Add Nuvoton BMC NPCM7xx/NPCM8xx sgpio driver support.
Nuvoton NPCM SGPIO module is combine serial to parallel IC (HC595)
and parallel to serial IC (HC165), and use APB3 clock to control it.
This interface has 4 pins  (D_out , D_in, S_CLK, LDSH).
BMC can use this driver to increase 64 GPI pins and 64 GPO pins to use.
Signed-off-by: Jim Liu <JJLIU0@nuvoton.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

Add dt-bindings document for the Nuvoton NPCM7xx sgpio driver
Signed-off-by: Jim Liu <JJLIU0@nuvoton.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Rob Herring <robh@kernel.org>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

This driver enables configuration of GPIO direction, GPIO values, GPIO
debounce settings and handles GPIO interrupts.
Signed-off-by: Tzuyi Chang <tychang@realtek.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

Add the device tree bindings for the Realtek DHC(Digital Home Center)
RTD SoCs GPIO controllers.
Signed-off-by: Tzuyi Chang <tychang@realtek.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

A bank PMIC EIC contains 16 EICs, and the operating registers
are BIT0-BIT15, such as BIT0 of the register operated by EIC0.
Using the one-dimensional array reg[CACHE_NR_REGS] for maintenance
will cause the configuration of other EICs to be affected when
operating a certain EIC. In order to solve this problem, configure
the bit corresponding to the EIC through offset.
Signed-off-by: Wenhua Lin <Wenhua.Lin@unisoc.com>
Reviewed-by: Chunyan Zhang <zhang.lyra@gmail.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

This way GPIO will be denied on pins already claimed by other devices
and basic pin configuration (pull-up, pull-down etc.) can be done
through the userspace GPIO API.
Signed-off-by: Emil Renner Berthing <emil.renner.berthing@canonical.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

Older code has an annoying habit of putting tabs between the type and the
name of the variable. This doesn't really add to readability and newer
code doesn't do it so make the entire file consistent.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

Older code has an annoying habit of putting tabs between the type and the
name of the variable. This doesn't really add to readability and newer
code doesn't do it so make the entire file consistent.

While at it: convert 'unsigned' to 'unsigned int'.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

extra_checks is only used in a few places. It also depends on
a non-standard DEBUG define one needs to add to the source file. The
overhead of removing it should be minimal (we already use pure
might_sleep() in the code anyway) so drop it.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>

CONFIG_DEBUG_GPIO should only be used to enable debug log messages and
for core GPIOLIB debugging. Don't use it to control the execution of
potentially buggy code. Just put it under an always-false #if.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>

Replace the wrapping functions that inhibit removal of the gpio chip
with equivalent guards.
Signed-off-by: Kent Gibson <warthog618@gmail.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

After the adoption of guard(), the locking wrappers that hold the
config_mutex for linereq_set_values() and linereq_set_config() no
longer add value, so combine them into the functions they wrap.
Signed-off-by: Kent Gibson <warthog618@gmail.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

The size of struct linereq may exceed a page, so allocate space for
it using kvzalloc() instead of kzalloc() to handle the case where
memory is heavily fragmented and kzalloc() cannot find a sufficient
contiguous region.
Signed-off-by: Kent Gibson <warthog618@gmail.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

struct_size() is used to calculate struct linereq size, so explicitly
include overflow.h.
Signed-off-by: Kent Gibson <warthog618@gmail.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

Linux 6.7-rc7

Pull x86 fixes from Ingo Molnar:

 - Fix a secondary CPUs enumeration regression caused by creative MADT
   APIC table entries on certain systems.

 - Fix a race in the NOP-patcher that can spuriously trigger crashes on
   bootup.

 - Fix a bootup failure regression caused by the parallel bringup code,
   caused by firmware inconsistency between the APIC initialization
   states of the boot and secondary CPUs, on certain systems.

