Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Address family of server side mismatches with that of client side #387

Closed
geliangtang opened this issue Apr 12, 2023 · 5 comments
Closed
Assignees
Labels

Comments

@geliangtang
Copy link
Member

geliangtang commented Apr 12, 2023

diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
index fafd19ec7e1f..0fd1e2f75bde 100755
--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
@@ -1833,12 +1833,17 @@ subflows_tests()
        fi
 
        # subflow
-       if reset "single subflow"; then
+       if reset_with_events "single subflow"; then
                pm_nl_set_limits $ns1 0 1
                pm_nl_set_limits $ns2 0 1
                pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow
                run_tests $ns1 $ns2 10.0.1.1
                chk_join_nr 1 1 1
+               echo "ns1:"
+               cat $evts_ns1
+               echo "ns2:"
+               cat $evts_ns2
+               kill_events_pids
        fi
 
        # multiple subflows
> sudo ./mptcp_join.sh -f

Created /tmp/tmp.DmRiCONIkN (size 1 KB) containing data sent by client
Created /tmp/tmp.NNizKh9RtU (size 1 KB) containing data sent by server
001 no JOIN                              syn[ ok ] - synack[ ok ] - ack[ ok ]
002 single subflow, limited by client    syn[ ok ] - synack[ ok ] - ack[ ok ]
003 single subflow, limited by server    syn[ ok ] - synack[ ok ] - ack[ ok ]
004 single subflow                       syn[ ok ] - synack[ ok ] - ack[ ok ]
ns1:
type:15,family:10,sport:10003,saddr6:::
type:1,token:3827302342,server_side:1,family:10,saddr6:::ffff:10.0.1.1,daddr6:::ffff:10.0.1.2,sport:10003,dport:43490,loc_id:0,rem_id:0
type:2,token:3827302342,server_side:1,family:10,saddr6:::ffff:10.0.1.1,daddr6:::ffff:10.0.1.2,sport:10003,dport:43490,loc_id:0,rem_id:0
type:10,token:3827302342,family:10,saddr6:::ffff:10.0.1.1,daddr6:::ffff:10.0.3.2,sport:10003,dport:53253,loc_id:0,rem_id:1,backup:0
type:3,token:3827302342
type:16,family:10,sport:10003,saddr6:::
ns2:
type:1,token:119841803,server_side:0,family:2,saddr4:10.0.1.2,daddr4:10.0.1.1,sport:43490,dport:10003,loc_id:0,rem_id:0
type:2,token:119841803,server_side:0,family:2,saddr4:10.0.1.2,daddr4:10.0.1.1,sport:43490,dport:10003,loc_id:0,rem_id:0
type:10,token:119841803,family:2,saddr4:10.0.3.2,daddr4:10.0.1.1,sport:53253,dport:10003,loc_id:1,rem_id:0,backup:0
type:3,token:119841803
005 multiple subflows                    syn[ ok ] - synack[ ok ] - ack[ ok ]
006 multiple subflows, limited by server syn[ ok ] - synack[ ok ] - ack[ ok ]
007 single subflow, dev                  syn[ ok ] - synack[ ok ] - ack[ ok ]
@matttbe
Copy link
Member

matttbe commented Apr 12, 2023

Hi Geliang,

It doesn't look like an issue to me, it is just that on the server side (ns1), the family is set to AF_INET6 and the v4 address is mapped in a v6 one.

But the rest seems OK, no?

  • first subflow: 10.0.1.210.0.1.1
  • second one: 10.0.3.210.0.1.1

@geliangtang
Copy link
Member Author

Yes, the rest is OK. It's better to set the family to AF_INET4 here.

Could you tell me which lines of code set the family to AF_INET6? I didn't find it yet.

@matttbe
Copy link
Member

matttbe commented Apr 12, 2023

If I'm not mistaken, the server always create a listen socket in AF_INET6 to be able to accept subflows in v4 and v6.

Why is it an issue for you? If you need to parse stuff, can you not simply remove ::ffff:? e.g. directly in bash:

ip="::ffff:10.0.1.1"
echo ${ip#::ffff:}

@matttbe
Copy link
Member

matttbe commented Apr 18, 2023

Hi @geliangtang,

Are you still affected by this issue? It is not clear to me if it is really an issue or something else (v4 mapped in v6) to take into account.

@matttbe matttbe self-assigned this Apr 18, 2023
@matttbe matttbe added question and removed bug labels Apr 20, 2023
@matttbe
Copy link
Member

matttbe commented Apr 20, 2023

I guess this question was related to this patch (we can see: addr="::ffff:$addr"): https://patchwork.kernel.org/project/mptcp/patch/3ddbc897e2e5a766a2b4df591e747126288661ff.1681463340.git.geliang.tang@suse.com/

I guess we can close this ticket then. Feel free to re-open it if needed.

@matttbe matttbe closed this as completed Apr 20, 2023
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this issue Jan 10, 2024
Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Signed-off-by: Geliang Tang <geliang.tang@linux.dev>
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this issue Jan 10, 2024
Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds random tests for both
addresses.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Signed-off-by: Geliang Tang <geliang.tang@linux.dev>
MPTCPimporter pushed a commit that referenced this issue Jan 10, 2024
Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: #387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Signed-off-by: Geliang Tang <geliang.tang@linux.dev>
Message-Id: <8521873db897300d966fb312f4e8802a024b70f9.1704892316.git.geliang.tang@linux.dev>
MPTCPimporter pushed a commit that referenced this issue Jan 10, 2024
Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds random tests for both
addresses.

Closes: #387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Signed-off-by: Geliang Tang <geliang.tang@linux.dev>
Message-Id: <227b0361a7bf58e5ecdfc938afe88e8e31cd47b0.1704892316.git.geliang.tang@linux.dev>
MPTCPimporter pushed a commit that referenced this issue Jan 16, 2024
Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: #387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Message-Id: <f5d079054adf4054b23922114e7a28b0854e480b.1705375746.git.tanggeliang@kylinos.cn>
MPTCPimporter pushed a commit that referenced this issue Jan 16, 2024
Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds random tests for both
addresses.

Closes: #387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Message-Id: <50d512efbd50a1832aae751f09935d2c87e491e4.1705375746.git.tanggeliang@kylinos.cn>
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this issue Jan 16, 2024
Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this issue Jan 16, 2024
Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds random tests for both
addresses.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this issue Jan 18, 2024
Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this issue Jan 18, 2024
Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds random tests for both
addresses.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
MPTCPimporter pushed a commit that referenced this issue Jan 18, 2024
Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: #387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Message-Id: <5b291bca5a8a69217ae9e1090c94fb8e10b0b4ce.1705558030.git.tanggeliang@kylinos.cn>
MPTCPimporter pushed a commit that referenced this issue Jan 18, 2024
Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds random tests for both
addresses.

Closes: #387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Message-Id: <4fb4501fdec6f950e7fece31b78b645235c10917.1705558030.git.tanggeliang@kylinos.cn>
MPTCPimporter pushed a commit that referenced this issue Feb 1, 2024
Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: #387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Message-Id: <978747717376e43b571aa264d31eec15f149ec1e.1706759413.git.tanggeliang@kylinos.cn>
MPTCPimporter pushed a commit that referenced this issue Feb 1, 2024
Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds random tests for both
addresses.

Closes: #387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Message-Id: <192be0c3c28b3fb8ab56ca0ac6b02c40d9153f8e.1706759413.git.tanggeliang@kylinos.cn>
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this issue Feb 1, 2024
Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this issue Feb 1, 2024
Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds random tests for both
addresses.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
MPTCPimporter pushed a commit that referenced this issue Feb 6, 2024
Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: #387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Message-Id: <978747717376e43b571aa264d31eec15f149ec1e.1706759413.git.tanggeliang@kylinos.cn>
MPTCPimporter pushed a commit that referenced this issue Feb 6, 2024
Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds random tests for both
addresses.

Closes: #387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Message-Id: <192be0c3c28b3fb8ab56ca0ac6b02c40d9153f8e.1706759413.git.tanggeliang@kylinos.cn>
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this issue Feb 6, 2024
Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this issue Feb 6, 2024
Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds a second subflow
to "userspace pm add & remove address" test, and two subflows could
be removed two different ways, one with the v4mapped and one with v4.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
johnny-mnemonic pushed a commit to linux-ia64/linux-stable-rc that referenced this issue Mar 6, 2024
commit 535d620 upstream.

Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
johnny-mnemonic pushed a commit to linux-ia64/linux-stable-rc that referenced this issue Mar 6, 2024
commit 7092dbe upstream.

Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds a second subflow
to "userspace pm add & remove address" test, and two subflows could
be removed two different ways, one with the v4mapped and one with v4.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-2-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
johnny-mnemonic pushed a commit to linux-ia64/linux-stable-rc that referenced this issue Mar 6, 2024
commit 535d620 upstream.

Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
johnny-mnemonic pushed a commit to linux-ia64/linux-stable-rc that referenced this issue Mar 6, 2024
commit 7092dbe upstream.

Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds a second subflow
to "userspace pm add & remove address" test, and two subflows could
be removed two different ways, one with the v4mapped and one with v4.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-2-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
johnny-mnemonic pushed a commit to linux-ia64/linux-stable-rc that referenced this issue Mar 6, 2024
commit 535d620 upstream.

Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
johnny-mnemonic pushed a commit to linux-ia64/linux-stable-rc that referenced this issue Mar 6, 2024
commit 7092dbe upstream.

Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds a second subflow
to "userspace pm add & remove address" test, and two subflows could
be removed two different ways, one with the v4mapped and one with v4.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-2-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
johnny-mnemonic pushed a commit to linux-ia64/linux-stable-rc that referenced this issue Mar 6, 2024
commit 535d620 upstream.

Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Whissi pushed a commit to Whissi/linux-stable that referenced this issue Mar 6, 2024
commit 535d620 upstream.

Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Whissi pushed a commit to Whissi/linux-stable that referenced this issue Mar 6, 2024
commit 7092dbe upstream.

Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds a second subflow
to "userspace pm add & remove address" test, and two subflows could
be removed two different ways, one with the v4mapped and one with v4.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-2-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Whissi pushed a commit to Whissi/linux-stable that referenced this issue Mar 6, 2024
commit 535d620 upstream.

Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Whissi pushed a commit to Whissi/linux-stable that referenced this issue Mar 6, 2024
commit 535d620 upstream.

Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Whissi pushed a commit to Whissi/linux-stable that referenced this issue Mar 6, 2024
commit 7092dbe upstream.

Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds a second subflow
to "userspace pm add & remove address" test, and two subflows could
be removed two different ways, one with the v4mapped and one with v4.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-2-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
love4taylor added a commit to love4taylor/linux-self-use-deb that referenced this issue Mar 6, 2024
commit 2e7cdd29fc42c410eab52fffe5710bf656619222
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Wed Mar 6 14:54:01 2024 +0000

    Linux 6.7.9

    Link: https://lore.kernel.org/r/20240304211551.833500257@linuxfoundation.org
    Tested-by: SeongJae Park <sj@kernel.org>
    Tested-by: Luna Jernberg <droidbittin@gmail.com>
    Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
    Tested-by: Ronald Warsow <rwarsow@gmx.de>
    Tested-by: Salvatore Bonaccorso <carnil@debian.org>
    Tested-by: Shuah Khan <skhan@linuxfoundation.org>
    Link: https://lore.kernel.org/r/20240305074649.580820283@linuxfoundation.org
    Tested-by: Luna Jernberg <droidbittin@gmail.com>
    Tested-by: Jon Hunter <jonathanh@nvidia.com>
    Link: https://lore.kernel.org/r/20240305112824.448003471@linuxfoundation.org
    Tested-by: Luna Jernberg <droidbittin@gmail.com>
    Tested-by: Ron Economos <re@w6rz.net>
    Tested-by: Pavel Machek (CIP) <pavel@denx.de>
    Tested-by: Jon Hunter <jonathanh@nvidia.com>
    Tested-by: Ronald Warsow <rwarsow@gmx.de>
    Tested-by: Ricardo B. Marliere <ricardo@marliere.net>
    Tested-by: Justin M. Forbes <jforbes@fedoraproject.org>
    Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7bf08643b2536d00d84504874551b36e8f996639
Author: Danilo Krummrich <dakr@redhat.com>
Date:   Mon Mar 4 18:01:46 2024 +0100

    drm/nouveau: don't fini scheduler before entity flush

    This bug is present in v6.7 only, since the scheduler design has been
    re-worked in v6.8.

    Client scheduler entities must be flushed before an associated GPU
    scheduler is teared down. Otherwise the entitiy might still hold a
    pointer to the scheduler's runqueue which is freed at scheduler tear
    down already.

    [  305.224293] ==================================================================
    [  305.224297] BUG: KASAN: slab-use-after-free in drm_sched_entity_flush+0x6c4/0x7b0 [gpu_sched]
    [  305.224310] Read of size 8 at addr ffff8881440a8f48 by task rmmod/4436

    [  305.224317] CPU: 10 PID: 4436 Comm: rmmod Tainted: G     U             6.7.6-100.fc38.x86_64+debug #1
    [  305.224321] Hardware name: Dell Inc. Precision 7550/01PXFR, BIOS 1.27.0 11/08/2023
    [  305.224324] Call Trace:
    [  305.224327]  <TASK>
    [  305.224329]  dump_stack_lvl+0x76/0xd0
    [  305.224336]  print_report+0xcf/0x670
    [  305.224342]  ? drm_sched_entity_flush+0x6c4/0x7b0 [gpu_sched]
    [  305.224352]  ? __virt_addr_valid+0x215/0x410
    [  305.224359]  ? drm_sched_entity_flush+0x6c4/0x7b0 [gpu_sched]
    [  305.224368]  kasan_report+0xa6/0xe0
    [  305.224373]  ? drm_sched_entity_flush+0x6c4/0x7b0 [gpu_sched]
    [  305.224385]  drm_sched_entity_flush+0x6c4/0x7b0 [gpu_sched]
    [  305.224395]  ? __pfx_drm_sched_entity_flush+0x10/0x10 [gpu_sched]
    [  305.224406]  ? rcu_is_watching+0x15/0xb0
    [  305.224413]  drm_sched_entity_destroy+0x17/0x20 [gpu_sched]
    [  305.224422]  nouveau_cli_fini+0x6c/0x120 [nouveau]
    [  305.224658]  nouveau_drm_device_fini+0x2ac/0x490 [nouveau]
    [  305.224871]  nouveau_drm_remove+0x18e/0x220 [nouveau]
    [  305.225082]  ? __pfx_nouveau_drm_remove+0x10/0x10 [nouveau]
    [  305.225290]  ? rcu_is_watching+0x15/0xb0
    [  305.225295]  ? _raw_spin_unlock_irqrestore+0x66/0x80
    [  305.225299]  ? trace_hardirqs_on+0x16/0x100
    [  305.225304]  ? _raw_spin_unlock_irqrestore+0x4f/0x80
    [  305.225310]  pci_device_remove+0xa3/0x1d0
    [  305.225316]  device_release_driver_internal+0x379/0x540
    [  305.225322]  driver_detach+0xc5/0x180
    [  305.225327]  bus_remove_driver+0x11e/0x2a0
    [  305.225333]  pci_unregister_driver+0x2a/0x250
    [  305.225339]  nouveau_drm_exit+0x1f/0x970 [nouveau]
    [  305.225548]  __do_sys_delete_module+0x350/0x580
    [  305.225554]  ? __pfx___do_sys_delete_module+0x10/0x10
    [  305.225562]  ? syscall_enter_from_user_mode+0x26/0x90
    [  305.225567]  ? rcu_is_watching+0x15/0xb0
    [  305.225571]  ? syscall_enter_from_user_mode+0x26/0x90
    [  305.225575]  ? trace_hardirqs_on+0x16/0x100
    [  305.225580]  do_syscall_64+0x61/0xe0
    [  305.225584]  ? rcu_is_watching+0x15/0xb0
    [  305.225587]  ? syscall_exit_to_user_mode+0x1f/0x50
    [  305.225592]  ? trace_hardirqs_on_prepare+0xe3/0x100
    [  305.225596]  ? do_syscall_64+0x70/0xe0
    [  305.225600]  ? trace_hardirqs_on_prepare+0xe3/0x100
    [  305.225604]  entry_SYSCALL_64_after_hwframe+0x6e/0x76
    [  305.225609] RIP: 0033:0x7f6148f3592b
    [  305.225650] Code: 73 01 c3 48 8b 0d dd 04 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ad 04 0c 00 f7 d8 64 89 01 48
    [  305.225653] RSP: 002b:00007ffe89986f08 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
    [  305.225659] RAX: ffffffffffffffda RBX: 000055cbb036e900 RCX: 00007f6148f3592b
    [  305.225662] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055cbb036e968
    [  305.225664] RBP: 00007ffe89986f30 R08: 1999999999999999 R09: 0000000000000000
    [  305.225667] R10: 00007f6148fa6ac0 R11: 0000000000000206 R12: 0000000000000000
    [  305.225670] R13: 00007ffe89987190 R14: 000055cbb036e900 R15: 0000000000000000
    [  305.225678]  </TASK>

