The T241 platform suffers from the T241-FABRIC-4 erratum which causes
unexpected behavior in the GIC when multiple transactions are received
simultaneously from different sources. This hardware issue impacts
NVIDIA server platforms that use more than two T241 chips
interconnected. Each chip has support for 320 {E}SPIs.

This issue occurs when multiple packets from different GICs are
incorrectly interleaved at the target chip. The erratum text below
specifies exactly what can cause multiple transfer packets susceptible
to interleaving and GIC state corruption. GIC state corruption can
lead to a range of problems, including kernel panics, and unexpected
behavior.

>From the erratum text:
  "In some cases, inter-socket AXI4 Stream packets with multiple
  transfers, may be interleaved by the fabric when presented to ARM
  Generic Interrupt Controller. GIC expects all transfers of a packet
  to be delivered without any interleaving.

  The following GICv3 commands may result in multiple transfer packets
  over inter-socket AXI4 Stream interface:
   - Register reads from GICD_I* and GICD_N*
   - Register writes to 64-bit GICD registers other than GICD_IROUTERn*
   - ITS command MOVALL

  Multiple commands in GICv4+ utilize multiple transfer packets,
  including VMOVP, VMOVI, VMAPP, and 64-bit register accesses."

  This issue impacts system configurations with more than 2 sockets,
  that require multi-transfer packets to be sent over inter-socket
  AXI4 Stream interface between GIC instances on different sockets.
  GICv4 cannot be supported. GICv3 SW model can only be supported
  with the workaround. Single and Dual socket configurations are not
  impacted by this issue and support GICv3 and GICv4."

Link: https://developer.nvidia.com/docs/t241-fabric-4/nvidia-t241-fabric-4-errata.pdf

Writing to the chip alias region of the GICD_In{E} registers except
GICD_ICENABLERn has an equivalent effect as writing to the global
distributor. The SPI interrupt deactivate path is not impacted by
the erratum.

To fix this problem, implement a workaround that ensures read accesses
to the GICD_In{E} registers are directed to the chip that owns the
SPI, and disable GICv4.x features. To simplify code changes, the
gic_configure_irq() function uses the same alias region for both read
and write operations to GICD_ICFGR.
Co-developed-by: Vikram Sethi <vsethi@nvidia.com>
Signed-off-by: Vikram Sethi <vsethi@nvidia.com>
Signed-off-by: Shanker Donthineni <sdonthineni@nvidia.com>
Acked-by: Sudeep Holla <sudeep.holla@arm.com> (for SMCCC/SOC ID bits)
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230319024314.3540573-2-sdonthineni@nvidia.com

With the last non-OF, non-ACPI user of the GIC being removed in
e73307b9 ("ARM: cns3xxx: remove entire platform"), we can finally
drop the entry point and do some minor cleanup.

We also make the driver depend on CONFIG_OF, which is required
even when CONFIG_ACPI is selected.
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230315130218.3212033-1-maz@kernel.org

Pull tracing fixes from Steven Rostedt:

 - Fix setting affinity of hwlat threads in containers

   Using sched_set_affinity() has unwanted side effects when being
   called within a container. Use set_cpus_allowed_ptr() instead

 - Fix per cpu thread management of the hwlat tracer:
    - Do not start per_cpu threads if one is already running for the CPU
    - When starting per_cpu threads, do not clear the kthread variable
      as it may already be set to running per cpu threads

 - Fix return value for test_gen_kprobe_cmd()

   On error the return value was overwritten by being set to the result
   of the call from kprobe_event_delete(), which would likely succeed,
   and thus have the function return success

 - Fix splice() reads from the trace file that was broken by commit
   36e2c742 ("fs: don't allow splice read/write without explicit
   ops")

 - Remove obsolete and confusing comment in ring_buffer.c

   The original design of the ring buffer used struct page flags for
   tricks to optimize, which was shortly removed due to them being
   tricks. But a comment for those tricks remained

 - Set local functions and variables to static

* tag 'trace-v6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing/hwlat: Replace sched_setaffinity with set_cpus_allowed_ptr
  ring-buffer: remove obsolete comment for free_buffer_page()
  tracing: Make splice_read available again
  ftrace: Set direct_ops storage-class-specifier to static
  trace/hwlat: Do not start per-cpu thread if it is already running
  trace/hwlat: Do not wipe the contents of per-cpu thread data
  tracing/osnoise: set several trace_osnoise.c variables storage-class-specifier to static
  tracing: Fix wrong return in kprobe_event_gen_test.c

There is a problem with the behavior of hwlat in a container,
resulting in incorrect output. A warning message is generated:
"cpumask changed while in round-robin mode, switching to mode none",
and the tracing_cpumask is ignored. This issue arises because
the kernel thread, hwlatd, is not a part of the container, and
the function sched_setaffinity is unable to locate it using its PID.
Additionally, the task_struct of hwlatd is already known.
Ultimately, the function set_cpus_allowed_ptr achieves
the same outcome as sched_setaffinity, but employs task_struct
instead of PID.

