Merge tag 'v5.15.160' into 5.15-main

This is the 5.15.160 stable release

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmZR86kACgkQONu9yGCS
# aT5cShAAn2f/JkJG8I/YWCPH8Sr+vTd8iCAFdJWTtOx8F4zoATTByPSsI6ZUYIvW
# wfvf/dLtgQjY+/iebKvihzl4+VYdKLnnDv6xJF/gisynFPi4rU3xXKkRV4MVYp38
# MkyC26Vy6YsX5xa564TAYLm6/BARg3I6V327qcGRhPJDcEkhQ3+Rw1xtVkDfnc+N
# XTfv4JO7F96+CWj3Md9IbUTubDr/QMTrMY9Nw223XeCO+jLiT8VKdrvoJ4hXkzJz
# mW1YAqEDglh6vyKPpOiBkqPV28fXoj7dQB5Jxqlj0lJc2dpIIHNZTVHw9LAcNlQb
# JGMmhIa65T0PxEM2VfUKvJStjg7usOxag8b52/gJgQvy0VinhaUF37YowElLvLWT
# xdDPl9WgTtBfSDnfoxjRfBQ4OThInJQ7hIVsEqvGXjJi2jd94X/PKxDAaARFSNSw
# ACONRhpGppiJX373qQ29u7aB0BoQyF1ObztyZCoVbSqRhCry5uqC+X1CMOjeO6P7
# rgeAM3/k4mWSFNcIFawpE36CwyV3kJ57Pif8CfgxS5NtqzaRvvAFKQTj0XS4CpUP
# BDcclQFVOAS473EPSdRq7Oen1n6Qi0YhSlQKuiRxn19ZqShXjiomKdNf2QJurSdk
# REJOq5M/CGHgYoRAe3S3Ifv7Yeh58dYr5acZK2k1U6YEpHh3/Ts=
# =Untg
# -----END PGP SIGNATURE-----
# gpg: Signature made Sat May 25 16:20:25 2024 CEST
# gpg:                using RSA key 647F28654894E3BD457199BE38DBBDC86092693E
# gpg: Can't check signature: No public key

Documentation/admin-guide/hw-vuln/core-scheduling.rst

@@ -66,8 +66,8 @@ arg4:
  will be performed for all tasks in the task group of ``pid``.
 
 arg5:
- userspace pointer to an unsigned long for storing the cookie returned by
- ``PR_SCHED_CORE_GET`` command. Should be 0 for all other commands.
+ userspace pointer to an unsigned long long for storing the cookie returned
+ by ``PR_SCHED_CORE_GET`` command. Should be 0 for all other commands.
 
 In order for a process to push a cookie to, or pull a cookie from a process, it
 is required to have the ptrace access mode: `PTRACE_MODE_READ_REALCREDS` to the

Documentation/sphinx/kernel_include.py

@@ -94,7 +94,6 @@ def _run(self):
  # HINT: this is the only line I had to change / commented out:
  #path = utils.relative_path(None, path)
 
- path = nodes.reprunicode(path)
  encoding = self.options.get(
  'encoding', self.state.document.settings.input_encoding)
  e_handler=self.state.document.settings.input_encoding_error_handler

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 15
-SUBLEVEL = 159
+SUBLEVEL = 160
 EXTRAVERSION =
 NAME = Trick or Treat
 

arch/x86/kvm/x86.c

@@ -9134,13 +9134,20 @@ int kvm_check_nested_events(struct kvm_vcpu *vcpu)
 
 static void kvm_inject_exception(struct kvm_vcpu *vcpu)
 {
+ /*
+ * Suppress the error code if the vCPU is in Real Mode, as Real Mode
+ * exceptions don't report error codes. The presence of an error code
+ * is carried with the exception and only stripped when the exception
+ * is injected as intercepted #PF VM-Exits for AMD's Paged Real Mode do
+ * report an error code despite the CPU being in Real Mode.
+ */
+ vcpu->arch.exception.has_error_code &= is_protmode(vcpu);
+
  trace_kvm_inj_exception(vcpu->arch.exception.nr,
  vcpu->arch.exception.has_error_code,
  vcpu->arch.exception.error_code,
  vcpu->arch.exception.injected);
 
