--- /dev/null
+From d6c14da474bf260d73953fbf7992c98d9112aec7 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Mon, 20 Jun 2022 09:52:43 +0200
+Subject: crypto: lib/blake2s - reduce stack frame usage in self test
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+commit d6c14da474bf260d73953fbf7992c98d9112aec7 upstream.
+
+Using 3 blocks here doesn't give us much more than using 2, and it
+causes a stack frame size warning on certain compiler/config/arch
+combinations:
+
+ lib/crypto/blake2s-selftest.c: In function 'blake2s_selftest':
+>> lib/crypto/blake2s-selftest.c:632:1: warning: the frame size of 1088 bytes is larger than 1024 bytes [-Wframe-larger-than=]
+ 632 | }
+ | ^
+
+So this patch just reduces the block from 3 to 2, which makes the
+warning go away.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/linux-crypto/202206200851.gE3MHCgd-lkp@intel.com
+Fixes: 2d16803c562e ("crypto: blake2s - remove shash module")
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/crypto/blake2s-selftest.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/lib/crypto/blake2s-selftest.c
++++ b/lib/crypto/blake2s-selftest.c
+@@ -593,7 +593,7 @@ bool __init blake2s_selftest(void)
+ enum { TEST_ALIGNMENT = 16 };
+ u8 unaligned_block[BLAKE2S_BLOCK_SIZE + TEST_ALIGNMENT - 1]
+ __aligned(TEST_ALIGNMENT);
+- u8 blocks[BLAKE2S_BLOCK_SIZE * 3];
++ u8 blocks[BLAKE2S_BLOCK_SIZE * 2];
+ struct blake2s_state state1, state2;
+
+ get_random_bytes(blocks, sizeof(blocks));
+@@ -603,8 +603,8 @@ bool __init blake2s_selftest(void)
+ defined(CONFIG_CRYPTO_ARCH_HAVE_LIB_BLAKE2S)
+ memcpy(&state1, &state, sizeof(state1));
+ memcpy(&state2, &state, sizeof(state2));
+- blake2s_compress(&state1, blocks, 3, BLAKE2S_BLOCK_SIZE);
+- blake2s_compress_generic(&state2, blocks, 3, BLAKE2S_BLOCK_SIZE);
++ blake2s_compress(&state1, blocks, 2, BLAKE2S_BLOCK_SIZE);
++ blake2s_compress_generic(&state2, blocks, 2, BLAKE2S_BLOCK_SIZE);
+ if (memcmp(&state1, &state2, sizeof(state1))) {
+ pr_err("blake2s random compress self-test %d: FAIL\n",
+ i + 1);
--- /dev/null
+From 69d93daec026cdda98e29e8edb12534bfa5b1a9b Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Thu, 30 Jun 2022 15:17:56 -0700
+Subject: mptcp: refine memory scheduling
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 69d93daec026cdda98e29e8edb12534bfa5b1a9b upstream.
+
+Similar to commit 7c80b038d23e ("net: fix sk_wmem_schedule() and
+sk_rmem_schedule() errors"), let the MPTCP receive path schedule
+exactly the required amount of memory.
+
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -323,9 +323,10 @@ static bool mptcp_rmem_schedule(struct s
+ struct mptcp_sock *msk = mptcp_sk(sk);
+ int amt, amount;
+
+- if (size < msk->rmem_fwd_alloc)
++ if (size <= msk->rmem_fwd_alloc)
+ return true;
+
++ size -= msk->rmem_fwd_alloc;
+ amt = sk_mem_pages(size);
+ amount = amt << SK_MEM_QUANTUM_SHIFT;
+ msk->rmem_fwd_alloc += amount;
--- /dev/null
+From 7e4babffa6f340a74c820d44d44d16511e666424 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Thu, 4 Aug 2022 23:28:17 +0300
+Subject: net: dsa: felix: fix min gate len calculation for tc when its first gate is closed
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit 7e4babffa6f340a74c820d44d44d16511e666424 upstream.
+
+min_gate_len[tc] is supposed to track the shortest interval of
+continuously open gates for a traffic class. For example, in the
+following case:
+
+TC 76543210
+
+t0 00000001b 200000 ns
+t1 00000010b 200000 ns
+
+min_gate_len[0] and min_gate_len[1] should be 200000, while
+min_gate_len[2-7] should be 0.
+
+However what happens is that min_gate_len[0] is 200000, but
+min_gate_len[1] ends up being 0 (despite gate_len[1] being 200000 at the
+point where the logic detects the gate close event for TC 1).
+
+The problem is that the code considers a "gate close" event whenever it
+sees that there is a 0 for that TC (essentially it's level rather than
+edge triggered). By doing that, any time a gate is seen as closed
+without having been open prior, gate_len, which is 0, will be written
+into min_gate_len. Once min_gate_len becomes 0, it's impossible for it
+to track anything higher than that (the length of actually open
+intervals).
+
+To fix this, we make the writing to min_gate_len[tc] be edge-triggered,
+which avoids writes for gates that are closed in consecutive intervals.
+However what this does is it makes us need to special-case the
+permanently closed gates at the end.
+
+Fixes: 55a515b1f5a9 ("net: dsa: felix: drop oversized frames with tc-taprio instead of hanging the port")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://lore.kernel.org/r/20220804202817.1677572-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/ocelot/felix_vsc9959.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/ocelot/felix_vsc9959.c
++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c
+@@ -1136,6 +1136,7 @@ static void vsc9959_tas_min_gate_lengths
+ {
+ struct tc_taprio_sched_entry *entry;
+ u64 gate_len[OCELOT_NUM_TC];
++ u8 gates_ever_opened = 0;
+ int tc, i, n;
+
+ /* Initialize arrays */
+@@ -1163,16 +1164,28 @@ static void vsc9959_tas_min_gate_lengths
+ for (tc = 0; tc < OCELOT_NUM_TC; tc++) {
+ if (entry->gate_mask & BIT(tc)) {
+ gate_len[tc] += entry->interval;
++ gates_ever_opened |= BIT(tc);
+ } else {
+ /* Gate closes now, record a potential new
+ * minimum and reinitialize length
+ */
+- if (min_gate_len[tc] > gate_len[tc])
++ if (min_gate_len[tc] > gate_len[tc] &&
++ gate_len[tc])
+ min_gate_len[tc] = gate_len[tc];
+ gate_len[tc] = 0;
+ }
+ }
+ }
++
++ /* min_gate_len[tc] actually tracks minimum *open* gate time, so for
++ * permanently closed gates, min_gate_len[tc] will still be U64_MAX.
++ * Therefore they are currently indistinguishable from permanently
++ * open gates. Overwrite the gate len with 0 when we know they're
++ * actually permanently closed, i.e. after the loop above.