Test case:

  # cd /sys/kernel/tracing
  # echo 0 > tracing_on
  # echo round-robin > hwlat_detector/mode
  # echo hwlat > current_tracer
  # unshare --fork --pid bash -c 'echo 1 > tracing_on'
  # dmesg -c

Actual behavior:

[573502.809060] hwlat_detector: cpumask changed while in round-robin mode, switching to mode none

Link: https://lore.kernel.org/linux-trace-kernel/20230316144535.1004952-1-costa.shul@redhat.com

Cc: Masami Hiramatsu <mhiramat@kernel.org>
Fixes: 0330f7aa ("tracing: Have hwlat trace migrate across tracing_cpumask CPUs")
Signed-off-by: Costa Shulyupin <costa.shul@redhat.com>
Acked-by: Daniel Bristot de Oliveira <bristot@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

The comment refers to mm/slob.c which is being removed. It comes from
commit ed56829c ("ring_buffer: reset buffer page when freeing") and
according to Steven the borrowed code was a page mapcount and mapping
reset, which was later removed by commit e4c2ce82 ("ring_buffer:
allocate buffer page pointer"). Thus the comment is not accurate anyway,
remove it.

Link: https://lore.kernel.org/linux-trace-kernel/20230315142446.27040-1-vbabka@suse.cz

Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Ingo Molnar <mingo@elte.hu>
Reported-by: Mike Rapoport <mike.rapoport@gmail.com>
Suggested-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Fixes: e4c2ce82 ("ring_buffer: allocate buffer page pointer")
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Reviewed-by: Mukesh Ojha <quic_mojha@quicinc.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Since the commit 36e2c742 ("fs: don't allow splice read/write
without explicit ops") is applied to the kernel, splice() and
sendfile() calls on the trace file (/sys/kernel/debug/tracing
/trace) return EINVAL.

This patch restores these system calls by initializing splice_read
in file_operations of the trace file. This patch only enables such
functionalities for the read case.

Link: https://lore.kernel.org/linux-trace-kernel/20230314013707.28814-1-sfoon.kim@samsung.com

Cc: stable@vger.kernel.org
Fixes: 36e2c742 ("fs: don't allow splice read/write without explicit ops")
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Pull tty/serial driver fixes from Greg KH:
 "Here are some small tty and serial driver fixes for 6.3-rc3 to resolve
  some reported issues.

  They include:

   - 8250 driver Kconfig issue pointed out by you that showed up in -rc1

   - qcom-geni serial driver fixes

   - various 8250 driver fixes for reported problems

   - fsl_lpuart driver fixes

   - serdev fix for regression in -rc1

   - vt.c bugfix

  All have been in linux-next for over a week with no reported problems"

* tag 'tty-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  tty: vt: protect KD_FONT_OP_GET_TALL from unbound access
  serial: qcom-geni: drop bogus uart_write_wakeup()
  serial: qcom-geni: fix mapping of empty DMA buffer
  serial: qcom-geni: fix DMA mapping leak on shutdown
  serial: qcom-geni: fix console shutdown hang
  serdev: Set fwnode for serdev devices
  tty: serial: fsl_lpuart: fix race on RX DMA shutdown
  serial: 8250_pci1xxxx: Disable SERIAL_8250_PCI1XXXX config by default
  serial: 8250_fsl: fix handle_irq locking
  serial: 8250_em: Fix UART port type
  serial: 8250: ASPEED_VUART: select REGMAP instead of depending on it
  tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
  Revert "tty: serial: fsl_lpuart: adjust SERIAL_FSL_LPUART_CONSOLE config dependency"

Pull char/misc driver fixes from Greg KH:
 "Here are a few small char/misc/other driver subsystem patches to
  resolve reported problems for 6.3-rc3.

  Included in here are:

   - Interconnect driver fixes for reported problems

   - Memory driver fixes for reported problems

   - nvmem core fix

   - firmware driver fix for reported problem

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'char-misc-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (23 commits)
  memory: tegra30-emc: fix interconnect registration race
  memory: tegra20-emc: fix interconnect registration race
  memory: tegra124-emc: fix interconnect registration race
  memory: tegra: fix interconnect registration race
  interconnect: exynos: drop redundant link destroy
  interconnect: exynos: fix registration race
  interconnect: exynos: fix node leak in probe PM QoS error path
  interconnect: qcom: msm8974: fix registration race
  interconnect: qcom: rpmh: fix registration race
  interconnect: qcom: rpmh: fix probe child-node error handling
  interconnect: qcom: rpm: fix registration race
  nvmem: core: return -ENOENT if nvmem cell is not found
  firmware: xilinx: don't make a sleepable memory allocation from an atomic context
  interconnect: qcom: rpm: fix probe child-node error handling
  interconnect: qcom: osm-l3: fix registration race
  interconnect: imx: fix registration race
  interconnect: fix provider registration API
  interconnect: fix icc_provider_del() error handling
  interconnect: fix mem leak when freeing nodes
  interconnect: qcom: qcm2290: Fix MASTER_SNOC_BIMC_NRT
  ...