* tag 'x86-urgent-2023-12-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/acpi: Handle bogus MADT APIC tables gracefully
  x86/alternatives: Disable interrupts and sync when optimizing NOPs in place
  x86/alternatives: Sync core before enabling interrupts
  x86/smpboot/64: Handle X2APIC BIOS inconsistency gracefully

Pull SCSI fixes from James Bottomley:
 "Four small fixes, three in drivers with the core one adding a batch
  indicator (for drivers which use it) to the error handler"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ufs: core: Let the sq_lock protect sq_tail_slot access
  scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in ufs_qcom_clk_scale_notify()
  scsi: core: Always send batch on reset or error handling command
  scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()

Pull USB / Thunderbolt fixes from Greg KH:
 "Here are some small bugfixes and new device ids for USB and
  Thunderbolt drivers for 6.7-rc7. Included in here are:

   - new usb-serial device ids

   - thunderbolt driver fixes

   - typec driver fix

   - usb-storage driver quirk added

   - fotg210 driver fix

  All of these have been in linux-next with no reported issues"

* tag 'usb-6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  USB: serial: option: add Quectel EG912Y module support
  USB: serial: ftdi_sio: update Actisense PIDs constant names
  usb: fotg210-hcd: delete an incorrect bounds test
  usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3
  usb: typec: ucsi: fix gpio-based orientation detection
  net: usb: ax88179_178a: avoid failed operations when device is disconnected
  USB: serial: option: add Quectel RM500Q R13 firmware support
  USB: serial: option: add Foxconn T99W265 with new baseline
  thunderbolt: Fix minimum allocated USB 3.x and PCIe bandwidth
  thunderbolt: Fix memory leak in margining_port_remove()

Pull char / misc driver fixes from Greg KH:
 "Here are a small number of various driver fixes for 6.7-rc7 that
  normally come through the char-misc tree, and one debugfs fix as well.

  Included in here are:

   - iio and hid sensor driver fixes for a number of small things

   - interconnect driver fixes

   - brcm_nvmem driver fixes

   - debugfs fix for previous fix

   - guard() definition in device.h so that many subsystems can start
     using it for 6.8-rc1 (requested by Dan Williams to make future
     merges easier)

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'char-misc-6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (21 commits)
  debugfs: initialize cancellations earlier
  Revert "iio: hid-sensor-als: Add light color temperature support"
  Revert "iio: hid-sensor-als: Add light chromaticity support"
  nvmem: brcm_nvram: store a copy of NVRAM content
  dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp
  driver core: Add a guard() definition for the device_lock()
  interconnect: qcom: icc-rpm: Fix peak rate calculation
  iio: adc: MCP3564: fix hardware identification logic
  iio: adc: MCP3564: fix calib_bias and calib_scale range checks
  iio: adc: meson: add separate config for axg SoC family
  iio: adc: imx93: add four channels for imx93 adc
  iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma()
  interconnect: qcom: sm8250: Enable sync_state
  iio: triggered-buffer: prevent possible freeing of wrong buffer
  iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
  iio: imu: adis16475: use bit numbers in assign_bit()
  iio: imu: adis16475: add spi_device_id table
  iio: tmag5273: fix temperature offset
  interconnect: Treat xlate() returning NULL node as an error
  iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table
  ...

Pull input updates from Dmitry Torokhov:

 - a quirk to AT keyboard driver to skip issuing "GET ID" command when
   8042 is in translated mode and the device is a laptop/portable,
   because the "GET ID" command makes a bunch of recent laptops unhappy

 - a quirk to i8042 to disable multiplexed mode on Acer P459-G2-M which
   causes issues on resume

 - psmouse will activate native RMI4 protocol support for touchpad on
   ThinkPad L14 G1

 - addition of Razer Wolverine V2 ID to xpad gamepad driver

 - mapping for airplane mode button in soc_button_array driver for
   TUXEDO laptops

 - improved error handling in ipaq-micro-keys driver

 - amimouse being prepared for platform remove callback returning void

* tag 'input-for-v6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: soc_button_array - add mapping for airplane mode button
  Input: xpad - add Razer Wolverine V2 support
  Input: ipaq-micro-keys - add error handling for devm_kmemdup
  Input: amimouse - convert to platform remove callback returning void
  Input: i8042 - add nomux quirk for Acer P459-G2-M
  Input: atkbd - skip ATKBD_CMD_GETID in translated mode
  Input: psmouse - enable Synaptics InterTouch for ThinkPad L14 G1

This add a mapping for the airplane mode button on the TUXEDO Pulse Gen3.

