kernel-alx/patches-5.4/0222-5.4.123-all-fixes.patch

diff --git a/Makefile b/Makefile
index 9b64ebcf45312..d3f7a032f080b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 4
-SUBLEVEL = 122
+SUBLEVEL = 123
 EXTRAVERSION =
 NAME = Kleptomaniac Octopus
 
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 40fe856184efa..6145311a3855f 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2022,6 +2022,10 @@ static void dwc3_gadget_enable_irq(struct dwc3 *dwc)
 	if (dwc->revision < DWC3_REVISION_250A)
 		reg |= DWC3_DEVTEN_ULSTCNGEN;
 
+	/* On 2.30a and above this bit enables U3/L2-L1 Suspend Events */
+	if (dwc->revision >= DWC3_REVISION_230A)
+		reg |= DWC3_DEVTEN_EOPFEN;
+
 	dwc3_writel(dwc->regs, DWC3_DEVTEN, reg);
 }
 
diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
index 43c9c5d2bedbd..33979017b7824 100644
--- a/include/net/nfc/nci_core.h
+++ b/include/net/nfc/nci_core.h
@@ -298,6 +298,7 @@ int nci_nfcc_loopback(struct nci_dev *ndev, void *data, size_t data_len,
 		      struct sk_buff **resp);
 
 struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev);
+void nci_hci_deallocate(struct nci_dev *ndev);
 int nci_hci_send_event(struct nci_dev *ndev, u8 gate, u8 event,
 		       const u8 *param, size_t param_len);
 int nci_hci_send_cmd(struct nci_dev *ndev, u8 gate,
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 11b217b0f4541..aefd947947968 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4272,18 +4272,10 @@ enum {
 };
 
 static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,
-			      const struct bpf_reg_state *off_reg,
-			      u32 *alu_limit, u8 opcode)
+			      u32 *alu_limit, bool mask_to_left)
 {
-	bool off_is_neg = off_reg->smin_value < 0;
-	bool mask_to_left = (opcode == BPF_ADD &&  off_is_neg) ||
-			    (opcode == BPF_SUB && !off_is_neg);
 	u32 max = 0, ptr_limit = 0;
 
-	if (!tnum_is_const(off_reg->var_off) &&
-	    (off_reg->smin_value < 0) != (off_reg->smax_value < 0))
-		return REASON_BOUNDS;
-
 	switch (ptr_reg->type) {
 	case PTR_TO_STACK:
 		/* Offset 0 is out-of-bounds, but acceptable start for the
@@ -4349,15 +4341,20 @@ static bool sanitize_needed(u8 opcode)
 	return opcode == BPF_ADD || opcode == BPF_SUB;
 }
 
+struct bpf_sanitize_info {
+	struct bpf_insn_aux_data aux;
+	bool mask_to_left;
+};
+
 static int sanitize_ptr_alu(struct bpf_verifier_env *env,
 			    struct bpf_insn *insn,
 			    const struct bpf_reg_state *ptr_reg,
 			    const struct bpf_reg_state *off_reg,
 			    struct bpf_reg_state *dst_reg,
-			    struct bpf_insn_aux_data *tmp_aux,
+			    struct bpf_sanitize_info *info,
 			    const bool commit_window)
 {
-	struct bpf_insn_aux_data *aux = commit_window ? cur_aux(env) : tmp_aux;
+	struct bpf_insn_aux_data *aux = commit_window ? cur_aux(env) : &info->aux;
 	struct bpf_verifier_state *vstate = env->cur_state;
 	bool off_is_imm = tnum_is_const(off_reg->var_off);
 	bool off_is_neg = off_reg->smin_value < 0;
@@ -4378,7 +4375,16 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
 	if (vstate->speculative)
 		goto do_sim;
 
-	err = retrieve_ptr_limit(ptr_reg, off_reg, &alu_limit, opcode);
+	if (!commit_window) {
+		if (!tnum_is_const(off_reg->var_off) &&
+		    (off_reg->smin_value < 0) != (off_reg->smax_value < 0))
+			return REASON_BOUNDS;
+
+		info->mask_to_left = (opcode == BPF_ADD &&  off_is_neg) ||
+				     (opcode == BPF_SUB && !off_is_neg);
+	}
+
+	err = retrieve_ptr_limit(ptr_reg, &alu_limit, info->mask_to_left);
 	if (err < 0)
 		return err;
 