- if (vcpu->arch.exception.error_code && !is_protmode(vcpu))
- vcpu->arch.exception.error_code = false;
  static_call(kvm_x86_queue_exception)(vcpu);
 }
 

drivers/android/binder.c

@@ -5165,7 +5165,7 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
  goto err;
  break;
  case BINDER_SET_MAX_THREADS: {
- int max_threads;
+ u32 max_threads;
 
  if (copy_from_user(&max_threads, ubuf,
  sizeof(max_threads))) {

drivers/android/binder_internal.h

@@ -420,7 +420,7 @@ struct binder_proc {
  struct list_head todo;
  struct binder_stats stats;
  struct list_head delivered_death;
- int max_threads;
+ u32 max_threads;
  int requested_threads;
  int requested_threads_started;
  int tmp_ref;

drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c

@@ -820,6 +820,9 @@ int amdgpu_ras_query_error_status(struct amdgpu_device *adev,
  if (!obj)
  return -EINVAL;
 
+ if (!info || info->head.block == AMDGPU_RAS_BLOCK_COUNT)
+ return -EINVAL;
+
  switch (info->head.block) {
  case AMDGPU_RAS_BLOCK__UMC:
  if (adev->umc.ras_funcs &&

drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c

@@ -939,7 +939,12 @@ static bool setup_dsc_config(
  if (!is_dsc_possible)
  goto done;
 
- dsc_cfg->num_slices_v = pic_height/slice_height;
+ if (slice_height > 0) {
+ dsc_cfg->num_slices_v = pic_height / slice_height;
+ } else {
+ is_dsc_possible = false;
+ goto done;
+ }
 
  if (target_bandwidth_kbps > 0) {
  is_dsc_possible = decide_dsc_target_bpp_x16(

drivers/net/ethernet/broadcom/genet/bcmgenet.c

@@ -2424,14 +2424,18 @@ static void umac_enable_set(struct bcmgenet_priv *priv, u32 mask, bool enable)
 {
  u32 reg;
 
+ spin_lock_bh(&priv->reg_lock);
  reg = bcmgenet_umac_readl(priv, UMAC_CMD);
- if (reg & CMD_SW_RESET)
+ if (reg & CMD_SW_RESET) {
+ spin_unlock_bh(&priv->reg_lock);
  return;
+ }
  if (enable)
  reg |= mask;
  else
  reg &= ~mask;
  bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+ spin_unlock_bh(&priv->reg_lock);
 
  /* UniMAC stops on a packet boundary, wait for a full-size packet
  * to be processed
@@ -2447,8 +2451,10 @@ static void reset_umac(struct bcmgenet_priv *priv)
  udelay(10);
 
  /* issue soft reset and disable MAC while updating its registers */
+ spin_lock_bh(&priv->reg_lock);
  bcmgenet_umac_writel(priv, CMD_SW_RESET, UMAC_CMD);
  udelay(2);
+ spin_unlock_bh(&priv->reg_lock);
 }
 
 static void bcmgenet_intr_disable(struct bcmgenet_priv *priv)
@@ -3576,16 +3582,19 @@ static void bcmgenet_set_rx_mode(struct net_device *dev)
  * 3. The number of filters needed exceeds the number filters
  * supported by the hardware.
  */
+ spin_lock(&priv->reg_lock);
  reg = bcmgenet_umac_readl(priv, UMAC_CMD);
  if ((dev->flags & (IFF_PROMISC | IFF_ALLMULTI)) ||
  (nfilter > MAX_MDF_FILTER)) {
  reg |= CMD_PROMISC;
  bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+ spin_unlock(&priv->reg_lock);
  bcmgenet_umac_writel(priv, 0, UMAC_MDF_CTRL);
  return;
  } else {
  reg &= ~CMD_PROMISC;
  bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+ spin_unlock(&priv->reg_lock);
  }
 
  /* update MDF filter */
@@ -3979,6 +3988,7 @@ static int bcmgenet_probe(struct platform_device *pdev)
  goto err;
  }
 
+ spin_lock_init(&priv->reg_lock);
  spin_lock_init(&priv->lock);
 
  SET_NETDEV_DEV(dev, &pdev->dev);

drivers/net/ethernet/broadcom/genet/bcmgenet.h

@@ -572,6 +572,8 @@ struct bcmgenet_rxnfc_rule {
 /* device context */
 struct bcmgenet_priv {
  void __iomem *base;
+ /* reg_lock: lock to serialize access to shared registers */
+ spinlock_t reg_lock;
  enum bcmgenet_version version;
  struct net_device *dev;
 

drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c

@@ -133,13 +133,15 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv,
  }
 
  /* Can't suspend with WoL if MAC is still in reset */
+ spin_lock_bh(&priv->reg_lock);
  reg = bcmgenet_umac_readl(priv, UMAC_CMD);
  if (reg & CMD_SW_RESET)
  reg &= ~CMD_SW_RESET;
 
  /* disable RX */
  reg &= ~CMD_RX_EN;
  bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+ spin_unlock_bh(&priv->reg_lock);
  mdelay(10);
 
  if (priv->wolopts & (WAKE_MAGIC | WAKE_MAGICSECURE)) {
@@ -185,13 +187,15 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv,
  }
 