++ */
++ for (tc = 0; tc < OCELOT_NUM_TC; tc++)
++ if (!(gates_ever_opened & BIT(tc)))
++ min_gate_len[tc] = 0;
+ }
+
+ /* Update QSYS_PORT_MAX_SDU to make sure the static guard bands added by the
--- /dev/null
+From 83ee9f23763a432a4077bf20624ee35de87bce99 Mon Sep 17 00:00:00 2001
+From: Russell Currey <ruscur@russell.cc>
+Date: Wed, 10 Aug 2022 15:43:31 +1000
+Subject: powerpc/kexec: Fix build failure from uninitialised variable
+
+From: Russell Currey <ruscur@russell.cc>
+
+commit 83ee9f23763a432a4077bf20624ee35de87bce99 upstream.
+
+clang 14 won't build because ret is uninitialised and can be returned if
+both prop and fdtprop are NULL. Drop the ret variable and return an
+error in that failure case.
+
+Fixes: b1fc44eaa9ba ("pseries/iommu/ddw: Fix kdump to work in absence of ibm,dma-window")
+Suggested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Russell Currey <ruscur@russell.cc>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220810054331.373761-1-ruscur@russell.cc
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kexec/file_load_64.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/powerpc/kexec/file_load_64.c
++++ b/arch/powerpc/kexec/file_load_64.c
+@@ -1043,17 +1043,17 @@ static int copy_property(void *fdt, int
+ const char *propname)
+ {
+ const void *prop, *fdtprop;
+- int len = 0, fdtlen = 0, ret;
++ int len = 0, fdtlen = 0;
+
+ prop = of_get_property(dn, propname, &len);
+ fdtprop = fdt_getprop(fdt, node_offset, propname, &fdtlen);
+
+ if (fdtprop && !prop)
+- ret = fdt_delprop(fdt, node_offset, propname);
++ return fdt_delprop(fdt, node_offset, propname);
+ else if (prop)
+- ret = fdt_setprop(fdt, node_offset, propname, prop, len);
+-
+- return ret;
++ return fdt_setprop(fdt, node_offset, propname, prop, len);
++ else
++ return -FDT_ERR_NOTFOUND;
+ }
+
+ static int update_pci_dma_nodes(void *fdt, const char *dmapropname)
--- /dev/null
+From 97a4d46b1516250d640c1ae0c9e7129d160d6a1c Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 23 Jun 2022 19:35:40 +0000
+Subject: raw: fix a typo in raw_icmp_error()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 97a4d46b1516250d640c1ae0c9e7129d160d6a1c upstream.
+
+I accidentally broke IPv4 traceroute, by swapping iph->saddr
+and iph->daddr.
+
+Probably because raw_icmp_error() and raw_v4_input()
+use different order for iph->saddr and iph->daddr.
+
+Fixes: ba44f8182ec2 ("raw: use more conventional iterators")
+Reported-by: John Sperbeck <jsperbeck@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/r/20220623193540.2851799-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/raw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -278,7 +278,7 @@ void raw_icmp_error(struct sk_buff *skb,
+ hlist_nulls_for_each_entry(sk, hnode, hlist, sk_nulls_node) {
+ iph = (const struct iphdr *)skb->data;
+ if (!raw_v4_match(net, sk, iph->protocol,
+- iph->saddr, iph->daddr, dif, sdif))
++ iph->daddr, iph->saddr, dif, sdif))
+ continue;
+ raw_err(sk, skb, info);
+ }
--- /dev/null
+From c4fceb46add65481ef0dfb79cad24c3c269b4cad Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 22 Jun 2022 03:23:03 +0000
+Subject: raw: remove unused variables from raw6_icmp_error()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit c4fceb46add65481ef0dfb79cad24c3c269b4cad upstream.
+
+saddr and daddr are set but not used.
+
+Fixes: ba44f8182ec2 ("raw: use more conventional iterators")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
+Link: https://lore.kernel.org/r/20220622032303.159394-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/raw.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -332,7 +332,6 @@ static void rawv6_err(struct sock *sk, s
+ void raw6_icmp_error(struct sk_buff *skb, int nexthdr,
+ u8 type, u8 code, int inner_offset, __be32 info)
+ {
+- const struct in6_addr *saddr, *daddr;
+ struct net *net = dev_net(skb->dev);
+ struct hlist_nulls_head *hlist;
+ struct hlist_nulls_node *hnode;
+@@ -345,8 +344,6 @@ void raw6_icmp_error(struct sk_buff *skb
+ hlist_nulls_for_each_entry(sk, hnode, hlist, sk_nulls_node) {
+ /* Note: ipv6_hdr(skb) != skb->data */
+ const struct ipv6hdr *ip6h = (const struct ipv6hdr *)skb->data;
+- saddr = &ip6h->saddr;
+- daddr = &ip6h->daddr;
+
+ if (!raw_v6_match(net, sk, nexthdr, &ip6h->saddr, &ip6h->daddr,
+ inet6_iif(skb), inet6_iif(skb)))
--- /dev/null
+From 38a523a2946d3a0961d141d477a1ee2b1f3bdbb1 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 27 Jun 2022 16:36:57 +0200
+Subject: Revert "devcoredump: remove the useless gfp_t parameter in dev_coredumpv and dev_coredumpm"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 38a523a2946d3a0961d141d477a1ee2b1f3bdbb1 upstream.
+
+This reverts commit 77515ebaf01920e2db49e04672ef669a7c2907f2 as it
+causes build problems in linux-next. It needs to be reintroduced in a
+way that can allow the api to evolve and not require a "flag day" to
+catch all users.
+
+Link: https://lore.kernel.org/r/20220623160723.7a44b573@canb.auug.org.au
+Cc: Duoming Zhou <duoming@zju.edu.cn>
+Cc: Brian Norris <briannorris@chromium.org>
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/devcoredump.c | 16 +++++++++------
+ drivers/bluetooth/btmrvl_sdio.c | 2 -
+ drivers/bluetooth/hci_qca.c | 2 -
+ drivers/gpu/drm/etnaviv/etnaviv_dump.c | 2 -
+ drivers/gpu/drm/msm/disp/msm_disp_snapshot.c | 4 +--
+ drivers/gpu/drm/msm/msm_gpu.c | 4 +--
+ drivers/media/platform/qcom/venus/core.c | 2 -
+ drivers/net/can/spi/mcp251xfd/mcp251xfd-dump.c | 2 -
+ drivers/net/wireless/ath/ath10k/coredump.c | 2 -
+ drivers/net/wireless/ath/wil6210/wil_crash_dump.c | 2 -
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c | 2 -
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 6 +++--
+ drivers/net/wireless/marvell/mwifiex/main.c | 3 +-
+ drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 3 +-
+ drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 3 +-
+ drivers/net/wireless/realtek/rtw88/main.c | 2 -
+ drivers/net/wireless/realtek/rtw89/ser.c | 2 -
+ drivers/remoteproc/qcom_q6v5_mss.c | 2 -
+ drivers/remoteproc/remoteproc_coredump.c | 8 +++----
+ include/drm/drm_print.h | 2 -
+ include/linux/devcoredump.h | 13 ++++++------
+ sound/soc/intel/avs/apl.c | 2 -
+ sound/soc/intel/avs/skl.c | 2 -
+ sound/soc/intel/catpt/dsp.c | 2 -
+ 24 files changed, 50 insertions(+), 40 deletions(-)
+
+--- a/drivers/base/devcoredump.c
++++ b/drivers/base/devcoredump.c
+@@ -173,13 +173,15 @@ static void devcd_freev(void *data)
+ * @dev: the struct device for the crashed device
+ * @data: vmalloc data containing the device coredump
+ * @datalen: length of the data
++ * @gfp: allocation flags
+ *
+ * This function takes ownership of the vmalloc'ed data and will free
+ * it when it is no longer used. See dev_coredumpm() for more information.
