]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Merge branch 'master' of gitolite.kernel.org:/pub/scm/linux/kernel/git/stable/stable...
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 7 Oct 2023 12:50:37 +0000 (14:50 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 7 Oct 2023 12:50:37 +0000 (14:50 +0200)
1  2 
queue-4.14/series
queue-4.19/series
queue-5.10/series
queue-5.15/series
queue-5.4/series
queue-6.1/series
queue-6.5/bluetooth-fix-hci_link_tx_to-rcu-lock-usage.patch
queue-6.5/net-mana-fix-the-tso_bytes-calculation.patch
queue-6.5/series

index e6b32f47a02dfe21722ced7fc695943eb5d38e2d,071e516413b20e404a9ac5ebe0efb9663696c551..0a87614d7455c5334c7cbaa53e8a8f191a6531ec
@@@ -33,6 -33,14 +33,17 @@@ ext4-fix-rec_len-verify-error.patc
  net-sched-sch_hfsc-ensure-inner-classes-have-fsc-curve.patch
  ata-libata-disallow-dev-initiated-lpm-transitions-to-unsupported-states.patch
  media-dvb-symbol-fixup-for-dvb_attach-again.patch
 +scsi-zfcp-fix-a-double-put-in-zfcp_port_enqueue.patch
 +wifi-mwifiex-fix-tlv_buf_left-calculation.patch
 +btrfs-reject-unknown-mount-options-early.patch
+ ubi-refuse-attaching-if-mtd-s-erasesize-is-0.patch
+ wifi-mwifiex-fix-oob-check-condition-in-mwifiex_proc.patch
+ drivers-net-process-the-result-of-hdlc_open-and-add-.patch
+ regmap-rbtree-fix-wrong-register-marked-as-in-cache-.patch
+ scsi-target-core-fix-deadlock-due-to-recursive-locki.patch
+ modpost-add-missing-else-to-the-of-check.patch
+ ipv4-ipv6-fix-handling-of-transhdrlen-in-__ip-6-_app.patch
+ net-usb-smsc75xx-fix-uninit-value-access-in-__smsc75.patch
+ tcp-fix-delayed-acks-for-mss-boundary-condition.patch
+ sctp-update-transport-state-when-processing-a-dupcoo.patch
+ sctp-update-hb-timer-immediately-after-users-change-.patch
index a12423c6a4d63cf04b72efd9d4e8e5472108b9af,bdc4156475dd82bee42d76cee23a00d6374b00f3..f19b387693027b637a7450976ed637f1ded326b8
@@@ -69,8 -69,16 +69,21 @@@ ata-libata-disallow-dev-initiated-lpm-t
  revert-drivers-core-use-sysfs_emit-and-sysfs_emit_at-for-show-device-...-functions.patch
  media-dvb-symbol-fixup-for-dvb_attach-again.patch
  revert-pci-qcom-disable-write-access-to-read-only-registers-for-ip-v2.3.3.patch
 +scsi-zfcp-fix-a-double-put-in-zfcp_port_enqueue.patch
 +qed-red_ll2-fix-undefined-behavior-bug-in-struct-qed_ll2_info.patch
 +wifi-mwifiex-fix-tlv_buf_left-calculation.patch
 +net-replace-calls-to-sock-ops-connect-with-kernel_connect.patch
 +btrfs-reject-unknown-mount-options-early.patch
+ ubi-refuse-attaching-if-mtd-s-erasesize-is-0.patch
+ wifi-mwifiex-fix-oob-check-condition-in-mwifiex_proc.patch
+ drivers-net-process-the-result-of-hdlc_open-and-add-.patch
+ regmap-rbtree-fix-wrong-register-marked-as-in-cache-.patch
+ scsi-target-core-fix-deadlock-due-to-recursive-locki.patch
+ modpost-add-missing-else-to-the-of-check.patch
+ ipv4-ipv6-fix-handling-of-transhdrlen-in-__ip-6-_app.patch
+ net-usb-smsc75xx-fix-uninit-value-access-in-__smsc75.patch
+ net-stmmac-dwmac-stm32-fix-resume-on-stm32-mcu.patch
+ tcp-fix-quick-ack-counting-to-count-actual-acks-of-n.patch
+ tcp-fix-delayed-acks-for-mss-boundary-condition.patch
+ sctp-update-transport-state-when-processing-a-dupcoo.patch
+ sctp-update-hb-timer-immediately-after-users-change-.patch
index c1474311eb3bdf824f06c2a6e2674d87b4bb2a9e,3061909b04796d04d5fb55f55d9f48666f655f87..5429360789ae43112ee15387a7f62f016211871b