@@ -4386,8 +4392,8 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
 		/* In commit phase we narrow the masking window based on
 		 * the observed pointer move after the simulated operation.
 		 */
-		alu_state = tmp_aux->alu_state;
-		alu_limit = abs(tmp_aux->alu_limit - alu_limit);
+		alu_state = info->aux.alu_state;
+		alu_limit = abs(info->aux.alu_limit - alu_limit);
 	} else {
 		alu_state  = off_is_neg ? BPF_ALU_NEG_VALUE : 0;
 		alu_state |= off_is_imm ? BPF_ALU_IMMEDIATE : 0;
@@ -4402,8 +4408,12 @@ do_sim:
 	/* If we're in commit phase, we're done here given we already
 	 * pushed the truncated dst_reg into the speculative verification
 	 * stack.
+	 *
+	 * Also, when register is a known constant, we rewrite register-based
+	 * operation to immediate-based, and thus do not need masking (and as
+	 * a consequence, do not need to simulate the zero-truncation either).
 	 */
-	if (commit_window)
+	if (commit_window || off_is_imm)
 		return 0;
 
 	/* Simulate and find potential out-of-bounds access under
@@ -4517,7 +4527,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
 	    smin_ptr = ptr_reg->smin_value, smax_ptr = ptr_reg->smax_value;
 	u64 umin_val = off_reg->umin_value, umax_val = off_reg->umax_value,
 	    umin_ptr = ptr_reg->umin_value, umax_ptr = ptr_reg->umax_value;
-	struct bpf_insn_aux_data tmp_aux = {};
+	struct bpf_sanitize_info info = {};
 	u8 opcode = BPF_OP(insn->code);
 	u32 dst = insn->dst_reg;
 	int ret;
@@ -4578,7 +4588,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
 
 	if (sanitize_needed(opcode)) {
 		ret = sanitize_ptr_alu(env, insn, ptr_reg, off_reg, dst_reg,
-				       &tmp_aux, false);
+				       &info, false);
 		if (ret < 0)
 			return sanitize_err(env, insn, ret, off_reg, dst_reg);
 	}
@@ -4719,7 +4729,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
 		return -EACCES;
 	if (sanitize_needed(opcode)) {
 		ret = sanitize_ptr_alu(env, insn, dst_reg, off_reg, dst_reg,
-				       &tmp_aux, true);
+				       &info, true);
 		if (ret < 0)
 			return sanitize_err(env, insn, ret, off_reg, dst_reg);
 	}
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 7cd5248843041..6a34a0a786eaa 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -1175,6 +1175,7 @@ EXPORT_SYMBOL(nci_allocate_device);
 void nci_free_device(struct nci_dev *ndev)
 {
 	nfc_free_device(ndev->nfc_dev);
+	nci_hci_deallocate(ndev);
 	kfree(ndev);
 }
 EXPORT_SYMBOL(nci_free_device);
diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c
index c18e76d6d8ba0..04e55ccb33836 100644
--- a/net/nfc/nci/hci.c
+++ b/net/nfc/nci/hci.c
@@ -795,3 +795,8 @@ struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev)
 
 	return hdev;
 }
+
+void nci_hci_deallocate(struct nci_dev *ndev)
+{
+	kfree(ndev->hci_dev);
+}
diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
index 15f6e46d71243..32b440631c29d 100644
--- a/tools/perf/util/unwind-libdw.c
+++ b/tools/perf/util/unwind-libdw.c
@@ -20,10 +20,24 @@
 
 static char *debuginfo_path;
 
+static int __find_debuginfo(Dwfl_Module *mod __maybe_unused, void **userdata,
+			    const char *modname __maybe_unused, Dwarf_Addr base __maybe_unused,
+			    const char *file_name, const char *debuglink_file __maybe_unused,
+			    GElf_Word debuglink_crc __maybe_unused, char **debuginfo_file_name)
+{
+	const struct dso *dso = *userdata;
+
+	assert(dso);
+	if (dso->symsrc_filename && strcmp (file_name, dso->symsrc_filename))
+		*debuginfo_file_name = strdup(dso->symsrc_filename);
+	return -1;
+}
+
 static const Dwfl_Callbacks offline_callbacks = {
-	.find_debuginfo		= dwfl_standard_find_debuginfo,
+	.find_debuginfo		= __find_debuginfo,
 	.debuginfo_path		= &debuginfo_path,
 	.section_address	= dwfl_offline_section_address,
+	// .find_elf is not set as we use dwfl_report_elf() instead.
 };
 