While it is physically a key it behaves more like a switch, sending a key
down on first press and a key up on 2nd press. Therefor the switch event
is used here. Besides this behaviour it uses the HID usage-id 0xc6
(Wireless Radio Button) and not 0xc8 (Wireless Radio Slider Switch), but
since neither 0xc6 nor 0xc8 are currently implemented at all in
soc_button_array this not to standard behaviour is not put behind a quirk
for the moment.
Signed-off-by: Christoffer Sandberg <cs@tuxedo.de>
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Link: https://lore.kernel.org/r/20231215171718.80229-1-wse@tuxedocomputers.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Pull block fixes from Jens Axboe:
 "Just an NVMe pull request this time, with a fix for bad sleeping
  context, and a revert of a patch that caused some trouble"

* tag 'block-6.7-2023-12-22' of git://git.kernel.dk/linux:
  nvme-pci: fix sleeping function called from interrupt context
  Revert "nvme-fc: fix race between error recovery and creating association"

Pull kvm fixes from Paolo Bonzini:
"RISC-V:

   - Fix a race condition in updating external interrupt for
     trap-n-emulated IMSIC swfile

   - Fix print_reg defaults in get-reg-list selftest

  ARM:

   - Ensure a vCPU's redistributor is unregistered from the MMIO bus if
     vCPU creation fails

   - Fix building KVM selftests for arm64 from the top-level Makefile

  x86:

   - Fix breakage for SEV-ES guests that use XSAVES

  Selftests:

   - Fix bad use of strcat(), by not using strcat() at all"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: SEV: Do not intercept accesses to MSR_IA32_XSS for SEV-ES guests
  KVM: selftests: Fix dynamic generation of configuration names
  RISCV: KVM: update external interrupt atomically for IMSIC swfile
  KVM: riscv: selftests: Fix get-reg-list print_reg defaults
  KVM: selftests: Ensure sysreg-defs.h is generated at the expected path
  KVM: Convert comment into an assertion in kvm_io_bus_register_dev()
  KVM: arm64: vgic: Ensure that slots_lock is held in vgic_register_all_redist_iodevs()
  KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy
  KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy()
  KVM: arm64: vgic: Simplify kvm_vgic_destroy()

KVM/riscv fixes for 6.7, take #1

- Fix a race condition in updating external interrupt for
  trap-n-emulated IMSIC swfile
- Fix print_reg defaults in get-reg-list selftest

Merge tag 'kvmarm-fixes-6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into kvm-master

KVM/arm64 fixes for 6.7, part #2

 - Ensure a vCPU's redistributor is unregistered from the MMIO bus
   if vCPU creation fails

 - Fix building KVM selftests for arm64 from the top-level Makefile

Pull printk fix from Petr Mladek:

 - Prevent refcount warning from code releasing a fwnode

* tag 'printk-for-6.8' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
  lib/vsprintf: Fix %pfwf when current node refcount == 0

Pull sound fixes from Takashi Iwai:
 "Apparently there were so many kids wishing bug fixes that made Santa
  busy; here we have lots of fixes although it's a bit late. But all
  changes are device-specific, hence it should be relatively safe to
  apply.

  Most of changes are for Cirrus codecs (for both ASoC and HD-audio),
  while the remaining are fixes for TI codecs, HD-audio and USB-audio
  quirks"

* tag 'sound-6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (24 commits)
  ALSA: hda: cs35l41: Only add SPI CS GPIO if SPI is enabled in kernel
  ALSA: hda: cs35l41: Do not allow uninitialised variables to be freed
  ASoC: fsl_sai: Fix channel swap issue on i.MX8MP
  ASoC: hdmi-codec: fix missing report for jack initial status
  ALSA: hda/realtek: Add quirks for ASUS Zenbook 2023 Models
  ALSA: hda: cs35l41: Support additional ASUS Zenbook 2023 Models
  ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models
  ALSA: hda: cs35l41: Support additional ASUS Zenbook 2022 Models
  ALSA: hda/realtek: Add quirks for ASUS ROG 2023 models
  ALSA: hda: cs35l41: Support additional ASUS ROG 2023 models
  ALSA: hda: cs35l41: Add config table to support many laptops without _DSD
  ASoC: Intel: bytcr_rt5640: Add new swapped-speakers quirk
  ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346
  kselftest: alsa: fixed a print formatting warning
  ALSA: usb-audio: Increase delay in MOTU M quirk
  ASoC: tas2781: check the validity of prm_no/cfg_no
  ALSA: hda/tas2781: select program 0, conf 0 by default
  ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA
  ASoC: cs42l43: Don't enable bias sense during type detect
  ASoC: Intel: soc-acpi-intel-mtl-match: Change CS35L56 prefixes to AMPn
  ...

