--- /dev/null
+From 535128158bbef07e3322a274054c670a384146c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Feb 2024 14:39:03 +0000
+Subject: afs: Increase buffer size in afs_update_volume_status()
+
+From: Daniil Dulov <d.dulov@aladdin.ru>
+
+[ Upstream commit 6ea38e2aeb72349cad50e38899b0ba6fbcb2af3d ]
+
+The max length of volume->vid value is 20 characters.
+So increase idbuf[] size up to 24 to avoid overflow.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+[DH: Actually, it's 20 + NUL, so increase it to 24 and use snprintf()]
+
+Fixes: d2ddc776a458 ("afs: Overhaul volume and server record caching and fileserver rotation")
+Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/r/20240211150442.3416-1-d.dulov@aladdin.ru/ # v1
+Link: https://lore.kernel.org/r/20240212083347.10742-1-d.dulov@aladdin.ru/ # v2
+Link: https://lore.kernel.org/r/20240219143906.138346-3-dhowells@redhat.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/volume.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/afs/volume.c b/fs/afs/volume.c
+index 4310336b9bb8c..4225bc766d464 100644
+--- a/fs/afs/volume.c
++++ b/fs/afs/volume.c
+@@ -221,7 +221,7 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key)
+ {
+ struct afs_server_list *new, *old, *discard;
+ struct afs_vldb_entry *vldb;
+- char idbuf[16];
++ char idbuf[24];
+ int ret, idsz;
+
+ _enter("");
+@@ -229,7 +229,7 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key)
+ /* We look up an ID by passing it as a decimal string in the
+ * operation's name parameter.
+ */
+- idsz = sprintf(idbuf, "%llu", volume->vid);
++ idsz = snprintf(idbuf, sizeof(idbuf), "%llu", volume->vid);
+
+ vldb = afs_vl_lookup_vldb(volume->cell, key, idbuf, idsz);
+ if (IS_ERR(vldb)) {
+--
+2.43.0
+
--- /dev/null
+From c0f22ec08dac9a066e66d1d6b2bb51b9d8b794cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 23:05:46 +0000
+Subject: bpf, scripts: Correct GPL license name
+
+From: Gianmarco Lusvardi <glusvardi@posteo.net>
+
+[ Upstream commit e37243b65d528a8a9f8b9a57a43885f8e8dfc15c ]
+
+The bpf_doc script refers to the GPL as the "GNU Privacy License".
+I strongly suspect that the author wanted to refer to the GNU General
+Public License, under which the Linux kernel is released, as, to the
+best of my knowledge, there is no license named "GNU Privacy License".
+This patch corrects the license name in the script accordingly.
+
+Fixes: 56a092c89505 ("bpf: add script and prepare bpf.h for new helpers documentation")
+Signed-off-by: Gianmarco Lusvardi <glusvardi@posteo.net>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Quentin Monnet <quentin@isovalent.com>
+Link: https://lore.kernel.org/bpf/20240213230544.930018-3-glusvardi@posteo.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/bpf_helpers_doc.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/bpf_helpers_doc.py b/scripts/bpf_helpers_doc.py
+index 15d3d83d6297c..78b7194a05521 100755
+--- a/scripts/bpf_helpers_doc.py
++++ b/scripts/bpf_helpers_doc.py
+@@ -286,7 +286,7 @@ eBPF programs can have an associated license, passed along with the bytecode
+ instructions to the kernel when the programs are loaded. The format for that
+ string is identical to the one in use for kernel modules (Dual licenses, such
+ as "Dual BSD/GPL", may be used). Some helper functions are only accessible to
+-programs that are compatible with the GNU Privacy License (GPL).
++programs that are compatible with the GNU General Public License (GNU GPL).
+
+ In order to use such helpers, the eBPF program must be loaded with the correct
+ license string passed (via **attr**) to the **bpf**\ () system call, and this
+--
+2.43.0
+
--- /dev/null
+From 27e50dab93123b63f044d5cc5cd5cd615a12e82b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jan 2024 08:32:06 -0800
+Subject: drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag
+ is set
+
+From: Erik Kurzinger <ekurzinger@nvidia.com>
+
+[ Upstream commit 3c43177ffb54ea5be97505eb8e2690e99ac96bc9 ]
+
+When waiting for a syncobj timeline point whose fence has not yet been
+submitted with the WAIT_FOR_SUBMIT flag, a callback is registered using
+drm_syncobj_fence_add_wait and the thread is put to sleep until the
+timeout expires. If the fence is submitted before then,
+drm_syncobj_add_point will wake up the sleeping thread immediately which
+will proceed to wait for the fence to be signaled.
+
+However, if the WAIT_AVAILABLE flag is used instead,
+drm_syncobj_fence_add_wait won't get called, meaning the waiting thread
+will always sleep for the full timeout duration, even if the fence gets
+submitted earlier. If it turns out that the fence *has* been submitted
+by the time it eventually wakes up, it will still indicate to userspace
+that the wait completed successfully (it won't return -ETIME), but it
+will have taken much longer than it should have.
+
+To fix this, we must call drm_syncobj_fence_add_wait if *either* the
+WAIT_FOR_SUBMIT flag or the WAIT_AVAILABLE flag is set. The only
+difference being that with WAIT_FOR_SUBMIT we will also wait for the
+fence to be signaled after it has been submitted while with
+WAIT_AVAILABLE we will return immediately.