Pull RAS fix from Borislav Petkov:

 - Flush out logged errors immediately after MCA banks configuration
   changes over sysfs have been done instead of waiting until something
   else triggers the workqueue later - another error or the polling
   interval cycle is reached

* tag 'ras_urgent_for_v6.3_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/mce: Make sure logged MCEs are processed after sysfs update

Pull perf fixes from Borislav Petkov:

 - Check whether sibling events have been deactivated before adding them
   to groups

 - Update the proper event time tracking variable depending on the event
   type

 - Fix a memory overwrite issue due to using the wrong function argument
   when outputting perf events

* tag 'perf_urgent_for_v6.3_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf: Fix check before add_event_to_groups() in perf_group_detach()
  perf: fix perf_event_context->time
  perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output

Pull x86 fixes from Borislav Petkov:
 "There's a little bit more 'movement' in there for my taste but it
  needs to happen and should make the code better after it.

   - Check cmdline_find_option()'s return value before further
     processing

   - Clear temporary storage in the resctrl code to prevent access to an
     unexistent MSR

   - Add a simple throttling mechanism to protect the hypervisor from
     potentially malicious SEV guests issuing requests in rapid
     succession.

     In order to not jeopardize the sanity of everyone involved in
     maintaining this code, the request issuing side has received a
     cleanup, split in more or less trivial, small and digestible
     pieces. Otherwise, the code was threatening to become an
     unmaintainable mess.

     Therefore, that cleanup is marked indirectly also for stable so
     that there's no differences between the upstream code and the
     stable variant when it comes down to backporting more there"

* tag 'x86_urgent_for_v6.3_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/mm: Fix use of uninitialized buffer in sme_enable()
  x86/resctrl: Clear staged_config[] before and after it is used
  virt/coco/sev-guest: Add throttling awareness
  virt/coco/sev-guest: Convert the sw_exit_info_2 checking to a switch-case
  virt/coco/sev-guest: Do some code style cleanups
  virt/coco/sev-guest: Carve out the request issuing logic into a helper
  virt/coco/sev-guest: Remove the disable_vmpck label in handle_guest_request()
  virt/coco/sev-guest: Simplify extended guest request handling
  virt/coco/sev-guest: Check SEV_SNP attribute at probe time

Pull ext4 fix from Ted Ts'o:
 "Fix a double unlock bug on an error path in ext4, found by smatch and
  syzkaller"

* tag 'ext4_for_linus_urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  ext4: fix possible double unlock when moving a directory

smatch reports this warning
kernel/trace/ftrace.c:2594:19: warning:
  symbol 'direct_ops' was not declared. Should it be static?

The variable direct_ops is only used in ftrace.c, so it should be static

Link: https://lore.kernel.org/linux-trace-kernel/20230311135113.711824-1-trix@redhat.comSigned-off-by: Tom Rix <trix@redhat.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

The hwlatd tracer will end up starting multiple per-cpu threads with
the following script:

    #!/bin/sh
    cd /sys/kernel/debug/tracing
    echo 0 > tracing_on
    echo hwlat > current_tracer
    echo per-cpu > hwlat_detector/mode
    echo 100000 > hwlat_detector/width
    echo 200000 > hwlat_detector/window
    echo 1 > tracing_on

To fix the issue, check if the hwlatd thread for the cpu is already
running, before starting a new one. Along with the previous patch, this
avoids running multiple instances of the same CPU thread on the system.

Link: https://lore.kernel.org/all/20230302113654.2984709-1-tero.kristo@linux.intel.com/
Link: https://lkml.kernel.org/r/20230310100451.3948583-3-tero.kristo@linux.intel.com

Cc: stable@vger.kernel.org
Fixes: f46b1652 ("trace/hwlat: Implement the per-cpu mode")
Signed-off-by: Tero Kristo <tero.kristo@linux.intel.com>
Acked-by: Daniel Bristot de Oliveira <bristot@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Do not wipe the contents of the per-cpu kthread data when starting the
tracer, as this will completely forget about already running instances
and can later start new additional per-cpu threads.

Link: https://lore.kernel.org/all/20230302113654.2984709-1-tero.kristo@linux.intel.com/
Link: https://lkml.kernel.org/r/20230310100451.3948583-2-tero.kristo@linux.intel.com

Cc: stable@vger.kernel.org
Fixes: f46b1652 ("trace/hwlat: Implement the per-cpu mode")
Signed-off-by: Tero Kristo <tero.kristo@linux.intel.com>
Acked-by: Daniel Bristot de Oliveira <bristot@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

smatch reports several similar warnings
kernel/trace/trace_osnoise.c:220:1: warning:
  symbol '__pcpu_scope_per_cpu_osnoise_var' was not declared. Should it be static?
kernel/trace/trace_osnoise.c:243:1: warning:
  symbol '__pcpu_scope_per_cpu_timerlat_var' was not declared. Should it be static?
kernel/trace/trace_osnoise.c:335:14: warning:
  symbol 'interface_lock' was not declared. Should it be static?
kernel/trace/trace_osnoise.c:2242:5: warning:
  symbol 'timerlat_min_period' was not declared. Should it be static?
kernel/trace/trace_osnoise.c:2243:5: warning:
  symbol 'timerlat_max_period' was not declared. Should it be static?