 static int __report_module(struct addr_location *al, u64 ip,
@@ -53,9 +67,22 @@ static int __report_module(struct addr_location *al, u64 ip,
 	}
 
 	if (!mod)
-		mod = dwfl_report_elf(ui->dwfl, dso->short_name,
-				      (dso->symsrc_filename ? dso->symsrc_filename : dso->long_name), -1, al->map->start - al->map->pgoff,
-				      false);
+		mod = dwfl_report_elf(ui->dwfl, dso->short_name, dso->long_name, -1,
+				      al->map->start - al->map->pgoff, false);
+	if (!mod) {
+		char filename[PATH_MAX];
+
+		if (dso__build_id_filename(dso, filename, sizeof(filename), false))
+			mod = dwfl_report_elf(ui->dwfl, dso->short_name, filename, -1,
+					      al->map->start - al->map->pgoff, false);
+	}
+
+	if (mod) {
+		void **userdatap;
+
+		dwfl_module_info(mod, &userdatap, NULL, NULL, NULL, NULL, NULL, NULL);
+		*userdatap = dso;
+	}
 
 	return mod && dwfl_addrmodule(ui->dwfl, ip) == mod ? 0 : -1;
 }
1	niro	3635	diff --git a/Makefile b/Makefile
2			index 9b64ebcf45312..d3f7a032f080b 100644
3			--- a/Makefile
4			+++ b/Makefile
5			@@ -1,7 +1,7 @@
6			# SPDX-License-Identifier: GPL-2.0
7			VERSION = 5
8			PATCHLEVEL = 4
9			-SUBLEVEL = 122
10			+SUBLEVEL = 123
11			EXTRAVERSION =
12			NAME = Kleptomaniac Octopus
13
14			diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
15			index 40fe856184efa..6145311a3855f 100644
16			--- a/drivers/usb/dwc3/gadget.c
17			+++ b/drivers/usb/dwc3/gadget.c
18			@@ -2022,6 +2022,10 @@ static void dwc3_gadget_enable_irq(struct dwc3 *dwc)
19			if (dwc->revision < DWC3_REVISION_250A)
20			reg \|= DWC3_DEVTEN_ULSTCNGEN;
21
22			+ /* On 2.30a and above this bit enables U3/L2-L1 Suspend Events */
23			+ if (dwc->revision >= DWC3_REVISION_230A)
24			+ reg \|= DWC3_DEVTEN_EOPFEN;
25			+
26			dwc3_writel(dwc->regs, DWC3_DEVTEN, reg);
27			}
28
29			diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
30			index 43c9c5d2bedbd..33979017b7824 100644
31			--- a/include/net/nfc/nci_core.h
32			+++ b/include/net/nfc/nci_core.h
33			@@ -298,6 +298,7 @@ int nci_nfcc_loopback(struct nci_dev ndev, void data, size_t data_len,
34			struct sk_buff **resp);
35
36			struct nci_hci_dev nci_hci_allocate(struct nci_dev ndev);
37			+void nci_hci_deallocate(struct nci_dev *ndev);
38			int nci_hci_send_event(struct nci_dev *ndev, u8 gate, u8 event,
39			const u8 *param, size_t param_len);
40			int nci_hci_send_cmd(struct nci_dev *ndev, u8 gate,
41			diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
42			index 11b217b0f4541..aefd947947968 100644
43			--- a/kernel/bpf/verifier.c
44			+++ b/kernel/bpf/verifier.c
45			@@ -4272,18 +4272,10 @@ enum {
46			};
47
48			static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,
49			- const struct bpf_reg_state *off_reg,
50			- u32 *alu_limit, u8 opcode)
51			+ u32 *alu_limit, bool mask_to_left)
52			{
53			- bool off_is_neg = off_reg->smin_value < 0;
54			- bool mask_to_left = (opcode == BPF_ADD && off_is_neg) \|\|
55			- (opcode == BPF_SUB && !off_is_neg);
56			u32 max = 0, ptr_limit = 0;
57
58			- if (!tnum_is_const(off_reg->var_off) &&
59			- (off_reg->smin_value < 0) != (off_reg->smax_value < 0))
60			- return REASON_BOUNDS;
61			-
62			switch (ptr_reg->type) {
63			case PTR_TO_STACK:
64			/* Offset 0 is out-of-bounds, but acceptable start for the
65			@@ -4349,15 +4341,20 @@ static bool sanitize_needed(u8 opcode)