    [  305.225683] Allocated by task 484:
    [  305.225685]  kasan_save_stack+0x33/0x60
    [  305.225690]  kasan_set_track+0x25/0x30
    [  305.225693]  __kasan_kmalloc+0x8f/0xa0
    [  305.225696]  drm_sched_init+0x3c7/0xce0 [gpu_sched]
    [  305.225705]  nouveau_sched_init+0xd2/0x110 [nouveau]
    [  305.225913]  nouveau_drm_device_init+0x130/0x3290 [nouveau]
    [  305.226121]  nouveau_drm_probe+0x1ab/0x6b0 [nouveau]
    [  305.226329]  local_pci_probe+0xda/0x190
    [  305.226333]  pci_device_probe+0x23a/0x780
    [  305.226337]  really_probe+0x3df/0xb80
    [  305.226341]  __driver_probe_device+0x18c/0x450
    [  305.226345]  driver_probe_device+0x4a/0x120
    [  305.226348]  __driver_attach+0x1e5/0x4a0
    [  305.226351]  bus_for_each_dev+0x106/0x190
    [  305.226355]  bus_add_driver+0x2a1/0x570
    [  305.226358]  driver_register+0x134/0x460
    [  305.226361]  do_one_initcall+0xd3/0x430
    [  305.226366]  do_init_module+0x238/0x770
    [  305.226370]  load_module+0x5581/0x6f10
    [  305.226374]  __do_sys_init_module+0x1f2/0x220
    [  305.226377]  do_syscall_64+0x61/0xe0
    [  305.226381]  entry_SYSCALL_64_after_hwframe+0x6e/0x76

    [  305.226387] Freed by task 4436:
    [  305.226389]  kasan_save_stack+0x33/0x60
    [  305.226392]  kasan_set_track+0x25/0x30
    [  305.226396]  kasan_save_free_info+0x2b/0x50
    [  305.226399]  __kasan_slab_free+0x10b/0x1a0
    [  305.226402]  slab_free_freelist_hook+0x12b/0x1e0
    [  305.226406]  __kmem_cache_free+0xd4/0x1d0
    [  305.226410]  drm_sched_fini+0x178/0x320 [gpu_sched]
    [  305.226418]  nouveau_drm_device_fini+0x2a0/0x490 [nouveau]
    [  305.226624]  nouveau_drm_remove+0x18e/0x220 [nouveau]
    [  305.226832]  pci_device_remove+0xa3/0x1d0
    [  305.226836]  device_release_driver_internal+0x379/0x540
    [  305.226840]  driver_detach+0xc5/0x180
    [  305.226843]  bus_remove_driver+0x11e/0x2a0
    [  305.226847]  pci_unregister_driver+0x2a/0x250
    [  305.226850]  nouveau_drm_exit+0x1f/0x970 [nouveau]
    [  305.227056]  __do_sys_delete_module+0x350/0x580
    [  305.227060]  do_syscall_64+0x61/0xe0
    [  305.227064]  entry_SYSCALL_64_after_hwframe+0x6e/0x76

    [  305.227070] The buggy address belongs to the object at ffff8881440a8f00
                    which belongs to the cache kmalloc-128 of size 128
    [  305.227073] The buggy address is located 72 bytes inside of
                    freed 128-byte region [ffff8881440a8f00, ffff8881440a8f80)

    [  305.227078] The buggy address belongs to the physical page:
    [  305.227081] page:00000000627efa0a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1440a8
    [  305.227085] head:00000000627efa0a order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0
    [  305.227088] flags: 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
    [  305.227093] page_type: 0xffffffff()
    [  305.227097] raw: 0017ffffc0000840 ffff8881000428c0 ffffea0005b33500 dead000000000002
    [  305.227100] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000
    [  305.227102] page dumped because: kasan: bad access detected

    [  305.227106] Memory state around the buggy address:
    [  305.227109]  ffff8881440a8e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    [  305.227112]  ffff8881440a8e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    [  305.227114] >ffff8881440a8f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    [  305.227117]                                               ^
    [  305.227120]  ffff8881440a8f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    [  305.227122]  ffff8881440a9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
    [  305.227125] ==================================================================

    Cc: <stable@vger.kernel.org> # v6.7 only
    Reported-by: Karol Herbst <kherbst@redhat.com>
    Closes: https://gist.githubusercontent.com/karolherbst/a20eb0f937a06ed6aabe2ac2ca3d11b5/raw/9cd8b1dc5894872d0eeebbee3dd0fdd28bb576bc/gistfile1.txt
    Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI")
    Signed-off-by: Danilo Krummrich <dakr@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7dfd52829f9db2d7d0691807dad55363f2179fcd
Author: Geliang Tang <tanggeliang@kylinos.cn>
Date:   Mon Mar 4 14:38:33 2024 +0100

    selftests: mptcp: rm subflow with v4/v4mapped addr

    commit 7092dbee23282b6fcf1313fc64e2b92649ee16e8 upstream.

    Now both a v4 address and a v4-mapped address are supported when
    destroying a userspace pm subflow, this patch adds a second subflow
    to "userspace pm add & remove address" test, and two subflows could
    be removed two different ways, one with the v4mapped and one with v4.

    Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/387
    Fixes: 48d73f609dcc ("selftests: mptcp: update userspace pm addr tests")
    Cc: stable@vger.kernel.org
    Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
    Reviewed-by: Mat Martineau <martineau@kernel.org>
    Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-2-162e87e48497@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 371efc293e96c54b6e035c18fe6c7d77a84a8c0c
Author: Geliang Tang <geliang@kernel.org>
Date:   Mon Mar 4 14:38:32 2024 +0100

    selftests: mptcp: add mptcp_lib_is_v6

    commit b850f2c7dd85ecd14a333685c4ffd23f12665e94 upstream.

    To avoid duplicated code in different MPTCP selftests, we can add
    and use helpers defined in mptcp_lib.sh.

    is_v6() helper is defined in mptcp_connect.sh, mptcp_join.sh and
    mptcp_sockopt.sh, so export it into mptcp_lib.sh and rename it as
    mptcp_lib_is_v6(). Use this new helper in all scripts.

    Reviewed-by: Matthieu Baerts <matttbe@kernel.org>
    Signed-off-by: Geliang Tang <geliang.tang@suse.com>
    Signed-off-by: Mat Martineau <martineau@kernel.org>
    Link: https://lore.kernel.org/r/20231128-send-net-next-2023107-v4-10-8d6b94150f6b@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 42f42773fe7171b9a7f600212c66af7a82d6d3e1
Author: Geliang Tang <geliang@kernel.org>
Date:   Mon Mar 4 14:38:31 2024 +0100

    selftests: mptcp: update userspace pm test helpers

    commit 757c828ce94905a2975873d5e90a376c701b2b90 upstream.

    This patch adds a new argument namespace to userspace_pm_add_addr() and
    userspace_pm_add_sf() to make these two helper more versatile.

    Add two more versatile helpers for userspace pm remove subflow or address:
    userspace_pm_rm_addr() and userspace_pm_rm_sf(). The original test helpers
    userspace_pm_rm_sf_addr_ns1() and userspace_pm_rm_sf_addr_ns2() can be
    replaced by these new helpers.

    Reviewed-by: Matthieu Baerts <matttbe@kernel.org>
    Signed-off-by: Geliang Tang <geliang.tang@suse.com>
    Signed-off-by: Mat Martineau <martineau@kernel.org>
    Link: https://lore.kernel.org/r/20231128-send-net-next-2023107-v4-4-8d6b94150f6b@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 16ac627e93b2788dddda2ac2c69e6182fa78b8d2
Author: Geliang Tang <geliang@kernel.org>
Date:   Mon Mar 4 14:38:30 2024 +0100

    selftests: mptcp: add chk_subflows_total helper

    commit 80775412882e273b8ef62124fae861cde8e6fb3d upstream.

    This patch adds a new helper chk_subflows_total(), in it use the newly
    added counter mptcpi_subflows_total to get the "correct" amount of
    subflows, including the initial one.

    To be compatible with old 'ss' or kernel versions not supporting this
    counter, get the total subflows by listing TCP connections that are
    MPTCP subflows:

        ss -ti state state established state syn-sent state syn-recv |
            grep -c tcp-ulp-mptcp.

    Reviewed-by: Matthieu Baerts <matttbe@kernel.org>
    Signed-off-by: Geliang Tang <geliang.tang@suse.com>
    Signed-off-by: Mat Martineau <martineau@kernel.org>
    Link: https://lore.kernel.org/r/20231128-send-net-next-2023107-v4-3-8d6b94150f6b@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 21dada9b05f2f8decb6926f3e8fc9e6f7ed165fb
Author: Geliang Tang <geliang@kernel.org>
Date:   Mon Mar 4 14:38:29 2024 +0100

    selftests: mptcp: add evts_get_info helper

    commit 06848c0f341ee3f9226ed01e519c72e4d2b6f001 upstream.

    This patch adds a new helper get_info_value(), using 'sed' command to
    parse the value of the given item name in the line with the given keyword,
    to make chk_mptcp_info() and pedit_action_pkts() more readable.

    Also add another helper evts_get_info() to use get_info_value() to parse
    the output of 'pm_nl_ctl events' command, to make all the userspace pm
    selftests more readable, both in mptcp_join.sh and userspace_pm.sh.

    Reviewed-by: Matthieu Baerts <matttbe@kernel.org>
    Signed-off-by: Geliang Tang <geliang.tang@suse.com>
    Signed-off-by: Mat Martineau <martineau@kernel.org>
    Link: https://lore.kernel.org/r/20231128-send-net-next-2023107-v4-2-8d6b94150f6b@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5287a535bd692b21f584af5d51df388ba7473590
Author: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date:   Sun Mar 3 20:24:30 2024 -0800

    KVM/VMX: Move VERW closer to VMentry for MDS mitigation

    commit 43fb862de8f628c5db5e96831c915b9aebf62d33 upstream.

    During VMentry VERW is executed to mitigate MDS. After VERW, any memory
    access like register push onto stack may put host data in MDS affected
    CPU buffers. A guest can then use MDS to sample host data.

    Although likelihood of secrets surviving in registers at current VERW
    callsite is less, but it can't be ruled out. Harden the MDS mitigation
    by moving the VERW mitigation late in VMentry path.

    Note that VERW for MMIO Stale Data mitigation is unchanged because of
    the complexity of per-guest conditional VERW which is not easy to handle
    that late in asm with no GPRs available. If the CPU is also affected by
    MDS, VERW is unconditionally executed late in asm regardless of guest
    having MMIO access.

    Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
    Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    Acked-by: Sean Christopherson <seanjc@google.com>
    Link: https://lore.kernel.org/all/20240213-delay-verw-v8-6-a6216d83edb7%40linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fe815656d87f443d75d69e7c48429dce3001c466
Author: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date:   Sun Mar 3 20:24:24 2024 -0800

    KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH

    From: Sean Christopherson <seanjc@google.com>

    commit 706a189dcf74d3b3f955e9384785e726ed6c7c80 upstream.

    Use EFLAGS.CF instead of EFLAGS.ZF to track whether to use VMRESUME versus
    VMLAUNCH.  Freeing up EFLAGS.ZF will allow doing VERW, which clobbers ZF,
    for MDS mitigations as late as possible without needing to duplicate VERW
    for both paths.

    Signed-off-by: Sean Christopherson <seanjc@google.com>
    Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
    Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>
    Link: https://lore.kernel.org/all/20240213-delay-verw-v8-5-a6216d83edb7%40linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f8ecc210fd37011956d92937e9e8c7c93ad55db7
Author: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date:   Sun Mar 3 20:24:19 2024 -0800

    x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key

    commit 6613d82e617dd7eb8b0c40b2fe3acea655b1d611 upstream.

    The VERW mitigation at exit-to-user is enabled via a static branch
    mds_user_clear. This static branch is never toggled after boot, and can
    be safely replaced with an ALTERNATIVE() which is convenient to use in
    asm.

    Switch to ALTERNATIVE() to use the VERW mitigation late in exit-to-user
    path. Also remove the now redundant VERW in exc_nmi() and
    arch_exit_to_user_mode().

    Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
    Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    Link: https://lore.kernel.org/all/20240213-delay-verw-v8-4-a6216d83edb7%40linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 51eca9f1fd047b500137d021f882d93f03280118
Author: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date:   Sun Mar 3 20:24:13 2024 -0800

    x86/entry_32: Add VERW just before userspace transition

    commit a0e2dab44d22b913b4c228c8b52b2a104434b0b3 upstream.

    As done for entry_64, add support for executing VERW late in exit to
    user path for 32-bit mode.

    Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
    Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    Link: https://lore.kernel.org/all/20240213-delay-verw-v8-3-a6216d83edb7%40linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2788b63256a8eba4bf47674db436b7bb5d32beea
Author: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date:   Sun Mar 3 20:24:07 2024 -0800

    x86/entry_64: Add VERW just before userspace transition

    commit 3c7501722e6b31a6e56edd23cea5e77dbb9ffd1a upstream.

    Mitigation for MDS is to use VERW instruction to clear any secrets in
    CPU Buffers. Any memory accesses after VERW execution can still remain
    in CPU buffers. It is safer to execute VERW late in return to user path
    to minimize the window in which kernel data can end up in CPU buffers.
    There are not many kernel secrets to be had after SWITCH_TO_USER_CR3.

    Add support for deploying VERW mitigation after user register state is
    restored. This helps minimize the chances of kernel data ending up into
    CPU buffers after executing VERW.

    Note that the mitigation at the new location is not yet enabled.

      Corner case not handled
      =======================
      Interrupts returning to kernel don't clear CPUs buffers since the
      exit-to-user path is expected to do that anyways. But, there could be
      a case when an NMI is generated in kernel after the exit-to-user path
      has cleared the buffers. This case is not handled and NMI returning to
      kernel don't clear CPU buffers because:

      1. It is rare to get an NMI after VERW, but before returning to userspace.
      2. For an unprivileged user, there is no known way to make that NMI
         less rare or target it.
      3. It would take a large number of these precisely-timed NMIs to mount
         an actual attack.  There's presumably not enough bandwidth.
      4. The NMI in question occurs after a VERW, i.e. when user state is
         restored and most interesting data is already scrubbed. Whats left
         is only the data that NMI touches, and that may or may not be of
         any interest.

      [ pawan: resolved conflict for hunk swapgs_restore_regs_and_return_to_usermode in backport ]

    Suggested-by: Dave Hansen <dave.hansen@intel.com>
    Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
    Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    Link: https://lore.kernel.org/all/20240213-delay-verw-v8-2-a6216d83edb7%40linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e4706e2d4b6b2d508106b7ea571c52f82e51aa6e
Author: Ming Lei <ming.lei@redhat.com>
Date:   Sun Feb 25 11:01:41 2024 +0800

    block: define bvec_iter as __packed __aligned(4)

    [ Upstream commit 7838b4656110d950afdd92a081cc0f33e23e0ea8 ]

    In commit 19416123ab3e ("block: define 'struct bvec_iter' as packed"),
    what we need is to save the 4byte padding, and avoid `bio` to spread on
    one extra cache line.

    It is enough to define it as '__packed __aligned(4)', as '__packed'
    alone means byte aligned, and can cause compiler to generate horrible
    code on architectures that don't support unaligned access in case that
    bvec_iter is embedded in other structures.

    Cc: Mikulas Patocka <mpatocka@redhat.com>
    Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
    Fixes: 19416123ab3e ("block: define 'struct bvec_iter' as packed")
    Signed-off-by: Ming Lei <ming.lei@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 44f0ce3318a5b8b5f81ccab7fa86239a84a738df
Author: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Date:   Thu Feb 29 18:25:49 2024 +0100

    gpio: fix resource unwinding order in error path

    [ Upstream commit ec5c54a9d3c4f9c15e647b049fea401ee5258696 ]

    Hogs are added *after* ACPI so should be removed *before* in error path.

    Fixes: a411e81e61df ("gpiolib: add hogs support for machine code")
    Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8ee9fb03cc792435de4740a50f51642ec0ad967a
Author: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date:   Wed Feb 21 21:28:46 2024 +0200

    gpiolib: Fix the error path order in gpiochip_add_data_with_key()

    [ Upstream commit e4aec4daa8c009057b5e063db1b7322252c92dc8 ]

    After shuffling the code, error path wasn't updated correctly.
    Fix it here.

    Fixes: 2f4133bb5f14 ("gpiolib: No need to call gpiochip_remove_pin_ranges() twice")
    Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8e51f26db6dbc1d78ca1529461c15778dd1674bc
Author: Arturas Moskvinas <arturas.moskvinas@gmail.com>
Date:   Fri Mar 1 09:12:04 2024 +0200

    gpio: 74x164: Enable output pins after registers are reset

    [ Upstream commit 530b1dbd97846b110ea8a94c7cc903eca21786e5 ]

    Chip outputs are enabled[1] before actual reset is performed[2] which might
    cause pin output value to flip flop if previous pin value was set to 1.
    Fix that behavior by making sure chip is fully reset before all outputs are
    enabled.

    Flip-flop can be noticed when module is removed and inserted again and one of
    the pins was changed to 1 before removal. 100 microsecond flipping is
    noticeable on oscilloscope (100khz SPI bus).

    For a properly reset chip - output is enabled around 100 microseconds (on 100khz
    SPI bus) later during probing process hence should be irrelevant behavioral
    change.