These variables are only used in trace_osnoise.c, so it should be static

Link: https://lore.kernel.org/linux-trace-kernel/20230309150414.4036764-1-trix@redhat.comSigned-off-by: Tom Rix <trix@redhat.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Daniel Bristot de Oliveira <bristot@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Overwriting the error code with the deletion result may cause the
function to return 0 despite encountering an error. Commit b111545d
("tracing: Remove the useless value assignment in
test_create_synth_event()") solves a similar issue by
returning the original error code, so this patch does the same.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Link: https://lore.kernel.org/linux-trace-kernel/20230131075818.5322-1-aagusev@ispras.ruSigned-off-by: Anton Gusev <aagusev@ispras.ru>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Pull fbdev fixes from Helge Deller:
 "The majority of lines changed is due to a code style cleanup in the
  pnmtologo helper program.

  Arnd removed the omap1 osk driver and the SIS fb driver is now
  orphaned.

  Other than that it's the usual bunch of small fixes and cleanups, e.g.
  prevent possible divide-by-zero in various fb drivers if the pixclock
  is zero and various conversions to devm_platform*() and of_property*()
  functions:

   - Drop omap1 osk driver

   - Various potential divide by zero pixclock fixes

   - Add pixelclock and fb_check_var() to stifb

   - Code style cleanups and indenting fixes"

* tag 'fbdev-for-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
  fbdev: Use of_property_present() for testing DT property presence
  fbdev: au1200fb: Fix potential divide by zero
  fbdev: lxfb: Fix potential divide by zero
  fbdev: intelfb: Fix potential divide by zero
  fbdev: nvidia: Fix potential divide by zero
  fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
  fbdev: omapfb: remove omap1 osk driver
  fbdev: xilinxfb: Use devm_platform_get_and_ioremap_resource()
  fbdev: wm8505fb: Use devm_platform_ioremap_resource()
  fbdev: pxa3xx-gcu: Use devm_platform_get_and_ioremap_resource()
  fbdev: Use of_property_read_bool() for boolean properties
  fbdev: clps711x-fb: Use devm_platform_get_and_ioremap_resource()
  fbdev: tgafb: Fix potential divide by zero
  MAINTAINERS: orphan SIS FRAMEBUFFER DRIVER
  fbdev: omapfb: cleanup inconsistent indentation
  drivers: video: logo: add SPDX comment, remove GPL notice in pnmtologo.c
  drivers: video: logo: fix code style issues in pnmtologo.c

Merge tag 'kbuild-fixes-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild

Pull Kbuild fixes from Masahiro Yamada:

 - Exclude kallsyms_seqs_of_names from kallsyms to fix build error

 - Fix 'make kernelrelease' for external module builds

 - Get the Debian source package compilable again

 - Fix the wrong uname when Debian packages are built with the
   KDEB_PKGVERSION option

 - Fix superfluous CROSS_COMPILE when building Debian packages

 - Fix RPM package build error when KCONFIG_CONFIG is set

 - Use 'git archive' for creating source tarballs

 - Remove the scripts/list-gitignored tool

* tag 'kbuild-fixes-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
  kbuild: use git-archive for source package creation
  kbuild: rpm-pkg: move source components to rpmbuild/SOURCES
  kbuild: deb-pkg: use dh_listpackages to know enabled packages
  kbuild: deb-pkg: split image and debug objects staging out into functions
  kbuild: deb-pkg: set CROSS_COMPILE only when undefined
  kbuild: deb-pkg: do not take KERNELRELEASE from the source version
  kbuild: deb-pkg: make debian source package working again
  Makefile: Make kernelrelease target work with M=
  kconfig: Update config changed flag before calling callback
  kallsyms: add kallsyms_seqs_of_names to list of special symbols

Merge tag 'hwmon-for-v6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:

 - ltc2992, adm1266: Set missing can_sleep flag

 - tmp512/tmp513: Drop of_match_ptr for ID table to fix build with
   !CONFIG_OF

 - ucd90320: Fix back-to-back access problem

 - ina3221: Fix bad error return from probe function

 - xgene: Fix use-after-free bug in remove function

 - adt7475: Fix hysteresis register bit masks, and fix association of
   'smoothing' attributes

* tag 'hwmon-for-v6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip
  hwmon: (adm1266) Set `can_sleep` flag for GPIO chip
  hwmon: tmp512: drop of_match_ptr for ID table
  hwmon: (ucd90320) Add minimum delay between bus accesses
  hwmon: (ina3221) return prober error code
  hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
  hwmon: (adt7475) Fix masking of hysteresis registers
  hwmon: (adt7475) Display smoothing attributes in correct order

Pull ata fixes from Damien Le Moal:

 - Two fixes from Ondrej for the pata_parport driver to address an issue
   with error handling during drive connection and to fix memory leaks
   in case of errors during initialization and when disconnecting a
   device.