+ */
+-void dev_coredumpv(struct device *dev, void *data, size_t datalen)
++void dev_coredumpv(struct device *dev, void *data, size_t datalen,
++ gfp_t gfp)
+ {
+- dev_coredumpm(dev, NULL, data, datalen, devcd_readv, devcd_freev);
++ dev_coredumpm(dev, NULL, data, datalen, gfp, devcd_readv, devcd_freev);
+ }
+ EXPORT_SYMBOL_GPL(dev_coredumpv);
+
+@@ -234,6 +236,7 @@ static ssize_t devcd_read_from_sgtable(c
+ * @owner: the module that contains the read/free functions, use %THIS_MODULE
+ * @data: data cookie for the @read/@free functions
+ * @datalen: length of the data
++ * @gfp: allocation flags
+ * @read: function to read from the given buffer
+ * @free: function to free the given buffer
+ *
+@@ -243,7 +246,7 @@ static ssize_t devcd_read_from_sgtable(c
+ * function will be called to free the data.
+ */
+ void dev_coredumpm(struct device *dev, struct module *owner,
+- void *data, size_t datalen,
++ void *data, size_t datalen, gfp_t gfp,
+ ssize_t (*read)(char *buffer, loff_t offset, size_t count,
+ void *data, size_t datalen),
+ void (*free)(void *data))
+@@ -265,7 +268,7 @@ void dev_coredumpm(struct device *dev, s
+ if (!try_module_get(owner))
+ goto free;
+
+- devcd = kzalloc(sizeof(*devcd), GFP_KERNEL);
++ devcd = kzalloc(sizeof(*devcd), gfp);
+ if (!devcd)
+ goto put_module;
+
+@@ -315,6 +318,7 @@ EXPORT_SYMBOL_GPL(dev_coredumpm);
+ * @dev: the struct device for the crashed device
+ * @table: the dump data
+ * @datalen: length of the data
++ * @gfp: allocation flags
+ *
+ * Creates a new device coredump for the given device. If a previous one hasn't
+ * been read yet, the new coredump is discarded. The data lifetime is determined
+@@ -322,9 +326,9 @@ EXPORT_SYMBOL_GPL(dev_coredumpm);
+ * it will free the data.
+ */
+ void dev_coredumpsg(struct device *dev, struct scatterlist *table,
+- size_t datalen)
++ size_t datalen, gfp_t gfp)
+ {
+- dev_coredumpm(dev, NULL, table, datalen, devcd_read_from_sgtable,
++ dev_coredumpm(dev, NULL, table, datalen, gfp, devcd_read_from_sgtable,
+ devcd_free_sgtable);
+ }
+ EXPORT_SYMBOL_GPL(dev_coredumpsg);
+--- a/drivers/bluetooth/btmrvl_sdio.c
++++ b/drivers/bluetooth/btmrvl_sdio.c
+@@ -1515,7 +1515,7 @@ done:
+ /* fw_dump_data will be free in device coredump release function
+ * after 5 min
+ */
+- dev_coredumpv(&card->func->dev, fw_dump_data, fw_dump_len);
++ dev_coredumpv(&card->func->dev, fw_dump_data, fw_dump_len, GFP_KERNEL);
+ BT_INFO("== btmrvl firmware dump to /sys/class/devcoredump end");
+ }
+
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -1120,7 +1120,7 @@ static void qca_controller_memdump(struc
+ qca_memdump->ram_dump_size);
+ memdump_buf = qca_memdump->memdump_buf_head;
+ dev_coredumpv(&hu->serdev->dev, memdump_buf,
+- qca_memdump->received_dump);
++ qca_memdump->received_dump, GFP_KERNEL);
+ cancel_delayed_work(&qca->ctrl_memdump_timeout);
+ kfree(qca->qca_memdump);
+ qca->qca_memdump = NULL;
+--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+@@ -225,5 +225,5 @@ void etnaviv_core_dump(struct etnaviv_ge
+
+ etnaviv_core_dump_header(&iter, ETDUMP_BUF_END, iter.data);
+
+- dev_coredumpv(gpu->dev, iter.start, iter.data - iter.start);
++ dev_coredumpv(gpu->dev, iter.start, iter.data - iter.start, GFP_KERNEL);
+ }
+--- a/drivers/gpu/drm/msm/disp/msm_disp_snapshot.c
++++ b/drivers/gpu/drm/msm/disp/msm_disp_snapshot.c
+@@ -74,8 +74,8 @@ static void _msm_disp_snapshot_work(stru
+ * If there is a codedump pending for the device, the dev_coredumpm()
+ * will also free new coredump state.
