]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
6.1-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 24 Jun 2024 16:38:44 +0000 (18:38 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 24 Jun 2024 16:38:44 +0000 (18:38 +0200)
added patches:
alsa-hda-realtek-fix-mute-micmute-leds-don-t-work-for-probook-445-465-g11.patch
alsa-hda-realtek-limit-mic-boost-on-n14ap7.patch
btrfs-retry-block-group-reclaim-without-infinite-loop.patch
cifs-fix-typo-in-module-parameter-enable_gcm_256.patch
drm-amdgpu-fix-ubsan-warning-in-kv_dpm.c.patch
drm-i915-mso-using-joiner-is-not-possible-with-edp-mso.patch
drm-radeon-fix-ubsan-warning-in-kv_dpm.c.patch
gcov-add-support-for-gcc-14.patch
kcov-don-t-lose-track-of-remote-references-during-softirqs.patch
kvm-arm64-disassociate-vcpus-from-redistributor-region-on-teardown.patch
kvm-fix-a-data-race-on-last_boosted_vcpu-in-kvm_vcpu_on_spin.patch
kvm-x86-always-sync-pir-to-irr-prior-to-scanning-i-o-apic-routes.patch
net-do-not-leave-a-dangling-sk-pointer-when-socket-creation-fails.patch
net-stmmac-assign-configured-channel-value-to-extts-event.patch
net-usb-ax88179_178a-improve-reset-check.patch

16 files changed:
queue-6.1/alsa-hda-realtek-fix-mute-micmute-leds-don-t-work-for-probook-445-465-g11.patch [new file with mode: 0644]
queue-6.1/alsa-hda-realtek-limit-mic-boost-on-n14ap7.patch [new file with mode: 0644]
queue-6.1/btrfs-retry-block-group-reclaim-without-infinite-loop.patch [new file with mode: 0644]
queue-6.1/cifs-fix-typo-in-module-parameter-enable_gcm_256.patch [new file with mode: 0644]
queue-6.1/drm-amdgpu-fix-ubsan-warning-in-kv_dpm.c.patch [new file with mode: 0644]
queue-6.1/drm-i915-mso-using-joiner-is-not-possible-with-edp-mso.patch [new file with mode: 0644]
queue-6.1/drm-radeon-fix-ubsan-warning-in-kv_dpm.c.patch [new file with mode: 0644]
queue-6.1/gcov-add-support-for-gcc-14.patch [new file with mode: 0644]
queue-6.1/kcov-don-t-lose-track-of-remote-references-during-softirqs.patch [new file with mode: 0644]
queue-6.1/kvm-arm64-disassociate-vcpus-from-redistributor-region-on-teardown.patch [new file with mode: 0644]
queue-6.1/kvm-fix-a-data-race-on-last_boosted_vcpu-in-kvm_vcpu_on_spin.patch [new file with mode: 0644]
queue-6.1/kvm-x86-always-sync-pir-to-irr-prior-to-scanning-i-o-apic-routes.patch [new file with mode: 0644]
queue-6.1/net-do-not-leave-a-dangling-sk-pointer-when-socket-creation-fails.patch [new file with mode: 0644]
queue-6.1/net-stmmac-assign-configured-channel-value-to-extts-event.patch [new file with mode: 0644]
queue-6.1/net-usb-ax88179_178a-improve-reset-check.patch [new file with mode: 0644]
queue-6.1/series

diff --git a/queue-6.1/alsa-hda-realtek-fix-mute-micmute-leds-don-t-work-for-probook-445-465-g11.patch b/queue-6.1/alsa-hda-realtek-fix-mute-micmute-leds-don-t-work-for-probook-445-465-g11.patch
new file mode 100644 (file)
index 0000000..e2d3a9f
--- /dev/null
@@ -0,0 +1,34 @@
+From ea5f8c4cffcd8a6b62b3a3bd5008275218c9d02a Mon Sep 17 00:00:00 2001
+From: Andy Chi <andy.chi@canonical.com>
+Date: Wed, 5 Jun 2024 17:22:41 +0800
+Subject: ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 445/465 G11.
+
+From: Andy Chi <andy.chi@canonical.com>
+
+commit ea5f8c4cffcd8a6b62b3a3bd5008275218c9d02a upstream.
+
+HP ProBook 445/465 G11 needs ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF quirk to
+make mic-mute/audio-mute working.
+
+Signed-off-by: Andy Chi <andy.chi@canonical.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20240605092243.41963-1-andy.chi@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9803,6 +9803,10 @@ static const struct snd_pci_quirk alc269
+       SND_PCI_QUIRK(0x103c, 0x8c70, "HP EliteBook 835 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
+       SND_PCI_QUIRK(0x103c, 0x8c71, "HP EliteBook 845 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
+       SND_PCI_QUIRK(0x103c, 0x8c72, "HP EliteBook 865 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
++      SND_PCI_QUIRK(0x103c, 0x8c7b, "HP ProBook 445 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
++      SND_PCI_QUIRK(0x103c, 0x8c7c, "HP ProBook 445 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
++      SND_PCI_QUIRK(0x103c, 0x8c7d, "HP ProBook 465 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
++      SND_PCI_QUIRK(0x103c, 0x8c7e, "HP ProBook 465 G11", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+       SND_PCI_QUIRK(0x103c, 0x8c89, "HP ProBook 460 G11", ALC236_FIXUP_HP_GPIO_LED),
+       SND_PCI_QUIRK(0x103c, 0x8c8a, "HP EliteBook 630", ALC236_FIXUP_HP_GPIO_LED),
+       SND_PCI_QUIRK(0x103c, 0x8c8c, "HP EliteBook 660", ALC236_FIXUP_HP_GPIO_LED),
diff --git a/queue-6.1/alsa-hda-realtek-limit-mic-boost-on-n14ap7.patch b/queue-6.1/alsa-hda-realtek-limit-mic-boost-on-n14ap7.patch
new file mode 100644 (file)
index 0000000..51b3bb0
--- /dev/null
@@ -0,0 +1,31 @@
+From 86a433862912f52597263aa224a9ed82bcd533bf Mon Sep 17 00:00:00 2001
+From: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
+Date: Wed, 5 Jun 2024 12:39:23 -0300
+Subject: ALSA: hda/realtek: Limit mic boost on N14AP7
+
+From: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
+
+commit 86a433862912f52597263aa224a9ed82bcd533bf upstream.