@@@ -177,10 -177,29 +177,36 @@@ rbd-take-header_rwsem-in-rbd_dev_refres
  block-fix-use-after-free-of-q-q_usage_counter.patch
  revert-clk-imx-pll14xx-dynamically-configure-pll-for-393216000-361267200hz.patch
  revert-pci-qcom-disable-write-access-to-read-only-registers-for-ip-v2.3.3.patch
 +scsi-zfcp-fix-a-double-put-in-zfcp_port_enqueue.patch
 +qed-red_ll2-fix-undefined-behavior-bug-in-struct-qed_ll2_info.patch
 +wifi-mwifiex-fix-tlv_buf_left-calculation.patch
 +net-replace-calls-to-sock-ops-connect-with-kernel_connect.patch
 +btrfs-reject-unknown-mount-options-early.patch
 +net-prevent-rewrite-of-msg_name-in-sock_sendmsg.patch
 +arm64-add-cortex-a520-cpu-part-definition.patch
+ ubi-refuse-attaching-if-mtd-s-erasesize-is-0.patch
+ wifi-iwlwifi-dbg_ini-fix-structure-packing.patch
+ wifi-mwifiex-fix-oob-check-condition-in-mwifiex_proc.patch
+ bpf-fix-tr-dereferencing.patch
+ drivers-net-process-the-result-of-hdlc_open-and-add-.patch
+ wifi-mt76-mt76x02-fix-mt76x0-external-lna-gain-handl.patch
+ regmap-rbtree-fix-wrong-register-marked-as-in-cache-.patch
+ ima-finish-deprecation-of-ima_trusted_keyring-kconfi.patch
+ scsi-target-core-fix-deadlock-due-to-recursive-locki.patch
+ ima-rework-config_ima-dependency-block.patch
+ nfsv4-fix-a-nfs4_state_manager-race.patch
+ modpost-add-missing-else-to-the-of-check.patch
+ net-fix-possible-store-tearing-in-neigh_periodic_wor.patch
+ ipv4-ipv6-fix-handling-of-transhdrlen-in-__ip-6-_app.patch
+ net-dsa-mv88e6xxx-avoid-eeprom-timeout-when-eeprom-i.patch
+ net-usb-smsc75xx-fix-uninit-value-access-in-__smsc75.patch
+ net-nfc-llcp-add-lock-when-modifying-device-list.patch
+ net-ethernet-ti-am65-cpsw-fix-error-code-in-am65_cps.patch
+ netfilter-handle-the-connecting-collision-properly-i.patch
+ netfilter-nf_tables-nft_set_rbtree-fix-spurious-inse.patch
+ net-stmmac-dwmac-stm32-fix-resume-on-stm32-mcu.patch
+ tipc-fix-a-potential-deadlock-on-tx-lock.patch
+ tcp-fix-quick-ack-counting-to-count-actual-acks-of-n.patch
+ tcp-fix-delayed-acks-for-mss-boundary-condition.patch
+ sctp-update-transport-state-when-processing-a-dupcoo.patch
+ sctp-update-hb-timer-immediately-after-users-change-.patch
index db2c7cabf559098eab0f575b129b17d712a87824,13216f5d3bbb482245b395d69ce56a60f64af158..0dd30663b8e895c78adc8118ad070e45094e2e9b
@@@ -16,12 -16,38 +16,47 @@@ rbd-decouple-parent-info-read-in-from-u
  rbd-take-header_rwsem-in-rbd_dev_refresh-only-when-u.patch
  block-fix-use-after-free-of-q-q_usage_counter.patch
  revert-clk-imx-pll14xx-dynamically-configure-pll-for-393216000-361267200hz.patch
 +scsi-zfcp-fix-a-double-put-in-zfcp_port_enqueue.patch
 +vringh-don-t-use-vringh_kiov_advance-in-vringh_iov_xfer.patch
 +qed-red_ll2-fix-undefined-behavior-bug-in-struct-qed_ll2_info.patch
 +wifi-mwifiex-fix-tlv_buf_left-calculation.patch
 +net-replace-calls-to-sock-ops-connect-with-kernel_connect.patch
 +btrfs-reject-unknown-mount-options-early.patch
 +net-prevent-rewrite-of-msg_name-in-sock_sendmsg.patch
 +drm-amd-fix-detection-of-_pr3-on-the-pcie-root-port.patch
 +arm64-add-cortex-a520-cpu-part-definition.patch
+ hid-sony-fix-a-potential-memory-leak-in-sony_probe.patch
+ ubi-refuse-attaching-if-mtd-s-erasesize-is-0.patch
+ wifi-iwlwifi-dbg_ini-fix-structure-packing.patch
+ iwlwifi-avoid-void-pointer-arithmetic.patch
+ wifi-iwlwifi-mvm-fix-a-memory-corruption-issue.patch
+ wifi-mwifiex-fix-oob-check-condition-in-mwifiex_proc.patch