+ */
+- dev_coredumpm(disp_state->dev, THIS_MODULE, disp_state, 0,
+- disp_devcoredump_read, msm_disp_state_free);
++ dev_coredumpm(disp_state->dev, THIS_MODULE, disp_state, 0, GFP_KERNEL,
++ disp_devcoredump_read, msm_disp_state_free);
+ }
+
+ void msm_disp_snapshot_state(struct drm_device *drm_dev)
+--- a/drivers/gpu/drm/msm/msm_gpu.c
++++ b/drivers/gpu/drm/msm/msm_gpu.c
+@@ -299,8 +299,8 @@ static void msm_gpu_crashstate_capture(s
+ gpu->crashstate = state;
+
+ /* FIXME: Release the crashstate if this errors out? */
+- dev_coredumpm(gpu->dev->dev, THIS_MODULE, gpu, 0,
+- msm_gpu_devcoredump_read, msm_gpu_devcoredump_free);
++ dev_coredumpm(gpu->dev->dev, THIS_MODULE, gpu, 0, GFP_KERNEL,
++ msm_gpu_devcoredump_read, msm_gpu_devcoredump_free);
+ }
+ #else
+ static void msm_gpu_crashstate_capture(struct msm_gpu *gpu,
+--- a/drivers/media/platform/qcom/venus/core.c
++++ b/drivers/media/platform/qcom/venus/core.c
+@@ -49,7 +49,7 @@ static void venus_coredump(struct venus_
+
+ memcpy(data, mem_va, mem_size);
+ memunmap(mem_va);
+- dev_coredumpv(dev, data, mem_size);
++ dev_coredumpv(dev, data, mem_size, GFP_KERNEL);
+ }
+
+ static void venus_event_notify(struct venus_core *core, u32 event)
+--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-dump.c
++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-dump.c
+@@ -281,5 +281,5 @@ void mcp251xfd_dump(const struct mcp251x
+ mcp251xfd_dump_end(priv, &iter);
+
+ dev_coredumpv(&priv->spi->dev, iter.start,
+- iter.data - iter.start);
++ iter.data - iter.start, GFP_KERNEL);
+ }
+--- a/drivers/net/wireless/ath/ath10k/coredump.c
++++ b/drivers/net/wireless/ath/ath10k/coredump.c
+@@ -1607,7 +1607,7 @@ int ath10k_coredump_submit(struct ath10k
+ return -ENODATA;
+ }
+
+- dev_coredumpv(ar->dev, dump, le32_to_cpu(dump->len));
++ dev_coredumpv(ar->dev, dump, le32_to_cpu(dump->len), GFP_KERNEL);
+
+ return 0;
+ }
+--- a/drivers/net/wireless/ath/wil6210/wil_crash_dump.c
++++ b/drivers/net/wireless/ath/wil6210/wil_crash_dump.c
+@@ -117,6 +117,6 @@ void wil_fw_core_dump(struct wil6210_pri
+ /* fw_dump_data will be free in device coredump release function
+ * after 5 min
+ */
+- dev_coredumpv(wil_to_dev(wil), fw_dump_data, fw_dump_size);
++ dev_coredumpv(wil_to_dev(wil), fw_dump_data, fw_dump_size, GFP_KERNEL);
+ wil_info(wil, "fw core dumped, size %d bytes\n", fw_dump_size);
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
+@@ -37,7 +37,7 @@ int brcmf_debug_create_memdump(struct br
+ return err;
+ }
+
+- dev_coredumpv(bus->dev, dump, len + ramsize);
++ dev_coredumpv(bus->dev, dump, len + ramsize, GFP_KERNEL);
+
+ return 0;
+ }
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -2601,7 +2601,8 @@ static void iwl_fw_error_dump(struct iwl
+ fw_error_dump.trans_ptr->data,
+ fw_error_dump.trans_ptr->len,
+ fw_error_dump.fwrt_len);
+- dev_coredumpsg(fwrt->trans->dev, sg_dump_data, file_len);
++ dev_coredumpsg(fwrt->trans->dev, sg_dump_data, file_len,
++ GFP_KERNEL);
+ }
+ vfree(fw_error_dump.fwrt_ptr);
+ vfree(fw_error_dump.trans_ptr);
+@@ -2646,7 +2647,8 @@ static void iwl_fw_error_ini_dump(struct
+ entry->data, entry->size, offs);
+ offs += entry->size;
+ }
+- dev_coredumpsg(fwrt->trans->dev, sg_dump_data, file_len);
++ dev_coredumpsg(fwrt->trans->dev, sg_dump_data, file_len,
++ GFP_KERNEL);
+ }
+ iwl_dump_ini_list_free(&dump_list);
+ }
+--- a/drivers/net/wireless/marvell/mwifiex/main.c
++++ b/drivers/net/wireless/marvell/mwifiex/main.c
+@@ -1115,7 +1115,8 @@ void mwifiex_upload_device_dump(struct m
+ */
+ mwifiex_dbg(adapter, MSG,
+ "== mwifiex dump information to /sys/class/devcoredump start\n");
+- dev_coredumpv(adapter->dev, adapter->devdump_data, adapter->devdump_len);
++ dev_coredumpv(adapter->dev, adapter->devdump_data, adapter->devdump_len,
++ GFP_KERNEL);
+ mwifiex_dbg(adapter, MSG,
+ "== mwifiex dump information to /sys/class/devcoredump end\n");
+
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+@@ -2422,5 +2422,6 @@ void mt7615_coredump_work(struct work_st
+
+ dev_kfree_skb(skb);
+ }
+- dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ);
++ dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ,
++ GFP_KERNEL);
+ }
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+@@ -1419,7 +1419,8 @@ void mt7921_coredump_work(struct work_st
+ }
+
+ if (dump)
+- dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ);
++ dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ,
++ GFP_KERNEL);
+
+ mt7921_reset(&dev->mt76);
+ }
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -414,7 +414,7 @@ static void rtw_fwcd_dump(struct rtw_dev
+ * framework. Note that a new dump will be discarded if a previous one
+ * hasn't been released yet.
+ */
+- dev_coredumpv(rtwdev->dev, desc->data, desc->size);
++ dev_coredumpv(rtwdev->dev, desc->data, desc->size, GFP_KERNEL);
+ }
+
+ static void rtw_fwcd_free(struct rtw_dev *rtwdev, bool free_self)
+--- a/drivers/net/wireless/realtek/rtw89/ser.c
++++ b/drivers/net/wireless/realtek/rtw89/ser.c
+@@ -127,7 +127,7 @@ static void rtw89_ser_cd_send(struct rtw
+ * will be discarded if a previous one hasn't been released by
+ * framework yet.
+ */
+- dev_coredumpv(rtwdev->dev, buf, sizeof(*buf));
++ dev_coredumpv(rtwdev->dev, buf, sizeof(*buf), GFP_KERNEL);
+ }
+
+ static void rtw89_ser_cd_free(struct rtw89_dev *rtwdev,
+--- a/drivers/remoteproc/qcom_q6v5_mss.c
++++ b/drivers/remoteproc/qcom_q6v5_mss.c
+@@ -597,7 +597,7 @@ static void q6v5_dump_mba_logs(struct q6
+ data = vmalloc(MBA_LOG_SIZE);
+ if (data) {
+ memcpy(data, mba_region, MBA_LOG_SIZE);
+- dev_coredumpv(&rproc->dev, data, MBA_LOG_SIZE);
++ dev_coredumpv(&rproc->dev, data, MBA_LOG_SIZE, GFP_KERNEL);
+ }
+ memunmap(mba_region);
+ }
+--- a/drivers/remoteproc/remoteproc_coredump.c
++++ b/drivers/remoteproc/remoteproc_coredump.c
+@@ -309,7 +309,7 @@ void rproc_coredump(struct rproc *rproc)
+ phdr += elf_size_of_phdr(class);
+ }
+ if (dump_conf == RPROC_COREDUMP_ENABLED) {
+- dev_coredumpv(&rproc->dev, data, data_size);
++ dev_coredumpv(&rproc->dev, data, data_size, GFP_KERNEL);
+ return;
+ }
+
+@@ -318,7 +318,7 @@ void rproc_coredump(struct rproc *rproc)
+ dump_state.header = data;
+ init_completion(&dump_state.dump_done);
+
+- dev_coredumpm(&rproc->dev, NULL, &dump_state, data_size,
++ dev_coredumpm(&rproc->dev, NULL, &dump_state, data_size, GFP_KERNEL,
+ rproc_coredump_read, rproc_coredump_free);
+
+ /*
+@@ -449,7 +449,7 @@ void rproc_coredump_using_sections(struc
+ }
+
+ if (dump_conf == RPROC_COREDUMP_ENABLED) {
+- dev_coredumpv(&rproc->dev, data, data_size);
++ dev_coredumpv(&rproc->dev, data, data_size, GFP_KERNEL);
+ return;
+ }
+
+@@ -458,7 +458,7 @@ void rproc_coredump_using_sections(struc
+ dump_state.header = data;
+ init_completion(&dump_state.dump_done);
+
+- dev_coredumpm(&rproc->dev, NULL, &dump_state, data_size,
++ dev_coredumpm(&rproc->dev, NULL, &dump_state, data_size, GFP_KERNEL,
+ rproc_coredump_read, rproc_coredump_free);
+
+ /* Wait until the dump is read and free is called. Data is freed
+--- a/include/drm/drm_print.h
++++ b/include/drm/drm_print.h
+@@ -162,7 +162,7 @@ struct drm_print_iterator {
+ * void makecoredump(...)