  /* Enable CRC forward */
+ spin_lock_bh(&priv->reg_lock);
  reg = bcmgenet_umac_readl(priv, UMAC_CMD);
  priv->crc_fwd_en = 1;
  reg |= CMD_CRC_FWD;
 
  /* Receiver must be enabled for WOL MP detection */
  reg |= CMD_RX_EN;
  bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+ spin_unlock_bh(&priv->reg_lock);
 
  reg = UMAC_IRQ_MPD_R;
  if (hfb_enable)
@@ -238,7 +242,9 @@ void bcmgenet_wol_power_up_cfg(struct bcmgenet_priv *priv,
  }
 
  /* Disable CRC Forward */
+ spin_lock_bh(&priv->reg_lock);
  reg = bcmgenet_umac_readl(priv, UMAC_CMD);
  reg &= ~CMD_CRC_FWD;
  bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+ spin_unlock_bh(&priv->reg_lock);
 }

drivers/net/ethernet/broadcom/genet/bcmmii.c

@@ -91,6 +91,7 @@ void bcmgenet_mii_setup(struct net_device *dev)
  reg |= RGMII_LINK;
  bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);
 
+ spin_lock_bh(&priv->reg_lock);
  reg = bcmgenet_umac_readl(priv, UMAC_CMD);
  reg &= ~((CMD_SPEED_MASK << CMD_SPEED_SHIFT) |
  CMD_HD_EN |
@@ -103,6 +104,7 @@ void bcmgenet_mii_setup(struct net_device *dev)
  reg |= CMD_TX_EN | CMD_RX_EN;
  }
  bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+ spin_unlock_bh(&priv->reg_lock);
 
  priv->eee.eee_active = phy_init_eee(phydev, 0) >= 0;
  bcmgenet_eee_enable_set(dev,
@@ -264,6 +266,7 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
  * block for the interface to work
  */
  if (priv->ext_phy) {
+ mutex_lock(&phydev->lock);
  reg = bcmgenet_ext_readl(priv, EXT_RGMII_OOB_CTRL);
  reg &= ~ID_MODE_DIS;
  reg |= id_mode_dis;
@@ -272,6 +275,7 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
  else
  reg |= RGMII_MODE_EN;
  bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);
+ mutex_unlock(&phydev->lock);
  }
 
  if (init)

drivers/pinctrl/core.c

@@ -205,6 +205,7 @@ static int pinctrl_register_one_pin(struct pinctrl_dev *pctldev,
  const struct pinctrl_pin_desc *pin)
 {
  struct pin_desc *pindesc;
+ int error;
 
  pindesc = pin_desc_get(pctldev, pin->number);
  if (pindesc) {
@@ -226,18 +227,25 @@ static int pinctrl_register_one_pin(struct pinctrl_dev *pctldev,
  } else {
  pindesc->name = kasprintf(GFP_KERNEL, "PIN%u", pin->number);
  if (!pindesc->name) {
- kfree(pindesc);
- return -ENOMEM;
+ error = -ENOMEM;
+ goto failed;
  }
  pindesc->dynamic_name = true;
  }
 
  pindesc->drv_data = pin->drv_data;
 
- radix_tree_insert(&pctldev->pin_desc_tree, pin->number, pindesc);
+ error = radix_tree_insert(&pctldev->pin_desc_tree, pin->number, pindesc);
+ if (error)
+ goto failed;
+
  pr_debug("registered pin %d (%s) on %s\n",
  pin->number, pindesc->name, pctldev->desc->name);
  return 0;
+
+failed:
+ kfree(pindesc);
+ return error;
 }
 
 static int pinctrl_register_pins(struct pinctrl_dev *pctldev,

drivers/remoteproc/mtk_scp.c

@@ -126,7 +126,7 @@ static int scp_elf_read_ipi_buf_addr(struct mtk_scp *scp,
 static int scp_ipi_init(struct mtk_scp *scp, const struct firmware *fw)
 {
  int ret;
- size_t offset;
+ size_t buf_sz, offset;
 
  /* read the ipi buf addr from FW itself first */
  ret = scp_elf_read_ipi_buf_addr(scp, fw, &offset);
@@ -138,6 +138,14 @@ static int scp_ipi_init(struct mtk_scp *scp, const struct firmware *fw)
  }
  dev_info(scp->dev, "IPI buf addr %#010zx\n", offset);
 