* tag 'ata-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata:
  ata: pata_parport: fix memory leaks
  ata: pata_parport: fix parport release without claim

The __find_restype() function loops over the m5mols_default_ffmt[]
array, and the termination condition ends up being wrong: instead of
stopping when the iterator becomes the size of the array it traverses,
it stops after it has already overshot the array.

Now, in practice this doesn't likely matter, because the code will
always find the entry it looks for, and will thus return early and never
hit that last extra iteration.

But it turns out that clang will unroll the loop fully, because it has
only two iterations (well, three due to the off-by-one bug), and then
clang will end up just giving up in the middle of the loop unrolling
when it notices that the code walks past the end of the array.

And that made 'objtool' very unhappy indeed, because the generated code
just falls off the edge of the universe, and ends up falling through to
the next function, causing this warning:

   drivers/media/i2c/m5mols/m5mols.o: warning: objtool: m5mols_set_fmt() falls through to next function m5mols_get_frame_desc()

Fix the loop ending condition.
Reported-by: Jens Axboe <axboe@kernel.dk>
Analyzed-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Analyzed-by: Nick Desaulniers <ndesaulniers@google.com>
Link: https://lore.kernel.org/linux-block/CAHk-=wgTSdKYbmB1JYM5vmHMcD9J9UZr0mn7BOYM_LudrP+Xvw@mail.gmail.com/
Fixes: bc125106 ("[media] Add support for M-5MOLS 8 Mega Pixel camera ISP")
Cc: HeungJun, Kim <riverful.kim@samsung.com>
Cc: Sylwester Nawrocki <s.nawrocki@samsung.com>
Cc: Kyungmin Park <kyungmin.park@samsung.com>
Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fixes: 0813299c ("ext4: Fix possible corruption when moving a directory")
Link: https://lore.kernel.org/r/5efbe1b9-ad8b-4a4f-b422-24824d2b775c@kili.mountainReported-by: Dan Carpenter <error27@gmail.com>
Reported-by: syzbot+0c73d1d8b952c5f3d714@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>

Pull networking fixes from Jakub Kicinski:
 "Including fixes from netfilter, wifi and ipsec.

  A little more changes than usual, but it's pretty normal for us that
  the rc3/rc4 PRs are oversized as people start testing in earnest.

  Possibly an extra boost from people deploying the 6.1 LTS but that's
  more of an unscientific hunch.

  Current release - regressions:

   - phy: mscc: fix deadlock in phy_ethtool_{get,set}_wol()

   - virtio: vsock: don't use skbuff state to account credit

   - virtio: vsock: don't drop skbuff on copy failure

   - virtio_net: fix page_to_skb() miscalculating the memory size

  Current release - new code bugs:

   - eth: correct xdp_features after device reconfig

   - wifi: nl80211: fix the puncturing bitmap policy

   - net/mlx5e: flower:
      - fix raw counter initialization
      - fix missing error code
      - fix cloned flow attribute

   - ipa:
      - fix some register validity checks
      - fix a surprising number of bad offsets
      - kill FILT_ROUT_CACHE_CFG IPA register

  Previous releases - regressions:

   - tcp: fix bind() conflict check for dual-stack wildcard address

   - veth: fix use after free in XDP_REDIRECT when skb headroom is small

   - ipv4: fix incorrect table ID in IOCTL path

   - ipvlan: make skb->skb_iif track skb->dev for l3s mode

   - mptcp:
      - fix possible deadlock in subflow_error_report
      - fix UaFs when destroying unaccepted and listening sockets

   - dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290

  Previous releases - always broken:

   - tcp: tcp_make_synack() can be called from process context, don't
     assume preemption is disabled when updating stats

   - netfilter: correct length for loading protocol registers

   - virtio_net: add checking sq is full inside xdp xmit

   - bonding: restore IFF_MASTER/SLAVE flags on bond enslave Ethertype
     change

   - phy: nxp-c45-tja11xx: fix MII_BASIC_CONFIG_REV bit number

   - eth: i40e: fix crash during reboot when adapter is in recovery mode

   - eth: ice: avoid deadlock on rtnl lock when auxiliary device
     plug/unplug meets bonding

   - dsa: mt7530:
      - remove now incorrect comment regarding port 5
      - set PLL frequency and trgmii only when trgmii is used

   - eth: mtk_eth_soc: reset PCS state when changing interface types

  Misc:

   - ynl: another license adjustment

   - move the TCA_EXT_WARN_MSG attribute for tc action"

* tag 'net-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (108 commits)
  selftests: bonding: add tests for ether type changes
  bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
  bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change
  net: renesas: rswitch: Fix GWTSDIE register handling
  net: renesas: rswitch: Fix the output value of quote from rswitch_rx()
  ethernet: sun: add check for the mdesc_grab()
  net: ipa: fix some register validity checks
  net: ipa: kill FILT_ROUT_CACHE_CFG IPA register
  net: ipa: add two missing declarations
  net: ipa: reg: include <linux/bug.h>
  net: xdp: don't call notifiers during driver init
  net/sched: act_api: add specific EXT_WARN_MSG for tc action
  Revert "net/sched: act_api: move TCA_EXT_WARN_MSG to the correct hierarchy"
  net: dsa: microchip: fix RGMII delay configuration on KSZ8765/KSZ8794/KSZ8795
  ynl: make the tooling check the license
  ynl: broaden the license even more
  tools: ynl: make definitions optional again
  hsr: ratelimit only when errors are printed
  qed/qed_mng_tlv: correctly zero out ->min instead of ->hour
  selftests: net: devlink_port_split.py: skip test if no suitable device available
  ...