+
+The internal mic boost on the N14AP7 is too high. Fix this by applying the
+ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine to limit the gain.
+
+Signed-off-by: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20240605153923.2837-1-edson.drosdeck@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10132,6 +10132,7 @@ static const struct snd_pci_quirk alc269
+       SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
+       SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802),
+       SND_PCI_QUIRK(0x1c06, 0x2015, "Lemote A190X", ALC269_FIXUP_LEMOTE_A190X),
++      SND_PCI_QUIRK(0x1c6c, 0x122a, "Positivo N14AP7", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+       SND_PCI_QUIRK(0x1c6c, 0x1251, "Positivo N14KP6-TG", ALC288_FIXUP_DELL1_MIC_NO_PRESENCE),
+       SND_PCI_QUIRK(0x1d05, 0x1132, "TongFang PHxTxX1", ALC256_FIXUP_SET_COEF_DEFAULTS),
+       SND_PCI_QUIRK(0x1d05, 0x1096, "TongFang GMxMRxx", ALC269_FIXUP_NO_SHUTUP),
diff --git a/queue-6.1/btrfs-retry-block-group-reclaim-without-infinite-loop.patch b/queue-6.1/btrfs-retry-block-group-reclaim-without-infinite-loop.patch
new file mode 100644 (file)
index 0000000..2f7a62d
--- /dev/null
@@ -0,0 +1,66 @@
+From 4eb4e85c4f818491efc67e9373aa16b123c3f522 Mon Sep 17 00:00:00 2001
+From: Boris Burkov <boris@bur.io>
+Date: Fri, 7 Jun 2024 12:50:14 -0700
+Subject: btrfs: retry block group reclaim without infinite loop
+
+From: Boris Burkov <boris@bur.io>
+
+commit 4eb4e85c4f818491efc67e9373aa16b123c3f522 upstream.
+
+If inc_block_group_ro systematically fails (e.g. due to ETXTBUSY from
+swap) or btrfs_relocate_chunk systematically fails (from lack of
+space), then this worker becomes an infinite loop.
+
+At the very least, this strands the cleaner thread, but can also result
+in hung tasks/RCU stalls on PREEMPT_NONE kernels and if the
+reclaim_bgs_lock mutex is not contended.
+
+I believe the best long term fix is to manage reclaim via work queue,
+where we queue up a relocation on the triggering condition and re-queue
+on failure. In the meantime, this is an easy fix to apply to avoid the
+immediate pain.
+
+Fixes: 7e2718099438 ("btrfs: reinsert BGs failed to reclaim")
+CC: stable@vger.kernel.org # 6.6+
+Signed-off-by: Boris Burkov <boris@bur.io>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/block-group.c |   11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/fs/btrfs/block-group.c
++++ b/fs/btrfs/block-group.c
+@@ -1615,6 +1615,7 @@ void btrfs_reclaim_bgs_work(struct work_
+               container_of(work, struct btrfs_fs_info, reclaim_bgs_work);
+       struct btrfs_block_group *bg;
+       struct btrfs_space_info *space_info;
++      LIST_HEAD(retry_list);
+       if (!test_bit(BTRFS_FS_OPEN, &fs_info->flags))
+               return;
+@@ -1717,8 +1718,11 @@ void btrfs_reclaim_bgs_work(struct work_
+               }
+ next:
+-              if (ret)
+-                      btrfs_mark_bg_to_reclaim(bg);
++              if (ret) {
++                      /* Refcount held by the reclaim_bgs list after splice. */
++                      btrfs_get_block_group(bg);
++                      list_add_tail(&bg->bg_list, &retry_list);
++              }
+               btrfs_put_block_group(bg);
+               mutex_unlock(&fs_info->reclaim_bgs_lock);
+@@ -1738,6 +1742,9 @@ next:
+       spin_unlock(&fs_info->unused_bgs_lock);
+       mutex_unlock(&fs_info->reclaim_bgs_lock);
+ end:
++      spin_lock(&fs_info->unused_bgs_lock);
++      list_splice_tail(&retry_list, &fs_info->reclaim_bgs);
++      spin_unlock(&fs_info->unused_bgs_lock);
+       btrfs_exclop_finish(fs_info);
+       sb_end_write(fs_info->sb);
+ }
diff --git a/queue-6.1/cifs-fix-typo-in-module-parameter-enable_gcm_256.patch b/queue-6.1/cifs-fix-typo-in-module-parameter-enable_gcm_256.patch
new file mode 100644 (file)
index 0000000..ef7f373
--- /dev/null
@@ -0,0 +1,32 @@
+From 8bf0287528da1992c5e49d757b99ad6bbc34b522 Mon Sep 17 00:00:00 2001
+From: Steve French <stfrench@microsoft.com>
+Date: Wed, 19 Jun 2024 14:46:48 -0500
+Subject: cifs: fix typo in module parameter enable_gcm_256
+
+From: Steve French <stfrench@microsoft.com>
+
+commit 8bf0287528da1992c5e49d757b99ad6bbc34b522 upstream.
+
+enable_gcm_256 (which allows the server to require the strongest
+encryption) is enabled by default, but the modinfo description
+incorrectly showed it disabled by default. Fix the typo.