+
+IGT test patch: https://lists.freedesktop.org/archives/igt-dev/2024-January/067537.html
+
+v1 -> v2: adjust lockdep_assert_none_held_once condition
+
+(cherry picked from commit 8c44ea81634a4a337df70a32621a5f3791be23df)
+
+Fixes: 01d6c3578379 ("drm/syncobj: add support for timeline point wait v8")
+Signed-off-by: Erik Kurzinger <ekurzinger@nvidia.com>
+Signed-off-by: Simon Ser <contact@emersion.fr>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Simon Ser <contact@emersion.fr>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240119163208.3723457-1-ekurzinger@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_syncobj.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
+index a1d2a3dc00768..9baf95a4fc9ff 100644
+--- a/drivers/gpu/drm/drm_syncobj.c
++++ b/drivers/gpu/drm/drm_syncobj.c
+@@ -898,7 +898,8 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,
+ uint64_t *points;
+ uint32_t signaled_count, i;
+
+- if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)
++ if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT |
++ DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE))
+ lockdep_assert_none_held_once();
+
+ points = kmalloc_array(count, sizeof(*points), GFP_KERNEL);
+@@ -967,7 +968,8 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,
+ * fallthough and try a 0 timeout wait!
+ */
+
+- if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) {
++ if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT |
++ DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE)) {
+ for (i = 0; i < count; ++i)
+ drm_syncobj_fence_add_wait(syncobjs[i], &entries[i]);
+ }
+--
+2.43.0
+
--- /dev/null
+From 2bccb12dcf11d8630ee133110a88ae6c28ffba89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 14:32:39 +0100
+Subject: drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit 7621350c6bb20fb6ab7eb988833ab96eac3dcbef ]
+
+DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT can't be used when we hold locks
+since we are basically waiting for userspace to do something.
+
+Holding a lock while doing so can trivial deadlock with page faults
+etc...
+
+So make lockdep complain when a driver tries to do this.
+
+v2: Add lockdep_assert_none_held() macro.
+v3: Add might_sleep() and also use lockdep_assert_none_held() in the
+ IOCTL path.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://patchwork.freedesktop.org/patch/414944/
+Stable-dep-of: 3c43177ffb54 ("drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_syncobj.c | 12 ++++++++++++
+ include/linux/lockdep.h | 5 +++++
+ 2 files changed, 17 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
+index 8b155e3377cfe..a1d2a3dc00768 100644
+--- a/drivers/gpu/drm/drm_syncobj.c
++++ b/drivers/gpu/drm/drm_syncobj.c
+@@ -325,6 +325,15 @@ int drm_syncobj_find_fence(struct drm_file *file_private,
+ if (!syncobj)
+ return -ENOENT;
+
++ /* Waiting for userspace with locks help is illegal cause that can
++ * trivial deadlock with page faults for example. Make lockdep complain
++ * about it early on.
++ */
++ if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) {
++ might_sleep();
++ lockdep_assert_none_held_once();
++ }
++
+ *fence = drm_syncobj_fence_get(syncobj);
+
+ if (*fence) {
+@@ -889,6 +898,9 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,
+ uint64_t *points;
+ uint32_t signaled_count, i;
+
++ if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)
++ lockdep_assert_none_held_once();
++
+ points = kmalloc_array(count, sizeof(*points), GFP_KERNEL);
+ if (points == NULL)
+ return -ENOMEM;
+diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h
+index b8a835fd611b2..15d92abb3f2d8 100644
+--- a/include/linux/lockdep.h
++++ b/include/linux/lockdep.h
+@@ -403,6 +403,10 @@ extern void lock_unpin_lock(struct lockdep_map *lock, struct pin_cookie);
+ WARN_ON_ONCE(debug_locks && !lockdep_is_held(l)); \
+ } while (0)
+
++#define lockdep_assert_none_held_once() do { \
++ WARN_ON_ONCE(debug_locks && current->lockdep_depth); \
++ } while (0)
++
+ #define lockdep_recursing(tsk) ((tsk)->lockdep_recursion)
+
+ #define lockdep_pin_lock(l) lock_pin_lock(&(l)->dep_map)
+@@ -479,6 +483,7 @@ struct lockdep_map { };
+ #define lockdep_assert_held_write(l) do { (void)(l); } while (0)
+ #define lockdep_assert_held_read(l) do { (void)(l); } while (0)
+ #define lockdep_assert_held_once(l) do { (void)(l); } while (0)
++#define lockdep_assert_none_held_once() do { } while (0)
+
+ #define lockdep_recursing(tsk) (0)
+
+--
+2.43.0
+
--- /dev/null
+From 095d487307322dc10f1754522afa38eefc6ed7d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jan 2024 16:55:23 +0800
+Subject: IB/hfi1: Fix a memleak in init_credit_return
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 809aa64ebff51eb170ee31a95f83b2d21efa32e2 ]
+
+When dma_alloc_coherent fails to allocate dd->cr_base[i].va,
+init_credit_return should deallocate dd->cr_base and
+dd->cr_base[i] that allocated before. Or those resources
+would be never freed and a memleak is triggered.