+ /* Make sure IPI buffer fits in the L2TCM range assigned to this core */
+ buf_sz = sizeof(*scp->recv_buf) + sizeof(*scp->send_buf);
+
+ if (scp->sram_size < buf_sz + offset) {
+ dev_err(scp->dev, "IPI buffer does not fit in SRAM.\n");
+ return -EOVERFLOW;
+ }
+
  scp->recv_buf = (struct mtk_share_obj __iomem *)
  (scp->sram_base + offset);
  scp->send_buf = (struct mtk_share_obj __iomem *)

drivers/tty/serial/kgdboc.c

@@ -19,6 +19,7 @@
 #include <linux/console.h>
 #include <linux/vt_kern.h>
 #include <linux/input.h>
+#include <linux/irq_work.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/serial_core.h>
@@ -48,6 +49,25 @@ static struct kgdb_io kgdboc_earlycon_io_ops;
 static int (*earlycon_orig_exit)(struct console *con);
 #endif /* IS_BUILTIN(CONFIG_KGDB_SERIAL_CONSOLE) */
 
+/*
+ * When we leave the debug trap handler we need to reset the keyboard status
+ * (since the original keyboard state gets partially clobbered by kdb use of
+ * the keyboard).
+ *
+ * The path to deliver the reset is somewhat circuitous.
+ *
+ * To deliver the reset we register an input handler, reset the keyboard and
+ * then deregister the input handler. However, to get this done right, we do
+ * have to carefully manage the calling context because we can only register
+ * input handlers from task context.
+ *
+ * In particular we need to trigger the action from the debug trap handler with
+ * all its NMI and/or NMI-like oddities. To solve this the kgdboc trap exit code
+ * (the "post_exception" callback) uses irq_work_queue(), which is NMI-safe, to
+ * schedule a callback from a hardirq context. From there we have to defer the
+ * work again, this time using schedule_work(), to get a callback using the
+ * system workqueue, which runs in task context.
+ */
 #ifdef CONFIG_KDB_KEYBOARD
 static int kgdboc_reset_connect(struct input_handler *handler,
  struct input_dev *dev,
@@ -99,10 +119,17 @@ static void kgdboc_restore_input_helper(struct work_struct *dummy)
 
 static DECLARE_WORK(kgdboc_restore_input_work, kgdboc_restore_input_helper);
 
+static void kgdboc_queue_restore_input_helper(struct irq_work *unused)
+{
+ schedule_work(&kgdboc_restore_input_work);
+}
+
+static DEFINE_IRQ_WORK(kgdboc_restore_input_irq_work, kgdboc_queue_restore_input_helper);
+
 static void kgdboc_restore_input(void)
 {
  if (likely(system_state == SYSTEM_RUNNING))
- schedule_work(&kgdboc_restore_input_work);
+ irq_work_queue(&kgdboc_restore_input_irq_work);
 }
 
 static int kgdboc_register_kbd(char **cptr)
@@ -133,6 +160,7 @@ static void kgdboc_unregister_kbd(void)
  i--;
  }
  }
+ irq_work_sync(&kgdboc_restore_input_irq_work);
  flush_work(&kgdboc_restore_input_work);
 }
 #else /* ! CONFIG_KDB_KEYBOARD */

drivers/usb/typec/ucsi/displayport.c

@@ -275,8 +275,6 @@ static void ucsi_displayport_work(struct work_struct *work)
  struct ucsi_dp *dp = container_of(work, struct ucsi_dp, work);
  int ret;
 
- mutex_lock(&dp->con->lock);
-
  ret = typec_altmode_vdm(dp->alt, dp->header,
  dp->vdo_data, dp->vdo_size);
  if (ret)
@@ -285,8 +283,6 @@ static void ucsi_displayport_work(struct work_struct *work)
  dp->vdo_data = NULL;
  dp->vdo_size = 0;
  dp->header = 0;
-
- mutex_unlock(&dp->con->lock);
 }
 
 void ucsi_displayport_remove_partner(struct typec_altmode *alt)

fs/nfs/callback.c

@@ -80,9 +80,6 @@ nfs4_callback_svc(void *vrqstp)
  set_freezable();
 
  while (!kthread_freezable_should_stop(NULL)) {
-
- if (signal_pending(current))
- flush_signals(current);
  /*
  * Listen for a request on the socket
  */
@@ -112,11 +109,7 @@ nfs41_callback_svc(void *vrqstp)
  set_freezable();
 
  while (!kthread_freezable_should_stop(NULL)) {
-
- if (signal_pending(current))
- flush_signals(current);
-
- prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_INTERRUPTIBLE);
+ prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_IDLE);
  spin_lock_bh(&serv->sv_cb_lock);
  if (!list_empty(&serv->sv_cb_list)) {
  req = list_first_entry(&serv->sv_cb_list,