+ bpf-fix-tr-dereferencing.patch
+ drivers-net-process-the-result-of-hdlc_open-and-add-.patch
+ wifi-mt76-mt76x02-fix-mt76x0-external-lna-gain-handl.patch
+ regmap-rbtree-fix-wrong-register-marked-as-in-cache-.patch
+ ima-finish-deprecation-of-ima_trusted_keyring-kconfi.patch
+ scsi-target-core-fix-deadlock-due-to-recursive-locki.patch
+ ima-rework-config_ima-dependency-block.patch
+ nfsv4-fix-a-nfs4_state_manager-race.patch
+ bpf-sockmap-reject-sk_msg-egress-redirects-to-non-tc.patch
+ modpost-add-missing-else-to-the-of-check.patch
+ net-fix-possible-store-tearing-in-neigh_periodic_wor.patch
+ ipv4-ipv6-fix-handling-of-transhdrlen-in-__ip-6-_app.patch
+ ptp-ocp-fix-error-handling-in-ptp_ocp_device_init.patch
+ net-dsa-mv88e6xxx-avoid-eeprom-timeout-when-eeprom-i.patch
+ net-usb-smsc75xx-fix-uninit-value-access-in-__smsc75.patch
+ net-nfc-llcp-add-lock-when-modifying-device-list.patch
+ net-ethernet-ti-am65-cpsw-fix-error-code-in-am65_cps.patch
+ ibmveth-remove-condition-to-recompute-tcp-header-che.patch
+ netfilter-handle-the-connecting-collision-properly-i.patch
+ netfilter-nf_tables-nft_set_rbtree-fix-spurious-inse.patch
+ ipv4-set-offload_failed-flag-in-fibmatch-results.patch
+ net-stmmac-dwmac-stm32-fix-resume-on-stm32-mcu.patch
+ tipc-fix-a-potential-deadlock-on-tx-lock.patch
+ tcp-fix-quick-ack-counting-to-count-actual-acks-of-n.patch
+ tcp-fix-delayed-acks-for-mss-boundary-condition.patch
+ sctp-update-transport-state-when-processing-a-dupcoo.patch
+ sctp-update-hb-timer-immediately-after-users-change-.patch
+ hid-sony-remove-duplicate-null-check-before-calling-.patch
+ hid-intel-ish-hid-ipc-disable-and-reenable-acpi-gpe-.patch
index 7aaf29bc64131678db0ba8bdbc60debb70dcb565,d3e10ae6137e8c888b08eefc7be27ccfb6745e03..b0aa14d43d1d72bc0998539d617c66468e736cb0
@@@ -89,9 -89,26 +89,32 @@@ rbd-decouple-header-read-in-from-updati
  rbd-decouple-parent-info-read-in-from-updating-rbd_d.patch
  rbd-take-header_rwsem-in-rbd_dev_refresh-only-when-u.patch
  revert-pci-qcom-disable-write-access-to-read-only-registers-for-ip-v2.3.3.patch
 +scsi-zfcp-fix-a-double-put-in-zfcp_port_enqueue.patch
 +qed-red_ll2-fix-undefined-behavior-bug-in-struct-qed_ll2_info.patch
 +wifi-mwifiex-fix-tlv_buf_left-calculation.patch
 +net-replace-calls-to-sock-ops-connect-with-kernel_connect.patch
 +btrfs-reject-unknown-mount-options-early.patch
 +net-prevent-rewrite-of-msg_name-in-sock_sendmsg.patch
+ ubi-refuse-attaching-if-mtd-s-erasesize-is-0.patch
+ wifi-iwlwifi-dbg_ini-fix-structure-packing.patch
+ wifi-mwifiex-fix-oob-check-condition-in-mwifiex_proc.patch
+ drivers-net-process-the-result-of-hdlc_open-and-add-.patch
+ wifi-mt76-mt76x02-fix-mt76x0-external-lna-gain-handl.patch
+ regmap-rbtree-fix-wrong-register-marked-as-in-cache-.patch
+ ima-finish-deprecation-of-ima_trusted_keyring-kconfi.patch
+ scsi-target-core-fix-deadlock-due-to-recursive-locki.patch
+ nfs4-trace-state-recovery-operation.patch
+ nfs-add-a-helper-nfs_client_for_each_server.patch
+ nfsv4-fix-a-nfs4_state_manager-race.patch
+ modpost-add-missing-else-to-the-of-check.patch
+ net-fix-possible-store-tearing-in-neigh_periodic_wor.patch
+ ipv4-ipv6-fix-handling-of-transhdrlen-in-__ip-6-_app.patch
+ net-dsa-mv88e6xxx-avoid-eeprom-timeout-when-eeprom-i.patch
+ net-usb-smsc75xx-fix-uninit-value-access-in-__smsc75.patch
+ net-nfc-llcp-add-lock-when-modifying-device-list.patch
+ netfilter-handle-the-connecting-collision-properly-i.patch
+ net-stmmac-dwmac-stm32-fix-resume-on-stm32-mcu.patch
+ tcp-fix-quick-ack-counting-to-count-actual-acks-of-n.patch
+ tcp-fix-delayed-acks-for-mss-boundary-condition.patch
+ sctp-update-transport-state-when-processing-a-dupcoo.patch
+ sctp-update-hb-timer-immediately-after-users-change-.patch
index 344ed8f6fea400a765c030bafe09639e4b4d708e,ffc7d8c115d9aacef67a5923acf04b4d2167e1e3..6108c4e6eb84479d066e7e1580172fb8384925e2
@@@ -54,21 -51,68 +51,86 @@@ block-fix-use-after-free-of-q-q_usage_c
  hwmon-nzxt-smart2-add-device-id.patch
  hwmon-nzxt-smart2-add-another-usb-id.patch
  i40e-fix-the-wrong-ptp-frequency-calculation.patch
 +scsi-zfcp-fix-a-double-put-in-zfcp_port_enqueue.patch
 +iommu-vt-d-avoid-memory-allocation-in-iommu_suspend.patch
 +vringh-don-t-use-vringh_kiov_advance-in-vringh_iov_xfer.patch
 +net-ethernet-mediatek-disable-irq-before-schedule-napi.patch
 +mptcp-userspace-pm-allow-creating-id-0-subflow.patch
 +qed-red_ll2-fix-undefined-behavior-bug-in-struct-qed_ll2_info.patch
 +bluetooth-hci_codec-fix-leaking-content-of-local_codecs.patch
 +bluetooth-hci_sync-fix-handling-of-hci_quirk_strict_duplicate_filter.patch
 +wifi-mwifiex-fix-tlv_buf_left-calculation.patch
 +md-raid5-release-batch_last-before-waiting-for-another-stripe_head.patch
 +pci-qcom-fix-ipq8074-enumeration.patch
 +net-replace-calls-to-sock-ops-connect-with-kernel_connect.patch
 +btrfs-reject-unknown-mount-options-early.patch
 +net-prevent-rewrite-of-msg_name-in-sock_sendmsg.patch
 +drm-amd-fix-detection-of-_pr3-on-the-pcie-root-port.patch
 +drm-amd-fix-logic-error-in-sienna_cichlid_update_pcie_parameters.patch
 +arm64-add-cortex-a520-cpu-part-definition.patch
 +arm64-errata-add-cortex-a520-speculative-unprivileged-load-workaround.patch
+ hid-sony-fix-a-potential-memory-leak-in-sony_probe.patch
+ ubi-refuse-attaching-if-mtd-s-erasesize-is-0.patch
+ erofs-fix-memory-leak-of-lzma-global-compressed-dedu.patch
+ wifi-iwlwifi-dbg_ini-fix-structure-packing.patch
+ wifi-iwlwifi-mvm-fix-a-memory-corruption-issue.patch
+ wifi-cfg80211-hold-wiphy-lock-in-auto-disconnect.patch
+ wifi-cfg80211-move-wowlan-disable-under-locks.patch
+ wifi-cfg80211-add-a-work-abstraction-with-special-se.patch
+ wifi-cfg80211-fix-cqm_config-access-race.patch
+ wifi-cfg80211-add-missing-kernel-doc-for-cqm_rssi_wo.patch
+ wifi-mwifiex-fix-oob-check-condition-in-mwifiex_proc.patch
+ leds-drop-bug_on-check-for-led_color_id_multi.patch
+ bpf-fix-tr-dereferencing.patch
+ regulator-mt6358-drop-_sshub-regulators.patch
+ regulator-mt6358-use-linear-voltage-helpers-for-sing.patch
+ regulator-mt6358-split-ops-for-buck-and-linear-range.patch
+ bluetooth-delete-unused-hci_req_prepare_suspend-decl.patch
+ bluetooth-iso-fix-handling-of-listen-for-unicast.patch
+ drivers-net-process-the-result-of-hdlc_open-and-add-.patch
+ wifi-mt76-mt76x02-fix-mt76x0-external-lna-gain-handl.patch
+ perf-x86-amd-core-fix-overflow-reset-on-hotplug.patch
+ regmap-rbtree-fix-wrong-register-marked-as-in-cache-.patch
+ wifi-mac80211-fix-potential-key-use-after-free.patch
+ perf-x86-amd-do-not-warn-on-every-irq.patch
+ iommu-mediatek-fix-share-pgtable-for-iova-over-4gb.patch
+ regulator-core-regulator_register-set-device-class-e.patch
+ ima-finish-deprecation-of-ima_trusted_keyring-kconfi.patch
+ scsi-target-core-fix-deadlock-due-to-recursive-locki.patch
+ ima-rework-config_ima-dependency-block.patch
+ nfsv4-fix-a-nfs4_state_manager-race.patch
+ bpf-tcp_read_skb-needs-to-pop-skb-regardless-of-seq.patch
+ bpf-sockmap-do-not-inc-copied_seq-when-peek-flag-set.patch
+ bpf-sockmap-reject-sk_msg-egress-redirects-to-non-tc.patch
+ modpost-add-missing-else-to-the-of-check.patch
+ net-fix-possible-store-tearing-in-neigh_periodic_wor.patch
+ bpf-add-bpf_fib_lookup_skip_neigh-for-bpf_fib_lookup.patch
+ neighbour-annotate-lockless-accesses-to-n-nud_state.patch
+ neighbour-switch-to-standard-rcu-instead-of-rcu_bh.patch
+ neighbour-fix-data-races-around-n-output.patch
+ ipv4-ipv6-fix-handling-of-transhdrlen-in-__ip-6-_app.patch
+ ptp-ocp-fix-error-handling-in-ptp_ocp_device_init.patch
+ net-dsa-mv88e6xxx-avoid-eeprom-timeout-when-eeprom-i.patch
+ ipv6-tcp-add-a-missing-nf_reset_ct-in-3whs-handling.patch
+ net-usb-smsc75xx-fix-uninit-value-access-in-__smsc75.patch
+ net-nfc-llcp-add-lock-when-modifying-device-list.patch
+ net-ethernet-ti-am65-cpsw-fix-error-code-in-am65_cps.patch
+ ibmveth-remove-condition-to-recompute-tcp-header-che.patch
+ netfilter-handle-the-connecting-collision-properly-i.patch
+ selftests-netfilter-test-nf_tables-audit-logging.patch
+ selftests-netfilter-extend-nft_audit.sh.patch
+ netfilter-nf_tables-deduplicate-nft_register_obj-aud.patch
+ netfilter-nf_tables-nft_set_rbtree-fix-spurious-inse.patch
+ ipv4-set-offload_failed-flag-in-fibmatch-results.patch
+ net-stmmac-dwmac-stm32-fix-resume-on-stm32-mcu.patch
+ tipc-fix-a-potential-deadlock-on-tx-lock.patch
+ tcp-fix-quick-ack-counting-to-count-actual-acks-of-n.patch
+ tcp-fix-delayed-acks-for-mss-boundary-condition.patch
+ sctp-update-transport-state-when-processing-a-dupcoo.patch
+ sctp-update-hb-timer-immediately-after-users-change-.patch
+ netlink-split-up-copies-in-the-ack-construction.patch
+ netlink-fix-potential-skb-memleak-in-netlink_ack.patch
+ netlink-annotate-data-races-around-sk-sk_err.patch
+ hid-sony-remove-duplicate-null-check-before-calling-.patch
+ hid-intel-ish-hid-ipc-disable-and-reenable-acpi-gpe-.patch
+ intel_idle-add-emerald-rapids-xeon-support.patch
index 0000000000000000000000000000000000000000,3455955afe90a23ca9aa783d40fd414290574ae1..0620afa312ae2b2327db93db6773a736ed21927e
mode 000000,100644..100644
--- /dev/null
@@@ -1,0 -1,64 +1,59 @@@
 - net/bluetooth/hci_core.c | 5 +++++
+ From 04ccb12162d600467a8b7797bc70620b75f20357 Mon Sep 17 00:00:00 2001
+ From: Sasha Levin <sashal@kernel.org>
+ Date: Mon, 4 Sep 2023 14:11:51 +0000
+ Subject: Bluetooth: Fix hci_link_tx_to RCU lock usage
+ From: Ying Hsu <yinghsu@chromium.org>
+ [ Upstream commit c7eaf80bfb0c8cef852cce9501b95dd5a6bddcb9 ]
+ Syzbot found a bug "BUG: sleeping function called from invalid context
+ at kernel/locking/mutex.c:580". It is because hci_link_tx_to holds an
+ RCU read lock and calls hci_disconnect which would hold a mutex lock
+ since the commit a13f316e90fd ("Bluetooth: hci_conn: Consolidate code
+ for aborting connections"). Here's an example call trace:
+    __dump_stack lib/dump_stack.c:88 [inline]
+    dump_stack_lvl+0xfc/0x174 lib/dump_stack.c:106
+    ___might_sleep+0x4a9/0x4d3 kernel/sched/core.c:9663
+    __mutex_lock_common kernel/locking/mutex.c:576 [inline]
+    __mutex_lock+0xc7/0x6e7 kernel/locking/mutex.c:732
+    hci_cmd_sync_queue+0x3a/0x287 net/bluetooth/hci_sync.c:388
+    hci_abort_conn+0x2cd/0x2e4 net/bluetooth/hci_conn.c:1812
+    hci_disconnect+0x207/0x237 net/bluetooth/hci_conn.c:244
+    hci_link_tx_to net/bluetooth/hci_core.c:3254 [inline]
+    __check_timeout net/bluetooth/hci_core.c:3419 [inline]
+    __check_timeout+0x310/0x361 net/bluetooth/hci_core.c:3399
+    hci_sched_le net/bluetooth/hci_core.c:3602 [inline]
+    hci_tx_work+0xe8f/0x12d0 net/bluetooth/hci_core.c:3652
+    process_one_work+0x75c/0xba1 kernel/workqueue.c:2310
+    worker_thread+0x5b2/0x73a kernel/workqueue.c:2457
+    kthread+0x2f7/0x30b kernel/kthread.c:319
+    ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
+ This patch releases RCU read lock before calling hci_disconnect and
+ reacquires it afterward to fix the bug.
+ Fixes: a13f316e90fd ("Bluetooth: hci_conn: Consolidate code for aborting connections")
+ Signed-off-by: Ying Hsu <yinghsu@chromium.org>
+ Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+ Signed-off-by: Sasha Levin <sashal@kernel.org>
+ ---
 -diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
 -index 29ae9b254a34e..e57d7c25511f4 100644
++ net/bluetooth/hci_core.c |    5 +++++
+  1 file changed, 5 insertions(+)
 -@@ -3418,7 +3418,12 @@ static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
+ --- a/net/bluetooth/hci_core.c
+ +++ b/net/bluetooth/hci_core.c
 --- 
 -2.40.1
 -
++@@ -3419,7 +3419,12 @@ static void hci_link_tx_to(struct hci_de
+               if (c->type == type && c->sent) {
+                       bt_dev_err(hdev, "killing stalled connection %pMR",
+                                  &c->dst);
+ +                     /* hci_disconnect might sleep, so, we have to release
+ +                      * the RCU read lock before calling it.
+ +                      */
+ +                     rcu_read_unlock();
+                       hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
+ +                     rcu_read_lock();
+               }
+       }
+  
index 5a3165a0872cf4e51cadde805ab9fae860089409,6aa7b83d2f670d67af69c93a6435de5356239e65..00f39d46eb61492512e9db54af74b182caaefcfb
@@@ -16,14 -16,17 +16,16 @@@ Signed-off-by: Haiyang Zhang <haiyangz@
  Reviewed-by: Simon Horman <horms@kernel.org>
  Reviewed-by: Shradha Gupta <shradhagupta@linux.microsoft.com>
  Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+ Stable-dep-of: a43e8e9ffa0d ("net: mana: Fix oversized sge0 for GSO packets")
+ Signed-off-by: Sasha Levin <sashal@kernel.org>
 +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  ---
 - drivers/net/ethernet/microsoft/mana/mana_en.c | 2 --
 + drivers/net/ethernet/microsoft/mana/mana_en.c |    2 --
   1 file changed, 2 deletions(-)
  
 -diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
 -index c2ad0921e893c..9f9bd3571da16 100644
  --- a/drivers/net/ethernet/microsoft/mana/mana_en.c
  +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
 -@@ -262,8 +262,6 @@ netdev_tx_t mana_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 +@@ -262,8 +262,6 @@ netdev_tx_t mana_start_xmit(struct sk_bu
                                ihs = skb_transport_offset(skb) + sizeof(struct udphdr);
                        } else {
                                ihs = skb_tcp_all_headers(skb);
index ef55352b566abc4c5cae521e2805de0ff7496b16,71dc571ba2e02a96bf6a00a1a291ab82fe78f50d..eb1ee4350e1cecdc3c6c8d0eb642077e96b0bac5
@@@ -23,34 -23,84 +23,114 @@@ net-release-reference-to-inet6_dev-poin
  iommu-arm-smmu-v3-avoid-constructing-invalid-range-c.patch
  maple_tree-reduce-resets-during-store-setup.patch
  maple_tree-add-mas_underflow-and-mas_overflow-states.patch
- net-mana-fix-the-tso_bytes-calculation.patch
 +iommu-apple-dart-handle-dma_fq-domains-in-attach_dev.patch
 +scsi-zfcp-fix-a-double-put-in-zfcp_port_enqueue.patch
 +iommu-vt-d-avoid-memory-allocation-in-iommu_suspend.patch
 +net-mana-fix-tx-cqe-error-handling.patch
 +vringh-don-t-use-vringh_kiov_advance-in-vringh_iov_xfer.patch
 +net-ethernet-mediatek-disable-irq-before-schedule-napi.patch
 +mptcp-fix-delegated-action-races.patch
 +mptcp-userspace-pm-allow-creating-id-0-subflow.patch
 +qed-red_ll2-fix-undefined-behavior-bug-in-struct-qed_ll2_info.patch
 +bluetooth-hci_codec-fix-leaking-content-of-local_codecs.patch
 +wifi-brcmfmac-replace-1-element-arrays-with-flexible-arrays.patch
 +bluetooth-hci_sync-fix-handling-of-hci_quirk_strict_duplicate_filter.patch
 +wifi-rtw88-rtw8723d-fix-mac-address-offset-in-eeprom.patch
 +wifi-mwifiex-fix-tlv_buf_left-calculation.patch
 +io_uring-don-t-allow-ioring_setup_no_mmap-rings-on-highmem-pages.patch
 +md-raid5-release-batch_last-before-waiting-for-another-stripe_head.patch
 +pci-pm-mark-devices-disconnected-if-upstream-pcie-link-is-down-on-resume.patch
 +pci-qcom-fix-ipq8074-enumeration.patch
 +platform-x86-intel-ifs-release-cpus_read_lock.patch
 +net-replace-calls-to-sock-ops-connect-with-kernel_connect.patch
 +io_uring-kbuf-don-t-allow-registered-buffer-rings-on-highmem-pages.patch
 +io_uring-ensure-io_lockdep_assert_cq_locked-handles-disabled-rings.patch
 +btrfs-always-print-transaction-aborted-messages-with-an-error-level.patch
 +btrfs-reject-unknown-mount-options-early.patch
 +net-prevent-rewrite-of-msg_name-in-sock_sendmsg.patch
 +drm-i915-don-t-set-pipe_control_flush_l3-for-aux-inval.patch
 +drm-amd-fix-detection-of-_pr3-on-the-pcie-root-port.patch
 +drm-amd-fix-logic-error-in-sienna_cichlid_update_pcie_parameters.patch
 +arm64-add-cortex-a520-cpu-part-definition.patch
 +arm64-errata-add-cortex-a520-speculative-unprivileged-load-workaround.patch
+ hid-sony-fix-a-potential-memory-leak-in-sony_probe.patch
+ wifi-mt76-fix-lock-dependency-problem-for-wed_lock.patch
+ ubi-refuse-attaching-if-mtd-s-erasesize-is-0.patch
+ erofs-fix-memory-leak-of-lzma-global-compressed-dedu.patch
+ wifi-cfg80211-mac80211-hold-link-bsses-when-assoc-fa.patch
+ iwlwifi-mvm-handle-ps-changes-in-vif_cfg_changed.patch
+ wifi-iwlwifi-dbg_ini-fix-structure-packing.patch
+ wifi-iwlwifi-mvm-fix-a-memory-corruption-issue.patch
+ wifi-cfg80211-fix-cqm_config-access-race.patch
+ rtla-timerlat_aa-zero-thread-sum-after-every-sample-.patch
+ rtla-timerlat_aa-fix-negative-irq-delay.patch
+ rtla-timerlat_aa-fix-previous-irq-delay-for-irqs-tha.patch
+ wifi-cfg80211-add-missing-kernel-doc-for-cqm_rssi_wo.patch
+ wifi-mac80211-fix-mesh-id-corruption-on-32-bit-syste.patch
+ wifi-mwifiex-fix-oob-check-condition-in-mwifiex_proc.patch
+ hid-nvidia-shield-add-leds_class-dependency.patch
+ erofs-allow-empty-device-tags-in-flatdev-mode.patch
+ s390-bpf-let-arch_prepare_bpf_trampoline-return-prog.patch
+ leds-drop-bug_on-check-for-led_color_id_multi.patch
+ bpf-fix-tr-dereferencing.patch
+ bpf-unconditionally-reset-backtrack_state-masks-on-g.patch
+ regulator-mt6358-split-ops-for-buck-and-linear-range.patch
+ bluetooth-delete-unused-hci_req_prepare_suspend-decl.patch
+ bluetooth-fix-hci_link_tx_to-rcu-lock-usage.patch
+ bluetooth-iso-fix-handling-of-listen-for-unicast.patch
+ drivers-net-process-the-result-of-hdlc_open-and-add-.patch
+ wifi-mt76-mt76x02-fix-mt76x0-external-lna-gain-handl.patch
+ perf-x86-amd-core-fix-overflow-reset-on-hotplug.patch
+ rtla-timerlat-do-not-stop-user-space-if-a-cpu-is-off.patch
+ regmap-rbtree-fix-wrong-register-marked-as-in-cache-.patch
+ wifi-mac80211-fix-potential-key-use-after-free.patch
+ perf-x86-amd-do-not-warn-on-every-irq.patch
+ iommu-mediatek-fix-share-pgtable-for-iova-over-4gb.patch
+ wifi-mac80211-create-resources-for-disabled-links.patch
+ regulator-core-regulator_register-set-device-class-e.patch
+ ima-finish-deprecation-of-ima_trusted_keyring-kconfi.patch
+ wifi-iwlwifi-mvm-fix-incorrect-usage-of-scan-api.patch
+ scsi-target-core-fix-deadlock-due-to-recursive-locki.patch
+ ima-rework-config_ima-dependency-block.patch
+ nfsv4-fix-a-nfs4_state_manager-race.patch
+ ice-always-add-legacy-32byte-rxdid-in-supported_rxdi.patch
+ bpf-tcp_read_skb-needs-to-pop-skb-regardless-of-seq.patch
+ bpf-sockmap-do-not-inc-copied_seq-when-peek-flag-set.patch
+ bpf-sockmap-reject-sk_msg-egress-redirects-to-non-tc.patch
+ modpost-add-missing-else-to-the-of-check.patch
+ net-stmmac-platform-fix-the-incorrect-parameter.patch
+ net-fix-possible-store-tearing-in-neigh_periodic_wor.patch
+ neighbour-fix-data-races-around-n-output.patch
+ ipv4-ipv6-fix-handling-of-transhdrlen-in-__ip-6-_app.patch
+ ptp-ocp-fix-error-handling-in-ptp_ocp_device_init.patch
+ net-dsa-mv88e6xxx-avoid-eeprom-timeout-when-eeprom-i.patch
+ ovl-move-freeing-ovl_entry-past-rcu-delay.patch
+ ovl-fetch-inode-once-in-ovl_dentry_revalidate_common.patch
+ ipv6-tcp-add-a-missing-nf_reset_ct-in-3whs-handling.patch
+ net-usb-smsc75xx-fix-uninit-value-access-in-__smsc75.patch
+ ethtool-plca-fix-plca-enable-data-type-while-parsing.patch
+ net-nfc-llcp-add-lock-when-modifying-device-list.patch
+ net-renesas-rswitch-add-spin-lock-protection-for-irq.patch
+ rswitch-fix-phy-station-management-clock-setting.patch
+ net-ethernet-ti-am65-cpsw-fix-error-code-in-am65_cps.patch
+ ibmveth-remove-condition-to-recompute-tcp-header-che.patch
+ netfilter-nft_payload-rebuild-vlan-header-on-h_proto.patch
+ netfilter-handle-the-connecting-collision-properly-i.patch
+ selftests-netfilter-test-nf_tables-audit-logging.patch
+ selftests-netfilter-extend-nft_audit.sh.patch
+ netfilter-nf_tables-deduplicate-nft_register_obj-aud.patch
+ netfilter-nf_tables-nft_set_rbtree-fix-spurious-inse.patch
+ ipv4-set-offload_failed-flag-in-fibmatch-results.patch
+ net-stmmac-dwmac-stm32-fix-resume-on-stm32-mcu.patch
+ tipc-fix-a-potential-deadlock-on-tx-lock.patch
+ tcp-fix-quick-ack-counting-to-count-actual-acks-of-n.patch
+ tcp-fix-delayed-acks-for-mss-boundary-condition.patch
+ sctp-update-transport-state-when-processing-a-dupcoo.patch
+ sctp-update-hb-timer-immediately-after-users-change-.patch
+ netlink-annotate-data-races-around-sk-sk_err.patch
+ net-mana-fix-the-tso_bytes-calculation.patch
+ net-mana-fix-oversized-sge0-for-gso-packets.patch
+ hid-nvidia-shield-fix-a-missing-led_classdev_unregis.patch
+ hid-sony-remove-duplicate-null-check-before-calling-.patch
+ hid-intel-ish-hid-ipc-disable-and-reenable-acpi-gpe-.patch
+ net-lan743x-also-select-phylib.patch