Pull i2c fixes from Wolfram Sang:

 - error path fixes (qcom-geni)

 - polling mode fix (rk3x)

 - target mode state machine fix (aspeed)

* tag 'i2c-for-6.7-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: aspeed: Handle the coalesced stop conditions with the start conditions.
  i2c: rk3x: fix potential spinlock recursion on poll
  i2c: qcom-geni: fix missing clk_disable_unprepare() and geni_se_resources_off()

Pull gpio fixes from Bartosz Golaszewski:
 "Here's another round of fixes from the GPIO subsystem for this release
  cycle.

  There's one commit adding synchronization to an ioctl() we overlooked
  previously and another synchronization changeset for one of the
  drivers:

   - add protection against GPIO device removal to an overlooked ioctl()

   - synchronize the interrupt mask register manually in gpio-dwapb"

* tag 'gpio-fixes-for-v6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpio: dwapb: mask/unmask IRQ when disable/enale it
  gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl()

Pull xen fix from Juergen Gross:
 "A single patch fixing a build issue for x86 32-bit configurations with
  CONFIG_XEN, which was introduced in the 6.7 development cycle"

* tag 'for-linus-6.7a-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  x86/xen: add CPU dependencies for 32-bit build

Pull drm fixes from Dave Airlie:
 "Pretty quiet for this week, just i915 and amdgpu fixes,

  I think the misc tree got lost this week, but didn't seem to have too
  much in it, so it can wait. I've also got a bunch of nouveau GSP fixes
  sailing around that'll probably land next time as well.

  amdgpu:
   - DCN 3.5 fixes
   - DCN 3.2 SubVP fix
   - GPUVM fix

  amdkfd:
   - SVM fix for APUs

  i915:
   - Fix state readout and check for DSC and bigjoiner combo
   - Fix a potential integer overflow
   - Reject async flips with bigjoiner
   - Fix MTL HDMI/DP PLL clock selection
   - Fix various issues by disabling pipe DMC events"

* tag 'drm-fixes-2023-12-22' of git://anongit.freedesktop.org/drm/drm:
  drm/amdgpu: re-create idle bo's PTE during VM state machine reset
  drm/amd/display: dereference variable before checking for zero
  drm/amd/display: get dprefclk ss info from integration info table
  drm/amd/display: Add case for dcn35 to support usb4 dmub hpd event
  drm/amd/display: disable FPO and SubVP for older DMUB versions on DCN32x
  drm/amdkfd: svm range always mapped flag not working on APU
  drm/amd/display: Revert " drm/amd/display: Use channel_width = 2 for vram table 3.0"
  drm/i915/dmc: Don't enable any pipe DMC events
  drm/i915/mtl: Fix HDMI/DP PLL clock selection
  drm/i915: Reject async flips with bigjoiner
  drm/i915/hwmon: Fix static analysis tool reported issues
  drm/i915/display: Get bigjoiner config before dsc config during readout

Pull 9p fixes from Dominique Martinet:
 "Two small fixes scheduled for stable trees:

  A tracepoint fix that's been reading past the end of messages forever,
  but semi-recently also went over the end of the buffer. And a
  potential incorrectly freeing garbage in pdu parsing error path"

* tag '9p-for-6.7-rc7' of https://github.com/martinetd/linux:
  net: 9p: avoid freeing uninit memory in p9pdu_vreadf
  9p: prevent read overrun in protocol dump tracepoint

Merge tag 'usb-serial-6.7-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus

Johan writes:

USB-serial device ids for 6.7-rc6

Here are some new modem device ids and a rename of a few ftdi product id
defines.

All have been in linux-next with no reported issues.

* tag 'usb-serial-6.7-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial:
  USB: serial: option: add Quectel EG912Y module support
  USB: serial: ftdi_sio: update Actisense PIDs constant names
  USB: serial: option: add Quectel RM500Q R13 firmware support
  USB: serial: option: add Foxconn T99W265 with new baseline

Tetsuo Handa pointed out that in the (now reverted)
lockdep commit I initialized the data too late. The
same is true for the cancellation data, it must be
initialized before the cmpxchg(), otherwise it may
be done twice and possibly even overwriting data in
there already when there's a race. Fix that, which
also requires destroying the mutex in case we lost
the race.