66			return opcode == BPF_ADD \|\| opcode == BPF_SUB;
67			}
68
69			+struct bpf_sanitize_info {
70			+ struct bpf_insn_aux_data aux;
71			+ bool mask_to_left;
72			+};
73			+
74			static int sanitize_ptr_alu(struct bpf_verifier_env *env,
75			struct bpf_insn *insn,
76			const struct bpf_reg_state *ptr_reg,
77			const struct bpf_reg_state *off_reg,
78			struct bpf_reg_state *dst_reg,
79			- struct bpf_insn_aux_data *tmp_aux,
80			+ struct bpf_sanitize_info *info,
81			const bool commit_window)
82			{
83			- struct bpf_insn_aux_data *aux = commit_window ? cur_aux(env) : tmp_aux;
84			+ struct bpf_insn_aux_data *aux = commit_window ? cur_aux(env) : &info->aux;
85			struct bpf_verifier_state *vstate = env->cur_state;
86			bool off_is_imm = tnum_is_const(off_reg->var_off);
87			bool off_is_neg = off_reg->smin_value < 0;
88			@@ -4378,7 +4375,16 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
89			if (vstate->speculative)
90			goto do_sim;
91
92			- err = retrieve_ptr_limit(ptr_reg, off_reg, &alu_limit, opcode);
93			+ if (!commit_window) {
94			+ if (!tnum_is_const(off_reg->var_off) &&
95			+ (off_reg->smin_value < 0) != (off_reg->smax_value < 0))
96			+ return REASON_BOUNDS;
97			+
98			+ info->mask_to_left = (opcode == BPF_ADD && off_is_neg) \|\|
99			+ (opcode == BPF_SUB && !off_is_neg);
100			+ }
101			+
102			+ err = retrieve_ptr_limit(ptr_reg, &alu_limit, info->mask_to_left);
103			if (err < 0)
104			return err;
105
106			@@ -4386,8 +4392,8 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
107			/* In commit phase we narrow the masking window based on
108			* the observed pointer move after the simulated operation.
109			*/
110			- alu_state = tmp_aux->alu_state;
111			- alu_limit = abs(tmp_aux->alu_limit - alu_limit);
112			+ alu_state = info->aux.alu_state;
113			+ alu_limit = abs(info->aux.alu_limit - alu_limit);
114			} else {
115			alu_state = off_is_neg ? BPF_ALU_NEG_VALUE : 0;
116			alu_state \|= off_is_imm ? BPF_ALU_IMMEDIATE : 0;
117			@@ -4402,8 +4408,12 @@ do_sim:
118			/* If we're in commit phase, we're done here given we already
119			* pushed the truncated dst_reg into the speculative verification
120			* stack.
121			+ *
122			+ * Also, when register is a known constant, we rewrite register-based
123			+ * operation to immediate-based, and thus do not need masking (and as
124			+ * a consequence, do not need to simulate the zero-truncation either).
125			*/
126			- if (commit_window)
127			+ if (commit_window \|\| off_is_imm)
128			return 0;
129
130			/* Simulate and find potential out-of-bounds access under
131			@@ -4517,7 +4527,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
132			smin_ptr = ptr_reg->smin_value, smax_ptr = ptr_reg->smax_value;
133			u64 umin_val = off_reg->umin_value, umax_val = off_reg->umax_value,
134			umin_ptr = ptr_reg->umin_value, umax_ptr = ptr_reg->umax_value;
135			- struct bpf_insn_aux_data tmp_aux = {};
136			+ struct bpf_sanitize_info info = {};
137			u8 opcode = BPF_OP(insn->code);
138			u32 dst = insn->dst_reg;
139			int ret;
140			@@ -4578,7 +4588,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
141
142			if (sanitize_needed(opcode)) {
143			ret = sanitize_ptr_alu(env, insn, ptr_reg, off_reg, dst_reg,
144			- &tmp_aux, false);
145			+ &info, false);
146			if (ret < 0)
147			return sanitize_err(env, insn, ret, off_reg, dst_reg);