+ * {
+ * ...
+- * dev_coredumpm(dev, THIS_MODULE, data, 0,
++ * dev_coredumpm(dev, THIS_MODULE, data, 0, GFP_KERNEL,
+ * coredump_read, ...)
+ * }
+ *
+--- a/include/linux/devcoredump.h
++++ b/include/linux/devcoredump.h
+@@ -52,26 +52,27 @@ static inline void _devcd_free_sgtable(s
+
+
+ #ifdef CONFIG_DEV_COREDUMP
+-void dev_coredumpv(struct device *dev, void *data, size_t datalen);
++void dev_coredumpv(struct device *dev, void *data, size_t datalen,
++ gfp_t gfp);
+
+ void dev_coredumpm(struct device *dev, struct module *owner,
+- void *data, size_t datalen,
++ void *data, size_t datalen, gfp_t gfp,
+ ssize_t (*read)(char *buffer, loff_t offset, size_t count,
+ void *data, size_t datalen),
+ void (*free)(void *data));
+
+ void dev_coredumpsg(struct device *dev, struct scatterlist *table,
+- size_t datalen);
++ size_t datalen, gfp_t gfp);
+ #else
+ static inline void dev_coredumpv(struct device *dev, void *data,
+- size_t datalen)
++ size_t datalen, gfp_t gfp)
+ {
+ vfree(data);
+ }
+
+ static inline void
+ dev_coredumpm(struct device *dev, struct module *owner,
+- void *data, size_t datalen,
++ void *data, size_t datalen, gfp_t gfp,
+ ssize_t (*read)(char *buffer, loff_t offset, size_t count,
+ void *data, size_t datalen),
+ void (*free)(void *data))
+@@ -80,7 +81,7 @@ dev_coredumpm(struct device *dev, struct
+ }
+
+ static inline void dev_coredumpsg(struct device *dev, struct scatterlist *table,
+- size_t datalen)
++ size_t datalen, gfp_t gfp)
+ {
+ _devcd_free_sgtable(table);
+ }
+--- a/sound/soc/intel/avs/apl.c
++++ b/sound/soc/intel/avs/apl.c
+@@ -164,7 +164,7 @@ static int apl_coredump(struct avs_dev *
+ } while (offset < msg->ext.coredump.stack_dump_size);
+
+ exit:
+- dev_coredumpv(adev->dev, dump, dump_size);
++ dev_coredumpv(adev->dev, dump, dump_size, GFP_KERNEL);
+
+ return 0;
+ }
+--- a/sound/soc/intel/avs/skl.c
++++ b/sound/soc/intel/avs/skl.c
+@@ -88,7 +88,7 @@ static int skl_coredump(struct avs_dev *
+ return -ENOMEM;
+
+ memcpy_fromio(dump, avs_sram_addr(adev, AVS_FW_REGS_WINDOW), AVS_FW_REGS_SIZE);
+- dev_coredumpv(adev->dev, dump, AVS_FW_REGS_SIZE);
++ dev_coredumpv(adev->dev, dump, AVS_FW_REGS_SIZE, GFP_KERNEL);
+
+ return 0;
+ }
+--- a/sound/soc/intel/catpt/dsp.c
++++ b/sound/soc/intel/catpt/dsp.c
+@@ -539,7 +539,7 @@ int catpt_coredump(struct catpt_dev *cde
+ pos += CATPT_DMA_REGS_SIZE;
+ }
+
+- dev_coredumpv(cdev->dev, dump, dump_size);
++ dev_coredumpv(cdev->dev, dump, dump_size, GFP_KERNEL);
+
+ return 0;
+ }
--- /dev/null
+From 61922beba36adea8702fe8069b309c806f6608af Mon Sep 17 00:00:00 2001
+From: Robert Foss <robert.foss@linaro.org>
+Date: Mon, 23 May 2022 18:15:19 +0200
+Subject: Revert "drm/bridge: anx7625: Use DPI bus type"
+
+From: Robert Foss <robert.foss@linaro.org>
+
+commit 61922beba36adea8702fe8069b309c806f6608af upstream.
+
+This reverts commit a77c2af0994e24ee36c7ffb6dc852770bdf06fb1.
+
+This patch depends on the patches just aplied to the media tree, and will
+not build without them, which leaves drm-misc-next in a broken state.
+Let's revert the two latter patches until rc1 has been branched,
+and rc1 has been backmerged into drm-misc-next.
+
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220523161520.354687-1-robert.foss@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/bridge/analogix/anx7625.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
+@@ -1623,14 +1623,14 @@ static int anx7625_parse_dt(struct devic
+
+ anx7625_get_swing_setting(dev, pdata);
+
+- pdata->is_dpi = 0; /* default dsi mode */
++ pdata->is_dpi = 1; /* default dpi mode */
+ pdata->mipi_host_node = of_graph_get_remote_node(np, 0, 0);
+ if (!pdata->mipi_host_node) {
+ DRM_DEV_ERROR(dev, "fail to get internal panel.\n");
+ return -ENODEV;
+ }
+
+- bus_type = 0;
++ bus_type = V4L2_FWNODE_BUS_TYPE_PARALLEL;
+ mipi_lanes = MAX_LANES_SUPPORT;
+ ep0 = of_graph_get_endpoint_by_regs(np, 0, 0);
+ if (ep0) {
+@@ -1640,8 +1640,8 @@ static int anx7625_parse_dt(struct devic
+ mipi_lanes = of_property_count_u32_elems(ep0, "data-lanes");
+ }
+
+- if (bus_type == V4L2_FWNODE_BUS_TYPE_DPI) /* bus type is DPI */
+- pdata->is_dpi = 1;
++ if (bus_type == V4L2_FWNODE_BUS_TYPE_PARALLEL) /* bus type is Parallel(DSI) */
++ pdata->is_dpi = 0;
+
+ pdata->mipi_lanes = mipi_lanes;
+ if (pdata->mipi_lanes > MAX_LANES_SUPPORT || pdata->mipi_lanes <= 0)
--- /dev/null
+From 5f8954e099b8ae96e7de1bb95950e00c85bedd40 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 27 Jun 2022 16:35:59 +0200
+Subject: Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 5f8954e099b8ae96e7de1bb95950e00c85bedd40 upstream.