Fixes: 8c88a474 ("debugfs: add API to allow debugfs operations cancellation")
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Link: https://lore.kernel.org/r/20231221150444.1e47a0377f80.If7e8ba721ba2956f12c6e8405e7d61e154aa7ae7@changeidSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge tag 'drm-intel-fixes-2023-12-21' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes

drm/i915 fixes for v6.7-rc7:
- Fix state readout and check for DSC and bigjoiner combo
- Fix a potential integer overflow
- Reject async flips with bigjoiner
- Fix MTL HDMI/DP PLL clock selection
- Fix various issues by disabling pipe DMC events
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/87plyzsnxi.fsf@intel.com

Merge tag 'amd-drm-fixes-6.7-2023-12-20' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes

amd-drm-fixes-6.7-2023-12-20:

amdgpu:
- DCN 3.5 fixes
- DCN 3.2 SubVP fix
- GPUVM fix

amdkfd:
- SVM fix for APUs
Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231220164845.4975-1-alexander.deucher@amd.com

Pull pin control fixes from Linus Walleij:
 "Some driver fixes for v6.7, all are in drivers, the most interesting
  one is probably the AMD laptop suspend bug which really needs fixing.
  Freedestop org has the bug description:

    https://gitlab.freedesktop.org/drm/amd/-/issues/2812

  Summary:

   - Ignore disabled device tree nodes in the Starfive 7100 and 7100
     drivers.

   - Mask non-wake source pins with interrupt enabled at suspend in the
     AMD driver, this blocks unnecessary wakeups from misc interrupts.
     This can be power consuming because in many cases the system
     doesn't really suspend, it just wakes right back up.

   - Fix a typo breaking compilation of the cy8c95x0 driver, and fix up
     bugs in the get/set config callbacks.

   - Use a dedicated lock class for the PIO4 drivers IRQ. This fixes a
     crash on suspend"

* tag 'pinctrl-v6.7-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl: at91-pio4: use dedicated lock class for IRQ
  pinctrl: cy8c95x0: Fix get_pincfg
  pinctrl: cy8c95x0: Fix regression
  pinctrl: cy8c95x0: Fix typo
  pinctrl: amd: Mask non-wake source pins with interrupt enabled at suspend
  pinctrl: starfive: jh7100: ignore disabled device tree nodes
  pinctrl: starfive: jh7110: ignore disabled device tree nodes

Pull NVMe fixes from Keith:

"nvme fixes for Linux 6.7

 - Revert a commit with improper sleep context (Keith)
 - Fix async event handling sleep context (Maurizio)"

* tag 'nvme-6.7-2023-12-21' of git://git.infradead.org/nvme:
  nvme-pci: fix sleeping function called from interrupt context
  Revert "nvme-fc: fix race between error recovery and creating association"

When an afs_volume struct is put, its refcount is reduced to 0 before
the cell->volume_lock is taken and the volume removed from the
cell->volumes tree.

Unfortunately, this means that the lookup code can race and see a volume
with a zero ref in the tree, resulting in a use-after-free:

    refcount_t: addition on 0; use-after-free.
    WARNING: CPU: 3 PID: 130782 at lib/refcount.c:25 refcount_warn_saturate+0x7a/0xda
    ...
    RIP: 0010:refcount_warn_saturate+0x7a/0xda
    ...
    Call Trace:
     afs_get_volume+0x3d/0x55
     afs_create_volume+0x126/0x1de
     afs_validate_fc+0xfe/0x130
     afs_get_tree+0x20/0x2e5
     vfs_get_tree+0x1d/0xc9
     do_new_mount+0x13b/0x22e
     do_mount+0x5d/0x8a
     __do_sys_mount+0x100/0x12a
     do_syscall_64+0x3a/0x94
     entry_SYSCALL_64_after_hwframe+0x62/0x6a

Fix this by:

 (1) When putting, use a flag to indicate if the volume has been removed
     from the tree and skip the rb_erase if it has.

 (2) When looking up, use a conditional ref increment and if it fails
     because the refcount is 0, replace the node in the tree and set the
     removal flag.

Fixes: 20325960 ("afs: Reorganise volume and server trees to be rooted on the cell")
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>