148			}
149			@@ -4719,7 +4729,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
150			return -EACCES;
151			if (sanitize_needed(opcode)) {
152			ret = sanitize_ptr_alu(env, insn, dst_reg, off_reg, dst_reg,
153			- &tmp_aux, true);
154			+ &info, true);
155			if (ret < 0)
156			return sanitize_err(env, insn, ret, off_reg, dst_reg);
157			}
158			diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
159			index 7cd5248843041..6a34a0a786eaa 100644
160			--- a/net/nfc/nci/core.c
161			+++ b/net/nfc/nci/core.c
162			@@ -1175,6 +1175,7 @@ EXPORT_SYMBOL(nci_allocate_device);
163			void nci_free_device(struct nci_dev *ndev)
164			{
165			nfc_free_device(ndev->nfc_dev);
166			+ nci_hci_deallocate(ndev);
167			kfree(ndev);
168			}
169			EXPORT_SYMBOL(nci_free_device);
170			diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c
171			index c18e76d6d8ba0..04e55ccb33836 100644
172			--- a/net/nfc/nci/hci.c
173			+++ b/net/nfc/nci/hci.c
174			@@ -795,3 +795,8 @@ struct nci_hci_dev nci_hci_allocate(struct nci_dev ndev)
175
176			return hdev;
177			}
178			+
179			+void nci_hci_deallocate(struct nci_dev *ndev)
180			+{
181			+ kfree(ndev->hci_dev);
182			+}
183			diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
184			index 15f6e46d71243..32b440631c29d 100644
185			--- a/tools/perf/util/unwind-libdw.c
186			+++ b/tools/perf/util/unwind-libdw.c
187			@@ -20,10 +20,24 @@
188
189			static char *debuginfo_path;
190
191			+static int __find_debuginfo(Dwfl_Module mod __maybe_unused, void *userdata,
192			+ const char *modname __maybe_unused, Dwarf_Addr base __maybe_unused,
193			+ const char file_name, const char debuglink_file __maybe_unused,
194			+ GElf_Word debuglink_crc __maybe_unused, char **debuginfo_file_name)
195			+{
196			+ const struct dso dso = userdata;
197			+
198			+ assert(dso);
199			+ if (dso->symsrc_filename && strcmp (file_name, dso->symsrc_filename))
200			+ *debuginfo_file_name = strdup(dso->symsrc_filename);
201			+ return -1;
202			+}
203			+
204			static const Dwfl_Callbacks offline_callbacks = {
205			- .find_debuginfo = dwfl_standard_find_debuginfo,
206			+ .find_debuginfo = __find_debuginfo,
207			.debuginfo_path = &debuginfo_path,
208			.section_address = dwfl_offline_section_address,
209			+ // .find_elf is not set as we use dwfl_report_elf() instead.
210			};
211
212			static int __report_module(struct addr_location *al, u64 ip,
213			@@ -53,9 +67,22 @@ static int __report_module(struct addr_location *al, u64 ip,
214			}
215
216			if (!mod)
217			- mod = dwfl_report_elf(ui->dwfl, dso->short_name,
218			- (dso->symsrc_filename ? dso->symsrc_filename : dso->long_name), -1, al->map->start - al->map->pgoff,
219			- false);
220			+ mod = dwfl_report_elf(ui->dwfl, dso->short_name, dso->long_name, -1,
221			+ al->map->start - al->map->pgoff, false);
222			+ if (!mod) {
223			+ char filename[PATH_MAX];
224			+
225			+ if (dso__build_id_filename(dso, filename, sizeof(filename), false))
226			+ mod = dwfl_report_elf(ui->dwfl, dso->short_name, filename, -1,
227			+ al->map->start - al->map->pgoff, false);
228			+ }
229			+
230			+ if (mod) {
231			+ void **userdatap;
232			+
233			+ dwfl_module_info(mod, &userdatap, NULL, NULL, NULL, NULL, NULL, NULL);
234			+ *userdatap = dso;
235			+ }
236
237			return mod && dwfl_addrmodule(ui->dwfl, ip) == mod ? 0 : -1;
238			}