+
+Cc: stable@vger.kernel.org
+Fixes: fee742b50289 ("smb3.1.1: enable negotiating stronger encryption by default")
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/cifsfs.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/smb/client/cifsfs.c
++++ b/fs/smb/client/cifsfs.c
+@@ -128,7 +128,7 @@ module_param(enable_oplocks, bool, 0644)
+ MODULE_PARM_DESC(enable_oplocks, "Enable or disable oplocks. Default: y/Y/1");
+ module_param(enable_gcm_256, bool, 0644);
+-MODULE_PARM_DESC(enable_gcm_256, "Enable requesting strongest (256 bit) GCM encryption. Default: n/N/0");
++MODULE_PARM_DESC(enable_gcm_256, "Enable requesting strongest (256 bit) GCM encryption. Default: y/Y/0");
+ module_param(require_gcm_256, bool, 0644);
+ MODULE_PARM_DESC(require_gcm_256, "Require strongest (256 bit) GCM encryption. Default: n/N/0");
diff --git a/queue-6.1/drm-amdgpu-fix-ubsan-warning-in-kv_dpm.c.patch b/queue-6.1/drm-amdgpu-fix-ubsan-warning-in-kv_dpm.c.patch
new file mode 100644 (file)
index 0000000..c74dc2e
--- /dev/null
@@ -0,0 +1,31 @@
+From f0d576f840153392d04b2d52cf3adab8f62e8cb6 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 20 May 2024 09:05:21 -0400
+Subject: drm/amdgpu: fix UBSAN warning in kv_dpm.c
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit f0d576f840153392d04b2d52cf3adab8f62e8cb6 upstream.
+
+Adds bounds check for sumo_vid_mapping_entry.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3392
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c
+@@ -164,6 +164,8 @@ static void sumo_construct_vid_mapping_t
+       for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++) {
+               if (table[i].ulSupportedSCLK != 0) {
++                      if (table[i].usVoltageIndex >= SUMO_MAX_NUMBER_VOLTAGES)
++                              continue;
+                       vid_mapping_table->entries[table[i].usVoltageIndex].vid_7bit =
+                               table[i].usVoltageID;
+                       vid_mapping_table->entries[table[i].usVoltageIndex].vid_2bit =
diff --git a/queue-6.1/drm-i915-mso-using-joiner-is-not-possible-with-edp-mso.patch b/queue-6.1/drm-i915-mso-using-joiner-is-not-possible-with-edp-mso.patch
new file mode 100644 (file)
index 0000000..71a6ebc
--- /dev/null
@@ -0,0 +1,44 @@
+From 49cc17967be95d64606d5684416ee51eec35e84a Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Fri, 14 Jun 2024 17:23:11 +0300
+Subject: drm/i915/mso: using joiner is not possible with eDP MSO
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit 49cc17967be95d64606d5684416ee51eec35e84a upstream.
+
+It's not possible to use the joiner at the same time with eDP MSO. When
+a panel needs MSO, it's not optional, so MSO trumps joiner.
+
+v3: Only change intel_dp_has_joiner(), leave debugfs alone (Ville)
+
+Fixes: bc71194e8897 ("drm/i915/edp: enable eDP MSO during link training")
+Cc: <stable@vger.kernel.org> # v5.13+
+Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1668
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240614142311.589089-1-jani.nikula@intel.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit 8b5a92ca24eb96bb71e2a55e352687487d87687f)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_dp.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/i915/display/intel_dp.c
++++ b/drivers/gpu/drm/i915/display/intel_dp.c
+@@ -390,6 +390,10 @@ bool intel_dp_can_bigjoiner(struct intel
+       struct intel_encoder *encoder = &intel_dig_port->base;
+       struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
++      /* eDP MSO is not compatible with joiner */
++      if (intel_dp->mso_link_count)
++              return false;
++
+       return DISPLAY_VER(dev_priv) >= 12 ||
+               (DISPLAY_VER(dev_priv) == 11 &&
+                encoder->port != PORT_A);
diff --git a/queue-6.1/drm-radeon-fix-ubsan-warning-in-kv_dpm.c.patch b/queue-6.1/drm-radeon-fix-ubsan-warning-in-kv_dpm.c.patch
new file mode 100644 (file)
index 0000000..47aada2
--- /dev/null
@@ -0,0 +1,30 @@
+From a498df5421fd737d11bfd152428ba6b1c8538321 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 20 May 2024 09:11:45 -0400
+Subject: drm/radeon: fix UBSAN warning in kv_dpm.c
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit a498df5421fd737d11bfd152428ba6b1c8538321 upstream.
+
+Adds bounds check for sumo_vid_mapping_entry.
+
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/sumo_dpm.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/sumo_dpm.c
++++ b/drivers/gpu/drm/radeon/sumo_dpm.c
+@@ -1621,6 +1621,8 @@ void sumo_construct_vid_mapping_table(st
+       for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++) {
+               if (table[i].ulSupportedSCLK != 0) {
++                      if (table[i].usVoltageIndex >= SUMO_MAX_NUMBER_VOLTAGES)
++                              continue;
+                       vid_mapping_table->entries[table[i].usVoltageIndex].vid_7bit =
+                               table[i].usVoltageID;
+                       vid_mapping_table->entries[table[i].usVoltageIndex].vid_2bit =
diff --git a/queue-6.1/gcov-add-support-for-gcc-14.patch b/queue-6.1/gcov-add-support-for-gcc-14.patch
new file mode 100644 (file)
index 0000000..c79dac8
--- /dev/null
@@ -0,0 +1,40 @@
+From c1558bc57b8e5b4da5d821537cd30e2e660861d8 Mon Sep 17 00:00:00 2001
+From: Peter Oberparleiter <oberpar@linux.ibm.com>
+Date: Mon, 10 Jun 2024 11:27:43 +0200
+Subject: gcov: add support for GCC 14
+
+From: Peter Oberparleiter <oberpar@linux.ibm.com>
+
+commit c1558bc57b8e5b4da5d821537cd30e2e660861d8 upstream.