    Fixes: 7ebc194d0fd4 (gpio: 74x164: Introduce 'enable-gpios' property)
    Link: https://elixir.bootlin.com/linux/v6.7.4/source/drivers/gpio/gpio-74x164.c#L130 [1]
    Link: https://elixir.bootlin.com/linux/v6.7.4/source/drivers/gpio/gpio-74x164.c#L150 [2]
    Signed-off-by: Arturas Moskvinas <arturas.moskvinas@gmail.com>
    Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit dd63817baf334888289877ab1db1d866af2a6479
Author: Nathan Lynch <nathanl@linux.ibm.com>
Date:   Thu Feb 22 16:19:14 2024 -0600

    powerpc/rtas: use correct function name for resetting TCE tables

    [ Upstream commit fad87dbd48156ab940538f052f1820f4b6ed2819 ]

    The PAPR spec spells the function name as

      "ibm,reset-pe-dma-windows"

    but in practice firmware uses the singular form:

      "ibm,reset-pe-dma-window"

    in the device tree. Since we have the wrong spelling in the RTAS
    function table, reverse lookups (token -> name) fail and warn:

      unexpected failed lookup for token 86
      WARNING: CPU: 1 PID: 545 at arch/powerpc/kernel/rtas.c:659 __do_enter_rtas_trace+0x2a4/0x2b4
      CPU: 1 PID: 545 Comm: systemd-udevd Not tainted 6.8.0-rc4 #30
      Hardware name: IBM,9105-22A POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NL1060_028) hv:phyp pSeries
      NIP [c0000000000417f0] __do_enter_rtas_trace+0x2a4/0x2b4
      LR [c0000000000417ec] __do_enter_rtas_trace+0x2a0/0x2b4
      Call Trace:
       __do_enter_rtas_trace+0x2a0/0x2b4 (unreliable)
       rtas_call+0x1f8/0x3e0
       enable_ddw.constprop.0+0x4d0/0xc84
       dma_iommu_dma_supported+0xe8/0x24c
       dma_set_mask+0x5c/0xd8
       mlx5_pci_init.constprop.0+0xf0/0x46c [mlx5_core]
       probe_one+0xfc/0x32c [mlx5_core]
       local_pci_probe+0x68/0x12c
       pci_call_probe+0x68/0x1ec
       pci_device_probe+0xbc/0x1a8
       really_probe+0x104/0x570
       __driver_probe_device+0xb8/0x224
       driver_probe_device+0x54/0x130
       __driver_attach+0x158/0x2b0
       bus_for_each_dev+0xa8/0x120
       driver_attach+0x34/0x48
       bus_add_driver+0x174/0x304
       driver_register+0x8c/0x1c4
       __pci_register_driver+0x68/0x7c
       mlx5_init+0xb8/0x118 [mlx5_core]
       do_one_initcall+0x60/0x388
       do_init_module+0x7c/0x2a4
       init_module_from_file+0xb4/0x108
       idempotent_init_module+0x184/0x34c
       sys_finit_module+0x90/0x114

    And oopses are possible when lockdep is enabled or the RTAS
    tracepoints are active, since those paths dereference the result of
    the lookup.

    Use the correct spelling to match firmware's behavior, adjusting the
    related constants to match.

    Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
    Fixes: 8252b88294d2 ("powerpc/rtas: improve function information lookups")
    Reported-by: Gaurav Batra <gbatra@linux.ibm.com>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Link: https://msgid.link/20240222-rtas-fix-ibm-reset-pe-dma-window-v1-1-7aaf235ac63c@linux.ibm.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5da6d306f315344af1ca2eff4bd9b10b130f0c28
Author: Gaurav Batra <gbatra@linux.vnet.ibm.com>
Date:   Thu Jan 25 14:30:17 2024 -0600

    powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV

    [ Upstream commit 09a3c1e46142199adcee372a420b024b4fc61051 ]

    When kdump kernel tries to copy dump data over SR-IOV, LPAR panics due
    to NULL pointer exception:

      Kernel attempted to read user page (0) - exploit attempt? (uid: 0)
      BUG: Kernel NULL pointer dereference on read at 0x00000000
      Faulting instruction address: 0xc000000020847ad4
      Oops: Kernel access of bad area, sig: 11 [#1]
      LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
      Modules linked in: mlx5_core(+) vmx_crypto pseries_wdt papr_scm libnvdimm mlxfw tls psample sunrpc fuse overlay squashfs loop
      CPU: 12 PID: 315 Comm: systemd-udevd Not tainted 6.4.0-Test102+ #12
      Hardware name: IBM,9080-HEX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_008) hv:phyp pSeries
      NIP:  c000000020847ad4 LR: c00000002083b2dc CTR: 00000000006cd18c
      REGS: c000000029162ca0 TRAP: 0300   Not tainted  (6.4.0-Test102+)
      MSR:  800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE>  CR: 48288244  XER: 00000008
      CFAR: c00000002083b2d8 DAR: 0000000000000000 DSISR: 40000000 IRQMASK: 1
      ...
      NIP _find_next_zero_bit+0x24/0x110
      LR  bitmap_find_next_zero_area_off+0x5c/0xe0
      Call Trace:
        dev_printk_emit+0x38/0x48 (unreliable)
        iommu_area_alloc+0xc4/0x180
        iommu_range_alloc+0x1e8/0x580
        iommu_alloc+0x60/0x130
        iommu_alloc_coherent+0x158/0x2b0
        dma_iommu_alloc_coherent+0x3c/0x50
        dma_alloc_attrs+0x170/0x1f0
        mlx5_cmd_init+0xc0/0x760 [mlx5_core]
        mlx5_function_setup+0xf0/0x510 [mlx5_core]
        mlx5_init_one+0x84/0x210 [mlx5_core]
        probe_one+0x118/0x2c0 [mlx5_core]
        local_pci_probe+0x68/0x110
        pci_call_probe+0x68/0x200
        pci_device_probe+0xbc/0x1a0
        really_probe+0x104/0x540
        __driver_probe_device+0xb4/0x230
        driver_probe_device+0x54/0x130
        __driver_attach+0x158/0x2b0
        bus_for_each_dev+0xa8/0x130
        driver_attach+0x34/0x50
        bus_add_driver+0x16c/0x300
        driver_register+0xa4/0x1b0
        __pci_register_driver+0x68/0x80
        mlx5_init+0xb8/0x100 [mlx5_core]
        do_one_initcall+0x60/0x300
        do_init_module+0x7c/0x2b0

    At the time of LPAR dump, before kexec hands over control to kdump
    kernel, DDWs (Dynamic DMA Windows) are scanned and added to the FDT.
    For the SR-IOV case, default DMA window "ibm,dma-window" is removed from
    the FDT and DDW added, for the device.

    Now, kexec hands over control to the kdump kernel.

    When the kdump kernel initializes, PCI busses are scanned and IOMMU
    group/tables created, in pci_dma_bus_setup_pSeriesLP(). For the SR-IOV
    case, there is no "ibm,dma-window". The original commit: b1fc44eaa9ba,
    fixes the path where memory is pre-mapped (direct mapped) to the DDW.
    When TCEs are direct mapped, there is no need to initialize IOMMU
    tables.

    iommu_table_setparms_lpar() only considers "ibm,dma-window" property
    when initiallizing IOMMU table. In the scenario where TCEs are
    dynamically allocated for SR-IOV, newly created IOMMU table is not
    initialized. Later, when the device driver tries to enter TCEs for the
    SR-IOV device, NULL pointer execption is thrown from iommu_area_alloc().

    The fix is to initialize the IOMMU table with DDW property stored in the
    FDT. There are 2 points to remember:

            1. For the dedicated adapter, kdump kernel would encounter both
               default and DDW in FDT. In this case, DDW property is used to
               initialize the IOMMU table.

            2. A DDW could be direct or dynamic mapped. kdump kernel would
               initialize IOMMU table and mark the existing DDW as
               "dynamic". This works fine since, at the time of table
               initialization, iommu_table_clear() makes some space in the
               DDW, for some predefined number of TCEs which are needed for
               kdump to succeed.

    Fixes: b1fc44eaa9ba ("pseries/iommu/ddw: Fix kdump to work in absence of ibm,dma-window")
    Signed-off-by: Gaurav Batra <gbatra@linux.vnet.ibm.com>
    Reviewed-by: Brian King <brking@linux.vnet.ibm.com>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Link: https://msgid.link/20240125203017.61014-1-gbatra@linux.ibm.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit bb71e040323175e18c233a9afef32ba14fa64eb7
Author: Fenghua Yu <fenghua.yu@intel.com>
Date:   Fri Feb 9 11:14:12 2024 -0800

    dmaengine: idxd: Ensure safe user copy of completion record

    [ Upstream commit d3ea125df37dc37972d581b74a5d3785c3f283ab ]

    If CONFIG_HARDENED_USERCOPY is enabled, copying completion record from
    event log cache to user triggers a kernel bug.

    [ 1987.159822] usercopy: Kernel memory exposure attempt detected from SLUB object 'dsa0' (offset 74, size 31)!
    [ 1987.170845] ------------[ cut here ]------------
    [ 1987.176086] kernel BUG at mm/usercopy.c:102!
    [ 1987.180946] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
    [ 1987.186866] CPU: 17 PID: 528 Comm: kworker/17:1 Not tainted 6.8.0-rc2+ #5
    [ 1987.194537] Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023
    [ 1987.206405] Workqueue: wq0.0 idxd_evl_fault_work [idxd]
    [ 1987.212338] RIP: 0010:usercopy_abort+0x72/0x90
    [ 1987.217381] Code: 58 65 9c 50 48 c7 c2 17 85 61 9c 57 48 c7 c7 98 fd 6b 9c 48 0f 44 d6 48 c7 c6 b3 08 62 9c 4c 89 d1 49 0f 44 f3 e8 1e 2e d5 ff <0f> 0b 49 c7 c1 9e 42 61 9c 4c 89 cf 4d 89 c8 eb a9 66 66 2e 0f 1f
    [ 1987.238505] RSP: 0018:ff62f5cf20607d60 EFLAGS: 00010246
    [ 1987.244423] RAX: 000000000000005f RBX: 000000000000001f RCX: 0000000000000000
    [ 1987.252480] RDX: 0000000000000000 RSI: ffffffff9c61429e RDI: 00000000ffffffff
    [ 1987.260538] RBP: ff62f5cf20607d78 R08: ff2a6a89ef3fffe8 R09: 00000000fffeffff
    [ 1987.268595] R10: ff2a6a89eed00000 R11: 0000000000000003 R12: ff2a66934849c89a
    [ 1987.276652] R13: 0000000000000001 R14: ff2a66934849c8b9 R15: ff2a66934849c899
    [ 1987.284710] FS:  0000000000000000(0000) GS:ff2a66b22fe40000(0000) knlGS:0000000000000000
    [ 1987.293850] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [ 1987.300355] CR2: 00007fe291a37000 CR3: 000000010fbd4005 CR4: 0000000000f71ef0
    [ 1987.308413] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [ 1987.316470] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
    [ 1987.324527] PKRU: 55555554
    [ 1987.327622] Call Trace:
    [ 1987.330424]  <TASK>
    [ 1987.332826]  ? show_regs+0x6e/0x80
    [ 1987.336703]  ? die+0x3c/0xa0
    [ 1987.339988]  ? do_trap+0xd4/0xf0
    [ 1987.343662]  ? do_error_trap+0x75/0xa0
    [ 1987.347922]  ? usercopy_abort+0x72/0x90
    [ 1987.352277]  ? exc_invalid_op+0x57/0x80
    [ 1987.356634]  ? usercopy_abort+0x72/0x90
    [ 1987.360988]  ? asm_exc_invalid_op+0x1f/0x30
    [ 1987.365734]  ? usercopy_abort+0x72/0x90
    [ 1987.370088]  __check_heap_object+0xb7/0xd0
    [ 1987.374739]  __check_object_size+0x175/0x2d0
    [ 1987.379588]  idxd_copy_cr+0xa9/0x130 [idxd]
    [ 1987.384341]  idxd_evl_fault_work+0x127/0x390 [idxd]
    [ 1987.389878]  process_one_work+0x13e/0x300
    [ 1987.394435]  ? __pfx_worker_thread+0x10/0x10
    [ 1987.399284]  worker_thread+0x2f7/0x420
    [ 1987.403544]  ? _raw_spin_unlock_irqrestore+0x2b/0x50
    [ 1987.409171]  ? __pfx_worker_thread+0x10/0x10
    [ 1987.414019]  kthread+0x107/0x140
    [ 1987.417693]  ? __pfx_kthread+0x10/0x10
    [ 1987.421954]  ret_from_fork+0x3d/0x60
    [ 1987.426019]  ? __pfx_kthread+0x10/0x10
    [ 1987.430281]  ret_from_fork_asm+0x1b/0x30
    [ 1987.434744]  </TASK>

    The issue arises because event log cache is created using
    kmem_cache_create() which is not suitable for user copy.

    Fix the issue by creating event log cache with
    kmem_cache_create_usercopy(), ensuring safe user copy.

    Fixes: c2f156bf168f ("dmaengine: idxd: create kmem cache for event log fault items")
    Reported-by: Tony Zhu <tony.zhu@intel.com>
    Tested-by: Tony Zhu <tony.zhu@intel.com>
    Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
    Reviewed-by: Lijun Pan <lijun.pan@intel.com>
    Reviewed-by: Dave Jiang <dave.jiang@intel.com>
    Link: https://lore.kernel.org/r/20240209191412.1050270-1-fenghua.yu@intel.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 4d78149ebe9920eb40e53f73e185a27c679f12f6
Author: Fenghua Yu <fenghua.yu@intel.com>
Date:   Wed Feb 14 18:49:31 2024 -0800

    dmaengine: idxd: Remove shadow Event Log head stored in idxd

    [ Upstream commit ecec7c9f29a7114a3e23a14020b1149ea7dffb4f ]

    head is defined in idxd->evl as a shadow of head in the EVLSTATUS register.
    There are two issues related to the shadow head:

    1. Mismatch between the shadow head and the state of the EVLSTATUS
       register:
       If Event Log is supported, upon completion of the Enable Device command,
       the Event Log head in the variable idxd->evl->head should be cleared to
       match the state of the EVLSTATUS register. But the variable is not reset
       currently, leading mismatch between the variable and the register state.
       The mismatch causes incorrect processing of Event Log entries.

    2. Unnecessary shadow head definition:
       The shadow head is unnecessary as head can be read directly from the
       EVLSTATUS register. Reading head from the register incurs no additional
       cost because event log head and tail are always read together and
       tail is already read directly from the register as required by hardware.

    Remove the shadow Event Log head stored in idxd->evl to address the
    mentioned issues.

    Fixes: 244da66cda35 ("dmaengine: idxd: setup event log configuration")
    Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
    Reviewed-by: Dave Jiang <dave.jiang@intel.com>
    Link: https://lore.kernel.org/r/20240215024931.1739621-1-fenghua.yu@intel.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a3c713cfa2b5854d6bcf1f0748acb018c25b850c
Author: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Date:   Tue Feb 13 15:38:24 2024 +0200

    phy: qcom-qmp-usb: fix v3 offsets data

    [ Upstream commit d4c08d8b23b22807c712208cd05cb047e92e7672 ]

    The MSM8996 platform has registers setup different to the rest of QMP v3
    USB platforms. It has PCS region at 0x600 and no PCS_MISC region, while
    other platforms have PCS region at 0x800 and PCS_MISC at 0x600.  This
    results in the malfunctioning USB host on some of the platforms.  The
    commit f74c35b630d4 ("phy: qcom-qmp-usb: fix register offsets for
    ipq8074/ipq6018") fixed the issue for IPQ platforms, but missed the
    SDM845 which has the same register layout.

    To simplify future platform addition and to make the driver more future
    proof, rename qmp_usb_offsets_v3 to qmp_usb_offsets_v3_msm8996 (to mark
    its peculiarity), rename qmp_usb_offsets_ipq8074 to qmp_usb_offsets_v3
    and use it for SDM845 platform.

    Fixes: 2be22aae6b18 ("phy: qcom-qmp-usb: populate offsets configuration")
    Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    Link: https://lore.kernel.org/r/20240213133824.2218916-1-dmitry.baryshkov@linaro.org
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit d78739eb66a8fbff7f8a0186e03b4c79718af5d2
Author: Yang Yingliang <yangyingliang@huawei.com>
Date:   Thu Aug 24 17:13:45 2023 +0800

    phy: qcom: phy-qcom-m31: fix wrong pointer pass to PTR_ERR()

    [ Upstream commit 95055beb067cb30f626fb10f7019737ca7681df0 ]

    It should be 'qphy->vreg' passed to PTR_ERR() when devm_regulator_get() fails.

    Fixes: 08e49af50701 ("phy: qcom: Introduce M31 USB PHY driver")
    Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
    Reviewed-by: Varadarajan Narayanan <quic_varada@quicinc.com>
    Link: https://lore.kernel.org/r/20230824091345.1072650-1-yangyingliang@huawei.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 76d89953240acad71f92ccf8adb28cb6cebdb2bf
Author: Alexander Stein <alexander.stein@ew.tq-group.com>
Date:   Wed Jan 10 10:33:43 2024 +0100

    phy: freescale: phy-fsl-imx8-mipi-dphy: Fix alias name to use dashes

    [ Upstream commit 7936378cb6d87073163130e1e1fc1e5f76a597cf ]

    Devicetree spec lists only dashes as valid characters for alias names.
    Table 3.2: Valid characters for alias names, Devicee Specification,
    Release v0.4

    Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
    Fixes: 3fbae284887de ("phy: freescale: phy-fsl-imx8-mipi-dphy: Add i.MX8qxp LVDS PHY mode support")
    Link: https://lore.kernel.org/r/20240110093343.468810-1-alexander.stein@ew.tq-group.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f396b4df27cfe01a99f4b41f584c49e56477be3a
Author: Kory Maincent <kory.maincent@bootlin.com>
Date:   Mon Jan 29 17:26:02 2024 +0100

    dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup

    [ Upstream commit bbcc1c83f343e580c3aa1f2a8593343bf7b55bba ]

    The Linked list element and pointer are not stored in the same memory as
    the eDMA controller register. If the doorbell register is toggled before
    the full write of the linked list a race condition error will occur.
    In remote setup we can only use a readl to the memory to assure the full
    write has occurred.

    Fixes: 7e4b8a4fbe2c ("dmaengine: Add Synopsys eDMA IP version 0 support")
    Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
    Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
    Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-6-8e8c1acb7a46@bootlin.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 17be6f5cb223f22e4733ed8fe8b2247cbb677716
Author: Kory Maincent <kory.maincent@bootlin.com>
Date:   Mon Jan 29 17:26:01 2024 +0100

    dmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup

    [ Upstream commit 712a92a48158e02155b4b6b21e03a817f78c9b7e ]

    The Linked list element and pointer are not stored in the same memory as
    the HDMA controller register. If the doorbell register is toggled before
    the full write of the linked list a race condition error will occur.
    In remote setup we can only use a readl to the memory to assure the full
    write has occurred.

    Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA")
    Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
    Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
    Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-5-8e8c1acb7a46@bootlin.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3cafc9aa7afb9f5d2996083aa5cabbef75e89083
Author: Kory Maincent <kory.maincent@bootlin.com>
Date:   Mon Jan 29 17:26:00 2024 +0100

    dmaengine: dw-edma: Add HDMA remote interrupt configuration

    [ Upstream commit e2f6a5789051ee9c632f27a12d0f01f0cbf78aac ]

    Only the local interruption was configured, remote interrupt was left
    behind. This patch fix it by setting stop and abort remote interrupts when
    the DW_EDMA_CHIP_LOCAL flag is not set.

    Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA")
    Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
    Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
    Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-4-8e8c1acb7a46@bootlin.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit fda7855f46bad4601147b7361aa37dd86dec3d40
Author: Kory Maincent <kory.maincent@bootlin.com>
Date:   Mon Jan 29 17:25:59 2024 +0100

    dmaengine: dw-edma: HDMA_V0_REMOTEL_STOP_INT_EN typo fix

    [ Upstream commit 930a8a015dcfde4b8906351ff081066dc277748c ]

    Fix "HDMA_V0_REMOTEL_STOP_INT_EN" typo error

    Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA")
    Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
    Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
    Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-3-8e8c1acb7a46@bootlin.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3ae8e5fdd92a06ffa6b0f6af3c1292243664438f
Author: Kory Maincent <kory.maincent@bootlin.com>
Date:   Mon Jan 29 17:25:58 2024 +0100

    dmaengine: dw-edma: Fix wrong interrupt bit set for HDMA

    [ Upstream commit 7b52ba8616e978bf4f38f207f11a8176517244d0 ]

    Instead of setting HDMA_V0_LOCAL_ABORT_INT_EN bit, HDMA_V0_LOCAL_STOP_INT_EN
    bit got set twice, due to which the abort interrupt is not getting generated for
    HDMA. Fix it by setting the correct interrupt enable bit.

    Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA")
    Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
    Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
    Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-2-8e8c1acb7a46@bootlin.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8fdc7f1d5b4aa76e56b871948c0a46fdda844426
Author: Kory Maincent <kory.maincent@bootlin.com>
Date:   Mon Jan 29 17:25:57 2024 +0100

    dmaengine: dw-edma: Fix the ch_count hdma callback

    [ Upstream commit cd665bfc757c71e9b7e0abff0f362d8abd38a805 ]

    The current check of ch_en enabled to know the maximum number of available
    hardware channels is wrong as it check the number of ch_en register set
    but all of them are unset at probe. This register is set at the
    dw_hdma_v0_core_start function which is run lately before a DMA transfer.

    The HDMA IP have no way to know the number of hardware channels available
    like the eDMA IP, then let set it to maximum channels and let the platform
    set the right number of channels.

    Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA")
    Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
    Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
    Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-1-8e8c1acb7a46@bootlin.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 67c8cf1207687f4951e464511100bf26d688a6a6
Author: Dan Carpenter <dan.carpenter@linaro.org>
Date:   Mon Feb 5 15:44:30 2024 +0300

    ASoC: cs35l56: fix reversed if statement in cs35l56_dspwait_asp1tx_put()

    commit 4703b014f28bf7a2e56d1da238ee95ef6c5ce76b upstream.

    It looks like the "!" character was added accidentally.  The
    regmap_update_bits_check() function is normally going to succeed.  This
    means the rest of the function is unreachable and we don't handle the
    situation where "changed" is true correctly.

    Fixes: 07f7d6e7a124 ("ASoC: cs35l56: Fix for initializing ASP1 mixer registers")
    Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
    Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
    Link: https://lore.kernel.org/r/0c254c07-d1c0-4a5c-a22b-7e135cab032c@moroto.mountain
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 43ba9e331559a30000c862eea313248707afa787
Author: Kuniyuki Iwashima <kuniyu@amazon.com>
Date:   Mon Feb 19 09:46:57 2024 -0800

    af_unix: Drop oob_skb ref before purging queue in GC.

    commit aa82ac51d63328714645c827775d64dbfd9941f3 upstream.

    syzbot reported another task hung in __unix_gc().  [0]

    The current while loop assumes that all of the left candidates
    have oob_skb and calling kfree_skb(oob_skb) releases the remaining
    candidates.

    However, I missed a case that oob_skb has self-referencing fd and
    another fd and the latter sk is placed before the former in the
    candidate list.  Then, the while loop never proceeds, resulting
    the task hung.

    __unix_gc() has the same loop just before purging the collected skb,
    so we can call kfree_skb(oob_skb) there and let __skb_queue_purge()
    release all inflight sockets.

    [0]:
    Sending NMI from CPU 0 to CPUs 1:
    NMI backtrace for cpu 1
    CPU: 1 PID: 2784 Comm: kworker/u4:8 Not tainted 6.8.0-rc4-syzkaller-01028-g71b605d32017 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
    Workqueue: events_unbound __unix_gc
    RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:200
    Code: 89 fb e8 23 00 00 00 48 8b 3d 84 f5 1a 0c 48 89 de 5b e9 43 26 57 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 48 8b 04 24 65 48 8b 0d 90 52 70 7e 65 8b 15 91 52 70
    RSP: 0018:ffffc9000a17fa78 EFLAGS: 00000287
    RAX: ffffffff8a0a6108 RBX: ffff88802b6c2640 RCX: ffff88802c0b3b80
    RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
    RBP: ffffc9000a17fbf0 R08: ffffffff89383f1d R09: 1ffff1100ee5ff84
    R10: dffffc0000000000 R11: ffffed100ee5ff85 R12: 1ffff110056d84ee
    R13: ffffc9000a17fae0 R14: 0000000000000000 R15: ffffffff8f47b840
    FS:  0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007ffef5687ff8 CR3: 0000000029b34000 CR4: 00000000003506f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
     <NMI>
     </NMI>
     <TASK>
     __unix_gc+0xe69/0xf40 net/unix/garbage.c:343
     process_one_work kernel/workqueue.c:2633 [inline]
     process_scheduled_works+0x913/0x1420 kernel/workqueue.c:2706
     worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787
     kthread+0x2ef/0x390 kernel/kthread.c:388
     ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
     ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
     </TASK>

    Reported-and-tested-by: syzbot+ecab4d36f920c3574bf9@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=ecab4d36f920c3574bf9
    Fixes: 25236c91b5ab ("af_unix: Fix task hung while purging oob_skb in GC.")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cb8890318dde26fc89c6ea67d6e9070ab50b6e91
Author: Kuniyuki Iwashima <kuniyu@amazon.com>
Date:   Fri Feb 9 14:04:53 2024 -0800

    af_unix: Fix task hung while purging oob_skb in GC.

    commit 25236c91b5ab4a26a56ba2e79b8060cf4e047839 upstream.

    syzbot reported a task hung; at the same time, GC was looping infinitely
    in list_for_each_entry_safe() for OOB skb.  [0]

    syzbot demonstrated that the list_for_each_entry_safe() was not actually
    safe in this case.

    A single skb could have references for multiple sockets.  If we free such
    a skb in the list_for_each_entry_safe(), the current and next sockets could
    be unlinked in a single iteration.

    unix_notinflight() uses list_del_init() to unlink the socket, so the
    prefetched next socket forms a loop itself and list_for_each_entry_safe()
    never stops.

    Here, we must use while() and make sure we always fetch the first socket.

    [0]:
    Sending NMI from CPU 0 to CPUs 1:
    NMI backtrace for cpu 1
    CPU: 1 PID: 5065 Comm: syz-executor236 Not tainted 6.8.0-rc3-syzkaller-00136-g1f719a2f3fa6 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
    RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:26 [inline]
    RIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline]
    RIP: 0010:__sanitizer_cov_trace_pc+0xd/0x60 kernel/kcov.c:207
    Code: cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 65 48 8b 14 25 40 c2 03 00 <65> 8b 05 b4 7c 78 7e a9 00 01 ff 00 48 8b 34 24 74 0f f6 c4 01 74
    RSP: 0018:ffffc900033efa58 EFLAGS: 00000283
    RAX: ffff88807b077800 RBX: ffff88807b077800 RCX: 1ffffffff27b1189
    RDX: ffff88802a5a3b80 RSI: ffffffff8968488d RDI: ffff88807b077f70
    RBP: ffffc900033efbb0 R08: 0000000000000001 R09: fffffbfff27a900c
    R10: ffffffff93d48067 R11: ffffffff8ae000eb R12: ffff88807b077800
    R13: dffffc0000000000 R14: ffff88807b077e40 R15: 0000000000000001
    FS:  0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000564f4fc1e3a8 CR3: 000000000d57a000 CR4: 00000000003506f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
     <NMI>
     </NMI>
     <TASK>
     unix_gc+0x563/0x13b0 net/unix/garbage.c:319
     unix_release_sock+0xa93/0xf80 net/unix/af_unix.c:683
     unix_release+0x91/0xf0 net/unix/af_unix.c:1064
     __sock_release+0xb0/0x270 net/socket.c:659
     sock_close+0x1c/0x30 net/socket.c:1421
     __fput+0x270/0xb80 fs/file_table.c:376
     task_work_run+0x14f/0x250 kernel/task_work.c:180
     exit_task_work include/linux/task_work.h:38 [inline]
     do_exit+0xa8a/0x2ad0 kernel/exit.c:871
     do_group_exit+0xd4/0x2a0 kernel/exit.c:1020
     __do_sys_exit_group kernel/exit.c:1031 [inline]
     __se_sys_exit_group kernel/exit.c:1029 [inline]
     __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1029
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x6f/0x77
    RIP: 0033:0x7f9d6cbdac09
    Code: Unable to access opcode bytes at 0x7f9d6cbdabdf.
    RSP: 002b:00007fff5952feb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
    RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9d6cbdac09
    RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
    RBP: 00007f9d6cc552b0 R08: ffffffffffffffb8 R09: 0000000000000006
    R10: 0000000000000006 R11: 0000000000000246 R12: 00007f9d6cc552b0
    R13: 0000000000000000 R14: 00007f9d6cc55d00 R15: 00007f9d6cbabe70
     </TASK>

    Reported-by: syzbot+4fa4a2d1f5a5ee06f006@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=4fa4a2d1f5a5ee06f006
    Fixes: 1279f9d9dec2 ("af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Link: https://lore.kernel.org/r/20240209220453.96053-1-kuniyu@amazon.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5fa917a67a03451cded859349249b8b7d08c3865
Author: NeilBrown <neilb@suse.de>
Date:   Wed Feb 28 10:23:31 2024 +1100

    NFS: Fix data corruption caused by congestion.

    when AOP_WRITEPAGE_ACTIVATE is returned (as NFS does when it detects
    congestion) it is important that the folio is redirtied.
    nfs_writepage_locked() doesn't do this, so files can become corrupted as
    writes can be lost.

    Note that this is not needed in v6.8 as AOP_WRITEPAGE_ACTIVATE cannot be
    returned.  It is needed for kernels v5.18..v6.7.  Prior to 6.3 the patch
    is different as it needs to mention "page", not "folio".

    Reported-and-tested-by: Jacek Tomaka <Jacek.Tomaka@poczta.fm>
    Fixes: 6df25e58532b ("nfs: remove reliance on bdi congestion")
    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c9633fcb4dbcd4d5f4f25380e5cccb289a33cdd9
Author: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Date:   Sun Oct 29 13:48:43 2023 +0200

    mfd: twl6030-irq: Revert to use of_match_device()

    commit 7a29fa05aeca2c16193f00a883c56ffc7c25b6c5 upstream.

    The core twl chip is probed via i2c and the dev->driver->of_match_table is
    NULL, causing the driver to fail to probe.

    This partially reverts:

      commit 1e0c866887f4 ("mfd: Use device_get_match_data() in a bunch of drivers")

    Fixes: 1e0c866887f4 ("mfd: Use device_get_match_data() in a bunch of drivers")
    Signed-off-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
    Link: https://lore.kernel.org/r/20231029114843.15553-1-peter.ujfalusi@gmail.com
    Signed-off-by: Lee Jones <lee@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d487e7ba1bc7444d5f062c4930ef8436c47c7e63
Author: Paolo Abeni <pabeni@redhat.com>
Date:   Fri Feb 23 17:14:19 2024 +0100

    mptcp: fix possible deadlock in subflow diag

    commit d6a9608af9a75d13243d217f6ce1e30e57d56ffe upstream.

    Syzbot and Eric reported a lockdep splat in the subflow diag:

       WARNING: possible circular locking dependency detected
       6.8.0-rc4-syzkaller-00212-g40b9385dd8e6 #0 Not tainted

       syz-executor.2/24141 is trying to acquire lock:
       ffff888045870130 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at:
       tcp_diag_put_ulp net/ipv4/tcp_diag.c:100 [inline]
       ffff888045870130 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at:
       tcp_diag_get_aux+0x738/0x830 net/ipv4/tcp_diag.c:137

       but task is already holding lock:
       ffffc9000135e488 (&h->lhash2[i].lock){+.+.}-{2:2}, at: spin_lock
       include/linux/spinlock.h:351 [inline]
       ffffc9000135e488 (&h->lhash2[i].lock){+.+.}-{2:2}, at:
       inet_diag_dump_icsk+0x39f/0x1f80 net/ipv4/inet_diag.c:1038

       which lock already depends on the new lock.

       the existing dependency chain (in reverse order) is:

       -> #1 (&h->lhash2[i].lock){+.+.}-{2:2}:
       lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
       __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
       _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
       spin_lock include/linux/spinlock.h:351 [inline]
       __inet_hash+0x335/0xbe0 net/ipv4/inet_hashtables.c:743
       inet_csk_listen_start+0x23a/0x320 net/ipv4/inet_connection_sock.c:1261
       __inet_listen_sk+0x2a2/0x770 net/ipv4/af_inet.c:217
       inet_listen+0xa3/0x110 net/ipv4/af_inet.c:239
       rds_tcp_listen_init+0x3fd/0x5a0 net/rds/tcp_listen.c:316
       rds_tcp_init_net+0x141/0x320 net/rds/tcp.c:577
       ops_init+0x352/0x610 net/core/net_namespace.c:136
       __register_pernet_operations net/core/net_namespace.c:1214 [inline]
       register_pernet_operations+0x2cb/0x660 net/core/net_namespace.c:1283
       register_pernet_device+0x33/0x80 net/core/net_namespace.c:1370
       rds_tcp_init+0x62/0xd0 net/rds/tcp.c:735
       do_one_initcall+0x238/0x830 init/main.c:1236
       do_initcall_level+0x157/0x210 init/main.c:1298
       do_initcalls+0x3f/0x80 init/main.c:1314
       kernel_init_freeable+0x42f/0x5d0 init/main.c:1551
       kernel_init+0x1d/0x2a0 init/main.c:1441
       ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242

       -> #0 (k-sk_lock-AF_INET6){+.+.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3134 [inline]
       check_prevs_add kernel/locking/lockdep.c:3253 [inline]
       validate_chain+0x18ca/0x58e0 kernel/locking/lockdep.c:3869
       __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137
       lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
       lock_sock_fast include/net/sock.h:1723 [inline]
       subflow_get_info+0x166/0xd20 net/mptcp/diag.c:28
       tcp_diag_put_ulp net/ipv4/tcp_diag.c:100 [inline]
       tcp_diag_get_aux+0x738/0x830 net/ipv4/tcp_diag.c:137
       inet_sk_diag_fill+0x10ed/0x1e00 net/ipv4/inet_diag.c:345
       inet_diag_dump_icsk+0x55b/0x1f80 net/ipv4/inet_diag.c:1061
       __inet_diag_dump+0x211/0x3a0 net/ipv4/inet_diag.c:1263
       inet_diag_dump_compat+0x1c1/0x2d0 net/ipv4/inet_diag.c:1371
       netlink_dump+0x59b/0xc80 net/netlink/af_netlink.c:2264
       __netlink_dump_start+0x5df/0x790 net/netlink/af_netlink.c:2370
       netlink_dump_start include/linux/netlink.h:338 [inline]
       inet_diag_rcv_msg_compat+0x209/0x4c0 net/ipv4/inet_diag.c:1405
       sock_diag_rcv_msg+0xe7/0x410
       netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543
       sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:280
       netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
       netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367
       netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908
       sock_sendmsg_nosec net/socket.c:730 [inline]
       __sock_sendmsg+0x221/0x270 net/socket.c:745
       ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584
       ___sys_sendmsg net/socket.c:2638 [inline]
       __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
       do_syscall_64+0xf9/0x240
       entry_SYSCALL_64_after_hwframe+0x6f/0x77

    As noted by Eric we can break the lock dependency chain avoid
    dumping any extended info for the mptcp subflow listener:
    nothing actually useful is presented there.