Pull block fixes from Jens Axboe:
 "A bit bigger than usual, as the NVMe pull request missed last weeks
  submission. In detail:

   - NVMe pull request via Christoph:
        - Avoid potential UAF in nvmet_req_complete (Damien Le Moal)
        - More quirks (Elmer Miroslav Mosher Golovin, Philipp Geulen)
        - Fix a memory leak in the nvme-pci probe teardown path
          (Irvin Cote)
        - Repair the MAINTAINERS entry (Lukas Bulwahn)
        - Fix handling single range discard request (Ming Lei)
        - Show more opcode names in trace events (Minwoo Im)
        - Fix nvme-tcp timeout reporting (Sagi Grimberg)

   - MD pull request via Song:
        - Two fixes for old issues (Neil)
        - Resource leak in device stopping (Xiao)

   - Bio based device stats fix (Yu)

   - Kill unused CONFIG_BLOCK_COMPAT (Lukas)

   - sunvdc missing mdesc_grab() failure check (Liang)

   - Fix for reversal of request ordering upon issue for certain cases
     (Jan)

   - null_blk timeout fixes (Damien)

   - Loop use-after-free fix (Bart)

   - blk-mq SRCU fix for BLK_MQ_F_BLOCKING devices (Chris)"

* tag 'block-6.3-2023-03-16' of git://git.kernel.dk/linux:
  block: remove obsolete config BLOCK_COMPAT
  md: select BLOCK_LEGACY_AUTOLOAD
  block: count 'ios' and 'sectors' when io is done for bio-based device
  block: sunvdc: add check for mdesc_grab() returning NULL
  nvmet: avoid potential UAF in nvmet_req_complete()
  nvme-trace: show more opcode names
  nvme-tcp: add nvme-tcp pdu size build protection
  nvme-tcp: fix opcode reporting in the timeout handler
  nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM620
  nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000
  nvme-pci: fixing memory leak in probe teardown path
  nvme: fix handling single range discard request
  MAINTAINERS: repair malformed T: entries in NVM EXPRESS DRIVERS
  block: null_blk: cleanup null_queue_rq()
  block: null_blk: Fix handling of fake timeout request
  blk-mq: fix "bad unlock balance detected" on q->srcu in __blk_mq_run_dispatch_ops
  loop: Fix use-after-free issues
  block: do not reverse request order when flushing plug list
  md: avoid signed overflow in slot_store()
  md: Free resources in __md_stop

Pull io_uring fixes from Jens Axboe:

 - When PF_NO_SETAFFINITY was removed for io-wq threads, we kind of
   forgot about the SQPOLL thread. Remove it there as well, there's even
   less of a reason to set it there (Michal)

 - Fixup a confusing 'ret' setting (Li)

 - When MSG_RING is used to send a direct descriptor to another ring,
   it's possible to have it allocate it on the target ring rather than
   provide a specific index for it. If this is done, return the chosen
   value in the CQE, like we would've done locally (Pavel)

 - Fix a regression in this series on huge page bvec collapsing (Pavel)

* tag 'io_uring-6.3-2023-03-16' of git://git.kernel.dk/linux:
  io_uring/rsrc: fix folio accounting
  io_uring/msg_ring: let target know allocated index
  io_uring: rsrc: Optimize return value variable 'ret'
  io_uring/sqpoll: Do not set PF_NO_SETAFFINITY on sqpoll threads

Pull power management fixes from Rafael Wysocki:
 "These fix an error code path issue in a cpuidle driver and make the
  sleepgraph utility more robust against unexpected input.

  Specifics:

   - Fix the psci_pd_init_topology() failure path in the PSCI cpuidle
     driver (Shawn Guo)

   - Modify the sleepgraph utility so it does not crash on binary data
     in device names (Todd Brandt)"

* tag 'pm-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  pm-graph: sleepgraph: Avoid crashing on binary data in device names
  cpuidle: psci: Iterate backwards over list in psci_pd_remove()

Pull ACPI fixes from Rafael Wysocki:
 "These add some new quirks, fix PPTT handling, fix an ACPI utility and
  correct a mistake in the ACPI documentation.