+
+This reverts commit a52ed4866d2b90dd5e4ae9dabd453f3ed8fa3cbc as it
+causes build problems in linux-next. It needs to be reintroduced in a
+way that can allow the api to evolve and not require a "flag day" to
+catch all users.
+
+Link: https://lore.kernel.org/r/20220623160723.7a44b573@canb.auug.org.au
+Cc: Duoming Zhou <duoming@zju.edu.cn>
+Cc: Brian Norris <briannorris@chromium.org>
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/marvell/mwifiex/init.c | 9 ++++-----
+ drivers/net/wireless/marvell/mwifiex/main.h | 3 +--
+ drivers/net/wireless/marvell/mwifiex/sta_event.c | 6 +++---
+ 3 files changed, 8 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/init.c
++++ b/drivers/net/wireless/marvell/mwifiex/init.c
+@@ -63,10 +63,9 @@ static void wakeup_timer_fn(struct timer
+ adapter->if_ops.card_reset(adapter);
+ }
+
+-static void fw_dump_work(struct work_struct *work)
++static void fw_dump_timer_fn(struct timer_list *t)
+ {
+- struct mwifiex_adapter *adapter =
+- container_of(work, struct mwifiex_adapter, devdump_work.work);
++ struct mwifiex_adapter *adapter = from_timer(adapter, t, devdump_timer);
+
+ mwifiex_upload_device_dump(adapter);
+ }
+@@ -322,7 +321,7 @@ static void mwifiex_init_adapter(struct
+ adapter->active_scan_triggered = false;
+ timer_setup(&adapter->wakeup_timer, wakeup_timer_fn, 0);
+ adapter->devdump_len = 0;
+- INIT_DELAYED_WORK(&adapter->devdump_work, fw_dump_work);
++ timer_setup(&adapter->devdump_timer, fw_dump_timer_fn, 0);
+ }
+
+ /*
+@@ -401,7 +400,7 @@ static void
+ mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
+ {
+ del_timer(&adapter->wakeup_timer);
+- cancel_delayed_work_sync(&adapter->devdump_work);
++ del_timer_sync(&adapter->devdump_timer);
+ mwifiex_cancel_all_pending_cmd(adapter);
+ wake_up_interruptible(&adapter->cmd_wait_q.wait);
+ wake_up_interruptible(&adapter->hs_activate_wait_q);
+--- a/drivers/net/wireless/marvell/mwifiex/main.h
++++ b/drivers/net/wireless/marvell/mwifiex/main.h
+@@ -49,7 +49,6 @@
+ #include <linux/pm_runtime.h>
+ #include <linux/slab.h>
+ #include <linux/of_irq.h>
+-#include <linux/workqueue.h>
+
+ #include "decl.h"
+ #include "ioctl.h"
+@@ -1056,7 +1055,7 @@ struct mwifiex_adapter {
+ /* Device dump data/length */
+ void *devdump_data;
+ int devdump_len;
+- struct delayed_work devdump_work;
++ struct timer_list devdump_timer;
+
+ bool ignore_btcoex_events;
+ };
+--- a/drivers/net/wireless/marvell/mwifiex/sta_event.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c
+@@ -623,8 +623,8 @@ mwifiex_fw_dump_info_event(struct mwifie
+ * transmission event get lost, in this cornel case,
+ * user would still get partial of the dump.
+ */
+- schedule_delayed_work(&adapter->devdump_work,
+- msecs_to_jiffies(MWIFIEX_TIMER_10S));
++ mod_timer(&adapter->devdump_timer,
++ jiffies + msecs_to_jiffies(MWIFIEX_TIMER_10S));
+ }
+
+ /* Overflow check */
+@@ -643,7 +643,7 @@ mwifiex_fw_dump_info_event(struct mwifie
+ return;
+
+ upload_dump:
+- cancel_delayed_work_sync(&adapter->devdump_work);
++ del_timer_sync(&adapter->devdump_timer);
+ mwifiex_upload_device_dump(adapter);
+ }
+
--- /dev/null
+From 953503751a426413ea8aee2299ae3ee971b70d9b Mon Sep 17 00:00:00 2001
+From: Alexander Gordeev <agordeev@linux.ibm.com>
+Date: Sat, 6 Aug 2022 09:29:46 +0200
+Subject: Revert "s390/smp: enforce lowcore protection on CPU restart"
+
+From: Alexander Gordeev <agordeev@linux.ibm.com>
+
+commit 953503751a426413ea8aee2299ae3ee971b70d9b upstream.
+
+This reverts commit 6f5c672d17f583b081e283927f5040f726c54598.
+
+This breaks normal crash dump when CPU0 is offline.
+
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/kernel/setup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -508,8 +508,8 @@ static void __init setup_lowcore_dat_on(
+ S390_lowcore.svc_new_psw.mask |= PSW_MASK_DAT;
+ S390_lowcore.program_new_psw.mask |= PSW_MASK_DAT;
+ S390_lowcore.io_new_psw.mask |= PSW_MASK_DAT;
+- __ctl_set_bit(0, 28);
+ __ctl_store(S390_lowcore.cregs_save_area, 0, 15);
++ __ctl_set_bit(0, 28);
+ put_abs_lowcore(restart_flags, RESTART_FLAG_CTLREGS);
+ put_abs_lowcore(program_new_psw, lc->program_new_psw);
+ for (cr = 0; cr < ARRAY_SIZE(lc->cregs_save_area); cr++)
powerpc64-ftrace-fix-ftrace-for-clang-builds.patch
net_sched-cls_route-remove-from-list-when-handle-is-0.patch
arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch
+revert-drm-bridge-anx7625-use-dpi-bus-type.patch
+tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch
+crypto-lib-blake2s-reduce-stack-frame-usage-in-self-test.patch
+raw-remove-unused-variables-from-raw6_icmp_error.patch
+raw-fix-a-typo-in-raw_icmp_error.patch
+revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch
+revert-devcoredump-remove-the-useless-gfp_t-parameter-in-dev_coredumpv-and-dev_coredumpm.patch
+mptcp-refine-memory-scheduling.patch
+wifi-cfg80211-handle-ibss-in-channel-switch.patch
+wifi-nl80211-hold-wdev-mutex-for-tid-config.patch
+wifi-nl80211-relax-wdev-mutex-check-in-wdev_chandef.patch
+wifi-nl80211-acquire-wdev-mutex-earlier-in-start_ap.patch
+wifi-cfg80211-remove-chandef-check-in-cfg80211_cac_event.patch
+tracing-use-a-copy-of-the-va_list-for-__assign_vstr.patch
+net-dsa-felix-fix-min-gate-len-calculation-for-tc-when-its-first-gate-is-closed.patch
+revert-s390-smp-enforce-lowcore-protection-on-cpu-restart.patch
+powerpc-kexec-fix-build-failure-from-uninitialised-variable.patch
--- /dev/null
+From c4ee118561a0f74442439b7b5b486db1ac1ddfeb Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Tue, 14 Jun 2022 10:17:33 -0700
+Subject: tcp: fix over estimation in sk_forced_mem_schedule()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit c4ee118561a0f74442439b7b5b486db1ac1ddfeb upstream.