    Fixes: b8adb69a7d29 ("mptcp: fix lockless access in subflow ULP diag")
    Cc: stable@vger.kernel.org
    Reported-by: Eric Dumazet <edumazet@google.com>
    Closes: https://lore.kernel.org/netdev/CANn89iJ=Oecw6OZDwmSYc9HJKQ_G32uN11L+oUcMu+TOD5Xiaw@mail.gmail.com/
    Suggested-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-9-162e87e48497@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 85933e80d077c9ae2227226beb86c22f464059cc
Author: Davide Caratti <dcaratti@redhat.com>
Date:   Fri Feb 23 17:14:18 2024 +0100

    mptcp: fix double-free on socket dismantle

    commit 10048689def7e40a4405acda16fdc6477d4ecc5c upstream.

    when MPTCP server accepts an incoming connection, it clones its listener
    socket. However, the pointer to 'inet_opt' for the new socket has the same
    value as the original one: as a consequence, on program exit it's possible
    to observe the following splat:

      BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0
      Free of addr ffff888485950880 by task swapper/25/0

      CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609
      Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0  07/26/2013
      Call Trace:
       <IRQ>
       dump_stack_lvl+0x32/0x50
       print_report+0xca/0x620
       kasan_report_invalid_free+0x64/0x90
       __kasan_slab_free+0x1aa/0x1f0
       kfree+0xed/0x2e0
       inet_sock_destruct+0x54f/0x8b0
       __sk_destruct+0x48/0x5b0
       rcu_do_batch+0x34e/0xd90
       rcu_core+0x559/0xac0
       __do_softirq+0x183/0x5a4
       irq_exit_rcu+0x12d/0x170
       sysvec_apic_timer_interrupt+0x6b/0x80
       </IRQ>
       <TASK>
       asm_sysvec_apic_timer_interrupt+0x16/0x20
      RIP: 0010:cpuidle_enter_state+0x175/0x300
      Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed <0f> 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b
      RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202
      RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000
      RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588
      RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080
      R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0
      R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80
       cpuidle_enter+0x4a/0xa0
       do_idle+0x310/0x410
       cpu_startup_entry+0x51/0x60
       start_secondary+0x211/0x270
       secondary_startup_64_no_verify+0x184/0x18b
       </TASK>

      Allocated by task 6853:
       kasan_save_stack+0x1c/0x40
       kasan_save_track+0x10/0x30
       __kasan_kmalloc+0xa6/0xb0
       __kmalloc+0x1eb/0x450
       cipso_v4_sock_setattr+0x96/0x360
       netlbl_sock_setattr+0x132/0x1f0
       selinux_netlbl_socket_post_create+0x6c/0x110
       selinux_socket_post_create+0x37b/0x7f0
       security_socket_post_create+0x63/0xb0
       __sock_create+0x305/0x450
       __sys_socket_create.part.23+0xbd/0x130
       __sys_socket+0x37/0xb0
       __x64_sys_socket+0x6f/0xb0
       do_syscall_64+0x83/0x160
       entry_SYSCALL_64_after_hwframe+0x6e/0x76

      Freed by task 6858:
       kasan_save_stack+0x1c/0x40
       kasan_save_track+0x10/0x30
       kasan_save_free_info+0x3b/0x60
       __kasan_slab_free+0x12c/0x1f0
       kfree+0xed/0x2e0
       inet_sock_destruct+0x54f/0x8b0
       __sk_destruct+0x48/0x5b0
       subflow_ulp_release+0x1f0/0x250
       tcp_cleanup_ulp+0x6e/0x110
       tcp_v4_destroy_sock+0x5a/0x3a0
       inet_csk_destroy_sock+0x135/0x390
       tcp_fin+0x41…
love4taylor added a commit to love4taylor/linux-clear-deb that referenced this issue Mar 6, 2024
commit 2e7cdd29fc42c410eab52fffe5710bf656619222
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Wed Mar 6 14:54:01 2024 +0000

    Linux 6.7.9

    Link: https://lore.kernel.org/r/20240304211551.833500257@linuxfoundation.org
    Tested-by: SeongJae Park <sj@kernel.org>
    Tested-by: Luna Jernberg <droidbittin@gmail.com>
    Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
    Tested-by: Ronald Warsow <rwarsow@gmx.de>
    Tested-by: Salvatore Bonaccorso <carnil@debian.org>
    Tested-by: Shuah Khan <skhan@linuxfoundation.org>
    Link: https://lore.kernel.org/r/20240305074649.580820283@linuxfoundation.org
    Tested-by: Luna Jernberg <droidbittin@gmail.com>
    Tested-by: Jon Hunter <jonathanh@nvidia.com>
    Link: https://lore.kernel.org/r/20240305112824.448003471@linuxfoundation.org
    Tested-by: Luna Jernberg <droidbittin@gmail.com>
    Tested-by: Ron Economos <re@w6rz.net>
    Tested-by: Pavel Machek (CIP) <pavel@denx.de>
    Tested-by: Jon Hunter <jonathanh@nvidia.com>
    Tested-by: Ronald Warsow <rwarsow@gmx.de>
    Tested-by: Ricardo B. Marliere <ricardo@marliere.net>
    Tested-by: Justin M. Forbes <jforbes@fedoraproject.org>
    Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7bf08643b2536d00d84504874551b36e8f996639
Author: Danilo Krummrich <dakr@redhat.com>
Date:   Mon Mar 4 18:01:46 2024 +0100

    drm/nouveau: don't fini scheduler before entity flush

    This bug is present in v6.7 only, since the scheduler design has been
    re-worked in v6.8.

    Client scheduler entities must be flushed before an associated GPU
    scheduler is teared down. Otherwise the entitiy might still hold a
    pointer to the scheduler's runqueue which is freed at scheduler tear
    down already.

    [  305.224293] ==================================================================
    [  305.224297] BUG: KASAN: slab-use-after-free in drm_sched_entity_flush+0x6c4/0x7b0 [gpu_sched]
    [  305.224310] Read of size 8 at addr ffff8881440a8f48 by task rmmod/4436

    [  305.224317] CPU: 10 PID: 4436 Comm: rmmod Tainted: G     U             6.7.6-100.fc38.x86_64+debug #1
    [  305.224321] Hardware name: Dell Inc. Precision 7550/01PXFR, BIOS 1.27.0 11/08/2023
    [  305.224324] Call Trace:
    [  305.224327]  <TASK>
    [  305.224329]  dump_stack_lvl+0x76/0xd0
    [  305.224336]  print_report+0xcf/0x670
    [  305.224342]  ? drm_sched_entity_flush+0x6c4/0x7b0 [gpu_sched]
    [  305.224352]  ? __virt_addr_valid+0x215/0x410
    [  305.224359]  ? drm_sched_entity_flush+0x6c4/0x7b0 [gpu_sched]
    [  305.224368]  kasan_report+0xa6/0xe0
    [  305.224373]  ? drm_sched_entity_flush+0x6c4/0x7b0 [gpu_sched]
    [  305.224385]  drm_sched_entity_flush+0x6c4/0x7b0 [gpu_sched]
    [  305.224395]  ? __pfx_drm_sched_entity_flush+0x10/0x10 [gpu_sched]
    [  305.224406]  ? rcu_is_watching+0x15/0xb0
    [  305.224413]  drm_sched_entity_destroy+0x17/0x20 [gpu_sched]
    [  305.224422]  nouveau_cli_fini+0x6c/0x120 [nouveau]
    [  305.224658]  nouveau_drm_device_fini+0x2ac/0x490 [nouveau]
    [  305.224871]  nouveau_drm_remove+0x18e/0x220 [nouveau]
    [  305.225082]  ? __pfx_nouveau_drm_remove+0x10/0x10 [nouveau]
    [  305.225290]  ? rcu_is_watching+0x15/0xb0
    [  305.225295]  ? _raw_spin_unlock_irqrestore+0x66/0x80
    [  305.225299]  ? trace_hardirqs_on+0x16/0x100
    [  305.225304]  ? _raw_spin_unlock_irqrestore+0x4f/0x80
    [  305.225310]  pci_device_remove+0xa3/0x1d0
    [  305.225316]  device_release_driver_internal+0x379/0x540
    [  305.225322]  driver_detach+0xc5/0x180
    [  305.225327]  bus_remove_driver+0x11e/0x2a0
    [  305.225333]  pci_unregister_driver+0x2a/0x250
    [  305.225339]  nouveau_drm_exit+0x1f/0x970 [nouveau]
    [  305.225548]  __do_sys_delete_module+0x350/0x580
    [  305.225554]  ? __pfx___do_sys_delete_module+0x10/0x10
    [  305.225562]  ? syscall_enter_from_user_mode+0x26/0x90
    [  305.225567]  ? rcu_is_watching+0x15/0xb0
    [  305.225571]  ? syscall_enter_from_user_mode+0x26/0x90
    [  305.225575]  ? trace_hardirqs_on+0x16/0x100
    [  305.225580]  do_syscall_64+0x61/0xe0
    [  305.225584]  ? rcu_is_watching+0x15/0xb0
    [  305.225587]  ? syscall_exit_to_user_mode+0x1f/0x50
    [  305.225592]  ? trace_hardirqs_on_prepare+0xe3/0x100
    [  305.225596]  ? do_syscall_64+0x70/0xe0
    [  305.225600]  ? trace_hardirqs_on_prepare+0xe3/0x100
    [  305.225604]  entry_SYSCALL_64_after_hwframe+0x6e/0x76
    [  305.225609] RIP: 0033:0x7f6148f3592b
    [  305.225650] Code: 73 01 c3 48 8b 0d dd 04 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ad 04 0c 00 f7 d8 64 89 01 48
    [  305.225653] RSP: 002b:00007ffe89986f08 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
    [  305.225659] RAX: ffffffffffffffda RBX: 000055cbb036e900 RCX: 00007f6148f3592b
    [  305.225662] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055cbb036e968
    [  305.225664] RBP: 00007ffe89986f30 R08: 1999999999999999 R09: 0000000000000000
    [  305.225667] R10: 00007f6148fa6ac0 R11: 0000000000000206 R12: 0000000000000000
    [  305.225670] R13: 00007ffe89987190 R14: 000055cbb036e900 R15: 0000000000000000
    [  305.225678]  </TASK>

    [  305.225683] Allocated by task 484:
    [  305.225685]  kasan_save_stack+0x33/0x60
    [  305.225690]  kasan_set_track+0x25/0x30
    [  305.225693]  __kasan_kmalloc+0x8f/0xa0
    [  305.225696]  drm_sched_init+0x3c7/0xce0 [gpu_sched]
    [  305.225705]  nouveau_sched_init+0xd2/0x110 [nouveau]
    [  305.225913]  nouveau_drm_device_init+0x130/0x3290 [nouveau]
    [  305.226121]  nouveau_drm_probe+0x1ab/0x6b0 [nouveau]
    [  305.226329]  local_pci_probe+0xda/0x190
    [  305.226333]  pci_device_probe+0x23a/0x780
    [  305.226337]  really_probe+0x3df/0xb80
    [  305.226341]  __driver_probe_device+0x18c/0x450
    [  305.226345]  driver_probe_device+0x4a/0x120
    [  305.226348]  __driver_attach+0x1e5/0x4a0
    [  305.226351]  bus_for_each_dev+0x106/0x190
    [  305.226355]  bus_add_driver+0x2a1/0x570
    [  305.226358]  driver_register+0x134/0x460
    [  305.226361]  do_one_initcall+0xd3/0x430
    [  305.226366]  do_init_module+0x238/0x770
    [  305.226370]  load_module+0x5581/0x6f10
    [  305.226374]  __do_sys_init_module+0x1f2/0x220
    [  305.226377]  do_syscall_64+0x61/0xe0
    [  305.226381]  entry_SYSCALL_64_after_hwframe+0x6e/0x76

    [  305.226387] Freed by task 4436:
    [  305.226389]  kasan_save_stack+0x33/0x60
    [  305.226392]  kasan_set_track+0x25/0x30
    [  305.226396]  kasan_save_free_info+0x2b/0x50
    [  305.226399]  __kasan_slab_free+0x10b/0x1a0
    [  305.226402]  slab_free_freelist_hook+0x12b/0x1e0
    [  305.226406]  __kmem_cache_free+0xd4/0x1d0
    [  305.226410]  drm_sched_fini+0x178/0x320 [gpu_sched]
    [  305.226418]  nouveau_drm_device_fini+0x2a0/0x490 [nouveau]
    [  305.226624]  nouveau_drm_remove+0x18e/0x220 [nouveau]
    [  305.226832]  pci_device_remove+0xa3/0x1d0
    [  305.226836]  device_release_driver_internal+0x379/0x540
    [  305.226840]  driver_detach+0xc5/0x180
    [  305.226843]  bus_remove_driver+0x11e/0x2a0
    [  305.226847]  pci_unregister_driver+0x2a/0x250
    [  305.226850]  nouveau_drm_exit+0x1f/0x970 [nouveau]
    [  305.227056]  __do_sys_delete_module+0x350/0x580
    [  305.227060]  do_syscall_64+0x61/0xe0
    [  305.227064]  entry_SYSCALL_64_after_hwframe+0x6e/0x76

    [  305.227070] The buggy address belongs to the object at ffff8881440a8f00
                    which belongs to the cache kmalloc-128 of size 128
    [  305.227073] The buggy address is located 72 bytes inside of
                    freed 128-byte region [ffff8881440a8f00, ffff8881440a8f80)

    [  305.227078] The buggy address belongs to the physical page:
    [  305.227081] page:00000000627efa0a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1440a8
    [  305.227085] head:00000000627efa0a order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0
    [  305.227088] flags: 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
    [  305.227093] page_type: 0xffffffff()
    [  305.227097] raw: 0017ffffc0000840 ffff8881000428c0 ffffea0005b33500 dead000000000002
    [  305.227100] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000
    [  305.227102] page dumped because: kasan: bad access detected

    [  305.227106] Memory state around the buggy address:
    [  305.227109]  ffff8881440a8e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    [  305.227112]  ffff8881440a8e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    [  305.227114] >ffff8881440a8f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    [  305.227117]                                               ^
    [  305.227120]  ffff8881440a8f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    [  305.227122]  ffff8881440a9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
    [  305.227125] ==================================================================

    Cc: <stable@vger.kernel.org> # v6.7 only
    Reported-by: Karol Herbst <kherbst@redhat.com>
    Closes: https://gist.githubusercontent.com/karolherbst/a20eb0f937a06ed6aabe2ac2ca3d11b5/raw/9cd8b1dc5894872d0eeebbee3dd0fdd28bb576bc/gistfile1.txt
    Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI")
    Signed-off-by: Danilo Krummrich <dakr@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7dfd52829f9db2d7d0691807dad55363f2179fcd
Author: Geliang Tang <tanggeliang@kylinos.cn>
Date:   Mon Mar 4 14:38:33 2024 +0100

    selftests: mptcp: rm subflow with v4/v4mapped addr

    commit 7092dbee23282b6fcf1313fc64e2b92649ee16e8 upstream.

    Now both a v4 address and a v4-mapped address are supported when
    destroying a userspace pm subflow, this patch adds a second subflow
    to "userspace pm add & remove address" test, and two subflows could
    be removed two different ways, one with the v4mapped and one with v4.

    Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/387
    Fixes: 48d73f609dcc ("selftests: mptcp: update userspace pm addr tests")
    Cc: stable@vger.kernel.org
    Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
    Reviewed-by: Mat Martineau <martineau@kernel.org>
    Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-2-162e87e48497@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 371efc293e96c54b6e035c18fe6c7d77a84a8c0c
Author: Geliang Tang <geliang@kernel.org>
Date:   Mon Mar 4 14:38:32 2024 +0100

    selftests: mptcp: add mptcp_lib_is_v6

    commit b850f2c7dd85ecd14a333685c4ffd23f12665e94 upstream.

    To avoid duplicated code in different MPTCP selftests, we can add
    and use helpers defined in mptcp_lib.sh.

    is_v6() helper is defined in mptcp_connect.sh, mptcp_join.sh and
    mptcp_sockopt.sh, so export it into mptcp_lib.sh and rename it as
    mptcp_lib_is_v6(). Use this new helper in all scripts.

    Reviewed-by: Matthieu Baerts <matttbe@kernel.org>
    Signed-off-by: Geliang Tang <geliang.tang@suse.com>
    Signed-off-by: Mat Martineau <martineau@kernel.org>
    Link: https://lore.kernel.org/r/20231128-send-net-next-2023107-v4-10-8d6b94150f6b@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 42f42773fe7171b9a7f600212c66af7a82d6d3e1
Author: Geliang Tang <geliang@kernel.org>
Date:   Mon Mar 4 14:38:31 2024 +0100

    selftests: mptcp: update userspace pm test helpers

    commit 757c828ce94905a2975873d5e90a376c701b2b90 upstream.

    This patch adds a new argument namespace to userspace_pm_add_addr() and
    userspace_pm_add_sf() to make these two helper more versatile.

    Add two more versatile helpers for userspace pm remove subflow or address:
    userspace_pm_rm_addr() and userspace_pm_rm_sf(). The original test helpers
    userspace_pm_rm_sf_addr_ns1() and userspace_pm_rm_sf_addr_ns2() can be
    replaced by these new helpers.

    Reviewed-by: Matthieu Baerts <matttbe@kernel.org>
    Signed-off-by: Geliang Tang <geliang.tang@suse.com>
    Signed-off-by: Mat Martineau <martineau@kernel.org>
    Link: https://lore.kernel.org/r/20231128-send-net-next-2023107-v4-4-8d6b94150f6b@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 16ac627e93b2788dddda2ac2c69e6182fa78b8d2
Author: Geliang Tang <geliang@kernel.org>
Date:   Mon Mar 4 14:38:30 2024 +0100

    selftests: mptcp: add chk_subflows_total helper

    commit 80775412882e273b8ef62124fae861cde8e6fb3d upstream.

    This patch adds a new helper chk_subflows_total(), in it use the newly
    added counter mptcpi_subflows_total to get the "correct" amount of
    subflows, including the initial one.

    To be compatible with old 'ss' or kernel versions not supporting this
    counter, get the total subflows by listing TCP connections that are
    MPTCP subflows:

        ss -ti state state established state syn-sent state syn-recv |
            grep -c tcp-ulp-mptcp.