  Specifics:

   - Fix ACPI PPTT handling to avoid sleep in the atomic context when it
     is not present (Sudeep Holla)

   - Add 'backlight=native' DMI quirk for Dell Vostro 15 3535 to the
     ACPI video driver (Chia-Lin Kao)

   - Add ACPI quirks for I2C device enumeration on Lenovo Yoga Book X90
     and Acer Iconia One 7 B1-750 (Hans de Goede)

   - Fix handling of invalid command line option values in the ACPI
     pfrut utility (Chen Yu)

   - Fix references to I2C device data type in the ACPI documentation
     for device enumeration (Andy Shevchenko)"

* tag 'acpi-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI: tools: pfrut: Check if the input of level and type is in the right numeric range
  ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent
  ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Book X90
  ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 7 B1-750
  ACPI: x86: Introduce an acpi_quirk_skip_gpio_event_handlers() helper
  ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535
  ACPI: docs: enumeration: Correct reference to the I²C device data type

Pull turbostat fweaks and fixes from Len Brown:
 "Leprechaun sized fixes and tweaks touching only turbostat.

  'Keeping happy users happy since 2010'"

* 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux:
  tools/power turbostat: version 2023.03.17
  tools/power turbostat: fix decoding of HWP_STATUS
  tools/power turbostat: Introduce support for EMR
  tools/power turbostat: remove stray newlines from warn/warnx strings
  tools/power turbostat: Fix /dev/cpu_dma_latency warnings
  tools/power turbostat: Provide better debug messages for failed capabilities accesses
  tools/power turbostat: update dump of SECONDARY_TURBO_RATIO_LIMIT

Pull xen fixes from Juergen Gross:

 - cleanup for xen time handling

 - enable the VGA console in a Xen PVH dom0

 - cleanup in the xenfs driver

* tag 'for-linus-6.3-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen: remove unnecessary (void*) conversions
  x86/PVH: obtain VGA console info in Dom0
  x86/xen/time: cleanup xen_tsc_safe_clocksource
  xen: update arch/x86/include/asm/xen/cpuid.h

Pull RISC-V fixes from Palmer Dabbelt:

 - fixes to the ASID allocator to avoid leaking stale mappings between
   tasks

 - fix the vmalloc fault handler to tolerate huge pages

* tag 'riscv-for-linus-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  RISC-V: mm: Support huge page in vmalloc_fault()
  riscv: asid: Fixup stale TLB entry cause application crash
  Revert "riscv: mm: notify remote harts about mmu cache updates"

Pull s390 fixes from Vasily Gorbik:

 - Update defconfigs

 - Fix early boot code by adding missing intersection check to prevent
   potential overwriting of the ipl report

 - Fix a use-after-free issue in s390-specific code related to PCI
   resources being retained after hot-unplugging individual functions,
   by removing the resources from the PCI bus's resource list and using
   the zpci_bar_struct's resource pointer directly

* tag 's390-6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390: update defconfigs
  PCI: s390: Fix use-after-free of PCI resources with per-function hotplug
  s390/ipl: add missing intersection check to ipl_report handling

Pull powerpc fixes from Michael Ellerman:

 - Fix false detection of read faults, introduced by execute-only
   support

 - Fix a build failure when GENERIC_ALLOCATOR is not selected

Thanks to Russell Currey, Randy Dunlap, Michal Suchánek, Nathan Lynch,
and Benjamin Gray.

* tag 'powerpc-6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/mm: Fix false detection of read faults
  powerpc/pseries: RTAS work area requires GENERIC_ALLOCATOR

Pull MMC host fixes from Ulf Hansson:

 - dw_mmc-starfive: Fix initialization of the prev_err variable

 - sdhci_am654: Lower power-on failed message severity

* tag 'mmc-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: dw_mmc-starfive: Fix initialization of prev_err
  mmc: sdhci_am654: lower power-on failed message severity

Pull sound fixes from Takashi Iwai:
 "Nothing surprising, a collection of small device-specific fixes.

  The majority of changes are for ASoC Intel stuff, while a few other
  ASoC and HD-audio fixes are found"

* tag 'sound-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (31 commits)
  ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
  ALSA: asihpi: check pao in control_message()
  ASoC: hdmi-codec: only startup/shutdown on supported streams
  ASoC: da7219: Initialize jack_det_mutex
  ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
  ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro
  ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP platform
  ALSA: hda: intel-dsp-config: add MTL PCI id
  ASoC: SOF: IPC4: update gain ipc msg definition to align with fw
  ASoC: SOF: sof-audio: don't squelch errors in WIDGET_SETUP phase
  ASoC: SOF: Intel: hda-ctrl: re-add sleep after entering and exiting reset
  ASoC: SOF: Intel: hda-dsp: harden D0i3 programming sequence
  ASoC: SOF: ipc4-topology: set dmic dai index from copier
  ASoC: SOF: sof-audio: Fix broken early bclk feature for SSP
  ASoC: SOF: Intel: pci-tng: revert invalid bar size setting
  ASoC: SOF: topology: Fix error handling in sof_widget_ready()
  ASoC: Intel: soc-acpi: fix copy-paste issue in topology names
  ASoC: SOF: ipc4-topology: Fix incorrect sample rate print unit
  ASoC: SOF: ipc3: Check for upper size limit for the received message
  ASOC: SOF: Intel: pci-tgl: Fix device description
  ...