+
+sk_forced_mem_schedule() has a bug similar to ones fixed
+in commit 7c80b038d23e ("net: fix sk_wmem_schedule() and
+sk_rmem_schedule() errors")
+
+While this bug has little chance to trigger in old kernels,
+we need to fix it before the following patch.
+
+Fixes: d83769a580f1 ("tcp: fix possible deadlock in tcp_send_fin()")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
+Reviewed-by: Shakeel Butt <shakeelb@google.com>
+Reviewed-by: Wei Wang <weiwan@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_output.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -3369,11 +3369,12 @@ void tcp_xmit_retransmit_queue(struct so
+ */
+ void sk_forced_mem_schedule(struct sock *sk, int size)
+ {
+- int amt;
++ int delta, amt;
+
+- if (size <= sk->sk_forward_alloc)
++ delta = size - sk->sk_forward_alloc;
++ if (delta <= 0)
+ return;
+- amt = sk_mem_pages(size);
++ amt = sk_mem_pages(delta);
+ sk->sk_forward_alloc += amt * SK_MEM_QUANTUM;
+ sk_memory_allocated_add(sk, amt);
+
--- /dev/null
+From 3a2dcbaf4d31023106975d6ae75b6df080c454cb Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
+Date: Tue, 19 Jul 2022 18:20:04 -0400
+Subject: tracing: Use a copy of the va_list for __assign_vstr()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+commit 3a2dcbaf4d31023106975d6ae75b6df080c454cb upstream.
+
+If an instance of tracing enables the same trace event as another
+instance, or the top level instance, or even perf, then the va_list passed
+into some tracepoints can be used more than once.
+
+As va_list can only be traversed once, this can cause issues:
+
+ # cat /sys/kernel/tracing/instances/qla2xxx/trace
+ cat-56106 [012] ..... 2419873.470098: ql_dbg_log: qla2xxx [0000:05:00.0]-1054:14: Entered (null).
+ cat-56106 [012] ..... 2419873.470101: ql_dbg_log: qla2xxx [0000:05:00.0]-1000:14: Entered ×+<96>²Ü<98>^H.
+ cat-56106 [012] ..... 2419873.470102: ql_dbg_log: qla2xxx [0000:05:00.0]-1006:14: Prepare to issue mbox cmd=0xde589000.
+
+ # cat /sys/kernel/tracing/trace
+ cat-56106 [012] ..... 2419873.470097: ql_dbg_log: qla2xxx [0000:05:00.0]-1054:14: Entered qla2x00_get_firmware_state.
+ cat-56106 [012] ..... 2419873.470100: ql_dbg_log: qla2xxx [0000:05:00.0]-1000:14: Entered qla2x00_mailbox_command.
+ cat-56106 [012] ..... 2419873.470102: ql_dbg_log: qla2xxx [0000:05:00.0]-1006:14: Prepare to issue mbox cmd=0x69.
+
+The instance version is corrupted because the top level instance iterated
+the va_list first.
+
+Use va_copy() in the __assign_vstr() macro to make sure that each trace
+event for each use case gets a fresh va_list.
+
+Link: https://lore.kernel.org/all/259d53a5-958e-6508-4e45-74dba2821242@marvell.com/
+Link: https://lkml.kernel.org/r/20220719182004.21daa83e@gandalf.local.home
+
+Fixes: 0563231f93c6d ("tracing/events: Add __vstring() and __assign_vstr() helper macros")
+Reported-by: Arun Easi <aeasi@marvell.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/trace/stages/stage6_event_callback.h | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/include/trace/stages/stage6_event_callback.h
++++ b/include/trace/stages/stage6_event_callback.h
+@@ -40,7 +40,12 @@
+
+ #undef __assign_vstr
+ #define __assign_vstr(dst, fmt, va) \
+- vsnprintf(__get_str(dst), TRACE_EVENT_STR_MAX, fmt, *(va))
++ do { \
++ va_list __cp_va; \
++ va_copy(__cp_va, *(va)); \
++ vsnprintf(__get_str(dst), TRACE_EVENT_STR_MAX, fmt, __cp_va); \
++ va_end(__cp_va); \
++ } while (0)
+
+ #undef __bitmask
+ #define __bitmask(item, nr_bits) __dynamic_array(unsigned long, item, -1)
--- /dev/null
+From 77e7b6ba78edf817bddfa97fadb15a971992b1ee Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 27 Jun 2022 12:36:03 +0200
+Subject: wifi: cfg80211: handle IBSS in channel switch
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 77e7b6ba78edf817bddfa97fadb15a971992b1ee upstream.
+
+Prior to commit 7b0a0e3c3a88 ("wifi: cfg80211: do some
+rework towards MLO link APIs") the interface type didn't
+really matter here, but now we need to handle all of the
+possible cases. Add IBSS ("ADHOC") and handle it.
+
+Fixes: 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link APIs")
+Reported-by: syzbot+90d912872157e63589e4@syzkaller.appspotmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/wireless/nl80211.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -18294,6 +18294,9 @@ void cfg80211_ch_switch_notify(struct ne
+ case NL80211_IFTYPE_P2P_GO:
+ wdev->links[link_id].ap.chandef = *chandef;
+ break;
++ case NL80211_IFTYPE_ADHOC:
++ wdev->u.ibss.chandef = *chandef;
++ break;
+ default:
+ WARN_ON(1);
+ break;
--- /dev/null
+From d6f671c8a339d5b655acfacb8be6918c744fbabf Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 27 Jun 2022 12:49:03 +0200
+Subject: wifi: cfg80211: remove chandef check in cfg80211_cac_event()
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit d6f671c8a339d5b655acfacb8be6918c744fbabf upstream.
+
+The current check only worked for AP mode, but we can do
+radar detection in mesh as well (for example). We could
+try to check this using wdev_chandef(), but we also don't
+really care since the chandef is passed in and we have no
+need to use it anymore (since we added the argument in
+commit d2859df5e7f0 ("cfg80211/mac80211: DFS setup chandef
+for cac event")).
+
+Change-Id: I856e4344d5e64ff4d2eead0b4c53b11f264be9b8
+Fixes: 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link APIs")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/wireless/mlme.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -955,9 +955,6 @@ void cfg80211_cac_event(struct net_devic
+ if (WARN_ON(!wdev->cac_started && event != NL80211_RADAR_CAC_STARTED))
+ return;
+
+- if (WARN_ON(!wdev->links[0].ap.chandef.chan))
+- return;
+-
+ switch (event) {
+ case NL80211_RADAR_CAC_FINISHED:
+ timeout = wdev->cac_start_time +
--- /dev/null
+From c2653990d5729a445296d6d04395be5dea8e282e Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 27 Jun 2022 12:49:03 +0200
+Subject: wifi: nl80211: acquire wdev mutex earlier in start_ap
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit c2653990d5729a445296d6d04395be5dea8e282e upstream.
+
+We need to hold the wdev mutex already in order to call
+nl80211_parse_tx_bitrate_mask(), so acquire it earlier.
+
+Fixes: 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link APIs")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/wireless/nl80211.c | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -5747,18 +5747,20 @@ static int nl80211_start_ap(struct sk_bu
+ goto out;
+ }
+
++ wdev_lock(wdev);
++
+ if (info->attrs[NL80211_ATTR_TX_RATES]) {
+ err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
+ NL80211_ATTR_TX_RATES,
+ ¶ms->beacon_rate,
+ dev, false, link_id);
+ if (err)
+- goto out;
++ goto out_unlock;
+
+ err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
+ ¶ms->beacon_rate);
+ if (err)
+- goto out;
++ goto out_unlock;
+ }
+
+ if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
+@@ -5771,19 +5773,19 @@ static int nl80211_start_ap(struct sk_bu
+ if (!(rdev->wiphy.features &
+ NL80211_FEATURE_STATIC_SMPS)) {
+ err = -EINVAL;
+- goto out;
++ goto out_unlock;
+ }
+ break;
+ case NL80211_SMPS_DYNAMIC:
+ if (!(rdev->wiphy.features &
+ NL80211_FEATURE_DYNAMIC_SMPS)) {
+ err = -EINVAL;
+- goto out;
++ goto out_unlock;
+ }
+ break;
+ default:
+ err = -EINVAL;
+- goto out;
++ goto out_unlock;
+ }
+ } else {
+ params->smps_mode = NL80211_SMPS_OFF;
+@@ -5792,7 +5794,7 @@ static int nl80211_start_ap(struct sk_bu
+ params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
+ if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
+ err = -EOPNOTSUPP;
+- goto out;
++ goto out_unlock;
+ }
+
+ if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
+@@ -5800,7 +5802,7 @@ static int nl80211_start_ap(struct sk_bu
+ if (IS_ERR(params->acl)) {
+ err = PTR_ERR(params->acl);
+ params->acl = NULL;
+- goto out;
++ goto out_unlock;
+ }
+ }
+
+@@ -5812,7 +5814,7 @@ static int nl80211_start_ap(struct sk_bu
+ info->attrs[NL80211_ATTR_HE_OBSS_PD],
+ ¶ms->he_obss_pd);
+ if (err)
+- goto out;
++ goto out_unlock;
+ }
+
+ if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
+@@ -5820,7 +5822,7 @@ static int nl80211_start_ap(struct sk_bu
+ info->attrs[NL80211_ATTR_FILS_DISCOVERY],
+ params);
+ if (err)
+- goto out;
++ goto out_unlock;
+ }
+
+ if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
+@@ -5828,7 +5830,7 @@ static int nl80211_start_ap(struct sk_bu
+ rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
+ params);
+ if (err)
+- goto out;
++ goto out_unlock;
+ }
+
+ if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
+@@ -5839,7 +5841,7 @@ static int nl80211_start_ap(struct sk_bu
+ params->beacon.mbssid_ies->cnt :
+ 0);
+ if (err)
+- goto out;
++ goto out_unlock;
+ }
+
+ nl80211_calculate_ap_params(params);
+@@ -5850,7 +5852,6 @@ static int nl80211_start_ap(struct sk_bu
+ else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
+ params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
+
+- wdev_lock(wdev);
+ if (wdev->conn_owner_nlportid &&
+ info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
+ wdev->conn_owner_nlportid != info->snd_portid) {
--- /dev/null
+From 206bbcf76121664e95a42e1c014c3fe168d07a3d Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 27 Jun 2022 12:43:37 +0200
+Subject: wifi: nl80211: hold wdev mutex for tid config
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 206bbcf76121664e95a42e1c014c3fe168d07a3d upstream.
+
+We need wdev_chandef() in this code, which now requires
+the wdev mutex due to the per-link nature. Hold it here
+to make sure we can access the link.
+
+Reported-by: syzbot+b4e9aa0f32ffd9902442@syzkaller.appspotmail.com
+Fixes: 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link APIs")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/wireless/nl80211.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -15285,6 +15285,8 @@ static int nl80211_set_tid_config(struct
+ if (info->attrs[NL80211_ATTR_MAC])
+ tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
+
++ wdev_lock(dev->ieee80211_ptr);
++
+ nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
+ rem_conf) {
+ ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
+@@ -15306,6 +15308,7 @@ static int nl80211_set_tid_config(struct
+
+ bad_tid_conf:
+ kfree(tid_config);
++ wdev_unlock(dev->ieee80211_ptr);
+ return ret;
+ }
+
--- /dev/null
+From 31177127e067eb73d5ca46ce32a410e41333d42f Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 27 Jun 2022 12:49:03 +0200
+Subject: wifi: nl80211: relax wdev mutex check in wdev_chandef()
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 31177127e067eb73d5ca46ce32a410e41333d42f upstream.
+
+In many cases we might get here from driver code that's
+not really set up to care about the locking, and for the
+non-MLO cases we really don't care so much about it. So
+relax the checking here for now, perhaps we should even
+remove it completely since we might not really care if
+we point to an invalid link's chandef and can require
+the caller to check the link validity first.
+
+Fixes: 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link APIs")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/wireless/chan.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/net/wireless/chan.c
++++ b/net/wireless/chan.c
+@@ -1433,7 +1433,17 @@ EXPORT_SYMBOL(cfg80211_any_usable_channe
+ struct cfg80211_chan_def *wdev_chandef(struct wireless_dev *wdev,
+ unsigned int link_id)
+ {
+- ASSERT_WDEV_LOCK(wdev);
++ /*
++ * We need to sort out the locking here - in some cases
++ * where we get here we really just don't care (yet)
++ * about the valid links, but in others we do. But we
++ * get here with various driver cases, so we cannot
++ * easily require the wdev mutex.
++ */
++ if (link_id || wdev->valid_links & BIT(0)) {
++ ASSERT_WDEV_LOCK(wdev);
++ WARN_ON(!(wdev->valid_links & BIT(link_id)));
++ }
+
+ switch (wdev->iftype) {
+ case NL80211_IFTYPE_MESH_POINT:
projects / thirdparty / kernel / stable-queue.git / commitdiff