    Reviewed-by: Matthieu Baerts <matttbe@kernel.org>
    Signed-off-by: Geliang Tang <geliang.tang@suse.com>
    Signed-off-by: Mat Martineau <martineau@kernel.org>
    Link: https://lore.kernel.org/r/20231128-send-net-next-2023107-v4-3-8d6b94150f6b@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 21dada9b05f2f8decb6926f3e8fc9e6f7ed165fb
Author: Geliang Tang <geliang@kernel.org>
Date:   Mon Mar 4 14:38:29 2024 +0100

    selftests: mptcp: add evts_get_info helper

    commit 06848c0f341ee3f9226ed01e519c72e4d2b6f001 upstream.

    This patch adds a new helper get_info_value(), using 'sed' command to
    parse the value of the given item name in the line with the given keyword,
    to make chk_mptcp_info() and pedit_action_pkts() more readable.

    Also add another helper evts_get_info() to use get_info_value() to parse
    the output of 'pm_nl_ctl events' command, to make all the userspace pm
    selftests more readable, both in mptcp_join.sh and userspace_pm.sh.

    Reviewed-by: Matthieu Baerts <matttbe@kernel.org>
    Signed-off-by: Geliang Tang <geliang.tang@suse.com>
    Signed-off-by: Mat Martineau <martineau@kernel.org>
    Link: https://lore.kernel.org/r/20231128-send-net-next-2023107-v4-2-8d6b94150f6b@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5287a535bd692b21f584af5d51df388ba7473590
Author: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date:   Sun Mar 3 20:24:30 2024 -0800

    KVM/VMX: Move VERW closer to VMentry for MDS mitigation

    commit 43fb862de8f628c5db5e96831c915b9aebf62d33 upstream.

    During VMentry VERW is executed to mitigate MDS. After VERW, any memory
    access like register push onto stack may put host data in MDS affected
    CPU buffers. A guest can then use MDS to sample host data.

    Although likelihood of secrets surviving in registers at current VERW
    callsite is less, but it can't be ruled out. Harden the MDS mitigation
    by moving the VERW mitigation late in VMentry path.

    Note that VERW for MMIO Stale Data mitigation is unchanged because of
    the complexity of per-guest conditional VERW which is not easy to handle
    that late in asm with no GPRs available. If the CPU is also affected by
    MDS, VERW is unconditionally executed late in asm regardless of guest
    having MMIO access.

    Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
    Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    Acked-by: Sean Christopherson <seanjc@google.com>
    Link: https://lore.kernel.org/all/20240213-delay-verw-v8-6-a6216d83edb7%40linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fe815656d87f443d75d69e7c48429dce3001c466
Author: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date:   Sun Mar 3 20:24:24 2024 -0800

    KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH

    From: Sean Christopherson <seanjc@google.com>

    commit 706a189dcf74d3b3f955e9384785e726ed6c7c80 upstream.

    Use EFLAGS.CF instead of EFLAGS.ZF to track whether to use VMRESUME versus
    VMLAUNCH.  Freeing up EFLAGS.ZF will allow doing VERW, which clobbers ZF,
    for MDS mitigations as late as possible without needing to duplicate VERW
    for both paths.

    Signed-off-by: Sean Christopherson <seanjc@google.com>
    Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
    Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>
    Link: https://lore.kernel.org/all/20240213-delay-verw-v8-5-a6216d83edb7%40linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f8ecc210fd37011956d92937e9e8c7c93ad55db7
Author: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date:   Sun Mar 3 20:24:19 2024 -0800

    x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key

    commit 6613d82e617dd7eb8b0c40b2fe3acea655b1d611 upstream.

    The VERW mitigation at exit-to-user is enabled via a static branch
    mds_user_clear. This static branch is never toggled after boot, and can
    be safely replaced with an ALTERNATIVE() which is convenient to use in
    asm.

    Switch to ALTERNATIVE() to use the VERW mitigation late in exit-to-user
    path. Also remove the now redundant VERW in exc_nmi() and
    arch_exit_to_user_mode().

    Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
    Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    Link: https://lore.kernel.org/all/20240213-delay-verw-v8-4-a6216d83edb7%40linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 51eca9f1fd047b500137d021f882d93f03280118
Author: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date:   Sun Mar 3 20:24:13 2024 -0800

    x86/entry_32: Add VERW just before userspace transition

    commit a0e2dab44d22b913b4c228c8b52b2a104434b0b3 upstream.

    As done for entry_64, add support for executing VERW late in exit to
    user path for 32-bit mode.

    Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
    Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    Link: https://lore.kernel.org/all/20240213-delay-verw-v8-3-a6216d83edb7%40linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2788b63256a8eba4bf47674db436b7bb5d32beea
Author: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date:   Sun Mar 3 20:24:07 2024 -0800

    x86/entry_64: Add VERW just before userspace transition

    commit 3c7501722e6b31a6e56edd23cea5e77dbb9ffd1a upstream.

    Mitigation for MDS is to use VERW instruction to clear any secrets in
    CPU Buffers. Any memory accesses after VERW execution can still remain
    in CPU buffers. It is safer to execute VERW late in return to user path
    to minimize the window in which kernel data can end up in CPU buffers.
    There are not many kernel secrets to be had after SWITCH_TO_USER_CR3.

    Add support for deploying VERW mitigation after user register state is
    restored. This helps minimize the chances of kernel data ending up into
    CPU buffers after executing VERW.

    Note that the mitigation at the new location is not yet enabled.

      Corner case not handled
      =======================
      Interrupts returning to kernel don't clear CPUs buffers since the
      exit-to-user path is expected to do that anyways. But, there could be
      a case when an NMI is generated in kernel after the exit-to-user path
      has cleared the buffers. This case is not handled and NMI returning to
      kernel don't clear CPU buffers because:

      1. It is rare to get an NMI after VERW, but before returning to userspace.
      2. For an unprivileged user, there is no known way to make that NMI
         less rare or target it.
      3. It would take a large number of these precisely-timed NMIs to mount
         an actual attack.  There's presumably not enough bandwidth.
      4. The NMI in question occurs after a VERW, i.e. when user state is
         restored and most interesting data is already scrubbed. Whats left
         is only the data that NMI touches, and that may or may not be of
         any interest.

      [ pawan: resolved conflict for hunk swapgs_restore_regs_and_return_to_usermode in backport ]

    Suggested-by: Dave Hansen <dave.hansen@intel.com>
    Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
    Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    Link: https://lore.kernel.org/all/20240213-delay-verw-v8-2-a6216d83edb7%40linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e4706e2d4b6b2d508106b7ea571c52f82e51aa6e
Author: Ming Lei <ming.lei@redhat.com>
Date:   Sun Feb 25 11:01:41 2024 +0800

    block: define bvec_iter as __packed __aligned(4)

    [ Upstream commit 7838b4656110d950afdd92a081cc0f33e23e0ea8 ]

    In commit 19416123ab3e ("block: define 'struct bvec_iter' as packed"),
    what we need is to save the 4byte padding, and avoid `bio` to spread on
    one extra cache line.

    It is enough to define it as '__packed __aligned(4)', as '__packed'
    alone means byte aligned, and can cause compiler to generate horrible
    code on architectures that don't support unaligned access in case that
    bvec_iter is embedded in other structures.

    Cc: Mikulas Patocka <mpatocka@redhat.com>
    Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
    Fixes: 19416123ab3e ("block: define 'struct bvec_iter' as packed")
    Signed-off-by: Ming Lei <ming.lei@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 44f0ce3318a5b8b5f81ccab7fa86239a84a738df
Author: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Date:   Thu Feb 29 18:25:49 2024 +0100

    gpio: fix resource unwinding order in error path

    [ Upstream commit ec5c54a9d3c4f9c15e647b049fea401ee5258696 ]

    Hogs are added *after* ACPI so should be removed *before* in error path.

    Fixes: a411e81e61df ("gpiolib: add hogs support for machine code")
    Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8ee9fb03cc792435de4740a50f51642ec0ad967a
Author: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date:   Wed Feb 21 21:28:46 2024 +0200

    gpiolib: Fix the error path order in gpiochip_add_data_with_key()

    [ Upstream commit e4aec4daa8c009057b5e063db1b7322252c92dc8 ]

    After shuffling the code, error path wasn't updated correctly.
    Fix it here.

    Fixes: 2f4133bb5f14 ("gpiolib: No need to call gpiochip_remove_pin_ranges() twice")
    Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8e51f26db6dbc1d78ca1529461c15778dd1674bc
Author: Arturas Moskvinas <arturas.moskvinas@gmail.com>
Date:   Fri Mar 1 09:12:04 2024 +0200

    gpio: 74x164: Enable output pins after registers are reset

    [ Upstream commit 530b1dbd97846b110ea8a94c7cc903eca21786e5 ]

    Chip outputs are enabled[1] before actual reset is performed[2] which might
    cause pin output value to flip flop if previous pin value was set to 1.
    Fix that behavior by making sure chip is fully reset before all outputs are
    enabled.

    Flip-flop can be noticed when module is removed and inserted again and one of
    the pins was changed to 1 before removal. 100 microsecond flipping is
    noticeable on oscilloscope (100khz SPI bus).

    For a properly reset chip - output is enabled around 100 microseconds (on 100khz
    SPI bus) later during probing process hence should be irrelevant behavioral
    change.

    Fixes: 7ebc194d0fd4 (gpio: 74x164: Introduce 'enable-gpios' property)
    Link: https://elixir.bootlin.com/linux/v6.7.4/source/drivers/gpio/gpio-74x164.c#L130 [1]
    Link: https://elixir.bootlin.com/linux/v6.7.4/source/drivers/gpio/gpio-74x164.c#L150 [2]
    Signed-off-by: Arturas Moskvinas <arturas.moskvinas@gmail.com>
    Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit dd63817baf334888289877ab1db1d866af2a6479
Author: Nathan Lynch <nathanl@linux.ibm.com>
Date:   Thu Feb 22 16:19:14 2024 -0600

    powerpc/rtas: use correct function name for resetting TCE tables

    [ Upstream commit fad87dbd48156ab940538f052f1820f4b6ed2819 ]

    The PAPR spec spells the function name as

      "ibm,reset-pe-dma-windows"

    but in practice firmware uses the singular form:

      "ibm,reset-pe-dma-window"

    in the device tree. Since we have the wrong spelling in the RTAS
    function table, reverse lookups (token -> name) fail and warn:

      unexpected failed lookup for token 86
      WARNING: CPU: 1 PID: 545 at arch/powerpc/kernel/rtas.c:659 __do_enter_rtas_trace+0x2a4/0x2b4
      CPU: 1 PID: 545 Comm: systemd-udevd Not tainted 6.8.0-rc4 #30
      Hardware name: IBM,9105-22A POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NL1060_028) hv:phyp pSeries
      NIP [c0000000000417f0] __do_enter_rtas_trace+0x2a4/0x2b4
      LR [c0000000000417ec] __do_enter_rtas_trace+0x2a0/0x2b4
      Call Trace:
       __do_enter_rtas_trace+0x2a0/0x2b4 (unreliable)
       rtas_call+0x1f8/0x3e0
       enable_ddw.constprop.0+0x4d0/0xc84
       dma_iommu_dma_supported+0xe8/0x24c
       dma_set_mask+0x5c/0xd8
       mlx5_pci_init.constprop.0+0xf0/0x46c [mlx5_core]
       probe_one+0xfc/0x32c [mlx5_core]
       local_pci_probe+0x68/0x12c
       pci_call_probe+0x68/0x1ec
       pci_device_probe+0xbc/0x1a8
       really_probe+0x104/0x570
       __driver_probe_device+0xb8/0x224
       driver_probe_device+0x54/0x130
       __driver_attach+0x158/0x2b0
       bus_for_each_dev+0xa8/0x120
       driver_attach+0x34/0x48
       bus_add_driver+0x174/0x304
       driver_register+0x8c/0x1c4
       __pci_register_driver+0x68/0x7c
       mlx5_init+0xb8/0x118 [mlx5_core]
       do_one_initcall+0x60/0x388
       do_init_module+0x7c/0x2a4
       init_module_from_file+0xb4/0x108
       idempotent_init_module+0x184/0x34c
       sys_finit_module+0x90/0x114

    And oopses are possible when lockdep is enabled or the RTAS
    tracepoints are active, since those paths dereference the result of
    the lookup.

    Use the correct spelling to match firmware's behavior, adjusting the
    related constants to match.

    Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
    Fixes: 8252b88294d2 ("powerpc/rtas: improve function information lookups")
    Reported-by: Gaurav Batra <gbatra@linux.ibm.com>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Link: https://msgid.link/20240222-rtas-fix-ibm-reset-pe-dma-window-v1-1-7aaf235ac63c@linux.ibm.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5da6d306f315344af1ca2eff4bd9b10b130f0c28
Author: Gaurav Batra <gbatra@linux.vnet.ibm.com>
Date:   Thu Jan 25 14:30:17 2024 -0600

    powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV

    [ Upstream commit 09a3c1e46142199adcee372a420b024b4fc61051 ]

    When kdump kernel tries to copy dump data over SR-IOV, LPAR panics due
    to NULL pointer exception:

      Kernel attempted to read user page (0) - exploit attempt? (uid: 0)
      BUG: Kernel NULL pointer dereference on read at 0x00000000
      Faulting instruction address: 0xc000000020847ad4
      Oops: Kernel access of bad area, sig: 11 [#1]
      LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
      Modules linked in: mlx5_core(+) vmx_crypto pseries_wdt papr_scm libnvdimm mlxfw tls psample sunrpc fuse overlay squashfs loop
      CPU: 12 PID: 315 Comm: systemd-udevd Not tainted 6.4.0-Test102+ #12
      Hardware name: IBM,9080-HEX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_008) hv:phyp pSeries
      NIP:  c000000020847ad4 LR: c00000002083b2dc CTR: 00000000006cd18c
      REGS: c000000029162ca0 TRAP: 0300   Not tainted  (6.4.0-Test102+)
      MSR:  800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE>  CR: 48288244  XER: 00000008
      CFAR: c00000002083b2d8 DAR: 0000000000000000 DSISR: 40000000 IRQMASK: 1
      ...
      NIP _find_next_zero_bit+0x24/0x110
      LR  bitmap_find_next_zero_area_off+0x5c/0xe0
      Call Trace:
        dev_printk_emit+0x38/0x48 (unreliable)
        iommu_area_alloc+0xc4/0x180
        iommu_range_alloc+0x1e8/0x580
        iommu_alloc+0x60/0x130
        iommu_alloc_coherent+0x158/0x2b0
        dma_iommu_alloc_coherent+0x3c/0x50
        dma_alloc_attrs+0x170/0x1f0
        mlx5_cmd_init+0xc0/0x760 [mlx5_core]
        mlx5_function_setup+0xf0/0x510 [mlx5_core]
        mlx5_init_one+0x84/0x210 [mlx5_core]
        probe_one+0x118/0x2c0 [mlx5_core]
        local_pci_probe+0x68/0x110
        pci_call_probe+0x68/0x200
        pci_device_probe+0xbc/0x1a0
        really_probe+0x104/0x540
        __driver_probe_device+0xb4/0x230
        driver_probe_device+0x54/0x130
        __driver_attach+0x158/0x2b0
        bus_for_each_dev+0xa8/0x130
        driver_attach+0x34/0x50
        bus_add_driver+0x16c/0x300
        driver_register+0xa4/0x1b0
        __pci_register_driver+0x68/0x80
        mlx5_init+0xb8/0x100 [mlx5_core]
        do_one_initcall+0x60/0x300
        do_init_module+0x7c/0x2b0

    At the time of LPAR dump, before kexec hands over control to kdump
    kernel, DDWs (Dynamic DMA Windows) are scanned and added to the FDT.
    For the SR-IOV case, default DMA window "ibm,dma-window" is removed from
    the FDT and DDW added, for the device.

    Now, kexec hands over control to the kdump kernel.

    When the kdump kernel initializes, PCI busses are scanned and IOMMU
    group/tables created, in pci_dma_bus_setup_pSeriesLP(). For the SR-IOV
    case, there is no "ibm,dma-window". The original commit: b1fc44eaa9ba,
    fixes the path where memory is pre-mapped (direct mapped) to the DDW.
    When TCEs are direct mapped, there is no need to initialize IOMMU
    tables.

    iommu_table_setparms_lpar() only considers "ibm,dma-window" property
    when initiallizing IOMMU table. In the scenario where TCEs are
    dynamically allocated for SR-IOV, newly created IOMMU table is not
    initialized. Later, when the device driver tries to enter TCEs for the
    SR-IOV device, NULL pointer execption is thrown from iommu_area_alloc().

    The fix is to initialize the IOMMU table with DDW property stored in the
    FDT. There are 2 points to remember:

            1. For the dedicated adapter, kdump kernel would encounter both
               default and DDW in FDT. In this case, DDW property is used to
               initialize the IOMMU table.

            2. A DDW could be direct or dynamic mapped. kdump kernel would
               initialize IOMMU table and mark the existing DDW as
               "dynamic". This works fine since, at the time of table
               initialization, iommu_table_clear() makes some space in the
               DDW, for some predefined number of TCEs which are needed for
               kdump to succeed.

    Fixes: b1fc44eaa9ba ("pseries/iommu/ddw: Fix kdump to work in absence of ibm,dma-window")
    Signed-off-by: Gaurav Batra <gbatra@linux.vnet.ibm.com>
    Reviewed-by: Brian King <brking@linux.vnet.ibm.com>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Link: https://msgid.link/20240125203017.61014-1-gbatra@linux.ibm.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit bb71e040323175e18c233a9afef32ba14fa64eb7
Author: Fenghua Yu <fenghua.yu@intel.com>
Date:   Fri Feb 9 11:14:12 2024 -0800

    dmaengine: idxd: Ensure safe user copy of completion record

    [ Upstream commit d3ea125df37dc37972d581b74a5d3785c3f283ab ]

    If CONFIG_HARDENED_USERCOPY is enabled, copying completion record from
    event log cache to user triggers a kernel bug.