+
+Using gcov on kernels compiled with GCC 14 results in truncated 16-byte
+long .gcda files with no usable data.  To fix this, update GCOV_COUNTERS
+to match the value defined by GCC 14.
+
+Tested with GCC versions 14.1.0 and 13.2.0.
+
+Link: https://lkml.kernel.org/r/20240610092743.1609845-1-oberpar@linux.ibm.com
+Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Reported-by: Allison Henderson <allison.henderson@oracle.com>
+Reported-by: Chuck Lever III <chuck.lever@oracle.com>
+Tested-by: Chuck Lever <chuck.lever@oracle.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/gcov/gcc_4_7.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/kernel/gcov/gcc_4_7.c
++++ b/kernel/gcov/gcc_4_7.c
+@@ -18,7 +18,9 @@
+ #include <linux/mm.h>
+ #include "gcov.h"
+-#if (__GNUC__ >= 10)
++#if (__GNUC__ >= 14)
++#define GCOV_COUNTERS                 9
++#elif (__GNUC__ >= 10)
+ #define GCOV_COUNTERS                 8
+ #elif (__GNUC__ >= 7)
+ #define GCOV_COUNTERS                 9
diff --git a/queue-6.1/kcov-don-t-lose-track-of-remote-references-during-softirqs.patch b/queue-6.1/kcov-don-t-lose-track-of-remote-references-during-softirqs.patch
new file mode 100644 (file)
index 0000000..3f48aa4
--- /dev/null
@@ -0,0 +1,79 @@
+From 01c8f9806bde438ca1c8cbbc439f0a14a6694f6c Mon Sep 17 00:00:00 2001
+From: Aleksandr Nogikh <nogikh@google.com>
+Date: Tue, 11 Jun 2024 15:32:29 +0200
+Subject: kcov: don't lose track of remote references during softirqs
+
+From: Aleksandr Nogikh <nogikh@google.com>
+
+commit 01c8f9806bde438ca1c8cbbc439f0a14a6694f6c upstream.
+
+In kcov_remote_start()/kcov_remote_stop(), we swap the previous KCOV
+metadata of the current task into a per-CPU variable.  However, the
+kcov_mode_enabled(mode) check is not sufficient in the case of remote KCOV
+coverage: current->kcov_mode always remains KCOV_MODE_DISABLED for remote
+KCOV objects.
+
+If the original task that has invoked the KCOV_REMOTE_ENABLE ioctl happens
+to get interrupted and kcov_remote_start() is called, it ultimately leads
+to kcov_remote_stop() NOT restoring the original KCOV reference.  So when
+the task exits, all registered remote KCOV handles remain active forever.
+
+The most uncomfortable effect (at least for syzkaller) is that the bug
+prevents the reuse of the same /sys/kernel/debug/kcov descriptor.  If
+we obtain it in the parent process and then e.g.  drop some
+capabilities and continuously fork to execute individual programs, at
+some point current->kcov of the forked process is lost,
+kcov_task_exit() takes no action, and all KCOV_REMOTE_ENABLE ioctls
+calls from subsequent forks fail.
+
+And, yes, the efficiency is also affected if we keep on losing remote
+kcov objects.
+a) kcov_remote_map keeps on growing forever.
+b) (If I'm not mistaken), we're also not freeing the memory referenced
+by kcov->area.
+
+Fix it by introducing a special kcov_mode that is assigned to the task
+that owns a KCOV remote object.  It makes kcov_mode_enabled() return true
+and yet does not trigger coverage collection in __sanitizer_cov_trace_pc()
+and write_comp_data().
+
+[nogikh@google.com: replace WRITE_ONCE() with an ordinary assignment]
+  Link: https://lkml.kernel.org/r/20240614171221.2837584-1-nogikh@google.com
+Link: https://lkml.kernel.org/r/20240611133229.527822-1-nogikh@google.com
+Fixes: 5ff3b30ab57d ("kcov: collect coverage from interrupts")
+Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
+Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
+Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
+Tested-by: Andrey Konovalov <andreyknvl@gmail.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Marco Elver <elver@google.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/kcov.h |    2 ++
+ kernel/kcov.c        |    1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/include/linux/kcov.h
++++ b/include/linux/kcov.h
+@@ -21,6 +21,8 @@ enum kcov_mode {
+       KCOV_MODE_TRACE_PC = 2,
+       /* Collecting comparison operands mode. */
+       KCOV_MODE_TRACE_CMP = 3,
++      /* The process owns a KCOV remote reference. */
++      KCOV_MODE_REMOTE = 4,
+ };
+ #define KCOV_IN_CTXSW (1 << 30)
+--- a/kernel/kcov.c
++++ b/kernel/kcov.c
+@@ -630,6 +630,7 @@ static int kcov_ioctl_locked(struct kcov
+                       return -EINVAL;
+               kcov->mode = mode;
+               t->kcov = kcov;
++              t->kcov_mode = KCOV_MODE_REMOTE;
+               kcov->t = t;
+               kcov->remote = true;
+               kcov->remote_size = remote_arg->area_size;
diff --git a/queue-6.1/kvm-arm64-disassociate-vcpus-from-redistributor-region-on-teardown.patch b/queue-6.1/kvm-arm64-disassociate-vcpus-from-redistributor-region-on-teardown.patch
new file mode 100644 (file)
index 0000000..6d9a529
--- /dev/null
@@ -0,0 +1,79 @@
+From 0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8 Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <maz@kernel.org>
+Date: Wed, 5 Jun 2024 18:56:37 +0100
+Subject: KVM: arm64: Disassociate vcpus from redistributor region on teardown
+
+From: Marc Zyngier <maz@kernel.org>
+
+commit 0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8 upstream.
+
+When tearing down a redistributor region, make sure we don't have
+any dangling pointer to that region stored in a vcpu.
+
+Fixes: e5a35635464b ("kvm: arm64: vgic-v3: Introduce vgic_v3_free_redist_region()")
+Reported-by: Alexander Potapenko <glider@google.com>
+Reviewed-by: Oliver Upton <oliver.upton@linux.dev>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20240605175637.1635653-1-maz@kernel.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/vgic/vgic-init.c    |    2 +-
+ arch/arm64/kvm/vgic/vgic-mmio-v3.c |   15 +++++++++++++--
+ arch/arm64/kvm/vgic/vgic.h         |    2 +-
+ 3 files changed, 15 insertions(+), 4 deletions(-)
+
+--- a/arch/arm64/kvm/vgic/vgic-init.c
++++ b/arch/arm64/kvm/vgic/vgic-init.c
+@@ -355,7 +355,7 @@ static void kvm_vgic_dist_destroy(struct
+       if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) {
+               list_for_each_entry_safe(rdreg, next, &dist->rd_regions, list)
+-                      vgic_v3_free_redist_region(rdreg);
++                      vgic_v3_free_redist_region(kvm, rdreg);
+               INIT_LIST_HEAD(&dist->rd_regions);
+       } else {
+               dist->vgic_cpu_base = VGIC_ADDR_UNDEF;
+--- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c
++++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
+@@ -942,8 +942,19 @@ free:
+       return ret;
+ }
+-void vgic_v3_free_redist_region(struct vgic_redist_region *rdreg)
++void vgic_v3_free_redist_region(struct kvm *kvm, struct vgic_redist_region *rdreg)
+ {
++      struct kvm_vcpu *vcpu;
++      unsigned long c;
++
++      lockdep_assert_held(&kvm->arch.config_lock);
++
++      /* Garbage collect the region */
++      kvm_for_each_vcpu(c, vcpu, kvm) {
++              if (vcpu->arch.vgic_cpu.rdreg == rdreg)
++                      vcpu->arch.vgic_cpu.rdreg = NULL;
++      }
++
+       list_del(&rdreg->list);
+       kfree(rdreg);
+ }
+@@ -968,7 +979,7 @@ int vgic_v3_set_redist_base(struct kvm *
+               mutex_lock(&kvm->arch.config_lock);
+               rdreg = vgic_v3_rdist_region_from_index(kvm, index);
+-              vgic_v3_free_redist_region(rdreg);
++              vgic_v3_free_redist_region(kvm, rdreg);
+               mutex_unlock(&kvm->arch.config_lock);
+               return ret;
+       }
+--- a/arch/arm64/kvm/vgic/vgic.h
++++ b/arch/arm64/kvm/vgic/vgic.h
+@@ -301,7 +301,7 @@ vgic_v3_rd_region_size(struct kvm *kvm,
+ struct vgic_redist_region *vgic_v3_rdist_region_from_index(struct kvm *kvm,
+                                                          u32 index);
+-void vgic_v3_free_redist_region(struct vgic_redist_region *rdreg);
++void vgic_v3_free_redist_region(struct kvm *kvm, struct vgic_redist_region *rdreg);
+ bool vgic_v3_rdist_overlap(struct kvm *kvm, gpa_t base, size_t size);
diff --git a/queue-6.1/kvm-fix-a-data-race-on-last_boosted_vcpu-in-kvm_vcpu_on_spin.patch b/queue-6.1/kvm-fix-a-data-race-on-last_boosted_vcpu-in-kvm_vcpu_on_spin.patch
new file mode 100644 (file)
index 0000000..53ceb60
--- /dev/null
@@ -0,0 +1,96 @@
+From 49f683b41f28918df3e51ddc0d928cb2e934ccdb Mon Sep 17 00:00:00 2001
+From: Breno Leitao <leitao@debian.org>
+Date: Fri, 10 May 2024 02:23:52 -0700
+Subject: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
+
+From: Breno Leitao <leitao@debian.org>
+
+commit 49f683b41f28918df3e51ddc0d928cb2e934ccdb upstream.
+
+Use {READ,WRITE}_ONCE() to access kvm->last_boosted_vcpu to ensure the
+loads and stores are atomic.  In the extremely unlikely scenario the
+compiler tears the stores, it's theoretically possible for KVM to attempt
+to get a vCPU using an out-of-bounds index, e.g. if the write is split
+into multiple 8-bit stores, and is paired with a 32-bit load on a VM with
+257 vCPUs:
+
+  CPU0                              CPU1
+  last_boosted_vcpu = 0xff;
+
+                                    (last_boosted_vcpu = 0x100)
+                                    last_boosted_vcpu[15:8] = 0x01;
+  i = (last_boosted_vcpu = 0x1ff)
+                                    last_boosted_vcpu[7:0] = 0x00;
+
+  vcpu = kvm->vcpu_array[0x1ff];
+
+As detected by KCSAN:
+
+  BUG: KCSAN: data-race in kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm]
+
+  write to 0xffffc90025a92344 of 4 bytes by task 4340 on cpu 16:
+  kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112) kvm
+  handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel
+  vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?
+                arch/x86/kvm/vmx/vmx.c:6606) kvm_intel
+  vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm
+  kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm
+  kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm
+  __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)
+  __x64_sys_ioctl (fs/ioctl.c:890)
+  x64_sys_call (arch/x86/entry/syscall_64.c:33)
+  do_syscall_64 (arch/x86/entry/common.c:?)
+  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
+
+  read to 0xffffc90025a92344 of 4 bytes by task 4342 on cpu 4:
+  kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm
+  handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel
+  vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?
+                       arch/x86/kvm/vmx/vmx.c:6606) kvm_intel
+  vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm
+  kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm
+  kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm
+  __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)
+  __x64_sys_ioctl (fs/ioctl.c:890)
+  x64_sys_call (arch/x86/entry/syscall_64.c:33)
+  do_syscall_64 (arch/x86/entry/common.c:?)
+  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
+
+  value changed: 0x00000012 -> 0x00000000
+
+Fixes: 217ece6129f2 ("KVM: use yield_to instead of sleep in kvm_vcpu_on_spin")
+Cc: stable@vger.kernel.org
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Link: https://lore.kernel.org/r/20240510092353.2261824-1-leitao@debian.org
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ virt/kvm/kvm_main.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -3742,12 +3742,13 @@ void kvm_vcpu_on_spin(struct kvm_vcpu *m
+ {
+       struct kvm *kvm = me->kvm;
+       struct kvm_vcpu *vcpu;
+-      int last_boosted_vcpu = me->kvm->last_boosted_vcpu;
++      int last_boosted_vcpu;
+       unsigned long i;
+       int yielded = 0;
+       int try = 3;
+       int pass;
++      last_boosted_vcpu = READ_ONCE(kvm->last_boosted_vcpu);
+       kvm_vcpu_set_in_spin_loop(me, true);
+       /*
+        * We boost the priority of a VCPU that is runnable but not
+@@ -3778,7 +3779,7 @@ void kvm_vcpu_on_spin(struct kvm_vcpu *m
+                       yielded = kvm_vcpu_yield_to(vcpu);
+                       if (yielded > 0) {
+-                              kvm->last_boosted_vcpu = i;
++                              WRITE_ONCE(kvm->last_boosted_vcpu, i);
+                               break;
+                       } else if (yielded < 0) {
+                               try--;
diff --git a/queue-6.1/kvm-x86-always-sync-pir-to-irr-prior-to-scanning-i-o-apic-routes.patch b/queue-6.1/kvm-x86-always-sync-pir-to-irr-prior-to-scanning-i-o-apic-routes.patch
new file mode 100644 (file)
index 0000000..d557017
--- /dev/null
@@ -0,0 +1,59 @@
+From f3ced000a2df53f4b12849e121769045a81a3b22 Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <seanjc@google.com>
+Date: Mon, 10 Jun 2024 18:48:45 -0700
+Subject: KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC routes
+
+From: Sean Christopherson <seanjc@google.com>
+
+commit f3ced000a2df53f4b12849e121769045a81a3b22 upstream.
+
+Sync pending posted interrupts to the IRR prior to re-scanning I/O APIC
+routes, irrespective of whether the I/O APIC is emulated by userspace or
+by KVM.  If a level-triggered interrupt routed through the I/O APIC is
+pending or in-service for a vCPU, KVM needs to intercept EOIs on said
+vCPU even if the vCPU isn't the destination for the new routing, e.g. if
+servicing an interrupt using the old routing races with I/O APIC
+reconfiguration.
+
+Commit fceb3a36c29a ("KVM: x86: ioapic: Fix level-triggered EOI and
+userspace I/OAPIC reconfigure race") fixed the common cases, but
+kvm_apic_pending_eoi() only checks if an interrupt is in the local
+APIC's IRR or ISR, i.e. misses the uncommon case where an interrupt is
+pending in the PIR.
+
+Failure to intercept EOI can manifest as guest hangs with Windows 11 if
+the guest uses the RTC as its timekeeping source, e.g. if the VMM doesn't
+expose a more modern form of time to the guest.
+
+Cc: stable@vger.kernel.org
+Cc: Adamos Ttofari <attofari@amazon.de>
+Cc: Raghavendra Rao Ananta <rananta@google.com>
+Reviewed-by: Jim Mattson <jmattson@google.com>
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-ID: <20240611014845.82795-1-seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/x86.c |    9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -10523,13 +10523,12 @@ static void vcpu_scan_ioapic(struct kvm_
+       bitmap_zero(vcpu->arch.ioapic_handled_vectors, 256);
++      static_call_cond(kvm_x86_sync_pir_to_irr)(vcpu);
++
+       if (irqchip_split(vcpu->kvm))
+               kvm_scan_ioapic_routes(vcpu, vcpu->arch.ioapic_handled_vectors);
+-      else {
+-              static_call_cond(kvm_x86_sync_pir_to_irr)(vcpu);
+-              if (ioapic_in_kernel(vcpu->kvm))
+-                      kvm_ioapic_scan_entry(vcpu, vcpu->arch.ioapic_handled_vectors);
+-      }
++      else if (ioapic_in_kernel(vcpu->kvm))
++              kvm_ioapic_scan_entry(vcpu, vcpu->arch.ioapic_handled_vectors);
+       if (is_guest_mode(vcpu))
+               vcpu->arch.load_eoi_exitmap_pending = true;
diff --git a/queue-6.1/net-do-not-leave-a-dangling-sk-pointer-when-socket-creation-fails.patch b/queue-6.1/net-do-not-leave-a-dangling-sk-pointer-when-socket-creation-fails.patch
new file mode 100644 (file)
index 0000000..83dea6b
--- /dev/null
@@ -0,0 +1,95 @@
+From 6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2 Mon Sep 17 00:00:00 2001
+From: Ignat Korchagin <ignat@cloudflare.com>
+Date: Mon, 17 Jun 2024 22:02:05 +0100
+Subject: net: do not leave a dangling sk pointer, when socket creation fails
+
+From: Ignat Korchagin <ignat@cloudflare.com>
+
+commit 6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2 upstream.
+
+It is possible to trigger a use-after-free by:
+  * attaching an fentry probe to __sock_release() and the probe calling the
+    bpf_get_socket_cookie() helper
+  * running traceroute -I 1.1.1.1 on a freshly booted VM
+
+A KASAN enabled kernel will log something like below (decoded and stripped):
+==================================================================
+BUG: KASAN: slab-use-after-free in __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)
+Read of size 8 at addr ffff888007110dd8 by task traceroute/299
+
+CPU: 2 PID: 299 Comm: traceroute Tainted: G            E      6.10.0-rc2+ #2
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
+Call Trace:
+ <TASK>
+dump_stack_lvl (lib/dump_stack.c:117 (discriminator 1))
+print_report (mm/kasan/report.c:378 mm/kasan/report.c:488)
+? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)
+kasan_report (mm/kasan/report.c:603)
+? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)
+kasan_check_range (mm/kasan/generic.c:183 mm/kasan/generic.c:189)
+__sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)
+bpf_get_socket_ptr_cookie (./arch/x86/include/asm/preempt.h:94 ./include/linux/sock_diag.h:42 net/core/filter.c:5094 net/core/filter.c:5092)
+bpf_prog_875642cf11f1d139___sock_release+0x6e/0x8e
+bpf_trampoline_6442506592+0x47/0xaf
+__sock_release (net/socket.c:652)
+__sock_create (net/socket.c:1601)
+...
+Allocated by task 299 on cpu 2 at 78.328492s:
+kasan_save_stack (mm/kasan/common.c:48)
+kasan_save_track (mm/kasan/common.c:68)
+__kasan_slab_alloc (mm/kasan/common.c:312 mm/kasan/common.c:338)
+kmem_cache_alloc_noprof (mm/slub.c:3941 mm/slub.c:4000 mm/slub.c:4007)
+sk_prot_alloc (net/core/sock.c:2075)
+sk_alloc (net/core/sock.c:2134)
+inet_create (net/ipv4/af_inet.c:327 net/ipv4/af_inet.c:252)
+__sock_create (net/socket.c:1572)
+__sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706)
+__x64_sys_socket (net/socket.c:1718)
+do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
+entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
+
+Freed by task 299 on cpu 2 at 78.328502s:
+kasan_save_stack (mm/kasan/common.c:48)
+kasan_save_track (mm/kasan/common.c:68)
+kasan_save_free_info (mm/kasan/generic.c:582)
+poison_slab_object (mm/kasan/common.c:242)
+__kasan_slab_free (mm/kasan/common.c:256)
+kmem_cache_free (mm/slub.c:4437 mm/slub.c:4511)
+__sk_destruct (net/core/sock.c:2117 net/core/sock.c:2208)
+inet_create (net/ipv4/af_inet.c:397 net/ipv4/af_inet.c:252)
+__sock_create (net/socket.c:1572)
+__sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706)
+__x64_sys_socket (net/socket.c:1718)
+do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
+entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
+
+Fix this by clearing the struct socket reference in sk_common_release() to cover
+all protocol families create functions, which may already attached the
+reference to the sk object with sock_init_data().
+
+Fixes: c5dbb89fc2ac ("bpf: Expose bpf_get_socket_cookie to tracing programs")
+Suggested-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/netdev/20240613194047.36478-1-kuniyu@amazon.com/T/
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20240617210205.67311-1-ignat@cloudflare.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/sock.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3695,6 +3695,9 @@ void sk_common_release(struct sock *sk)
+       sk->sk_prot->unhash(sk);
++      if (sk->sk_socket)
++              sk->sk_socket->sk = NULL;
++
+       /*
+        * In this point socket cannot receive new packets, but it is possible
+        * that some packets are in flight because some CPU runs receiver and
diff --git a/queue-6.1/net-stmmac-assign-configured-channel-value-to-extts-event.patch b/queue-6.1/net-stmmac-assign-configured-channel-value-to-extts-event.patch
new file mode 100644 (file)
index 0000000..0523f7d
--- /dev/null
@@ -0,0 +1,61 @@
+From 8851346912a1fa33e7a5966fe51f07313b274627 Mon Sep 17 00:00:00 2001
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+Date: Tue, 18 Jun 2024 09:38:21 +0200
+Subject: net: stmmac: Assign configured channel value to EXTTS event
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+commit 8851346912a1fa33e7a5966fe51f07313b274627 upstream.
+
+Assign the configured channel value to the EXTTS event in the timestamp
+interrupt handler. Without assigning the correct channel, applications
+like ts2phc will refuse to accept the event, resulting in errors such
+as:
+...
+ts2phc[656.834]: config item end1.ts2phc.pin_index is 0
+ts2phc[656.834]: config item end1.ts2phc.channel is 3
+ts2phc[656.834]: config item end1.ts2phc.extts_polarity is 2
+ts2phc[656.834]: config item end1.ts2phc.extts_correction is 0
+...
+ts2phc[656.862]: extts on unexpected channel
+ts2phc[658.141]: extts on unexpected channel
+ts2phc[659.140]: extts on unexpected channel
+
+Fixes: f4da56529da60 ("net: stmmac: Add support for external trigger timestamping")
+Cc: stable@vger.kernel.org
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
+Link: https://lore.kernel.org/r/20240618073821.619751-1-o.rempel@pengutronix.de
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+@@ -176,6 +176,7 @@ static void timestamp_interrupt(struct s
+ {
+       u32 num_snapshot, ts_status, tsync_int;
+       struct ptp_clock_event event;
++      u32 acr_value, channel;
+       unsigned long flags;
+       u64 ptp_time;
+       int i;
+@@ -201,12 +202,15 @@ static void timestamp_interrupt(struct s
+       num_snapshot = (ts_status & GMAC_TIMESTAMP_ATSNS_MASK) >>
+                      GMAC_TIMESTAMP_ATSNS_SHIFT;
++      acr_value = readl(priv->ptpaddr + PTP_ACR);
++      channel = ilog2(FIELD_GET(PTP_ACR_MASK, acr_value));
++
+       for (i = 0; i < num_snapshot; i++) {
+               read_lock_irqsave(&priv->ptp_lock, flags);
+               get_ptptime(priv->ptpaddr, &ptp_time);
+               read_unlock_irqrestore(&priv->ptp_lock, flags);
+               event.type = PTP_CLOCK_EXTTS;
+-              event.index = 0;
++              event.index = channel;
+               event.timestamp = ptp_time;
+               ptp_clock_event(priv->ptp_clock, &event);
+       }
diff --git a/queue-6.1/net-usb-ax88179_178a-improve-reset-check.patch b/queue-6.1/net-usb-ax88179_178a-improve-reset-check.patch
new file mode 100644 (file)
index 0000000..5f6cf21
--- /dev/null
@@ -0,0 +1,83 @@
+From 7be4cb7189f747b4e5b6977d0e4387bde3204e62 Mon Sep 17 00:00:00 2001
+From: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
+Date: Mon, 17 Jun 2024 12:28:21 +0200
+Subject: net: usb: ax88179_178a: improve reset check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
+
+commit 7be4cb7189f747b4e5b6977d0e4387bde3204e62 upstream.
+
+After ecf848eb934b ("net: usb: ax88179_178a: fix link status when link is
+set to down/up") to not reset from usbnet_open after the reset from
+usbnet_probe at initialization stage to speed up this, some issues have
+been reported.
+
+It seems to happen that if the initialization is slower, and some time
+passes between the probe operation and the open operation, the second reset
+from open is necessary too to have the device working. The reason is that
+if there is no activity with the phy, this is "disconnected".
+
+In order to improve this, the solution is to detect when the phy is
+"disconnected", and we can use the phy status register for this. So we will
+only reset the device from reset operation in this situation, that is, only
+if necessary.
+
+The same bahavior is happening when the device is stopped (link set to
+down) and later is restarted (link set to up), so if the phy keeps working
+we only need to enable the mac again, but if enough time passes between the
+device stop and restart, reset is necessary, and we can detect the
+situation checking the phy status register too.
+
+cc: stable@vger.kernel.org # 6.6+
+Fixes: ecf848eb934b ("net: usb: ax88179_178a: fix link status when link is set to down/up")
+Reported-by: Yongqin Liu <yongqin.liu@linaro.org>
+Reported-by: Antje Miederhöfer <a.miederhoefer@gmx.de>
+Reported-by: Arne Fitzenreiter <arne_f@ipfire.org>
+Tested-by: Yongqin Liu <yongqin.liu@linaro.org>
+Tested-by: Antje Miederhöfer <a.miederhoefer@gmx.de>
+Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/ax88179_178a.c |   18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -174,7 +174,6 @@ struct ax88179_data {
+       u32 wol_supported;
+       u32 wolopts;
+       u8 disconnecting;
+-      u8 initialized;
+ };
+ struct ax88179_int_data {
+@@ -1676,12 +1675,21 @@ static int ax88179_reset(struct usbnet *
+ static int ax88179_net_reset(struct usbnet *dev)
+ {
+-      struct ax88179_data *ax179_data = dev->driver_priv;
++      u16 tmp16;
+-      if (ax179_data->initialized)
++      ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, GMII_PHY_PHYSR,
++                       2, &tmp16);
++      if (tmp16) {
++              ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
++                               2, 2, &tmp16);
++              if (!(tmp16 & AX_MEDIUM_RECEIVE_EN)) {
++                      tmp16 |= AX_MEDIUM_RECEIVE_EN;
++                      ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
++                                        2, 2, &tmp16);
++              }
++      } else {
+               ax88179_reset(dev);
+-      else
+-              ax179_data->initialized = 1;
++      }
+       return 0;
+ }
index ba4843d2ce6fddf65a59cb800ac5bef3994e5da5..e19350afb7aab5929ad8714c430f24da6ac0dfde 100644 (file)
@@ -91,3 +91,18 @@ firmware-psci-fix-return-value-from-psci_system_susp.patch
 rdma-mlx5-add-check-for-srq-max_sge-attribute.patch
 kbuild-remove-support-for-clang-s-thinlto-caching.patch
 mips-dts-bcm63268-add-missing-properties-to-the-twd-node.patch
+net-stmmac-assign-configured-channel-value-to-extts-event.patch
+net-usb-ax88179_178a-improve-reset-check.patch
+net-do-not-leave-a-dangling-sk-pointer-when-socket-creation-fails.patch
+btrfs-retry-block-group-reclaim-without-infinite-loop.patch
+cifs-fix-typo-in-module-parameter-enable_gcm_256.patch
+kvm-fix-a-data-race-on-last_boosted_vcpu-in-kvm_vcpu_on_spin.patch
+kvm-arm64-disassociate-vcpus-from-redistributor-region-on-teardown.patch
+kvm-x86-always-sync-pir-to-irr-prior-to-scanning-i-o-apic-routes.patch
+alsa-hda-realtek-fix-mute-micmute-leds-don-t-work-for-probook-445-465-g11.patch
+alsa-hda-realtek-limit-mic-boost-on-n14ap7.patch
+drm-i915-mso-using-joiner-is-not-possible-with-edp-mso.patch
+drm-radeon-fix-ubsan-warning-in-kv_dpm.c.patch
+drm-amdgpu-fix-ubsan-warning-in-kv_dpm.c.patch
+gcov-add-support-for-gcc-14.patch
+kcov-don-t-lose-track-of-remote-references-during-softirqs.patch