+
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Link: https://lore.kernel.org/r/20240112085523.3731720-1-alexious@zju.edu.cn
+Acked-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/pio.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
+index fa5de362010f2..8303c506733cc 100644
+--- a/drivers/infiniband/hw/hfi1/pio.c
++++ b/drivers/infiniband/hw/hfi1/pio.c
+@@ -2131,7 +2131,7 @@ int init_credit_return(struct hfi1_devdata *dd)
+ "Unable to allocate credit return DMA range for NUMA %d\n",
+ i);
+ ret = -ENOMEM;
+- goto done;
++ goto free_cr_base;
+ }
+ }
+ set_dev_node(&dd->pcidev->dev, dd->node);
+@@ -2139,6 +2139,10 @@ int init_credit_return(struct hfi1_devdata *dd)
+ ret = 0;
+ done:
+ return ret;
++
++free_cr_base:
++ free_credit_return(dd);
++ goto done;
+ }
+
+ void free_credit_return(struct hfi1_devdata *dd)
+--
+2.43.0
+
--- /dev/null
+From b0ed70e21c32a070603125f355487f65a1f97763 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Feb 2024 17:21:06 +0000
+Subject: ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 081a0e3b0d4c061419d3f4679dec9f68725b17e4 ]
+
+net->dev_base_seq and ipv4.dev_addr_genid are monotonically increasing.
+
+If we XOR their values, we could miss to detect if both values
+were changed with the same amount.
+
+Fixes: 0465277f6b3f ("ipv4: provide addr and netconf dump consistency info")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/devinet.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
+index 4c013f8800f0c..ed00b233cee2e 100644
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -1798,6 +1798,21 @@ static int in_dev_dump_addr(struct in_device *in_dev, struct sk_buff *skb,
+ return err;
+ }
+
++/* Combine dev_addr_genid and dev_base_seq to detect changes.
++ */
++static u32 inet_base_seq(const struct net *net)
++{
++ u32 res = atomic_read(&net->ipv4.dev_addr_genid) +
++ net->dev_base_seq;
++
++ /* Must not return 0 (see nl_dump_check_consistent()).
++ * Chose a value far away from 0.
++ */
++ if (!res)
++ res = 0x80000000;
++ return res;
++}
++
+ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
+ {
+ const struct nlmsghdr *nlh = cb->nlh;
+@@ -1849,8 +1864,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
+ idx = 0;
+ head = &tgt_net->dev_index_head[h];
+ rcu_read_lock();
+- cb->seq = atomic_read(&tgt_net->ipv4.dev_addr_genid) ^
+- tgt_net->dev_base_seq;
++ cb->seq = inet_base_seq(tgt_net);
+ hlist_for_each_entry_rcu(dev, head, index_hlist) {
+ if (idx < s_idx)
+ goto cont;
+@@ -2249,8 +2263,7 @@ static int inet_netconf_dump_devconf(struct sk_buff *skb,
+ idx = 0;
+ head = &net->dev_index_head[h];
+ rcu_read_lock();
+- cb->seq = atomic_read(&net->ipv4.dev_addr_genid) ^
+- net->dev_base_seq;
++ cb->seq = inet_base_seq(net);
+ hlist_for_each_entry_rcu(dev, head, index_hlist) {
+ if (idx < s_idx)
+ goto cont;
+--
+2.43.0
+
--- /dev/null
+From 7c70e1a8d25bf36ecd3d0ebfdc64300a19128aea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Feb 2024 17:21:07 +0000
+Subject: ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit e898e4cd1aab271ca414f9ac6e08e4c761f6913c ]
+
+net->dev_base_seq and ipv6.dev_addr_genid are monotonically increasing.
+
+If we XOR their values, we could miss to detect if both values
+were changed with the same amount.
+
+Fixes: 63998ac24f83 ("ipv6: provide addr and netconf dump consistency info")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/addrconf.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 4bec4c0617412..6fcbe8912b431 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -696,6 +696,22 @@ static int inet6_netconf_get_devconf(struct sk_buff *in_skb,
+ return err;
+ }
+
++/* Combine dev_addr_genid and dev_base_seq to detect changes.
++ */
++static u32 inet6_base_seq(const struct net *net)
++{
++ u32 res = atomic_read(&net->ipv6.dev_addr_genid) +
++ net->dev_base_seq;
++
++ /* Must not return 0 (see nl_dump_check_consistent()).
++ * Chose a value far away from 0.
++ */
++ if (!res)
++ res = 0x80000000;
++ return res;
++}
++
++
+ static int inet6_netconf_dump_devconf(struct sk_buff *skb,
+ struct netlink_callback *cb)
+ {
+@@ -729,8 +745,7 @@ static int inet6_netconf_dump_devconf(struct sk_buff *skb,
+ idx = 0;
+ head = &net->dev_index_head[h];
+ rcu_read_lock();
+- cb->seq = atomic_read(&net->ipv6.dev_addr_genid) ^
+- net->dev_base_seq;
++ cb->seq = inet6_base_seq(net);
+ hlist_for_each_entry_rcu(dev, head, index_hlist) {
+ if (idx < s_idx)
+ goto cont;
+@@ -5232,7 +5247,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
+ }
+
+ rcu_read_lock();
+- cb->seq = atomic_read(&tgt_net->ipv6.dev_addr_genid) ^ tgt_net->dev_base_seq;
++ cb->seq = inet6_base_seq(tgt_net);
+ for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
+ idx = 0;
+ head = &tgt_net->dev_index_head[h];
+--
+2.43.0
+
--- /dev/null
+From 641284a9b6f46dde8ce8fb29c677e9a3b26c6d86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Feb 2024 23:27:17 +0300
+Subject: ipv6: sr: fix possible use-after-free and null-ptr-deref
+
+From: Vasiliy Kovalev <kovalev@altlinux.org>
+
+[ Upstream commit 5559cea2d5aa3018a5f00dd2aca3427ba09b386b ]
+
+The pernet operations structure for the subsystem must be registered
+before registering the generic netlink family.