    [ 1987.159822] usercopy: Kernel memory exposure attempt detected from SLUB object 'dsa0' (offset 74, size 31)!
    [ 1987.170845] ------------[ cut here ]------------
    [ 1987.176086] kernel BUG at mm/usercopy.c:102!
    [ 1987.180946] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
    [ 1987.186866] CPU: 17 PID: 528 Comm: kworker/17:1 Not tainted 6.8.0-rc2+ #5
    [ 1987.194537] Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023
    [ 1987.206405] Workqueue: wq0.0 idxd_evl_fault_work [idxd]
    [ 1987.212338] RIP: 0010:usercopy_abort+0x72/0x90
    [ 1987.217381] Code: 58 65 9c 50 48 c7 c2 17 85 61 9c 57 48 c7 c7 98 fd 6b 9c 48 0f 44 d6 48 c7 c6 b3 08 62 9c 4c 89 d1 49 0f 44 f3 e8 1e 2e d5 ff <0f> 0b 49 c7 c1 9e 42 61 9c 4c 89 cf 4d 89 c8 eb a9 66 66 2e 0f 1f
    [ 1987.238505] RSP: 0018:ff62f5cf20607d60 EFLAGS: 00010246
    [ 1987.244423] RAX: 000000000000005f RBX: 000000000000001f RCX: 0000000000000000
    [ 1987.252480] RDX: 0000000000000000 RSI: ffffffff9c61429e RDI: 00000000ffffffff
    [ 1987.260538] RBP: ff62f5cf20607d78 R08: ff2a6a89ef3fffe8 R09: 00000000fffeffff
    [ 1987.268595] R10: ff2a6a89eed00000 R11: 0000000000000003 R12: ff2a66934849c89a
    [ 1987.276652] R13: 0000000000000001 R14: ff2a66934849c8b9 R15: ff2a66934849c899
    [ 1987.284710] FS:  0000000000000000(0000) GS:ff2a66b22fe40000(0000) knlGS:0000000000000000
    [ 1987.293850] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [ 1987.300355] CR2: 00007fe291a37000 CR3: 000000010fbd4005 CR4: 0000000000f71ef0
    [ 1987.308413] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [ 1987.316470] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
    [ 1987.324527] PKRU: 55555554
    [ 1987.327622] Call Trace:
    [ 1987.330424]  <TASK>
    [ 1987.332826]  ? show_regs+0x6e/0x80
    [ 1987.336703]  ? die+0x3c/0xa0
    [ 1987.339988]  ? do_trap+0xd4/0xf0
    [ 1987.343662]  ? do_error_trap+0x75/0xa0
    [ 1987.347922]  ? usercopy_abort+0x72/0x90
    [ 1987.352277]  ? exc_invalid_op+0x57/0x80
    [ 1987.356634]  ? usercopy_abort+0x72/0x90
    [ 1987.360988]  ? asm_exc_invalid_op+0x1f/0x30
    [ 1987.365734]  ? usercopy_abort+0x72/0x90
    [ 1987.370088]  __check_heap_object+0xb7/0xd0
    [ 1987.374739]  __check_object_size+0x175/0x2d0
    [ 1987.379588]  idxd_copy_cr+0xa9/0x130 [idxd]
    [ 1987.384341]  idxd_evl_fault_work+0x127/0x390 [idxd]
    [ 1987.389878]  process_one_work+0x13e/0x300
    [ 1987.394435]  ? __pfx_worker_thread+0x10/0x10
    [ 1987.399284]  worker_thread+0x2f7/0x420
    [ 1987.403544]  ? _raw_spin_unlock_irqrestore+0x2b/0x50
    [ 1987.409171]  ? __pfx_worker_thread+0x10/0x10
    [ 1987.414019]  kthread+0x107/0x140
    [ 1987.417693]  ? __pfx_kthread+0x10/0x10
    [ 1987.421954]  ret_from_fork+0x3d/0x60
    [ 1987.426019]  ? __pfx_kthread+0x10/0x10
    [ 1987.430281]  ret_from_fork_asm+0x1b/0x30
    [ 1987.434744]  </TASK>

    The issue arises because event log cache is created using
    kmem_cache_create() which is not suitable for user copy.

    Fix the issue by creating event log cache with
    kmem_cache_create_usercopy(), ensuring safe user copy.

    Fixes: c2f156bf168f ("dmaengine: idxd: create kmem cache for event log fault items")
    Reported-by: Tony Zhu <tony.zhu@intel.com>
    Tested-by: Tony Zhu <tony.zhu@intel.com>
    Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
    Reviewed-by: Lijun Pan <lijun.pan@intel.com>
    Reviewed-by: Dave Jiang <dave.jiang@intel.com>
    Link: https://lore.kernel.org/r/20240209191412.1050270-1-fenghua.yu@intel.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 4d78149ebe9920eb40e53f73e185a27c679f12f6
Author: Fenghua Yu <fenghua.yu@intel.com>
Date:   Wed Feb 14 18:49:31 2024 -0800

    dmaengine: idxd: Remove shadow Event Log head stored in idxd

    [ Upstream commit ecec7c9f29a7114a3e23a14020b1149ea7dffb4f ]

    head is defined in idxd->evl as a shadow of head in the EVLSTATUS register.
    There are two issues related to the shadow head:

    1. Mismatch between the shadow head and the state of the EVLSTATUS
       register:
       If Event Log is supported, upon completion of the Enable Device command,
       the Event Log head in the variable idxd->evl->head should be cleared to
       match the state of the EVLSTATUS register. But the variable is not reset
       currently, leading mismatch between the variable and the register state.
       The mismatch causes incorrect processing of Event Log entries.

    2. Unnecessary shadow head definition:
       The shadow head is unnecessary as head can be read directly from the
       EVLSTATUS register. Reading head from the register incurs no additional
       cost because event log head and tail are always read together and
       tail is already read directly from the register as required by hardware.

    Remove the shadow Event Log head stored in idxd->evl to address the
    mentioned issues.

    Fixes: 244da66cda35 ("dmaengine: idxd: setup event log configuration")
    Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
    Reviewed-by: Dave Jiang <dave.jiang@intel.com>
    Link: https://lore.kernel.org/r/20240215024931.1739621-1-fenghua.yu@intel.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a3c713cfa2b5854d6bcf1f0748acb018c25b850c
Author: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Date:   Tue Feb 13 15:38:24 2024 +0200

    phy: qcom-qmp-usb: fix v3 offsets data

    [ Upstream commit d4c08d8b23b22807c712208cd05cb047e92e7672 ]

    The MSM8996 platform has registers setup different to the rest of QMP v3
    USB platforms. It has PCS region at 0x600 and no PCS_MISC region, while
    other platforms have PCS region at 0x800 and PCS_MISC at 0x600.  This
    results in the malfunctioning USB host on some of the platforms.  The
    commit f74c35b630d4 ("phy: qcom-qmp-usb: fix register offsets for
    ipq8074/ipq6018") fixed the issue for IPQ platforms, but missed the
    SDM845 which has the same register layout.

    To simplify future platform addition and to make the driver more future
    proof, rename qmp_usb_offsets_v3 to qmp_usb_offsets_v3_msm8996 (to mark
    its peculiarity), rename qmp_usb_offsets_ipq8074 to qmp_usb_offsets_v3
    and use it for SDM845 platform.

    Fixes: 2be22aae6b18 ("phy: qcom-qmp-usb: populate offsets configuration")
    Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    Link: https://lore.kernel.org/r/20240213133824.2218916-1-dmitry.baryshkov@linaro.org
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit d78739eb66a8fbff7f8a0186e03b4c79718af5d2
Author: Yang Yingliang <yangyingliang@huawei.com>
Date:   Thu Aug 24 17:13:45 2023 +0800

    phy: qcom: phy-qcom-m31: fix wrong pointer pass to PTR_ERR()

    [ Upstream commit 95055beb067cb30f626fb10f7019737ca7681df0 ]

    It should be 'qphy->vreg' passed to PTR_ERR() when devm_regulator_get() fails.

    Fixes: 08e49af50701 ("phy: qcom: Introduce M31 USB PHY driver")
    Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
    Reviewed-by: Varadarajan Narayanan <quic_varada@quicinc.com>
    Link: https://lore.kernel.org/r/20230824091345.1072650-1-yangyingliang@huawei.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 76d89953240acad71f92ccf8adb28cb6cebdb2bf
Author: Alexander Stein <alexander.stein@ew.tq-group.com>
Date:   Wed Jan 10 10:33:43 2024 +0100

    phy: freescale: phy-fsl-imx8-mipi-dphy: Fix alias name to use dashes

    [ Upstream commit 7936378cb6d87073163130e1e1fc1e5f76a597cf ]

    Devicetree spec lists only dashes as valid characters for alias names.
    Table 3.2: Valid characters for alias names, Devicee Specification,
    Release v0.4

    Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
    Fixes: 3fbae284887de ("phy: freescale: phy-fsl-imx8-mipi-dphy: Add i.MX8qxp LVDS PHY mode support")
    Link: https://lore.kernel.org/r/20240110093343.468810-1-alexander.stein@ew.tq-group.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f396b4df27cfe01a99f4b41f584c49e56477be3a
Author: Kory Maincent <kory.maincent@bootlin.com>
Date:   Mon Jan 29 17:26:02 2024 +0100

    dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup

    [ Upstream commit bbcc1c83f343e580c3aa1f2a8593343bf7b55bba ]

    The Linked list element and pointer are not stored in the same memory as
    the eDMA controller register. If the doorbell register is toggled before
    the full write of the linked list a race condition error will occur.
    In remote setup we can only use a readl to the memory to assure the full
    write has occurred.

    Fixes: 7e4b8a4fbe2c ("dmaengine: Add Synopsys eDMA IP version 0 support")
    Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
    Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
    Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-6-8e8c1acb7a46@bootlin.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 17be6f5cb223f22e4733ed8fe8b2247cbb677716
Author: Kory Maincent <kory.maincent@bootlin.com>
Date:   Mon Jan 29 17:26:01 2024 +0100

    dmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup

    [ Upstream commit 712a92a48158e02155b4b6b21e03a817f78c9b7e ]

    The Linked list element and pointer are not stored in the same memory as
    the HDMA controller register. If the doorbell register is toggled before
    the full write of the linked list a race condition error will occur.
    In remote setup we can only use a readl to the memory to assure the full
    write has occurred.

    Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA")
    Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
    Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
    Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-5-8e8c1acb7a46@bootlin.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3cafc9aa7afb9f5d2996083aa5cabbef75e89083
Author: Kory Maincent <kory.maincent@bootlin.com>
Date:   Mon Jan 29 17:26:00 2024 +0100

    dmaengine: dw-edma: Add HDMA remote interrupt configuration

    [ Upstream commit e2f6a5789051ee9c632f27a12d0f01f0cbf78aac ]

    Only the local interruption was configured, remote interrupt was left
    behind. This patch fix it by setting stop and abort remote interrupts when
    the DW_EDMA_CHIP_LOCAL flag is not set.

    Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA")
    Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
    Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
    Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-4-8e8c1acb7a46@bootlin.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit fda7855f46bad4601147b7361aa37dd86dec3d40
Author: Kory Maincent <kory.maincent@bootlin.com>
Date:   Mon Jan 29 17:25:59 2024 +0100

    dmaengine: dw-edma: HDMA_V0_REMOTEL_STOP_INT_EN typo fix

    [ Upstream commit 930a8a015dcfde4b8906351ff081066dc277748c ]

    Fix "HDMA_V0_REMOTEL_STOP_INT_EN" typo error

    Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA")
    Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
    Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
    Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-3-8e8c1acb7a46@bootlin.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3ae8e5fdd92a06ffa6b0f6af3c1292243664438f
Author: Kory Maincent <kory.maincent@bootlin.com>
Date:   Mon Jan 29 17:25:58 2024 +0100

    dmaengine: dw-edma: Fix wrong interrupt bit set for HDMA

    [ Upstream commit 7b52ba8616e978bf4f38f207f11a8176517244d0 ]

    Instead of setting HDMA_V0_LOCAL_ABORT_INT_EN bit, HDMA_V0_LOCAL_STOP_INT_EN
    bit got set twice, due to which the abort interrupt is not getting generated for
    HDMA. Fix it by setting the correct interrupt enable bit.

    Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA")
    Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
    Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
    Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-2-8e8c1acb7a46@bootlin.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8fdc7f1d5b4aa76e56b871948c0a46fdda844426
Author: Kory Maincent <kory.maincent@bootlin.com>
Date:   Mon Jan 29 17:25:57 2024 +0100

    dmaengine: dw-edma: Fix the ch_count hdma callback

    [ Upstream commit cd665bfc757c71e9b7e0abff0f362d8abd38a805 ]

    The current check of ch_en enabled to know the maximum number of available
    hardware channels is wrong as it check the number of ch_en register set
    but all of them are unset at probe. This register is set at the
    dw_hdma_v0_core_start function which is run lately before a DMA transfer.

    The HDMA IP have no way to know the number of hardware channels available
    like the eDMA IP, then let set it to maximum channels and let the platform
    set the right number of channels.

    Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA")
    Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
    Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
    Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-1-8e8c1acb7a46@bootlin.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 67c8cf1207687f4951e464511100bf26d688a6a6
Author: Dan Carpenter <dan.carpenter@linaro.org>
Date:   Mon Feb 5 15:44:30 2024 +0300

    ASoC: cs35l56: fix reversed if statement in cs35l56_dspwait_asp1tx_put()

    commit 4703b014f28bf7a2e56d1da238ee95ef6c5ce76b upstream.

    It looks like the "!" character was added accidentally.  The
    regmap_update_bits_check() function is normally going to succeed.  This
    means the rest of the function is unreachable and we don't handle the
    situation where "changed" is true correctly.

    Fixes: 07f7d6e7a124 ("ASoC: cs35l56: Fix for initializing ASP1 mixer registers")
    Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
    Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
    Link: https://lore.kernel.org/r/0c254c07-d1c0-4a5c-a22b-7e135cab032c@moroto.mountain
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 43ba9e331559a30000c862eea313248707afa787
Author: Kuniyuki Iwashima <kuniyu@amazon.com>
Date:   Mon Feb 19 09:46:57 2024 -0800

    af_unix: Drop oob_skb ref before purging queue in GC.

    commit aa82ac51d63328714645c827775d64dbfd9941f3 upstream.

    syzbot reported another task hung in __unix_gc().  [0]

    The current while loop assumes that all of the left candidates
    have oob_skb and calling kfree_skb(oob_skb) releases the remaining
    candidates.

    However, I missed a case that oob_skb has self-referencing fd and
    another fd and the latter sk is placed before the former in the
    candidate list.  Then, the while loop never proceeds, resulting
    the task hung.

    __unix_gc() has the same loop just before purging the collected skb,
    so we can call kfree_skb(oob_skb) there and let __skb_queue_purge()
    release all inflight sockets.

    [0]:
    Sending NMI from CPU 0 to CPUs 1:
    NMI backtrace for cpu 1
    CPU: 1 PID: 2784 Comm: kworker/u4:8 Not tainted 6.8.0-rc4-syzkaller-01028-g71b605d32017 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
    Workqueue: events_unbound __unix_gc
    RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:200
    Code: 89 fb e8 23 00 00 00 48 8b 3d 84 f5 1a 0c 48 89 de 5b e9 43 26 57 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 48 8b 04 24 65 48 8b 0d 90 52 70 7e 65 8b 15 91 52 70
    RSP: 0018:ffffc9000a17fa78 EFLAGS: 00000287
    RAX: ffffffff8a0a6108 RBX: ffff88802b6c2640 RCX: ffff88802c0b3b80
    RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
    RBP: ffffc9000a17fbf0 R08: ffffffff89383f1d R09: 1ffff1100ee5ff84
    R10: dffffc0000000000 R11: ffffed100ee5ff85 R12: 1ffff110056d84ee
    R13: ffffc9000a17fae0 R14: 0000000000000000 R15: ffffffff8f47b840
    FS:  0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007ffef5687ff8 CR3: 0000000029b34000 CR4: 00000000003506f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
     <NMI>
     </NMI>
     <TASK>
     __unix_gc+0xe69/0xf40 net/unix/garbage.c:343
     process_one_work kernel/workqueue.c:2633 [inline]
     process_scheduled_works+0x913/0x1420 kernel/workqueue.c:2706
     worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787
     kthread+0x2ef/0x390 kernel/kthread.c:388
     ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
     ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
     </TASK>

    Reported-and-tested-by: syzbot+ecab4d36f920c3574bf9@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=ecab4d36f920c3574bf9
    Fixes: 25236c91b5ab ("af_unix: Fix task hung while purging oob_skb in GC.")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cb8890318dde26fc89c6ea67d6e9070ab50b6e91
Author: Kuniyuki Iwashima <kuniyu@amazon.com>
Date:   Fri Feb 9 14:04:53 2024 -0800

    af_unix: Fix task hung while purging oob_skb in GC.

    commit 25236c91b5ab4a26a56ba2e79b8060cf4e047839 upstream.

    syzbot reported a task hung; at the same time, GC was looping infinitely
    in list_for_each_entry_safe() for OOB skb.  [0]

    syzbot demonstrated that the list_for_each_entry_safe() was not actually
    safe in this case.

    A single skb could have references for multiple sockets.  If we free such
    a skb in the list_for_each_entry_safe(), the current and next sockets could
    be unlinked in a single iteration.

    unix_notinflight() uses list_del_init() to unlink the socket, so the
    prefetched next socket forms a loop itself and list_for_each_entry_safe()
    never stops.

    Here, we must use while() and make sure we always fetch the first socket.