Pull drm fixes from Dave Airlie:
 "Seems like a pretty regular rc3, i915 and amdgpu with the usual
  selection of fixes, then a scattering of fixes across misc drivers and
  other areas:

  accel:
   - build fix for accel

  edid:
   - fix info leak in edid

  ttm:
   - fix NULL ptr deref
   - reference counting fix

  i915:
   - Fix hwmon PL1 power limit enabling
   - Fix audio ELD handling for DP MST
   - Fix PSR io and wake line calculations
   - Fix DG2 HDMI modes with 267.30 and 319.89 MHz pixel clocks
   - Fix SSEU subslice out-of-bounds access
   - Fix misuse of non-idle barriers as fence trackers

  amdgpu:
   - SMU 13 update
   - RDNA2 suspend/resume fix when overclocking is enabled
   - SRIOV VCN fixes
   - HDCP suspend/resume fix
   - Fix drm polling splat regression
   - Fix dirty rectangle tracking for PSR
   - Fix vangogh regression on certain BIOSes
   - Misc display fixes
   - Suspend/resume IOMMU regression fix

  amdkfd:
   - Fix BO offset for multi-VMA page migration
   - Fix a possible double free
   - Fix potential use after free
   - Fix process cleanup on module exit

  bridge:
   - fix returned array size name documentation

  fbdev:
   - ref-counting fix for fbdev deferred I/O

  virtio:
   - dma sync fix

  shmem-helper:
   - error path fix

  msm:
   - shrinker blocking fix

  panfrost:
   - shrinker rpm fix

  chipsfb:
   - fix error code

  meson:
   - fix 1px pink line
   - fix regulator interaction

  sun4i:
   - fix missing component unbind"

* tag 'drm-fixes-2023-03-17' of git://anongit.freedesktop.org/drm/drm: (38 commits)
  drm/ttm: drop extra ttm_bo_put in ttm_bo_cleanup_refs
  drm/amdgpu: Don't resume IOMMU after incomplete init
  drm/amdkfd: Fixed kfd_process cleanup on module exit.
  drm/amd/display: disconnect MPCC only on OTG change
  drm/amd/display: Fix DP MST sinks removal issue
  drm/amd/display: Do not set DRR on pipe Commit
  drm/amd/display: Remove OTG DIV register write for Virtual signals.
  drm/meson: dw-hdmi: Fix devm_regulator_*get_enable*() conversion again
  drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc
  drm/amdgpu/vcn: Disable indirect SRAM on Vangogh broken BIOSes
  drm/amdgpu/nv: fix codec array for SR_IOV
  drm/amd/display: Write to correct dirty_rect
  drm/amdgpu: move poll enabled/disable into non DC path
  drm/amd/display: Fix HDCP failing to enable after suspend
  drm/amdkfd: fix potential kgd_mem UAFs
  drm/amdgpu/vcn: custom video info caps for sriov
  drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume
  drm/amd/pm: bump SMU 13.0.4 driver_if header version
  drm/amdkfd: fix a potential double free in pqm_create_queue
  drm/amdkfd: Get prange->offset after svm_range_vram_node_new
  ...

Pull SCSI fixes from James Bottomley:
 "Ten patches, eight in drivers and two in the core, which correct a
  regression from directory removal and add a no VPD size quirk also to
  fix a regression. All pretty small"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ufs: mcq: Use active_reqs to check busy in clock scaling
  scsi: core: Fix a procfs host directory removal regression
  scsi: core: Add BLIST_NO_VPD_SIZE for some VDASD
  scsi: mpi3mr: Fix expander node leak in mpi3mr_remove()
  scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc()
  scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove()
  scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove()
  scsi: mpi3mr: Fix config page DMA memory leak
  scsi: mpi3mr: Fix throttle_groups memory leak
  scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()

Merge a PSCI cpuidle driver fix for 6.3-rc1:

 - Fix the psci_pd_init_topology() failure path in the PSCI cpuidle
   driver (Shawn Guo).

* pm-cpuidle:
  cpuidle: psci: Iterate backwards over list in psci_pd_remove()

Merge a new ACPI backlight quirk, new ACPI quirks for I2C device
enumeration on some platforms, a pfrut utility fix and an ACPI
documentation fix for 6.3-rc3:

 - Add backlight=native DMI quirk for Dell Vostro 15 3535 to the ACPI
   video driver (Chia-Lin Kao).

 - Add ACPI quirks for I2C devices enumeration on Lenovo Yoga Book X90
   and Acer Iconia One 7 B1-750 (Hans de Goede).

 - Fix handling of invalid command line option values in the ACPI pfrut
   utility (Chen Yu).

 - Fix references to I2C device data type in the ACPI documentation for
   device enumeration (Andy Shevchenko).

* acpi-video:
  ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535

* acpi-x86:
  ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Book X90
  ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 7 B1-750
  ACPI: x86: Introduce an acpi_quirk_skip_gpio_event_handlers() helper

* acpi-tools:
  ACPI: tools: pfrut: Check if the input of level and type is in the right numeric range

* acpi-docs:
  ACPI: docs: enumeration: Correct reference to the I²C device data type