+
+Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6")
+Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
+Link: https://lore.kernel.org/r/20240215202717.29815-1-kovalev@altlinux.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/seg6.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
+index f5c448c276fef..7094f8691ac68 100644
+--- a/net/ipv6/seg6.c
++++ b/net/ipv6/seg6.c
+@@ -441,22 +441,24 @@ int __init seg6_init(void)
+ {
+ int err = -ENOMEM;
+
+- err = genl_register_family(&seg6_genl_family);
++ err = register_pernet_subsys(&ip6_segments_ops);
+ if (err)
+ goto out;
+
+- err = register_pernet_subsys(&ip6_segments_ops);
++ err = genl_register_family(&seg6_genl_family);
+ if (err)
+- goto out_unregister_genl;
++ goto out_unregister_pernet;
+
+ #ifdef CONFIG_IPV6_SEG6_LWTUNNEL
+ err = seg6_iptunnel_init();
+ if (err)
+- goto out_unregister_pernet;
++ goto out_unregister_genl;
+
+ err = seg6_local_init();
+- if (err)
+- goto out_unregister_pernet;
++ if (err) {
++ seg6_iptunnel_exit();
++ goto out_unregister_genl;
++ }
+ #endif
+
+ #ifdef CONFIG_IPV6_SEG6_HMAC
+@@ -477,11 +479,11 @@ int __init seg6_init(void)
+ #endif
+ #endif
+ #ifdef CONFIG_IPV6_SEG6_LWTUNNEL
+-out_unregister_pernet:
+- unregister_pernet_subsys(&ip6_segments_ops);
+-#endif
+ out_unregister_genl:
+ genl_unregister_family(&seg6_genl_family);
++#endif
++out_unregister_pernet:
++ unregister_pernet_subsys(&ip6_segments_ops);
+ goto out;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 8c4fb0854a2c3807a25adf02eb262c56f0ed429b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Feb 2024 16:58:04 +0100
+Subject: netfilter: nf_tables: set dormant flag on hook register failure
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit bccebf64701735533c8db37773eeacc6566cc8ec ]
+
+We need to set the dormant flag again if we fail to register
+the hooks.
+
+During memory pressure hook registration can fail and we end up
+with a table marked as active but no registered hooks.
+
+On table/base chain deletion, nf_tables will attempt to unregister
+the hook again which yields a warn splat from the nftables core.
+
+Reported-and-tested-by: syzbot+de4025c006ec68ac56fc@syzkaller.appspotmail.com
+Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 6c83d3e169c9c..c5dbb950822fd 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -951,6 +951,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx)
+ return 0;
+
+ err_register_hooks:
++ ctx->table->flags |= NFT_TABLE_F_DORMANT;
+ nft_trans_destroy(trans);
+ return ret;
+ }
+--
+2.43.0
+
--- /dev/null
+From 66ad66ace65e4e4da1191fa62d1501936386b7d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 10:57:37 +0100
+Subject: nouveau: fix function cast warnings
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 0affdba22aca5573f9d989bcb1d71d32a6a03efe ]
+
+clang-16 warns about casting between incompatible function types:
+
+drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c:161:10: error: cast from 'void (*)(const struct firmware *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+ 161 | .fini = (void(*)(void *))release_firmware,
+
+This one was done to use the generic shadow_fw_release() function as a
+callback for struct nvbios_source. Change it to use the same prototype
+as the other five instances, with a trivial helper function that actually
+calls release_firmware.
+
+Fixes: 70c0f263cc2e ("drm/nouveau/bios: pull in basic vbios subdev, more to come later")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Danilo Krummrich <dakr@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240213095753.455062-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
+index 4b571cc6bc70f..6597def18627e 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
+@@ -154,11 +154,17 @@ shadow_fw_init(struct nvkm_bios *bios, const char *name)
+ return (void *)fw;
+ }
+
++static void
++shadow_fw_release(void *fw)
++{
++ release_firmware(fw);
++}
++
+ static const struct nvbios_source
+ shadow_fw = {
+ .name = "firmware",
+ .init = shadow_fw_init,
+- .fini = (void(*)(void *))release_firmware,
++ .fini = shadow_fw_release,
+ .read = shadow_fw_read,
+ .rw = false,
+ };
+--
+2.43.0
+
--- /dev/null
+From 66789dfe4fc040c7a0a222734292fa2389d9b9da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Aug 2022 23:02:27 +0200
+Subject: packet: move from strlcpy with unused retval to strscpy
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 8fc9d51ea2d32a05f7d7cf86a25cc86ecc57eb45 ]
+
+Follow the advice of the below link and prefer 'strscpy' in this
+subsystem. Conversion is 1:1 because the return value is not used.
+Generated by a coccinelle script.
+
+Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Link: https://lore.kernel.org/r/20220818210227.8611-1-wsa+renesas@sang-engineering.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: a7d6027790ac ("arp: Prevent overflow in arp_req_get().")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 600a84a5c582a..451f9c43b34b8 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1850,7 +1850,7 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,
+ */
+
+ spkt->spkt_family = dev->type;
+- strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
++ strscpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
+ spkt->spkt_protocol = skb->protocol;
+
+ /*
+@@ -3511,7 +3511,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
+ rcu_read_lock();
+ dev = dev_get_by_index_rcu(sock_net(sk), READ_ONCE(pkt_sk(sk)->ifindex));
+ if (dev)
+- strlcpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data));
++ strscpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data));
+ rcu_read_unlock();
+
+ return sizeof(*uaddr);
+--
+2.43.0
+
--- /dev/null
+From 1f3e2128daaef2423f20e5e7cf093358b6b1f4d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 20:54:36 -0800
+Subject: RDMA/bnxt_re: Return error for SRQ resize
+
+From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+
+[ Upstream commit 3687b450c5f32e80f179ce4b09e0454da1449eac ]
+
+SRQ resize is not supported in the driver. But driver is not
+returning error from bnxt_re_modify_srq() for SRQ resize.
+
+Fixes: 37cb11acf1f7 ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters")
+Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Link: https://lore.kernel.org/r/1705985677-15551-5-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index 183f1c3c1f5ef..c9a7c03403ac0 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -1623,7 +1623,7 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr,
+ switch (srq_attr_mask) {
+ case IB_SRQ_MAX_WR:
+ /* SRQ resize is not supported */
+- break;
++ return -EINVAL;
+ case IB_SRQ_LIMIT:
+ /* Change the SRQ threshold */
+ if (srq_attr->srq_limit > srq->qplib_srq.max_wqe)
+@@ -1638,13 +1638,12 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr,
+ /* On success, update the shadow */
+ srq->srq_limit = srq_attr->srq_limit;
+ /* No need to Build and send response back to udata */
+- break;
++ return 0;
+ default:
+ dev_err(rdev_to_dev(rdev),
+ "Unsupported srq_attr_mask 0x%x", srq_attr_mask);
+ return -EINVAL;
+ }
+- return 0;
+ }
+
+ int bnxt_re_query_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr)
+--
+2.43.0
+
--- /dev/null
+From 27be4d398dbcb400f954b4ed2801dd82fd198f0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 11:07:13 +0100
+Subject: RDMA/srpt: fix function pointer cast warnings
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit eb5c7465c3240151cd42a55c7ace9da0026308a1 ]
+
+clang-16 notices that srpt_qp_event() gets called through an incompatible
+pointer here:
+
+drivers/infiniband/ulp/srpt/ib_srpt.c:1815:5: error: cast from 'void (*)(struct ib_event *, struct srpt_rdma_ch *)' to 'void (*)(struct ib_event *, void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+ 1815 | = (void(*)(struct ib_event *, void*))srpt_qp_event;
+
+Change srpt_qp_event() to use the correct prototype and adjust the
+argument inside of it.
+
+Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20240213100728.458348-1-arnd@kernel.org
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index ccd9811c6c1e2..d03a4f2e006fb 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -213,10 +213,12 @@ static const char *get_ch_state_name(enum rdma_ch_state s)
+ /**
+ * srpt_qp_event - QP event callback function
+ * @event: Description of the event that occurred.
+- * @ch: SRPT RDMA channel.
++ * @ptr: SRPT RDMA channel.
+ */
+-static void srpt_qp_event(struct ib_event *event, struct srpt_rdma_ch *ch)
++static void srpt_qp_event(struct ib_event *event, void *ptr)
+ {
++ struct srpt_rdma_ch *ch = ptr;
++
+ pr_debug("QP event %d on ch=%p sess_name=%s-%d state=%s\n",
+ event->event, ch, ch->sess_name, ch->qp->qp_num,
+ get_ch_state_name(ch->state));
+@@ -1802,8 +1804,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
+ }
+
+ qp_init->qp_context = (void *)ch;
+- qp_init->event_handler
+- = (void(*)(struct ib_event *, void*))srpt_qp_event;
++ qp_init->event_handler = srpt_qp_event;
+ qp_init->send_cq = ch->cq;
+ qp_init->recv_cq = ch->cq;
+ qp_init->sq_sig_type = IB_SIGNAL_REQ_WR;
+--
+2.43.0
+
--- /dev/null
+From a70716a39f2c4bf1af379a8b794c2f960a232901 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 May 2020 10:22:10 -0700
+Subject: RDMA/srpt: Make debug output more detailed
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit d4ee7f3a4445ec1b0b88af216f4032c4d30abf5a ]
+
+Since the session name by itself is not sufficient to uniquely identify a
+queue pair, include the queue pair number. Show the ASCII channel state
+name instead of the numeric value. This change makes the ib_srpt debug
+output more consistent.
+
+Link: https://lore.kernel.org/r/20200525172212.14413-3-bvanassche@acm.org
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Stable-dep-of: eb5c7465c324 ("RDMA/srpt: fix function pointer cast warnings")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index 2822ca5e82779..ccd9811c6c1e2 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -217,8 +217,9 @@ static const char *get_ch_state_name(enum rdma_ch_state s)
+ */
+ static void srpt_qp_event(struct ib_event *event, struct srpt_rdma_ch *ch)
+ {
+- pr_debug("QP event %d on ch=%p sess_name=%s state=%d\n",
+- event->event, ch, ch->sess_name, ch->state);
++ pr_debug("QP event %d on ch=%p sess_name=%s-%d state=%s\n",
++ event->event, ch, ch->sess_name, ch->qp->qp_num,
++ get_ch_state_name(ch->state));
+
+ switch (event->event) {
+ case IB_EVENT_COMM_EST:
+@@ -2005,8 +2006,8 @@ static void __srpt_close_all_ch(struct srpt_port *sport)
+ list_for_each_entry(nexus, &sport->nexus_list, entry) {
+ list_for_each_entry(ch, &nexus->ch_list, list) {
+ if (srpt_disconnect_ch(ch) >= 0)
+- pr_info("Closing channel %s because target %s_%d has been disabled\n",
+- ch->sess_name,
++ pr_info("Closing channel %s-%d because target %s_%d has been disabled\n",
++ ch->sess_name, ch->qp->qp_num,
+ dev_name(&sport->sdev->device->dev),
+ sport->port);
+ srpt_close_ch(ch);
+--
+2.43.0
+
--- /dev/null
+From 422f78d1080194c9bfe6d9449cb97456658e10f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 20:48:14 -0400
+Subject: s390: use the correct count for __iowrite64_copy()
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 723a2cc8d69d4342b47dfddbfe6c19f1b135f09b ]
+
+The signature for __iowrite64_copy() requires the number of 64 bit
+quantities, not bytes. Multiple by 8 to get to a byte length before
+invoking zpci_memcpy_toio()
+
+Fixes: 87bc359b9822 ("s390/pci: speed up __iowrite64_copy by using pci store block insn")
+Acked-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Link: https://lore.kernel.org/r/0-v1-9223d11a7662+1d7785-s390_iowrite64_jgg@nvidia.com
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/pci/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
+index b8ddacf1efe11..8d241f3c3b78b 100644
+--- a/arch/s390/pci/pci.c
++++ b/arch/s390/pci/pci.c
+@@ -223,7 +223,7 @@ resource_size_t pcibios_align_resource(void *data, const struct resource *res,
+ /* combine single writes by using store-block insn */
+ void __iowrite64_copy(void __iomem *to, const void *from, size_t count)
+ {
+- zpci_memcpy_toio(to, from, count);
++ zpci_memcpy_toio(to, from, count * 8);
+ }
+
+ void __iomem *ioremap(unsigned long ioaddr, unsigned long size)
+--
+2.43.0
+
--- /dev/null
+From 3b32be33273af19784c071482fbd0b3755701a4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Oct 2019 20:07:37 -0700
+Subject: scripts/bpf: teach bpf_helpers_doc.py to dump BPF helper definitions
+
+From: Andrii Nakryiko <andriin@fb.com>
+
+[ Upstream commit 7a387bed47f7e80e257d966cd64a3e92a63e26a1 ]
+
+Enhance scripts/bpf_helpers_doc.py to emit C header with BPF helper
+definitions (to be included from libbpf's bpf_helpers.h).
+
+Signed-off-by: Andrii Nakryiko <andriin@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: e37243b65d52 ("bpf, scripts: Correct GPL license name")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/bpf_helpers_doc.py | 155 ++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 154 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/bpf_helpers_doc.py b/scripts/bpf_helpers_doc.py
+index 894cc58c1a034..15d3d83d6297c 100755
+--- a/scripts/bpf_helpers_doc.py
++++ b/scripts/bpf_helpers_doc.py
+@@ -391,6 +391,154 @@ SEE ALSO
+
+ print('')
+
++class PrinterHelpers(Printer):
++ """
++ A printer for dumping collected information about helpers as C header to
++ be included from BPF program.
++ @helpers: array of Helper objects to print to standard output
++ """
++
++ type_fwds = [
++ 'struct bpf_fib_lookup',
++ 'struct bpf_perf_event_data',
++ 'struct bpf_perf_event_value',
++ 'struct bpf_sock',
++ 'struct bpf_sock_addr',
++ 'struct bpf_sock_ops',
++ 'struct bpf_sock_tuple',
++ 'struct bpf_spin_lock',
++ 'struct bpf_sysctl',
++ 'struct bpf_tcp_sock',
++ 'struct bpf_tunnel_key',
++ 'struct bpf_xfrm_state',
++ 'struct pt_regs',
++ 'struct sk_reuseport_md',
++ 'struct sockaddr',
++ 'struct tcphdr',
++
++ 'struct __sk_buff',
++ 'struct sk_msg_md',
++ 'struct xpd_md',
++ ]
++ known_types = {
++ '...',
++ 'void',
++ 'const void',
++ 'char',
++ 'const char',
++ 'int',
++ 'long',
++ 'unsigned long',
++
++ '__be16',
++ '__be32',
++ '__wsum',
++
++ 'struct bpf_fib_lookup',
++ 'struct bpf_perf_event_data',
++ 'struct bpf_perf_event_value',
++ 'struct bpf_sock',
++ 'struct bpf_sock_addr',
++ 'struct bpf_sock_ops',
++ 'struct bpf_sock_tuple',
++ 'struct bpf_spin_lock',
++ 'struct bpf_sysctl',
++ 'struct bpf_tcp_sock',
++ 'struct bpf_tunnel_key',
++ 'struct bpf_xfrm_state',
++ 'struct pt_regs',
++ 'struct sk_reuseport_md',
++ 'struct sockaddr',
++ 'struct tcphdr',
++ }
++ mapped_types = {
++ 'u8': '__u8',
++ 'u16': '__u16',
++ 'u32': '__u32',
++ 'u64': '__u64',
++ 's8': '__s8',
++ 's16': '__s16',
++ 's32': '__s32',
++ 's64': '__s64',
++ 'size_t': 'unsigned long',
++ 'struct bpf_map': 'void',
++ 'struct sk_buff': 'struct __sk_buff',
++ 'const struct sk_buff': 'const struct __sk_buff',
++ 'struct sk_msg_buff': 'struct sk_msg_md',
++ 'struct xdp_buff': 'struct xdp_md',
++ }
++
++ def print_header(self):
++ header = '''\
++/* This is auto-generated file. See bpf_helpers_doc.py for details. */
++
++/* Forward declarations of BPF structs */'''
++
++ print(header)
++ for fwd in self.type_fwds:
++ print('%s;' % fwd)
++ print('')
++
++ def print_footer(self):
++ footer = ''
++ print(footer)
++
++ def map_type(self, t):
++ if t in self.known_types:
++ return t
++ if t in self.mapped_types:
++ return self.mapped_types[t]
++ print("")
++ print("Unrecognized type '%s', please add it to known types!" % t)
++ sys.exit(1)
++
++ seen_helpers = set()
++
++ def print_one(self, helper):
++ proto = helper.proto_break_down()
++
++ if proto['name'] in self.seen_helpers:
++ return
++ self.seen_helpers.add(proto['name'])
++
++ print('/*')
++ print(" * %s" % proto['name'])
++ print(" *")
++ if (helper.desc):
++ # Do not strip all newline characters: formatted code at the end of
++ # a section must be followed by a blank line.