    [0]:
    Sending NMI from CPU 0 to CPUs 1:
    NMI backtrace for cpu 1
    CPU: 1 PID: 5065 Comm: syz-executor236 Not tainted 6.8.0-rc3-syzkaller-00136-g1f719a2f3fa6 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
    RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:26 [inline]
    RIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline]
    RIP: 0010:__sanitizer_cov_trace_pc+0xd/0x60 kernel/kcov.c:207
    Code: cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 65 48 8b 14 25 40 c2 03 00 <65> 8b 05 b4 7c 78 7e a9 00 01 ff 00 48 8b 34 24 74 0f f6 c4 01 74
    RSP: 0018:ffffc900033efa58 EFLAGS: 00000283
    RAX: ffff88807b077800 RBX: ffff88807b077800 RCX: 1ffffffff27b1189
    RDX: ffff88802a5a3b80 RSI: ffffffff8968488d RDI: ffff88807b077f70
    RBP: ffffc900033efbb0 R08: 0000000000000001 R09: fffffbfff27a900c
    R10: ffffffff93d48067 R11: ffffffff8ae000eb R12: ffff88807b077800
    R13: dffffc0000000000 R14: ffff88807b077e40 R15: 0000000000000001
    FS:  0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000564f4fc1e3a8 CR3: 000000000d57a000 CR4: 00000000003506f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
     <NMI>
     </NMI>
     <TASK>
     unix_gc+0x563/0x13b0 net/unix/garbage.c:319
     unix_release_sock+0xa93/0xf80 net/unix/af_unix.c:683
     unix_release+0x91/0xf0 net/unix/af_unix.c:1064
     __sock_release+0xb0/0x270 net/socket.c:659
     sock_close+0x1c/0x30 net/socket.c:1421
     __fput+0x270/0xb80 fs/file_table.c:376
     task_work_run+0x14f/0x250 kernel/task_work.c:180
     exit_task_work include/linux/task_work.h:38 [inline]
     do_exit+0xa8a/0x2ad0 kernel/exit.c:871
     do_group_exit+0xd4/0x2a0 kernel/exit.c:1020
     __do_sys_exit_group kernel/exit.c:1031 [inline]
     __se_sys_exit_group kernel/exit.c:1029 [inline]
     __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1029
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x6f/0x77
    RIP: 0033:0x7f9d6cbdac09
    Code: Unable to access opcode bytes at 0x7f9d6cbdabdf.
    RSP: 002b:00007fff5952feb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
    RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9d6cbdac09
    RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
    RBP: 00007f9d6cc552b0 R08: ffffffffffffffb8 R09: 0000000000000006
    R10: 0000000000000006 R11: 0000000000000246 R12: 00007f9d6cc552b0
    R13: 0000000000000000 R14: 00007f9d6cc55d00 R15: 00007f9d6cbabe70
     </TASK>

    Reported-by: syzbot+4fa4a2d1f5a5ee06f006@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=4fa4a2d1f5a5ee06f006
    Fixes: 1279f9d9dec2 ("af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Link: https://lore.kernel.org/r/20240209220453.96053-1-kuniyu@amazon.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5fa917a67a03451cded859349249b8b7d08c3865
Author: NeilBrown <neilb@suse.de>
Date:   Wed Feb 28 10:23:31 2024 +1100

    NFS: Fix data corruption caused by congestion.

    when AOP_WRITEPAGE_ACTIVATE is returned (as NFS does when it detects
    congestion) it is important that the folio is redirtied.
    nfs_writepage_locked() doesn't do this, so files can become corrupted as
    writes can be lost.

    Note that this is not needed in v6.8 as AOP_WRITEPAGE_ACTIVATE cannot be
    returned.  It is needed for kernels v5.18..v6.7.  Prior to 6.3 the patch
    is different as it needs to mention "page", not "folio".

    Reported-and-tested-by: Jacek Tomaka <Jacek.Tomaka@poczta.fm>
    Fixes: 6df25e58532b ("nfs: remove reliance on bdi congestion")
    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c9633fcb4dbcd4d5f4f25380e5cccb289a33cdd9
Author: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Date:   Sun Oct 29 13:48:43 2023 +0200

    mfd: twl6030-irq: Revert to use of_match_device()

    commit 7a29fa05aeca2c16193f00a883c56ffc7c25b6c5 upstream.

    The core twl chip is probed via i2c and the dev->driver->of_match_table is
    NULL, causing the driver to fail to probe.

    This partially reverts:

      commit 1e0c866887f4 ("mfd: Use device_get_match_data() in a bunch of drivers")

    Fixes: 1e0c866887f4 ("mfd: Use device_get_match_data() in a bunch of drivers")
    Signed-off-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
    Link: https://lore.kernel.org/r/20231029114843.15553-1-peter.ujfalusi@gmail.com
    Signed-off-by: Lee Jones <lee@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d487e7ba1bc7444d5f062c4930ef8436c47c7e63
Author: Paolo Abeni <pabeni@redhat.com>
Date:   Fri Feb 23 17:14:19 2024 +0100

    mptcp: fix possible deadlock in subflow diag

    commit d6a9608af9a75d13243d217f6ce1e30e57d56ffe upstream.

    Syzbot and Eric reported a lockdep splat in the subflow diag:

       WARNING: possible circular locking dependency detected
       6.8.0-rc4-syzkaller-00212-g40b9385dd8e6 #0 Not tainted

       syz-executor.2/24141 is trying to acquire lock:
       ffff888045870130 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at:
       tcp_diag_put_ulp net/ipv4/tcp_diag.c:100 [inline]
       ffff888045870130 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at:
       tcp_diag_get_aux+0x738/0x830 net/ipv4/tcp_diag.c:137

       but task is already holding lock:
       ffffc9000135e488 (&h->lhash2[i].lock){+.+.}-{2:2}, at: spin_lock
       include/linux/spinlock.h:351 [inline]
       ffffc9000135e488 (&h->lhash2[i].lock){+.+.}-{2:2}, at:
       inet_diag_dump_icsk+0x39f/0x1f80 net/ipv4/inet_diag.c:1038

       which lock already depends on the new lock.

       the existing dependency chain (in reverse order) is:

       -> #1 (&h->lhash2[i].lock){+.+.}-{2:2}:
       lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
       __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
       _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
       spin_lock include/linux/spinlock.h:351 [inline]
       __inet_hash+0x335/0xbe0 net/ipv4/inet_hashtables.c:743
       inet_csk_listen_start+0x23a/0x320 net/ipv4/inet_connection_sock.c:1261
       __inet_listen_sk+0x2a2/0x770 net/ipv4/af_inet.c:217
       inet_listen+0xa3/0x110 net/ipv4/af_inet.c:239
       rds_tcp_listen_init+0x3fd/0x5a0 net/rds/tcp_listen.c:316
       rds_tcp_init_net+0x141/0x320 net/rds/tcp.c:577
       ops_init+0x352/0x610 net/core/net_namespace.c:136
       __register_pernet_operations net/core/net_namespace.c:1214 [inline]
       register_pernet_operations+0x2cb/0x660 net/core/net_namespace.c:1283
       register_pernet_device+0x33/0x80 net/core/net_namespace.c:1370
       rds_tcp_init+0x62/0xd0 net/rds/tcp.c:735
       do_one_initcall+0x238/0x830 init/main.c:1236
       do_initcall_level+0x157/0x210 init/main.c:1298
       do_initcalls+0x3f/0x80 init/main.c:1314
       kernel_init_freeable+0x42f/0x5d0 init/main.c:1551
       kernel_init+0x1d/0x2a0 init/main.c:1441
       ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242

       -> #0 (k-sk_lock-AF_INET6){+.+.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3134 [inline]
       check_prevs_add kernel/locking/lockdep.c:3253 [inline]
       validate_chain+0x18ca/0x58e0 kernel/locking/lockdep.c:3869
       __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137
       lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
       lock_sock_fast include/net/sock.h:1723 [inline]
       subflow_get_info+0x166/0xd20 net/mptcp/diag.c:28
       tcp_diag_put_ulp net/ipv4/tcp_diag.c:100 [inline]
       tcp_diag_get_aux+0x738/0x830 net/ipv4/tcp_diag.c:137
       inet_sk_diag_fill+0x10ed/0x1e00 net/ipv4/inet_diag.c:345
       inet_diag_dump_icsk+0x55b/0x1f80 net/ipv4/inet_diag.c:1061
       __inet_diag_dump+0x211/0x3a0 net/ipv4/inet_diag.c:1263
       inet_diag_dump_compat+0x1c1/0x2d0 net/ipv4/inet_diag.c:1371
       netlink_dump+0x59b/0xc80 net/netlink/af_netlink.c:2264
       __netlink_dump_start+0x5df/0x790 net/netlink/af_netlink.c:2370
       netlink_dump_start include/linux/netlink.h:338 [inline]
       inet_diag_rcv_msg_compat+0x209/0x4c0 net/ipv4/inet_diag.c:1405
       sock_diag_rcv_msg+0xe7/0x410
       netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543
       sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:280
       netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
       netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367
       netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908
       sock_sendmsg_nosec net/socket.c:730 [inline]
       __sock_sendmsg+0x221/0x270 net/socket.c:745
       ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584
       ___sys_sendmsg net/socket.c:2638 [inline]
       __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
       do_syscall_64+0xf9/0x240
       entry_SYSCALL_64_after_hwframe+0x6f/0x77

    As noted by Eric we can break the lock dependency chain avoid
    dumping any extended info for the mptcp subflow listener:
    nothing actually useful is presented there.

    Fixes: b8adb69a7d29 ("mptcp: fix lockless access in subflow ULP diag")
    Cc: stable@vger.kernel.org
    Reported-by: Eric Dumazet <edumazet@google.com>
    Closes: https://lore.kernel.org/netdev/CANn89iJ=Oecw6OZDwmSYc9HJKQ_G32uN11L+oUcMu+TOD5Xiaw@mail.gmail.com/
    Suggested-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-9-162e87e48497@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 85933e80d077c9ae2227226beb86c22f464059cc
Author: Davide Caratti <dcaratti@redhat.com>
Date:   Fri Feb 23 17:14:18 2024 +0100

    mptcp: fix double-free on socket dismantle

    commit 10048689def7e40a4405acda16fdc6477d4ecc5c upstream.

    when MPTCP server accepts an incoming connection, it clones its listener
    socket. However, the pointer to 'inet_opt' for the new socket has the same
    value as the original one: as a consequence, on program exit it's possible
    to observe the following splat:

      BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0
      Free of addr ffff888485950880 by task swapper/25/0

      CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609
      Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0  07/26/2013
      Call Trace:
       <IRQ>
       dump_stack_lvl+0x32/0x50
       print_report+0xca/0x620
       kasan_report_invalid_free+0x64/0x90
       __kasan_slab_free+0x1aa/0x1f0
       kfree+0xed/0x2e0
       inet_sock_destruct+0x54f/0x8b0
       __sk_destruct+0x48/0x5b0
       rcu_do_batch+0x34e/0xd90
       rcu_core+0x559/0xac0
       __do_softirq+0x183/0x5a4
       irq_exit_rcu+0x12d/0x170
       sysvec_apic_timer_interrupt+0x6b/0x80
       </IRQ>
       <TASK>
       asm_sysvec_apic_timer_interrupt+0x16/0x20
      RIP: 0010:cpuidle_enter_state+0x175/0x300
      Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed <0f> 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b
      RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202
      RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000
      RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588
      RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080
      R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0
      R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80
       cpuidle_enter+0x4a/0xa0
       do_idle+0x310/0x410
       cpu_startup_entry+0x51/0x60
       start_secondary+0x211/0x270
       secondary_startup_64_no_verify+0x184/0x18b
       </TASK>

      Allocated by task 6853:
       kasan_save_stack+0x1c/0x40
       kasan_save_track+0x10/0x30
       __kasan_kmalloc+0xa6/0xb0
       __kmalloc+0x1eb/0x450
       cipso_v4_sock_setattr+0x96/0x360
       netlbl_sock_setattr+0x132/0x1f0
       selinux_netlbl_socket_post_create+0x6c/0x110
       selinux_socket_post_create+0x37b/0x7f0
       security_socket_post_create+0x63/0xb0
       __sock_create+0x305/0x450
       __sys_socket_create.part.23+0xbd/0x130
       __sys_socket+0x37/0xb0
       __x64_sys_socket+0x6f/0xb0
       do_syscall_64+0x83/0x160
       entry_SYSCALL_64_after_hwframe+0x6e/0x76

      Freed by task 6858:
       kasan_save_stack+0x1c/0x40
       kasan_save_track+0x10/0x30
       kasan_save_free_info+0x3b/0x60
       __kasan_slab_free+0x12c/0x1f0
       kfree+0xed/0x2e0
       inet_sock_destruct+0x54f/0x8b0
       __sk_destruct+0x48/0x5b0
       subflow_ulp_release+0x1f0/0x250
       tcp_cleanup_ulp+0x6e/0x110
       tcp_v4_destroy_sock+0x5a/0x3a0
       inet_csk_destroy_sock+0x135/0x390
       tcp_fin+0x41…
NeroReflex pushed a commit to NeroReflex/linux that referenced this issue Mar 6, 2024
commit 535d620 upstream.

Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
NeroReflex pushed a commit to NeroReflex/linux that referenced this issue Mar 6, 2024
commit 535d620 upstream.

Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
johnny-mnemonic pushed a commit to linux-ia64/linux-stable-rc that referenced this issue Mar 7, 2024
commit 535d620 upstream.

Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
johnny-mnemonic pushed a commit to linux-ia64/linux-stable-rc that referenced this issue Mar 7, 2024
commit 535d620 upstream.

Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
johnny-mnemonic pushed a commit to linux-ia64/linux-stable-rc that referenced this issue Mar 7, 2024
commit 7092dbe upstream.

Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds a second subflow
to "userspace pm add & remove address" test, and two subflows could
be removed two different ways, one with the v4mapped and one with v4.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-2-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
johnny-mnemonic pushed a commit to linux-ia64/linux-stable-rc that referenced this issue Mar 7, 2024
commit 535d620 upstream.

Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
johnny-mnemonic pushed a commit to linux-ia64/linux-stable-rc that referenced this issue Mar 7, 2024
commit 7092dbe upstream.

Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds a second subflow
to "userspace pm add & remove address" test, and two subflows could
be removed two different ways, one with the v4mapped and one with v4.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-2-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
rohanmclure pushed a commit to rohanmclure/linux-ci that referenced this issue Mar 7, 2024
Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
rohanmclure pushed a commit to rohanmclure/linux-ci that referenced this issue Mar 7, 2024
Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds a second subflow
to "userspace pm add & remove address" test, and two subflows could
be removed two different ways, one with the v4mapped and one with v4.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-2-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
rohanmclure pushed a commit to rohanmclure/linux-ci that referenced this issue Mar 7, 2024
Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
rohanmclure pushed a commit to rohanmclure/linux-ci that referenced this issue Mar 7, 2024
Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds a second subflow
to "userspace pm add & remove address" test, and two subflows could
be removed two different ways, one with the v4mapped and one with v4.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-2-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
NeroReflex pushed a commit to NeroReflex/linux that referenced this issue Mar 13, 2024
commit 535d620 upstream.

Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
NeroReflex pushed a commit to NeroReflex/linux that referenced this issue Mar 13, 2024
commit 7092dbe upstream.

Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds a second subflow
to "userspace pm add & remove address" test, and two subflows could
be removed two different ways, one with the v4mapped and one with v4.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-2-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
naushir pushed a commit to naushir/linux that referenced this issue Mar 20, 2024
commit 535d620 upstream.

Address family of server side mismatches with that of client side, like
in "userspace pm add & remove address" test:

    userspace_pm_add_addr $ns1 10.0.2.1 10
    userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

That's because on the server side, the family is set to AF_INET6 and the
v4 address is mapped in a v6 one.

This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
checking local address family with remote address family, map an IPv4
address to an IPv6 address if the pair is a v4-mapped address.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 702c2f6 ("mptcp: netlink: allow userspace-driven subflow establishment")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
naushir pushed a commit to naushir/linux that referenced this issue Mar 20, 2024
commit 7092dbe upstream.

Now both a v4 address and a v4-mapped address are supported when
destroying a userspace pm subflow, this patch adds a second subflow
to "userspace pm add & remove address" test, and two subflows could
be removed two different ways, one with the v4mapped and one with v4.

Closes: multipath-tcp/mptcp_net-next#387
Fixes: 48d73f6 ("selftests: mptcp: update userspace pm addr tests")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-2-162e87e48497@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
bella485 pushed a commit to bella485/centos-stream-9 that referenced this issue May 1, 2024
JIRA: https://issues.redhat.com/browse/RHEL-32669
Upstream Status: net.git commit 535d620ea5ff1a033dc64ee3d912acadc7470619

commit 535d620ea5ff1a033dc64ee3d912acadc7470619
Author: Geliang Tang <tanggeliang@kylinos.cn>
Date:   Fri Feb 23 17:14:11 2024 +0100

    mptcp: map v4 address to v6 when destroying subflow

    Address family of server side mismatches with that of client side, like
    in "userspace pm add & remove address" test:

        userspace_pm_add_addr $ns1 10.0.2.1 10
        userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED

    That's because on the server side, the family is set to AF_INET6 and the
    v4 address is mapped in a v6 one.

    This patch fixes this issue. In mptcp_pm_nl_subflow_destroy_doit(), before
    checking local address family with remote address family, map an IPv4
    address to an IPv6 address if the pair is a v4-mapped address.

    Closes: multipath-tcp/mptcp_net-next#387
    Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment")
    Cc: stable@vger.kernel.org
    Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
    Reviewed-by: Mat Martineau <martineau@kernel.org>
    Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-1-162e87e48497@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants