--- /dev/null
+From db67345716a52abb750ec8f76d6a5675218715f9 Mon Sep 17 00:00:00 2001
+From: Chris Paterson <chris.paterson2@renesas.com>
+Date: Fri, 9 Jun 2023 23:11:36 +0100
+Subject: arm64: dts: renesas: rzg2l: Fix txdv-skew-psec typos
+
+From: Chris Paterson <chris.paterson2@renesas.com>
+
+commit db67345716a52abb750ec8f76d6a5675218715f9 upstream.
+
+It looks like txdv-skew-psec is a typo from a copy+paste. txdv-skew-psec
+is not present in the PHY bindings nor is it in the driver.
+
+Correct to txen-skew-psec which is clearly what it was meant to be.
+
+Given that the default for txen-skew-psec is 0, and the device tree is
+only trying to set it to 0 anyway, there should not be any functional
+change from this fix.
+
+Fixes: 361b0dcbd7f9 ("arm64: dts: renesas: rzg2l-smarc-som: Enable Ethernet")
+Fixes: 6494e4f90503 ("arm64: dts: renesas: rzg2ul-smarc-som: Enable Ethernet on SMARC platform")
+Fixes: ce0c63b6a5ef ("arm64: dts: renesas: Add initial device tree for RZ/G2LC SMARC EVK")
+Cc: stable@vger.kernel.org # 6.1.y
+Reported-by: Tomohiro Komagata <tomohiro.komagata.aj@renesas.com>
+Signed-off-by: Chris Paterson <chris.paterson2@renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20230609221136.7431-1-chris.paterson2@renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/renesas/rzg2l-smarc-som.dtsi | 4 ++--
+ arch/arm64/boot/dts/renesas/rzg2lc-smarc-som.dtsi | 2 +-
+ arch/arm64/boot/dts/renesas/rzg2ul-smarc-som.dtsi | 4 ++--
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/arm64/boot/dts/renesas/rzg2l-smarc-som.dtsi
++++ b/arch/arm64/boot/dts/renesas/rzg2l-smarc-som.dtsi
+@@ -100,7 +100,7 @@
+ rxc-skew-psec = <2400>;
+ txc-skew-psec = <2400>;
+ rxdv-skew-psec = <0>;
+- txdv-skew-psec = <0>;
++ txen-skew-psec = <0>;
+ rxd0-skew-psec = <0>;
+ rxd1-skew-psec = <0>;
+ rxd2-skew-psec = <0>;
+@@ -128,7 +128,7 @@
+ rxc-skew-psec = <2400>;
+ txc-skew-psec = <2400>;
+ rxdv-skew-psec = <0>;
+- txdv-skew-psec = <0>;
++ txen-skew-psec = <0>;
+ rxd0-skew-psec = <0>;
+ rxd1-skew-psec = <0>;
+ rxd2-skew-psec = <0>;
+--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc-som.dtsi
++++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc-som.dtsi
+@@ -77,7 +77,7 @@
+ rxc-skew-psec = <2400>;
+ txc-skew-psec = <2400>;
+ rxdv-skew-psec = <0>;
+- txdv-skew-psec = <0>;
++ txen-skew-psec = <0>;
+ rxd0-skew-psec = <0>;
+ rxd1-skew-psec = <0>;
+ rxd2-skew-psec = <0>;
+--- a/arch/arm64/boot/dts/renesas/rzg2ul-smarc-som.dtsi
++++ b/arch/arm64/boot/dts/renesas/rzg2ul-smarc-som.dtsi
+@@ -80,7 +80,7 @@
+ rxc-skew-psec = <2400>;
+ txc-skew-psec = <2400>;
+ rxdv-skew-psec = <0>;
+- txdv-skew-psec = <0>;
++ txen-skew-psec = <0>;
+ rxd0-skew-psec = <0>;
+ rxd1-skew-psec = <0>;
+ rxd2-skew-psec = <0>;
+@@ -107,7 +107,7 @@
+ rxc-skew-psec = <2400>;
+ txc-skew-psec = <2400>;
+ rxdv-skew-psec = <0>;
+- txdv-skew-psec = <0>;
++ txen-skew-psec = <0>;
+ rxd0-skew-psec = <0>;
+ rxd1-skew-psec = <0>;
+ rxd2-skew-psec = <0>;
--- /dev/null
+From d900d9a435ca95a386f49424f3689cd17ec201da Mon Sep 17 00:00:00 2001
+From: Sheetal <sheetal@nvidia.com>
+Date: Thu, 22 Jun 2023 17:04:09 +0530
+Subject: ASoC: tegra: Fix SFC conversion for few rates
+
+From: Sheetal <sheetal@nvidia.com>
+
+commit d900d9a435ca95a386f49424f3689cd17ec201da upstream.
+
+Sample rate conversions for rates greater than 48kHz are found to be
+failing. It means x->y conversions fail when either x or y is greater
+than 48kHz.
+
+This happens because, tegra210_sfc_rate_to_idx() returns incorrect
+index for rates greater than 48kHz. This actually depends on the
+tegra210_sfc_rates[] array and it is not in sync with frequency
+values of SFC TX/RX register. To be precise, 64kHz entry is missing
+in above array defined in the driver. Due to this wrong index is
+returned and this results in incorrect programming of coefficients.
+
+To fix this, align the tegra210_sfc_rates[] array with SFC register
+specification and thus add 64kHz entry to it. Also, the coefficient
+table is updated to reflect that none of the conversions are supported
+for 64kHz.
+
+Fixes: b2f74ec53a6c ("ASoC: tegra: Add Tegra210 based SFC driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sheetal <sheetal@nvidia.com>
+Reviewed-by: Mohan Kumar D <mkumard@nvidia.com>
+Reviewed-by: Sameer Pujar <spujar@nvidia.com>
+Link: https://lore.kernel.org/r/Message-Id: <1687433656-7892-2-git-send-email-spujar@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/tegra/tegra210_sfc.c | 31 ++++++++++++++++++++++++++++++-
+ sound/soc/tegra/tegra210_sfc.h | 4 ++--
+ 2 files changed, 32 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/tegra/tegra210_sfc.c
++++ b/sound/soc/tegra/tegra210_sfc.c
+@@ -2,7 +2,7 @@
+ //
+ // tegra210_sfc.c - Tegra210 SFC driver
+ //
+-// Copyright (c) 2021 NVIDIA CORPORATION. All rights reserved.
++// Copyright (c) 2021-2023 NVIDIA CORPORATION. All rights reserved.
+
+ #include <linux/clk.h>
+ #include <linux/device.h>
+@@ -42,6 +42,7 @@ static const int tegra210_sfc_rates[TEGR
+ 32000,
+ 44100,
+ 48000,
++ 64000,
+ 88200,
+ 96000,
+ 176400,
+@@ -2857,6 +2858,7 @@ static s32 *coef_addr_table[TEGRA210_SFC
+ coef_8to32,
+ coef_8to44,
+ coef_8to48,
++ UNSUPP_CONV,
+ coef_8to88,
+ coef_8to96,
+ UNSUPP_CONV,
+@@ -2872,6 +2874,7 @@ static s32 *coef_addr_table[TEGRA210_SFC
+ coef_11to32,
+ coef_11to44,
+ coef_11to48,
++ UNSUPP_CONV,
+ coef_11to88,
+ coef_11to96,
+ UNSUPP_CONV,
+@@ -2887,6 +2890,7 @@ static s32 *coef_addr_table[TEGRA210_SFC
+ coef_16to32,
+ coef_16to44,
+ coef_16to48,
++ UNSUPP_CONV,
+ coef_16to88,
+ coef_16to96,
+ coef_16to176,
+@@ -2902,6 +2906,7 @@ static s32 *coef_addr_table[TEGRA210_SFC
+ coef_22to32,
+ coef_22to44,
+ coef_22to48,
++ UNSUPP_CONV,
+ coef_22to88,
+ coef_22to96,
+ coef_22to176,
+@@ -2917,6 +2922,7 @@ static s32 *coef_addr_table[TEGRA210_SFC
+ coef_24to32,
+ coef_24to44,
+ coef_24to48,
++ UNSUPP_CONV,
+ coef_24to88,
+ coef_24to96,
+ coef_24to176,
+@@ -2932,6 +2938,7 @@ static s32 *coef_addr_table[TEGRA210_SFC
+ BYPASS_CONV,
+ coef_32to44,
+ coef_32to48,
++ UNSUPP_CONV,
+ coef_32to88,
+ coef_32to96,
+ coef_32to176,
+@@ -2947,6 +2954,7 @@ static s32 *coef_addr_table[TEGRA210_SFC
+ coef_44to32,
+ BYPASS_CONV,
+ coef_44to48,
++ UNSUPP_CONV,
+ coef_44to88,
+ coef_44to96,
+ coef_44to176,
+@@ -2962,11 +2970,28 @@ static s32 *coef_addr_table[TEGRA210_SFC
+ coef_48to32,
+ coef_48to44,
+ BYPASS_CONV,
++ UNSUPP_CONV,
+ coef_48to88,
+ coef_48to96,
+ coef_48to176,
+ coef_48to192,
+ },
++ /* Convertions from 64 kHz */
++ {
++ UNSUPP_CONV,
++ UNSUPP_CONV,
++ UNSUPP_CONV,
++ UNSUPP_CONV,
++ UNSUPP_CONV,
++ UNSUPP_CONV,
++ UNSUPP_CONV,
++ UNSUPP_CONV,
++ UNSUPP_CONV,
++ UNSUPP_CONV,
++ UNSUPP_CONV,
++ UNSUPP_CONV,
++ UNSUPP_CONV,
++ },
+ /* Convertions from 88.2 kHz */
+ {
+ coef_88to8,
+@@ -2977,6 +3002,7 @@ static s32 *coef_addr_table[TEGRA210_SFC
+ coef_88to32,
+ coef_88to44,
+ coef_88to48,
++ UNSUPP_CONV,
+ BYPASS_CONV,
+ coef_88to96,
+ coef_88to176,
+@@ -2991,6 +3017,7 @@ static s32 *coef_addr_table[TEGRA210_SFC
+ coef_96to32,
+ coef_96to44,
+ coef_96to48,
++ UNSUPP_CONV,
+ coef_96to88,
+ BYPASS_CONV,
+ coef_96to176,
+@@ -3006,6 +3033,7 @@ static s32 *coef_addr_table[TEGRA210_SFC
+ coef_176to32,
+ coef_176to44,
+ coef_176to48,
++ UNSUPP_CONV,
+ coef_176to88,
+ coef_176to96,
+ BYPASS_CONV,
+@@ -3021,6 +3049,7 @@ static s32 *coef_addr_table[TEGRA210_SFC
+ coef_192to32,
+ coef_192to44,
+ coef_192to48,
++ UNSUPP_CONV,
+ coef_192to88,
+ coef_192to96,
+ coef_192to176,
+--- a/sound/soc/tegra/tegra210_sfc.h
++++ b/sound/soc/tegra/tegra210_sfc.h
+@@ -2,7 +2,7 @@
+ /*
+ * tegra210_sfc.h - Definitions for Tegra210 SFC driver
+ *
+- * Copyright (c) 2021 NVIDIA CORPORATION. All rights reserved.
++ * Copyright (c) 2021-2023 NVIDIA CORPORATION. All rights reserved.
+ *
+ */
+
+@@ -47,7 +47,7 @@
+ #define TEGRA210_SFC_EN_SHIFT 0
+ #define TEGRA210_SFC_EN (1 << TEGRA210_SFC_EN_SHIFT)
+
+-#define TEGRA210_SFC_NUM_RATES 12
++#define TEGRA210_SFC_NUM_RATES 13
+
+ /* Fields in TEGRA210_SFC_COEF_RAM */
+ #define TEGRA210_SFC_COEF_RAM_EN BIT(0)
--- /dev/null
+From cabce92dd805945a090dc6fc73b001bb35ed083a Mon Sep 17 00:00:00 2001
+From: Qiang Yu <quic_qianyu@quicinc.com>
+Date: Thu, 18 May 2023 14:22:39 +0800
+Subject: bus: mhi: host: Skip MHI reset if device is in RDDM
+
+From: Qiang Yu <quic_qianyu@quicinc.com>
+
+commit cabce92dd805945a090dc6fc73b001bb35ed083a upstream.
+
+In RDDM EE, device can not process MHI reset issued by host. In case of MHI
+power off, host is issuing MHI reset and polls for it to get cleared until
+it times out. Since this timeout can not be avoided in case of RDDM, skip
+the MHI reset in this scenarios.
+
+Cc: <stable@vger.kernel.org>
+Fixes: a6e2e3522f29 ("bus: mhi: core: Add support for PM state transitions")
+Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com>
+Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://lore.kernel.org/r/1684390959-17836-1-git-send-email-quic_qianyu@quicinc.com
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bus/mhi/host/pm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/bus/mhi/host/pm.c
++++ b/drivers/bus/mhi/host/pm.c
+@@ -470,6 +470,10 @@ static void mhi_pm_disable_transition(st
+
+ /* Trigger MHI RESET so that the device will not access host memory */
+ if (!MHI_PM_IN_FATAL_STATE(mhi_cntrl->pm_state)) {
++ /* Skip MHI RESET if in RDDM state */
++ if (mhi_cntrl->rddm_image && mhi_get_exec_env(mhi_cntrl) == MHI_EE_RDDM)
++ goto skip_mhi_reset;
++
+ dev_dbg(dev, "Triggering MHI Reset in device\n");
+ mhi_set_mhi_state(mhi_cntrl, MHI_STATE_RESET);
+
+@@ -495,6 +499,7 @@ static void mhi_pm_disable_transition(st
+ }
+ }
+
++skip_mhi_reset:
+ dev_dbg(dev,
+ "Waiting for all pending event ring processing to complete\n");
+ mhi_event = mhi_cntrl->mhi_event;
--- /dev/null
+From b6d44d42313baa45a81ce9b299aeee2ccf3d0ee1 Mon Sep 17 00:00:00 2001
+From: Bharath SM <bharathsm@microsoft.com>
+Date: Wed, 16 Aug 2023 19:38:45 +0000
+Subject: cifs: update desired access while requesting for directory lease
+
+From: Bharath SM <bharathsm@microsoft.com>
+
+commit b6d44d42313baa45a81ce9b299aeee2ccf3d0ee1 upstream.
+
+We read and cache directory contents when we get directory
+lease, so we should ask for read permission to read contents
+of directory.
+
+Signed-off-by: Bharath SM <bharathsm@microsoft.com>
+Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/cached_dir.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/smb/client/cached_dir.c
++++ b/fs/smb/client/cached_dir.c
+@@ -218,7 +218,7 @@ int open_cached_dir(unsigned int xid, st
+ .tcon = tcon,
+ .path = path,
+ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_FILE),
+- .desired_access = FILE_READ_ATTRIBUTES,
++ .desired_access = FILE_READ_DATA | FILE_READ_ATTRIBUTES,
+ .disposition = FILE_OPEN,
+ .fid = pfid,
+ };
--- /dev/null
+From 37cfd5e457cbdcd030f378127ff2d62776f641e7 Mon Sep 17 00:00:00 2001
+From: Marco Felsch <m.felsch@pengutronix.de>
+Date: Mon, 7 Aug 2023 10:47:43 +0200
+Subject: clk: imx: pll14xx: align pdiv with reference manual
+
+From: Marco Felsch <m.felsch@pengutronix.de>
+
+commit 37cfd5e457cbdcd030f378127ff2d62776f641e7 upstream.
+
+The PLL14xx hardware can be found on i.MX8M{M,N,P} SoCs and always come
+with a 6-bit pre-divider. Neither the reference manuals nor the
+datasheets of these SoCs do mention any restrictions. Furthermore the
+current code doesn't respect the restrictions from the comment too.
+
+Therefore drop the restriction and align the max pre-divider (pdiv)
+value to 63 to get more accurate frequencies.
+
+Fixes: b09c68dc57c9 ("clk: imx: pll14xx: Support dynamic rates")
+Cc: stable@vger.kernel.org
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Reviewed-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Acked-by: Sascha Hauer <s.hauer@pengutronix.de>
+Tested-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Link: https://lore.kernel.org/r/20230807084744.1184791-1-m.felsch@pengutronix.de
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/imx/clk-pll14xx.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/clk/imx/clk-pll14xx.c
++++ b/drivers/clk/imx/clk-pll14xx.c
+@@ -135,11 +135,10 @@ static void imx_pll14xx_calc_settings(st
+ /*
+ * Fractional PLL constrains:
+ *
+- * a) 6MHz <= prate <= 25MHz
+- * b) 1 <= p <= 63 (1 <= p <= 4 prate = 24MHz)
+- * c) 64 <= m <= 1023
+- * d) 0 <= s <= 6
+- * e) -32768 <= k <= 32767
++ * a) 1 <= p <= 63
++ * b) 64 <= m <= 1023
++ * c) 0 <= s <= 6
++ * d) -32768 <= k <= 32767
+ *
+ * fvco = (m * 65536 + k) * prate / (p * 65536)
+ */
+@@ -182,7 +181,7 @@ static void imx_pll14xx_calc_settings(st
+ }
+
+ /* Finally calculate best values */
+- for (pdiv = 1; pdiv <= 7; pdiv++) {
++ for (pdiv = 1; pdiv <= 63; pdiv++) {
+ for (sdiv = 0; sdiv <= 6; sdiv++) {
+ /* calc mdiv = round(rate * pdiv * 2^sdiv) / prate) */
+ mdiv = DIV_ROUND_CLOSEST(rate * (pdiv << sdiv), prate);
--- /dev/null
+From 72d00e560d10665e6139c9431956a87ded6e9880 Mon Sep 17 00:00:00 2001
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Date: Mon, 7 Aug 2023 10:47:44 +0200
+Subject: clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz
+
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+
+commit 72d00e560d10665e6139c9431956a87ded6e9880 upstream.
+
+Since commit b09c68dc57c9 ("clk: imx: pll14xx: Support dynamic rates"),
+the driver has the ability to dynamically compute PLL parameters to
+approximate the requested rates. This is not always used, because the
+logic is as follows:
+
+ - Check if the target rate is hardcoded in the frequency table
+ - Check if varying only kdiv is possible, so switch over is glitch free
+ - Compute rate dynamically by iterating over pdiv range
+
+If we skip the frequency table for the 1443x PLL, we find that the
+computed values differ to the hardcoded ones. This can be valid if the
+hardcoded values guarantee for example an earlier lock-in or if the
+divisors are chosen, so that other important rates are more likely to
+be reached glitch-free.
+
+For rates (393216000 and 361267200, this doesn't seem to be the case:
+They are only approximated by existing parameters (393215995 and
+361267196 Hz, respectively) and they aren't reachable glitch-free from
+other hardcoded frequencies. Dropping them from the table allows us
+to lock-in to these frequencies exactly.
+
+This is immediately noticeable because they are the assigned-clock-rates
+for IMX8MN_AUDIO_PLL1 and IMX8MN_AUDIO_PLL2, respectively and a look
+into clk_summary so far showed that they were a few Hz short of the target:
+
+imx8mn-board:~# grep audio_pll[12]_out /sys/kernel/debug/clk/clk_summary
+audio_pll2_out 0 0 0 361267196 0 0 50000 N
+audio_pll1_out 1 1 0 393215995 0 0 50000 Y
+
+and afterwards:
+
+imx8mn-board:~# grep audio_pll[12]_out /sys/kernel/debug/clk/clk_summary
+audio_pll2_out 0 0 0 361267200 0 0 50000 N
+audio_pll1_out 1 1 0 393216000 0 0 50000 Y
+
+This change is equivalent to adding following hardcoded values:
+
+ /* rate mdiv pdiv sdiv kdiv */
+ PLL_1443X_RATE(393216000, 655, 5, 3, 23593),
+ PLL_1443X_RATE(361267200, 497, 33, 0, -16882),
+
+Fixes: 053a4ffe2988 ("clk: imx: imx8mm: fix audio pll setting")
+Cc: stable@vger.kernel.org # v5.18+
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Link: https://lore.kernel.org/r/20230807084744.1184791-2-m.felsch@pengutronix.de
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/imx/clk-pll14xx.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/clk/imx/clk-pll14xx.c
++++ b/drivers/clk/imx/clk-pll14xx.c
+@@ -62,8 +62,6 @@ static const struct imx_pll14xx_rate_tab
+ PLL_1443X_RATE(650000000U, 325, 3, 2, 0),
+ PLL_1443X_RATE(594000000U, 198, 2, 2, 0),
+ PLL_1443X_RATE(519750000U, 173, 2, 2, 16384),
+- PLL_1443X_RATE(393216000U, 262, 2, 3, 9437),
+- PLL_1443X_RATE(361267200U, 361, 3, 3, 17511),
+ };
+
+ struct imx_pll14xx_clk imx_1443x_pll = {
--- /dev/null
+From c948ff727e25297f3a703eb5349dd66aabf004e4 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 18 Jul 2023 15:28:55 +0200
+Subject: clk: qcom: camcc-sc7180: fix async resume during probe
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit c948ff727e25297f3a703eb5349dd66aabf004e4 upstream.
+
+To make sure that the controller is runtime resumed and its power domain
+is enabled before accessing its registers during probe, the synchronous
+runtime PM interface must be used.
+
+Fixes: 8d4025943e13 ("clk: qcom: camcc-sc7180: Use runtime PM ops instead of clk ones")
+Cc: stable@vger.kernel.org # 5.11
+Cc: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20230718132902.21430-2-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/camcc-sc7180.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/camcc-sc7180.c
++++ b/drivers/clk/qcom/camcc-sc7180.c
+@@ -1664,7 +1664,7 @@ static int cam_cc_sc7180_probe(struct pl
+ return ret;
+ }
+
+- ret = pm_runtime_get(&pdev->dev);
++ ret = pm_runtime_resume_and_get(&pdev->dev);
+ if (ret)
+ return ret;
+
--- /dev/null
+From b0f3d01bda6c3f6f811e70f76d2040ae81f64565 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 18 Jul 2023 15:28:56 +0200
+Subject: clk: qcom: dispcc-sm8450: fix runtime PM imbalance on probe errors
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit b0f3d01bda6c3f6f811e70f76d2040ae81f64565 upstream.
+
+Make sure to decrement the runtime PM usage count before returning in
+case regmap initialisation fails.
+
+Fixes: 16fb89f92ec4 ("clk: qcom: Add support for Display Clock Controller on SM8450")
+Cc: stable@vger.kernel.org # 6.1
+Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20230718132902.21430-3-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/dispcc-sm8450.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/qcom/dispcc-sm8450.c
++++ b/drivers/clk/qcom/dispcc-sm8450.c
+@@ -1783,8 +1783,10 @@ static int disp_cc_sm8450_probe(struct p
+ return ret;
+
+ regmap = qcom_cc_map(pdev, &disp_cc_sm8450_desc);
+- if (IS_ERR(regmap))
+- return PTR_ERR(regmap);
++ if (IS_ERR(regmap)) {
++ ret = PTR_ERR(regmap);
++ goto err_put_rpm;
++ }
+
+ clk_lucid_evo_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config);
+ clk_lucid_evo_pll_configure(&disp_cc_pll1, regmap, &disp_cc_pll1_config);
+@@ -1799,9 +1801,16 @@ static int disp_cc_sm8450_probe(struct p
+ regmap_update_bits(regmap, 0xe05c, BIT(0), BIT(0));
+
+ ret = qcom_cc_really_probe(pdev, &disp_cc_sm8450_desc, regmap);
++ if (ret)
++ goto err_put_rpm;
+
+ pm_runtime_put(&pdev->dev);
+
++ return 0;
++
++err_put_rpm:
++ pm_runtime_put_sync(&pdev->dev);
++
+ return ret;
+ }
+
--- /dev/null
+From 1583694bb4eaf186f17131dbc1b83d6057d2749b Mon Sep 17 00:00:00 2001
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Date: Sat, 13 May 2023 00:17:23 +0300
+Subject: clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+commit 1583694bb4eaf186f17131dbc1b83d6057d2749b upstream.
+
+The pll0_vote clock definitely should have pll0 as a parent (instead of
+pll8).
+
+Fixes: 7792a8d6713c ("clk: mdm9615: Add support for MDM9615 Clock Controllers")
+Cc: stable@kernel.org
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230512211727.3445575-7-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/gcc-mdm9615.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/gcc-mdm9615.c
++++ b/drivers/clk/qcom/gcc-mdm9615.c
+@@ -58,7 +58,7 @@ static struct clk_regmap pll0_vote = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "pll0_vote",
+- .parent_names = (const char *[]){ "pll8" },
++ .parent_names = (const char *[]){ "pll0" },
+ .num_parents = 1,
+ .ops = &clk_pll_vote_ops,
+ },
--- /dev/null
+From 66af5339d4f8e20c6d89a490570bd94d40f1a7f6 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 18 Jul 2023 15:28:59 +0200
+Subject: clk: qcom: lpasscc-sc7280: fix missing resume during probe
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 66af5339d4f8e20c6d89a490570bd94d40f1a7f6 upstream.
+
+Drivers that enable runtime PM must make sure that the controller is
+runtime resumed before accessing its registers to prevent the power
+domain from being disabled.
+
+Fixes: 4ab43d171181 ("clk: qcom: Add lpass clock controller driver for SC7280")
+Cc: stable@vger.kernel.org # 5.16
+Cc: Taniya Das <quic_tdas@quicinc.com>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20230718132902.21430-6-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/lpasscc-sc7280.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/drivers/clk/qcom/lpasscc-sc7280.c
++++ b/drivers/clk/qcom/lpasscc-sc7280.c
+@@ -115,9 +115,13 @@ static int lpass_cc_sc7280_probe(struct
+ ret = pm_clk_add(&pdev->dev, "iface");
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to acquire iface clock\n");
+- goto destroy_pm_clk;
++ goto err_destroy_pm_clk;
+ }
+
++ ret = pm_runtime_resume_and_get(&pdev->dev);
++ if (ret)
++ goto err_destroy_pm_clk;
++
+ if (!of_property_read_bool(pdev->dev.of_node, "qcom,adsp-pil-mode")) {
+ lpass_regmap_config.name = "qdsp6ss";
+ lpass_regmap_config.max_register = 0x3f;
+@@ -125,7 +129,7 @@ static int lpass_cc_sc7280_probe(struct
+
+ ret = qcom_cc_probe_by_index(pdev, 0, desc);
+ if (ret)
+- goto destroy_pm_clk;
++ goto err_put_rpm;
+ }
+
+ lpass_regmap_config.name = "top_cc";
+@@ -134,11 +138,15 @@ static int lpass_cc_sc7280_probe(struct
+
+ ret = qcom_cc_probe_by_index(pdev, 1, desc);
+ if (ret)
+- goto destroy_pm_clk;
++ goto err_put_rpm;
++
++ pm_runtime_put(&pdev->dev);
+
+ return 0;
+
+-destroy_pm_clk:
++err_put_rpm:
++ pm_runtime_put_sync(&pdev->dev);
++err_destroy_pm_clk:
+ pm_clk_destroy(&pdev->dev);
+
+ disable_pm_runtime:
--- /dev/null
+From e2349da0fa7ca822cda72f427345b95795358fe7 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 18 Jul 2023 15:29:01 +0200
+Subject: clk: qcom: mss-sc7180: fix missing resume during probe
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit e2349da0fa7ca822cda72f427345b95795358fe7 upstream.
+
+Drivers that enable runtime PM must make sure that the controller is
+runtime resumed before accessing its registers to prevent the power
+domain from being disabled.
+
+Fixes: 8def929c4097 ("clk: qcom: Add modem clock controller driver for SC7180")
+Cc: stable@vger.kernel.org # 5.7
+Cc: Taniya Das <quic_tdas@quicinc.com>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20230718132902.21430-8-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/mss-sc7180.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/mss-sc7180.c
++++ b/drivers/clk/qcom/mss-sc7180.c
+@@ -87,11 +87,22 @@ static int mss_sc7180_probe(struct platf
+ return ret;
+ }
+
++ ret = pm_runtime_resume_and_get(&pdev->dev);
++ if (ret)
++ return ret;
++
+ ret = qcom_cc_probe(pdev, &mss_sc7180_desc);
+ if (ret < 0)
+- return ret;
++ goto err_put_rpm;
++
++ pm_runtime_put(&pdev->dev);
+
+ return 0;
++
++err_put_rpm:
++ pm_runtime_put_sync(&pdev->dev);
++
++ return ret;
+ }
+
+ static const struct dev_pm_ops mss_sc7180_pm_ops = {
--- /dev/null
+From 97112c83f4671a4a722f99a53be4e91fac4091bc Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 18 Jul 2023 15:29:00 +0200
+Subject: clk: qcom: q6sstop-qcs404: fix missing resume during probe
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 97112c83f4671a4a722f99a53be4e91fac4091bc upstream.
+
+Drivers that enable runtime PM must make sure that the controller is
+runtime resumed before accessing its registers to prevent the power
+domain from being disabled.
+
+Fixes: 6cdef2738db0 ("clk: qcom: Add Q6SSTOP clock controller for QCS404")
+Cc: stable@vger.kernel.org # 5.5
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20230718132902.21430-7-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/q6sstop-qcs404.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/qcom/q6sstop-qcs404.c
++++ b/drivers/clk/qcom/q6sstop-qcs404.c
+@@ -174,21 +174,32 @@ static int q6sstopcc_qcs404_probe(struct
+ return ret;
+ }
+
++ ret = pm_runtime_resume_and_get(&pdev->dev);
++ if (ret)
++ return ret;
++
+ q6sstop_regmap_config.name = "q6sstop_tcsr";
+ desc = &tcsr_qcs404_desc;
+
+ ret = qcom_cc_probe_by_index(pdev, 1, desc);
+ if (ret)
+- return ret;
++ goto err_put_rpm;
+
+ q6sstop_regmap_config.name = "q6sstop_cc";
+ desc = &q6sstop_qcs404_desc;
+
+ ret = qcom_cc_probe_by_index(pdev, 0, desc);
+ if (ret)
+- return ret;
++ goto err_put_rpm;
++
++ pm_runtime_put(&pdev->dev);
+
+ return 0;
++
++err_put_rpm:
++ pm_runtime_put_sync(&pdev->dev);
++
++ return ret;
+ }
+
+ static const struct dev_pm_ops q6sstopcc_pm_ops = {
--- /dev/null
+From a9f71a033587c9074059132d34c74eabbe95ef26 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 18 Jul 2023 15:29:02 +0200
+Subject: clk: qcom: turingcc-qcs404: fix missing resume during probe
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit a9f71a033587c9074059132d34c74eabbe95ef26 upstream.
+
+Drivers that enable runtime PM must make sure that the controller is
+runtime resumed before accessing its registers to prevent the power
+domain from being disabled.
+
+Fixes: 892df0191b29 ("clk: qcom: Add QCS404 TuringCC")
+Cc: stable@vger.kernel.org # 5.2
+Cc: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20230718132902.21430-9-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/turingcc-qcs404.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/turingcc-qcs404.c
++++ b/drivers/clk/qcom/turingcc-qcs404.c
+@@ -125,11 +125,22 @@ static int turingcc_probe(struct platfor
+ return ret;
+ }
+
++ ret = pm_runtime_resume_and_get(&pdev->dev);
++ if (ret)
++ return ret;
++
+ ret = qcom_cc_probe(pdev, &turingcc_desc);
+ if (ret < 0)
+- return ret;
++ goto err_put_rpm;
++
++ pm_runtime_put(&pdev->dev);
+
+ return 0;
++
++err_put_rpm:
++ pm_runtime_put_sync(&pdev->dev);
++
++ return ret;
+ }
+
+ static const struct dev_pm_ops turingcc_pm_ops = {
--- /dev/null
+From 4cfe75f0f14f044dae66ad0e6eea812d038465d9 Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Wed, 21 Jun 2023 14:53:35 +0200
+Subject: drm/ast: Fix DRAM init on AST2200
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit 4cfe75f0f14f044dae66ad0e6eea812d038465d9 upstream.
+
+Fix the test for the AST2200 in the DRAM initialization. The value
+in ast->chip has to be compared against an enum constant instead of
+a numerical value.
+
+This bug got introduced when the driver was first imported into the
+kernel.
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Fixes: 312fec1405dd ("drm: Initial KMS driver for AST (ASpeed Technologies) 2000 series (v2)")
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v3.5+
+Reviewed-by: Sui Jingfeng <suijingfeng@loongson.cn>
+Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
+Tested-by: Jocelyn Falempe <jfalempe@redhat.com> # AST2600
+Link: https://patchwork.freedesktop.org/patch/msgid/20230621130032.3568-2-tzimmermann@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/ast/ast_post.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/ast/ast_post.c
++++ b/drivers/gpu/drm/ast/ast_post.c
+@@ -291,7 +291,7 @@ static void ast_init_dram_reg(struct drm
+ ;
+ } while (ast_read32(ast, 0x10100) != 0xa8);
+ } else {/* AST2100/1100 */
+- if (ast->chip == AST2100 || ast->chip == 2200)
++ if (ast->chip == AST2100 || ast->chip == AST2200)
+ dram_reg_info = ast2100_dram_table_data;
+ else
+ dram_reg_info = ast1100_dram_table_data;
--- /dev/null
+From 172044e30b00977784269e8ab72132a48293c654 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Fri, 28 Jul 2023 18:59:23 +0200
+Subject: dt-bindings: clock: xlnx,versal-clk: drop select:false
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 172044e30b00977784269e8ab72132a48293c654 upstream.
+
+select:false makes the schema basically ignored and not effective, which
+is clearly not what we want for a device binding.
+
+Fixes: 352546805a44 ("dt-bindings: clock: Add bindings for versal clock driver")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20230728165923.108589-1-krzysztof.kozlowski@linaro.org
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Reviewed-by: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/clock/xlnx,versal-clk.yaml | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/Documentation/devicetree/bindings/clock/xlnx,versal-clk.yaml
++++ b/Documentation/devicetree/bindings/clock/xlnx,versal-clk.yaml
+@@ -16,8 +16,6 @@ description: |
+ reads required input clock frequencies from the devicetree and acts as clock
+ provider for all clock consumers of PS clocks.
+
+-select: false
+-
+ properties:
+ compatible:
+ const: xlnx,versal-clk
--- /dev/null
+From f90a0e5265b60cdd3c77990e8105f79aa2fac994 Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Tue, 13 Jun 2023 13:06:49 +0200
+Subject: fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit f90a0e5265b60cdd3c77990e8105f79aa2fac994 upstream.
+
+Do not assing the Linux device to struct fb_info.dev. The call to
+register_framebuffer() initializes the field to the fbdev device.
+Drivers should not override its value.
+
+Fixes a bug where the driver incorrectly decreases the hardware
+device's reference counter and leaks the fbdev device.
+
+v2:
+ * add Fixes tag (Dan)
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Fixes: 88017bda96a5 ("ep93xx video driver")
+Cc: <stable@vger.kernel.org> # v2.6.32+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230613110953.24176-15-tzimmermann@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/ep93xx-fb.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/video/fbdev/ep93xx-fb.c
++++ b/drivers/video/fbdev/ep93xx-fb.c
+@@ -474,7 +474,6 @@ static int ep93xxfb_probe(struct platfor
+ if (!info)
+ return -ENOMEM;
+
+- info->dev = &pdev->dev;
+ platform_set_drvdata(pdev, info);
+ fbi = info->par;
+ fbi->mach_info = mach_info;
--- /dev/null
+From efb78fa86e95832b78ca0ba60f3706788a818938 Mon Sep 17 00:00:00 2001
+From: Andrew Donnellan <ajd@linux.ibm.com>
+Date: Fri, 14 Jul 2023 11:52:38 +1000
+Subject: lib/test_meminit: allocate pages up to order MAX_ORDER
+
+From: Andrew Donnellan <ajd@linux.ibm.com>
+
+commit efb78fa86e95832b78ca0ba60f3706788a818938 upstream.
+
+test_pages() tests the page allocator by calling alloc_pages() with
+different orders up to order 10.
+
+However, different architectures and platforms support different maximum
+contiguous allocation sizes. The default maximum allocation order
+(MAX_ORDER) is 10, but architectures can use CONFIG_ARCH_FORCE_MAX_ORDER
+to override this. On platforms where this is less than 10, test_meminit()
+will blow up with a WARN(). This is expected, so let's not do that.
+
+Replace the hardcoded "10" with the MAX_ORDER macro so that we test
+allocations up to the expected platform limit.
+
+Link: https://lkml.kernel.org/r/20230714015238.47931-1-ajd@linux.ibm.com
+Fixes: 5015a300a522 ("lib: introduce test_meminit module")
+Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com>
+Reviewed-by: Alexander Potapenko <glider@google.com>
+Cc: Xiaoke Wang <xkernel.wang@foxmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/test_meminit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/test_meminit.c
++++ b/lib/test_meminit.c
+@@ -93,7 +93,7 @@ static int __init test_pages(int *total_
+ int failures = 0, num_tests = 0;
+ int i;
+
+- for (i = 0; i < 10; i++)
++ for (i = 0; i <= MAX_ORDER; i++)
+ num_tests += do_alloc_pages_order(i, &failures);
+
+ REPORT_FAILURES_IN_FN();
--- /dev/null
+From 86327e8eb94c52eca4f93cfece2e29d1bf52acbf Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.com>
+Date: Tue, 4 Jul 2023 13:52:40 +0200
+Subject: memcg: drop kmem.limit_in_bytes
+
+From: Michal Hocko <mhocko@suse.com>
+
+commit 86327e8eb94c52eca4f93cfece2e29d1bf52acbf upstream.
+
+kmem.limit_in_bytes (v1 way to limit kernel memory usage) has been
+deprecated since 58056f77502f ("memcg, kmem: further deprecate
+kmem.limit_in_bytes") merged in 5.16. We haven't heard about any serious
+users since then but it seems that the mere presence of the file is
+causing more harm thatn good. We (SUSE) have had several bug reports from
+customers where Docker based containers started to fail because a write to
+kmem.limit_in_bytes has failed.
+
+This was unexpected because runc code only expects ENOENT (kmem disabled)
+or EBUSY (tasks already running within cgroup). So a new error code was
+unexpected and the whole container startup failed. This has been later
+addressed by
+https://github.com/opencontainers/runc/commit/52390d68040637dfc77f9fda6bbe70952423d380
+so current Docker runtimes do not suffer from the problem anymore. There
+are still older version of Docker in use and likely hard to get rid of
+completely.
+
+Address this by wiping out the file completely and effectively get back to
+pre 4.5 era and CONFIG_MEMCG_KMEM=n configuration.
+
+I would recommend backporting to stable trees which have picked up
+58056f77502f ("memcg, kmem: further deprecate kmem.limit_in_bytes").
+
+[mhocko@suse.com: restore _KMEM switch case]
+ Link: https://lkml.kernel.org/r/ZKe5wxdbvPi5Cwd7@dhcp22.suse.cz
+Link: https://lkml.kernel.org/r/20230704115240.14672-1-mhocko@kernel.org
+Signed-off-by: Michal Hocko <mhocko@suse.com>
+Acked-by: Shakeel Butt <shakeelb@google.com>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Muchun Song <muchun.song@linux.dev>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/admin-guide/cgroup-v1/memory.rst | 2 --
+ mm/memcontrol.c | 10 ----------
+ 2 files changed, 12 deletions(-)
+
+--- a/Documentation/admin-guide/cgroup-v1/memory.rst
++++ b/Documentation/admin-guide/cgroup-v1/memory.rst
+@@ -91,8 +91,6 @@ Brief summary of control files.
+ memory.oom_control set/show oom controls.
+ memory.numa_stat show the number of memory usage per numa
+ node
+- memory.kmem.limit_in_bytes This knob is deprecated and writing to
+- it will return -ENOTSUPP.
+ memory.kmem.usage_in_bytes show current kernel memory allocation
+ memory.kmem.failcnt show the number of kernel memory usage
+ hits limits
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -3841,10 +3841,6 @@ static ssize_t mem_cgroup_write(struct k
+ case _MEMSWAP:
+ ret = mem_cgroup_resize_max(memcg, nr_pages, true);
+ break;
+- case _KMEM:
+- /* kmem.limit_in_bytes is deprecated. */
+- ret = -EOPNOTSUPP;
+- break;
+ case _TCP:
+ ret = memcg_update_tcp_max(memcg, nr_pages);
+ break;
+@@ -5056,12 +5052,6 @@ static struct cftype mem_cgroup_legacy_f
+ },
+ #endif
+ {
+- .name = "kmem.limit_in_bytes",
+- .private = MEMFILE_PRIVATE(_KMEM, RES_LIMIT),
+- .write = mem_cgroup_write,
+- .read_u64 = mem_cgroup_read_u64,
+- },
+- {
+ .name = "kmem.usage_in_bytes",
+ .private = MEMFILE_PRIVATE(_KMEM, RES_USAGE),
+ .read_u64 = mem_cgroup_read_u64,
--- /dev/null
+From 3ce2c24cb68f228590a053d6058a5901cd31af61 Mon Sep 17 00:00:00 2001
+From: Muchun Song <songmuchun@bytedance.com>
+Date: Fri, 7 Jul 2023 11:38:59 +0800
+Subject: mm: hugetlb_vmemmap: fix a race between vmemmap pmd split
+
+From: Muchun Song <songmuchun@bytedance.com>
+
+commit 3ce2c24cb68f228590a053d6058a5901cd31af61 upstream.
+
+The local variable @page in __split_vmemmap_huge_pmd() to obtain a pmd
+page without holding page_table_lock may possiblely get the page table
+page instead of a huge pmd page.
+
+The effect may be in set_pte_at() since we may pass an invalid page
+struct, if set_pte_at() wants to access the page struct (e.g.
+CONFIG_PAGE_TABLE_CHECK is enabled), it may crash the kernel.
+
+So fix it. And inline __split_vmemmap_huge_pmd() since it only has one
+user.
+
+Link: https://lkml.kernel.org/r/20230707033859.16148-1-songmuchun@bytedance.com
+Fixes: d8d55f5616cf ("mm: sparsemem: use page table lock to protect kernel pmd operations")
+Signed-off-by: Muchun Song <songmuchun@bytedance.com>
+Cc: Mike Kravetz <mike.kravetz@oracle.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/hugetlb_vmemmap.c | 34 ++++++++++++++--------------------
+ 1 file changed, 14 insertions(+), 20 deletions(-)
+
+--- a/mm/hugetlb_vmemmap.c
++++ b/mm/hugetlb_vmemmap.c
+@@ -36,14 +36,22 @@ struct vmemmap_remap_walk {
+ struct list_head *vmemmap_pages;
+ };
+
+-static int __split_vmemmap_huge_pmd(pmd_t *pmd, unsigned long start)
++static int split_vmemmap_huge_pmd(pmd_t *pmd, unsigned long start)
+ {
+ pmd_t __pmd;
+ int i;
+ unsigned long addr = start;
+- struct page *page = pmd_page(*pmd);
+- pte_t *pgtable = pte_alloc_one_kernel(&init_mm);
++ struct page *head;
++ pte_t *pgtable;
++
++ spin_lock(&init_mm.page_table_lock);
++ head = pmd_leaf(*pmd) ? pmd_page(*pmd) : NULL;
++ spin_unlock(&init_mm.page_table_lock);
+
++ if (!head)
++ return 0;
++
++ pgtable = pte_alloc_one_kernel(&init_mm);
+ if (!pgtable)
+ return -ENOMEM;
+
+@@ -53,7 +61,7 @@ static int __split_vmemmap_huge_pmd(pmd_
+ pte_t entry, *pte;
+ pgprot_t pgprot = PAGE_KERNEL;
+
+- entry = mk_pte(page + i, pgprot);
++ entry = mk_pte(head + i, pgprot);
+ pte = pte_offset_kernel(&__pmd, addr);
+ set_pte_at(&init_mm, addr, pte, entry);
+ }
+@@ -65,8 +73,8 @@ static int __split_vmemmap_huge_pmd(pmd_
+ * be treated as indepdenent small pages (as they can be freed
+ * individually).
+ */
+- if (!PageReserved(page))
+- split_page(page, get_order(PMD_SIZE));
++ if (!PageReserved(head))
++ split_page(head, get_order(PMD_SIZE));
+
+ /* Make pte visible before pmd. See comment in pmd_install(). */
+ smp_wmb();
+@@ -80,20 +88,6 @@ static int __split_vmemmap_huge_pmd(pmd_
+ return 0;
+ }
+
+-static int split_vmemmap_huge_pmd(pmd_t *pmd, unsigned long start)
+-{
+- int leaf;
+-
+- spin_lock(&init_mm.page_table_lock);
+- leaf = pmd_leaf(*pmd);
+- spin_unlock(&init_mm.page_table_lock);
+-
+- if (!leaf)
+- return 0;
+-
+- return __split_vmemmap_huge_pmd(pmd, start);
+-}
+-
+ static void vmemmap_pte_range(pmd_t *pmd, unsigned long addr,
+ unsigned long end,
+ struct vmemmap_remap_walk *walk)
--- /dev/null
+From 88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Sat, 19 Aug 2023 17:22:14 -0400
+Subject: NFS: Fix a potential data corruption
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit 88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4 upstream.
+
+We must ensure that the subrequests are joined back into the head before
+we can retransmit a request. If the head was not on the commit lists,
+because the server wrote it synchronously, we still need to add it back
+to the retransmission list.
+Add a call that mirrors the effect of nfs_cancel_remove_inode() for
+O_DIRECT.
+
+Fixes: ed5d588fe47f ("NFS: Try to join page groups before an O_DIRECT retransmission")
+Cc: stable@vger.kernel.org
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/direct.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -474,13 +474,31 @@ out:
+ return result;
+ }
+
++static void nfs_direct_add_page_head(struct list_head *list,
++ struct nfs_page *req)
++{
++ struct nfs_page *head = req->wb_head;
++
++ if (!list_empty(&head->wb_list) || !nfs_lock_request(head))
++ return;
++ if (!list_empty(&head->wb_list)) {
++ nfs_unlock_request(head);
++ return;
++ }
++ list_add(&head->wb_list, list);
++ kref_get(&head->wb_kref);
++ kref_get(&head->wb_kref);
++}
++
+ static void nfs_direct_join_group(struct list_head *list, struct inode *inode)
+ {
+ struct nfs_page *req, *subreq;
+
+ list_for_each_entry(req, list, wb_list) {
+- if (req->wb_head != req)
++ if (req->wb_head != req) {
++ nfs_direct_add_page_head(&req->wb_list, req);
+ continue;
++ }
+ subreq = req->wb_this_page;
+ if (subreq == req)
+ continue;
--- /dev/null
+From 96562c45af5c31b89a197af28f79bfa838fb8391 Mon Sep 17 00:00:00 2001
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+Date: Thu, 20 Jul 2023 18:37:51 +0300
+Subject: NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+commit 96562c45af5c31b89a197af28f79bfa838fb8391 upstream.
+
+It is an almost improbable error case but when page allocating loop in
+nfs4_get_device_info() fails then we should only free the already
+allocated pages, as __free_page() can't deal with NULL arguments.
+
+Found by Linux Verification Center (linuxtesting.org).
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/pnfs_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfs/pnfs_dev.c
++++ b/fs/nfs/pnfs_dev.c
+@@ -154,7 +154,7 @@ nfs4_get_device_info(struct nfs_server *
+ set_bit(NFS_DEVICEID_NOCACHE, &d->flags);
+
+ out_free_pages:
+- for (i = 0; i < max_pages; i++)
++ while (--i >= 0)
+ __free_page(pages[i]);
+ kfree(pages);
+ out_free_pdev:
--- /dev/null
+From 5a26e45edb4690d58406178b5a9ea4c6dcf2c105 Mon Sep 17 00:00:00 2001
+From: Chengming Zhou <zhouchengming@bytedance.com>
+Date: Fri, 1 Sep 2023 20:03:06 +0800
+Subject: null_blk: fix poll request timeout handling
+
+From: Chengming Zhou <zhouchengming@bytedance.com>
+
+commit 5a26e45edb4690d58406178b5a9ea4c6dcf2c105 upstream.
+
+When doing io_uring benchmark on /dev/nullb0, it's easy to crash the
+kernel if poll requests timeout triggered, as reported by David. [1]
+
+BUG: kernel NULL pointer dereference, address: 0000000000000008
+Workqueue: kblockd blk_mq_timeout_work
+RIP: 0010:null_timeout_rq+0x4e/0x91
+Call Trace:
+ ? null_timeout_rq+0x4e/0x91
+ blk_mq_handle_expired+0x31/0x4b
+ bt_iter+0x68/0x84
+ ? bt_tags_iter+0x81/0x81
+ __sbitmap_for_each_set.constprop.0+0xb0/0xf2
+ ? __blk_mq_complete_request_remote+0xf/0xf
+ bt_for_each+0x46/0x64
+ ? __blk_mq_complete_request_remote+0xf/0xf
+ ? percpu_ref_get_many+0xc/0x2a
+ blk_mq_queue_tag_busy_iter+0x14d/0x18e
+ blk_mq_timeout_work+0x95/0x127
+ process_one_work+0x185/0x263
+ worker_thread+0x1b5/0x227
+
+This is indeed a race problem between null_timeout_rq() and null_poll().
+
+null_poll() null_timeout_rq()
+ spin_lock(&nq->poll_lock)
+ list_splice_init(&nq->poll_list, &list)
+ spin_unlock(&nq->poll_lock)
+
+ while (!list_empty(&list))
+ req = list_first_entry()
+ list_del_init()
+ ...
+ blk_mq_add_to_batch()
+ // req->rq_next = NULL
+ spin_lock(&nq->poll_lock)
+
+ // rq->queuelist->next == NULL
+ list_del_init(&rq->queuelist)
+
+ spin_unlock(&nq->poll_lock)
+
+Fix these problems by setting requests state to MQ_RQ_COMPLETE under
+nq->poll_lock protection, in which null_timeout_rq() can safely detect
+this race and early return.
+
+Note this patch just fix the kernel panic when request timeout happen.
+
+[1] https://lore.kernel.org/all/3893581.1691785261@warthog.procyon.org.uk/
+
+Fixes: 0a593fbbc245 ("null_blk: poll queue support")
+Reported-by: David Howells <dhowells@redhat.com>
+Tested-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Chengming Zhou <zhouchengming@bytedance.com>
+Link: https://lore.kernel.org/r/20230901120306.170520-2-chengming.zhou@linux.dev
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/null_blk/main.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/block/null_blk/main.c
++++ b/drivers/block/null_blk/main.c
+@@ -1585,9 +1585,12 @@ static int null_poll(struct blk_mq_hw_ct
+ struct nullb_queue *nq = hctx->driver_data;
+ LIST_HEAD(list);
+ int nr = 0;
++ struct request *rq;
+
+ spin_lock(&nq->poll_lock);
+ list_splice_init(&nq->poll_list, &list);
++ list_for_each_entry(rq, &list, queuelist)
++ blk_mq_set_request_complete(rq);
+ spin_unlock(&nq->poll_lock);
+
+ while (!list_empty(&list)) {
+@@ -1613,16 +1616,21 @@ static enum blk_eh_timer_return null_tim
+ struct blk_mq_hw_ctx *hctx = rq->mq_hctx;
+ struct nullb_cmd *cmd = blk_mq_rq_to_pdu(rq);
+
+- pr_info("rq %p timed out\n", rq);
+-
+ if (hctx->type == HCTX_TYPE_POLL) {
+ struct nullb_queue *nq = hctx->driver_data;
+
+ spin_lock(&nq->poll_lock);
++ /* The request may have completed meanwhile. */
++ if (blk_mq_request_completed(rq)) {
++ spin_unlock(&nq->poll_lock);
++ return BLK_EH_DONE;
++ }
+ list_del_init(&rq->queuelist);
+ spin_unlock(&nq->poll_lock);
+ }
+
++ pr_info("rq %p timed out\n", rq);
++
+ /*
+ * If the device is marked as blocking (i.e. memory backed or zoned
+ * device), the submission path may be blocked waiting for resources
--- /dev/null
+From 4db89524b084f712a887256391fc19d9f66c8e55 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sun, 27 Aug 2023 13:46:11 +0200
+Subject: parisc: led: Fix LAN receive and transmit LEDs
+
+From: Helge Deller <deller@gmx.de>
+
+commit 4db89524b084f712a887256391fc19d9f66c8e55 upstream.
+
+Fix the LAN receive and LAN transmit LEDs, which where swapped
+up to now.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/parisc/include/asm/led.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/parisc/include/asm/led.h
++++ b/arch/parisc/include/asm/led.h
+@@ -11,8 +11,8 @@
+ #define LED1 0x02
+ #define LED0 0x01 /* bottom (or furthest left) LED */
+
+-#define LED_LAN_TX LED0 /* for LAN transmit activity */
+-#define LED_LAN_RCV LED1 /* for LAN receive activity */
++#define LED_LAN_RCV LED0 /* for LAN receive activity */
++#define LED_LAN_TX LED1 /* for LAN transmit activity */
+ #define LED_DISK_IO LED2 /* for disk activity */
+ #define LED_HEARTBEAT LED3 /* heartbeat */
+
--- /dev/null
+From 358ad816e52d4253b38c2f312e6b1cbd89e0dbf7 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Fri, 25 Aug 2023 17:46:39 +0200
+Subject: parisc: led: Reduce CPU overhead for disk & lan LED computation
+
+From: Helge Deller <deller@gmx.de>
+
+commit 358ad816e52d4253b38c2f312e6b1cbd89e0dbf7 upstream.
+
+Older PA-RISC machines have LEDs which show the disk- and LAN-activity.
+The computation is done in software and takes quite some time, e.g. on a
+J6500 this may take up to 60% time of one CPU if the machine is loaded
+via network traffic.
+
+Since most people don't care about the LEDs, start with LEDs disabled and
+just show a CPU heartbeat LED. The disk and LAN LEDs can be turned on
+manually via /proc/pdc/led.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/parisc/led.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/parisc/led.c
++++ b/drivers/parisc/led.c
+@@ -56,8 +56,8 @@
+ static int led_type __read_mostly = -1;
+ static unsigned char lastleds; /* LED state from most recent update */
+ static unsigned int led_heartbeat __read_mostly = 1;
+-static unsigned int led_diskio __read_mostly = 1;
+-static unsigned int led_lanrxtx __read_mostly = 1;
++static unsigned int led_diskio __read_mostly;
++static unsigned int led_lanrxtx __read_mostly;
+ static char lcd_text[32] __read_mostly;
+ static char lcd_text_default[32] __read_mostly;
+ static int lcd_no_led_support __read_mostly = 0; /* KittyHawk doesn't support LED on its LCD */
--- /dev/null
+From d5301c90716a8e20bc961a348182daca00c8e8f0 Mon Sep 17 00:00:00 2001
+From: Raag Jadav <raag.jadav@intel.com>
+Date: Tue, 22 Aug 2023 12:53:40 +0530
+Subject: pinctrl: cherryview: fix address_space_handler() argument
+
+From: Raag Jadav <raag.jadav@intel.com>
+
+commit d5301c90716a8e20bc961a348182daca00c8e8f0 upstream.
+
+First argument of acpi_*_address_space_handler() APIs is acpi_handle of
+the device, which is incorrectly passed in driver ->remove() path here.
+Fix it by passing the appropriate argument and while at it, make both
+API calls consistent using ACPI_HANDLE().
+
+Fixes: a0b028597d59 ("pinctrl: cherryview: Add support for GMMR GPIO opregion")
+Cc: stable@vger.kernel.org
+Signed-off-by: Raag Jadav <raag.jadav@intel.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/intel/pinctrl-cherryview.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -1698,7 +1698,6 @@ static int chv_pinctrl_probe(struct plat
+ struct intel_community_context *cctx;
+ struct intel_community *community;
+ struct device *dev = &pdev->dev;
+- struct acpi_device *adev = ACPI_COMPANION(dev);
+ struct intel_pinctrl *pctrl;
+ acpi_status status;
+ unsigned int i;
+@@ -1766,7 +1765,7 @@ static int chv_pinctrl_probe(struct plat
+ if (ret)
+ return ret;
+
+- status = acpi_install_address_space_handler(adev->handle,
++ status = acpi_install_address_space_handler(ACPI_HANDLE(dev),
+ community->acpi_space_id,
+ chv_pinctrl_mmio_access_handler,
+ NULL, pctrl);
+@@ -1783,7 +1782,7 @@ static int chv_pinctrl_remove(struct pla
+ struct intel_pinctrl *pctrl = platform_get_drvdata(pdev);
+ const struct intel_community *community = &pctrl->communities[0];
+
+- acpi_remove_address_space_handler(ACPI_COMPANION(&pdev->dev),
++ acpi_remove_address_space_handler(ACPI_HANDLE(&pdev->dev),
+ community->acpi_space_id,
+ chv_pinctrl_mmio_access_handler);
+
--- /dev/null
+From 09ee7a3bf866c0fa5ee1914d2c65958559eb5b4c Mon Sep 17 00:00:00 2001
+From: Steve French <stfrench@microsoft.com>
+Date: Thu, 24 Aug 2023 23:29:18 -0500
+Subject: [SMB3] send channel sequence number in SMB3 requests after reconnects
+
+From: Steve French <stfrench@microsoft.com>
+
+commit 09ee7a3bf866c0fa5ee1914d2c65958559eb5b4c upstream.
+
+The ChannelSequence field in the SMB3 header is supposed to be
+increased after reconnect to allow the server to distinguish
+requests from before and after the reconnect. We had always
+been setting it to zero. There are cases where incrementing
+ChannelSequence on requests after network reconnects can reduce
+the chance of data corruptions.
+
+See MS-SMB2 3.2.4.1 and 3.2.7.1
+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Cc: stable@vger.kernel.org # 5.16+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/cifsglob.h | 1 +
+ fs/smb/client/connect.c | 1 +
+ fs/smb/client/smb2ops.c | 11 ++++++++++-
+ fs/smb/client/smb2pdu.c | 11 +++++++++++
+ fs/smb/common/smb2pdu.h | 22 ++++++++++++++++++++++
+ 5 files changed, 45 insertions(+), 1 deletion(-)
+
+--- a/fs/smb/client/cifsglob.h
++++ b/fs/smb/client/cifsglob.h
+@@ -734,6 +734,7 @@ struct TCP_Server_Info {
+ */
+ #define CIFS_SERVER_IS_CHAN(server) (!!(server)->primary_server)
+ struct TCP_Server_Info *primary_server;
++ __u16 channel_sequence_num; /* incremented on primary channel on each chan reconnect */
+
+ #ifdef CONFIG_CIFS_SWN_UPCALL
+ bool use_swn_dstaddr;
+--- a/fs/smb/client/connect.c
++++ b/fs/smb/client/connect.c
+@@ -1725,6 +1725,7 @@ cifs_get_tcp_session(struct smb3_fs_cont
+ ctx->target_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
+ tcp_ses->session_estab = false;
+ tcp_ses->sequence_number = 0;
++ tcp_ses->channel_sequence_num = 0; /* only tracked for primary channel */
+ tcp_ses->reconnect_instance = 1;
+ tcp_ses->lstrp = jiffies;
+ tcp_ses->compress_algorithm = cpu_to_le16(ctx->compression);
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -167,8 +167,17 @@ smb2_set_credits(struct TCP_Server_Info
+
+ spin_lock(&server->req_lock);
+ server->credits = val;
+- if (val == 1)
++ if (val == 1) {
+ server->reconnect_instance++;
++ /*
++ * ChannelSequence updated for all channels in primary channel so that consistent
++ * across SMB3 requests sent on any channel. See MS-SMB2 3.2.4.1 and 3.2.7.1
++ */
++ if (CIFS_SERVER_IS_CHAN(server))
++ server->primary_server->channel_sequence_num++;
++ else
++ server->channel_sequence_num++;
++ }
+ scredits = server->credits;
+ in_flight = server->in_flight;
+ spin_unlock(&server->req_lock);
+--- a/fs/smb/client/smb2pdu.c
++++ b/fs/smb/client/smb2pdu.c
+@@ -88,9 +88,20 @@ smb2_hdr_assemble(struct smb2_hdr *shdr,
+ const struct cifs_tcon *tcon,
+ struct TCP_Server_Info *server)
+ {
++ struct smb3_hdr_req *smb3_hdr;
+ shdr->ProtocolId = SMB2_PROTO_NUMBER;
+ shdr->StructureSize = cpu_to_le16(64);
+ shdr->Command = smb2_cmd;
++ if (server->dialect >= SMB30_PROT_ID) {
++ /* After reconnect SMB3 must set ChannelSequence on subsequent reqs */
++ smb3_hdr = (struct smb3_hdr_req *)shdr;
++ /* if primary channel is not set yet, use default channel for chan sequence num */
++ if (CIFS_SERVER_IS_CHAN(server))
++ smb3_hdr->ChannelSequence =
++ cpu_to_le16(server->primary_server->channel_sequence_num);
++ else
++ smb3_hdr->ChannelSequence = cpu_to_le16(server->channel_sequence_num);
++ }
+ if (server) {
+ spin_lock(&server->req_lock);
+ /* Request up to 10 credits but don't go over the limit. */
+--- a/fs/smb/common/smb2pdu.h
++++ b/fs/smb/common/smb2pdu.h
+@@ -153,6 +153,28 @@ struct smb2_hdr {
+ __u8 Signature[16];
+ } __packed;
+
++struct smb3_hdr_req {
++ __le32 ProtocolId; /* 0xFE 'S' 'M' 'B' */
++ __le16 StructureSize; /* 64 */
++ __le16 CreditCharge; /* MBZ */
++ __le16 ChannelSequence; /* See MS-SMB2 3.2.4.1 and 3.2.7.1 */
++ __le16 Reserved;
++ __le16 Command;
++ __le16 CreditRequest; /* CreditResponse */
++ __le32 Flags;
++ __le32 NextCommand;
++ __le64 MessageId;
++ union {
++ struct {
++ __le32 ProcessId;
++ __le32 TreeId;
++ } __packed SyncId;
++ __le64 AsyncId;
++ } __packed Id;
++ __le64 SessionId;
++ __u8 Signature[16];
++} __packed;
++
+ struct smb2_pdu {
+ struct smb2_hdr hdr;
+ __le16 StructureSize2; /* size of wct area (varies, request specific) */
scsi-qla2xxx-fix-smatch-warn-for-qla_init_iocb_limit.patch
scsi-qla2xxx-error-code-did-not-return-to-upper-layer.patch
scsi-qla2xxx-fix-firmware-resource-tracking.patch
+null_blk-fix-poll-request-timeout-handling.patch
+fbdev-ep93xx-fb-do-not-assign-to-struct-fb_info.dev.patch
+clk-qcom-camcc-sc7180-fix-async-resume-during-probe.patch
+drm-ast-fix-dram-init-on-ast2200.patch
+asoc-tegra-fix-sfc-conversion-for-few-rates.patch
+clk-qcom-turingcc-qcs404-fix-missing-resume-during-probe.patch
+arm64-dts-renesas-rzg2l-fix-txdv-skew-psec-typos.patch
+send-channel-sequence-number-in-smb3-requests-after-reconnects.patch
+memcg-drop-kmem.limit_in_bytes.patch
+mm-hugetlb_vmemmap-fix-a-race-between-vmemmap-pmd-split.patch
+lib-test_meminit-allocate-pages-up-to-order-max_order.patch
+parisc-led-fix-lan-receive-and-transmit-leds.patch
+parisc-led-reduce-cpu-overhead-for-disk-lan-led-computation.patch
+cifs-update-desired-access-while-requesting-for-directory-lease.patch
+pinctrl-cherryview-fix-address_space_handler-argument.patch
+dt-bindings-clock-xlnx-versal-clk-drop-select-false.patch
+clk-imx-pll14xx-dynamically-configure-pll-for-393216000-361267200hz.patch
+clk-imx-pll14xx-align-pdiv-with-reference-manual.patch
+clk-qcom-gcc-mdm9615-use-proper-parent-for-pll0_vote-clock.patch
+soc-qcom-qmi_encdec-restrict-string-length-in-decode.patch
+clk-qcom-dispcc-sm8450-fix-runtime-pm-imbalance-on-probe-errors.patch
+clk-qcom-lpasscc-sc7280-fix-missing-resume-during-probe.patch
+clk-qcom-q6sstop-qcs404-fix-missing-resume-during-probe.patch
+clk-qcom-mss-sc7180-fix-missing-resume-during-probe.patch
+nfs-fix-a-potential-data-corruption.patch
+nfsv4-pnfs-minor-fix-for-cleanup-path-in-nfs4_get_device_info.patch
+bus-mhi-host-skip-mhi-reset-if-device-is-in-rddm.patch
--- /dev/null
+From 8d207400fd6b79c92aeb2f33bb79f62dff904ea2 Mon Sep 17 00:00:00 2001
+From: Chris Lew <quic_clew@quicinc.com>
+Date: Tue, 1 Aug 2023 12:17:12 +0530
+Subject: soc: qcom: qmi_encdec: Restrict string length in decode
+
+From: Chris Lew <quic_clew@quicinc.com>
+
+commit 8d207400fd6b79c92aeb2f33bb79f62dff904ea2 upstream.
+
+The QMI TLV value for strings in a lot of qmi element info structures
+account for null terminated strings with MAX_LEN + 1. If a string is
+actually MAX_LEN + 1 length, this will cause an out of bounds access
+when the NULL character is appended in decoding.
+
+Fixes: 9b8a11e82615 ("soc: qcom: Introduce QMI encoder/decoder")
+Cc: stable@vger.kernel.org
+Signed-off-by: Chris Lew <quic_clew@quicinc.com>
+Signed-off-by: Praveenkumar I <quic_ipkumar@quicinc.com>
+Link: https://lore.kernel.org/r/20230801064712.3590128-1-quic_ipkumar@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/qcom/qmi_encdec.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/soc/qcom/qmi_encdec.c
++++ b/drivers/soc/qcom/qmi_encdec.c
+@@ -534,8 +534,8 @@ static int qmi_decode_string_elem(const
+ decoded_bytes += rc;
+ }
+
+- if (string_len > temp_ei->elem_len) {
+- pr_err("%s: String len %d > Max Len %d\n",
++ if (string_len >= temp_ei->elem_len) {
++ pr_err("%s: String len %d >= Max Len %d\n",
+ __func__, string_len, temp_ei->elem_len);
+ return -ETOOSMALL;
+ } else if (string_len > tlv_len) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