++ for line in re.sub('\n$', '', helper.desc, count=1).split('\n'):
++ print(' *{}{}'.format(' \t' if line else '', line))
++
++ if (helper.ret):
++ print(' *')
++ print(' * Returns')
++ for line in helper.ret.rstrip().split('\n'):
++ print(' *{}{}'.format(' \t' if line else '', line))
++
++ print(' */')
++ print('static %s %s(*%s)(' % (self.map_type(proto['ret_type']),
++ proto['ret_star'], proto['name']), end='')
++ comma = ''
++ for i, a in enumerate(proto['args']):
++ t = a['type']
++ n = a['name']
++ if proto['name'] == 'bpf_get_socket_cookie' and i == 0:
++ t = 'void'
++ n = 'ctx'
++ one_arg = '{}{}'.format(comma, self.map_type(t))
++ if n:
++ if a['star']:
++ one_arg += ' {}'.format(a['star'])
++ else:
++ one_arg += ' '
++ one_arg += '{}'.format(n)
++ comma = ', '
++ print(one_arg, end='')
++
++ print(') = (void *) %d;' % len(self.seen_helpers))
++ print('')
++
+ ###############################################################################
+
+ # If script is launched from scripts/ from kernel tree and can access
+@@ -405,6 +553,8 @@ Parse eBPF header file and generate documentation for eBPF helper functions.
+ The RST-formatted output produced can be turned into a manual page with the
+ rst2man utility.
+ """)
++argParser.add_argument('--header', action='store_true',
++ help='generate C header file')
+ if (os.path.isfile(bpfh)):
+ argParser.add_argument('--filename', help='path to include/uapi/linux/bpf.h',
+ default=bpfh)
+@@ -417,5 +567,8 @@ headerParser = HeaderParser(args.filename)
+ headerParser.run()
+
+ # Print formatted output to standard output.
+-printer = PrinterRST(headerParser.helpers)
++if args.header:
++ printer = PrinterHelpers(headerParser.helpers)
++else:
++ printer = PrinterRST(headerParser.helpers)
+ printer.print_all()
+--
+2.43.0
+
--- /dev/null
+From a20baf2ebc056e9a4d2e356c1dffe5c2e626d158 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 21:59:53 -0800
+Subject: scsi: jazz_esp: Only build if SCSI core is builtin
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 9ddf190a7df77b77817f955fdb9c2ae9d1c9c9a3 ]
+
+JAZZ_ESP is a bool kconfig symbol that selects SCSI_SPI_ATTRS. When
+CONFIG_SCSI=m, this results in SCSI_SPI_ATTRS=m while JAZZ_ESP=y, which
+causes many undefined symbol linker errors.
+
+Fix this by only offering to build this driver when CONFIG_SCSI=y.
