ b/drivers/clocksource/i8253.c
+@@ -108,11 +108,8 @@ int __init clocksource_i8253_init(void)
+ #endif
+
+ #ifdef CONFIG_CLKEVT_I8253
+-static int pit_shutdown(struct clock_event_device *evt)
++void clockevent_i8253_disable(void)
+ {
+- if (!clockevent_state_oneshot(evt) && !clockevent_state_periodic(evt))
+- return 0;
+-
+ raw_spin_lock(&i8253_lock);
+
+ outb_p(0x30, PIT_MODE);
+@@ -123,6 +120,14 @@ static int pit_shutdown(struct clock_eve
+ }
+
+ raw_spin_unlock(&i8253_lock);
++}
++
++static int pit_shutdown(struct clock_event_device *evt)
++{
++ if (!clockevent_state_oneshot(evt) && !clockevent_state_periodic(evt))
++ return 0;
++
++ clockevent_i8253_disable();
+ return 0;
+ }
+
+--- a/include/linux/i8253.h
++++ b/include/linux/i8253.h
+@@ -24,6 +24,7 @@ extern raw_spinlock_t i8253_lock;
+ extern bool i8253_clear_counter_on_shutdown;
+ extern struct clock_event_device i8253_clockevent;
+ extern void clockevent_i8253_init(bool oneshot);
++extern void clockevent_i8253_disable(void);
+
+ extern void setup_pit_timer(void);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