+
+[mkp: JAZZ_ESP is unique in that it does not support being compiled as a
+module unlike the remaining SPI SCSI HBA drivers]
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/r/20240214055953.9612-1-rdunlap@infradead.org
+Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Cc: linux-mips@vger.kernel.org
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Masahiro Yamada <masahiroy@kernel.org>
+Cc: Nicolas Schier <nicolas@fjasle.eu>
+Cc: James E.J. Bottomley <jejb@linux.ibm.com>
+Cc: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: linux-scsi@vger.kernel.org
+Cc: Geert Uytterhoeven <geert@linux-m68k.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202402112222.Gl0udKyU-lkp@intel.com/
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
+index 51bbc858a944c..cab6e67ea606b 100644
+--- a/drivers/scsi/Kconfig
++++ b/drivers/scsi/Kconfig
+@@ -1286,7 +1286,7 @@ source "drivers/scsi/arm/Kconfig"
+
+ config JAZZ_ESP
+ bool "MIPS JAZZ FAS216 SCSI support"
+- depends on MACH_JAZZ && SCSI
++ depends on MACH_JAZZ && SCSI=y
+ select SCSI_SPI_ATTRS
+ help
+ This is the driver for the onboard SCSI host adapter of MIPS Magnum
+--
+2.43.0
+
usb-cdns3-fix-memory-double-free-when-handle-zero-packet.patch
usb-gadget-ncm-avoid-dropping-datagrams-of-properly-parsed-ntbs.patch
usb-roles-don-t-get-set_role-when-usb_role_switch-is-unregistered.patch
+ib-hfi1-fix-a-memleak-in-init_credit_return.patch
+rdma-bnxt_re-return-error-for-srq-resize.patch
+rdma-srpt-make-debug-output-more-detailed.patch
+rdma-srpt-fix-function-pointer-cast-warnings.patch
+scripts-bpf-teach-bpf_helpers_doc.py-to-dump-bpf-hel.patch
+bpf-scripts-correct-gpl-license-name.patch
+scsi-jazz_esp-only-build-if-scsi-core-is-builtin.patch
+nouveau-fix-function-cast-warnings.patch
+ipv4-properly-combine-dev_base_seq-and-ipv4.dev_addr.patch
+ipv6-properly-combine-dev_base_seq-and-ipv6.dev_addr.patch
+afs-increase-buffer-size-in-afs_update_volume_status.patch
+ipv6-sr-fix-possible-use-after-free-and-null-ptr-der.patch
+packet-move-from-strlcpy-with-unused-retval-to-strsc.patch
+s390-use-the-correct-count-for-__iowrite64_copy.patch
+tls-rx-jump-to-a-more-appropriate-label.patch
+tls-rx-drop-pointless-else-after-goto.patch
+tls-stop-recv-if-initial-process_rx_list-gave-us-non.patch
+netfilter-nf_tables-set-dormant-flag-on-hook-registe.patch
+drm-syncobj-make-lockdep-complain-on-wait_for_submit.patch
+drm-syncobj-call-drm_syncobj_fence_add_wait-when-wai.patch
--- /dev/null
+From dc67caebe13b0c9ef56e3fe7420c91aa26ae9ec2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Apr 2022 20:38:15 -0700
+Subject: tls: rx: drop pointless else after goto
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit d5123edd10cf9d324fcb88e276bdc7375f3c5321 ]
+
+Pointless else branch after goto makes the code harder to refactor
+down the line.
+
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Stable-dep-of: fdfbaec5923d ("tls: stop recv() if initial process_rx_list gave us non-DATA")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 606a51237c50f..fb7428f222a8f 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1777,10 +1777,9 @@ int tls_sw_recvmsg(struct sock *sk,
+ if (err < 0) {
+ tls_err_abort(sk, err);
+ goto end;
+- } else {
+- copied = err;
+ }
+
++ copied = err;
+ if (len <= copied)
+ goto end;
+
+--
+2.43.0
+
--- /dev/null
+From c1198c25292d4bca2ce28a60f827c879408613d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Apr 2022 20:38:14 -0700
+Subject: tls: rx: jump to a more appropriate label
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit bfc06e1aaa130b86a81ce3c41ec71a2f5e191690 ]
+
+'recv_end:' checks num_async and decrypted, and is then followed
+by the 'end' label. Since we know that decrypted and num_async
+are 0 at the start we can jump to 'end'.
+
+Move the init of decrypted and num_async to let the compiler
+catch if I'm wrong.
+
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Stable-dep-of: fdfbaec5923d ("tls: stop recv() if initial process_rx_list gave us non-DATA")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 38592d0871a3f..606a51237c50f 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1748,6 +1748,7 @@ int tls_sw_recvmsg(struct sock *sk,
+ struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
+ struct tls_prot_info *prot = &tls_ctx->prot_info;
+ struct sk_psock *psock;
++ int num_async, pending;
+ unsigned char control = 0;
+ ssize_t decrypted = 0;
+ struct strp_msg *rxm;
+@@ -1760,8 +1761,6 @@ int tls_sw_recvmsg(struct sock *sk,
+ bool is_kvec = iov_iter_is_kvec(&msg->msg_iter);
+ bool is_peek = flags & MSG_PEEK;
+ bool bpf_strp_enabled;
+- int num_async = 0;
+- int pending;
+
+ flags |= nonblock;
+
+@@ -1783,12 +1782,14 @@ int tls_sw_recvmsg(struct sock *sk,
+ }
+
+ if (len <= copied)
+- goto recv_end;
++ goto end;
+
+ target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
+ len = len - copied;
+ timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
+
++ decrypted = 0;
++ num_async = 0;
+ while (len && (decrypted + copied < target || ctx->recv_pkt)) {
+ bool retain_skb = false;
+ bool zc = false;
+--
+2.43.0
+
--- /dev/null
+From 1cf42821be21152e5b6e0f3847c439ffec22c3bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Feb 2024 17:17:30 +0100
+Subject: tls: stop recv() if initial process_rx_list gave us non-DATA
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit fdfbaec5923d9359698cbb286bc0deadbb717504 ]
+
+If we have a non-DATA record on the rx_list and another record of the
+same type still on the queue, we will end up merging them:
+ - process_rx_list copies the non-DATA record
+ - we start the loop and process the first available record since it's
+ of the same type
+ - we break out of the loop since the record was not DATA
+
+Just check the record type and jump to the end in case process_rx_list
+did some work.
+
+Fixes: 692d7b5d1f91 ("tls: Fix recvmsg() to be able to peek across multiple records")
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://lore.kernel.org/r/bd31449e43bd4b6ff546f5c51cf958c31c511deb.1708007371.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index fb7428f222a8f..910da98d6bfb3 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1780,7 +1780,7 @@ int tls_sw_recvmsg(struct sock *sk,
+ }
+
+ copied = err;
+- if (len <= copied)
++ if (len <= copied || (copied && control != TLS_RECORD_TYPE_DATA))
+ goto end;
+
+ target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
+--
+2.43.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
