In 'basic' time-travel mode (without =inf-cpu or =ext), we
still get timer interrupts. These can happen at arbitrary
points in time, i.e. while in timer_read(), which pushes
time forward just a little bit. Then, if we happen to get
the interrupt after calculating the new time to push to,
but before actually finishing that, the interrupt will set
the time to a value that's incompatible with the forward,
and we'll crash because time goes backwards when we do the
forwarding.

Fix this by reading the time_travel_time, calculating the
adjustment, and doing the adjustment all with interrupts
disabled.

Reported-by: Vincent Whitchurch <Vincent.Whitchurch@axis.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Richard Weinberger <richard@nod.at>

With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),
indirect call targets are validated against the expected function
pointer prototype to make sure the call target is valid to help mitigate
ROP attacks. If they are not identical, there is a failure at run time,
which manifests as either a kernel panic or thread getting killed. A
warning in clang aims to catch these at compile time, which reveals:

  arch/um/drivers/net_kern.c:353:21: warning: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Wincompatible-function-pointer-types-strict]
    353 |         .ndo_start_xmit         = uml_net_start_xmit,
        |                                   ^~~~~~~~~~~~~~~~~~
  1 warning generated.

->ndo_start_xmit() in 'struct net_device_ops' expects a return type of
'netdev_tx_t', not 'int'. Adjust the return type of uml_net_start_xmit()
to match the prototype's to resolve the warning. While UML does not
currently implement support for kCFI, it could in the future, which
means this warning becomes a fatal CFI failure at run time.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202310031340.v1vPh207-lkp@intel.com/


Acked-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Richard Weinberger <richard@nod.at>

The stub executable page is remapped to a different location in the
userland process. As these functions may be used by the stub, they
really need to be always inlined rather than permitting the compiler to
emit a function.

Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
Signed-off-by: Richard Weinberger <richard@nod.at>

The trampoline is running in a cloned process. It is not safe to use
printk for error printing there.

Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
Signed-off-by: Richard Weinberger <richard@nod.at>

When the winch thread runs into an error condition, it would exit(1) and
never be reaped until shutdown time. Change this to write a command byte
which causes the driver to kill it, therefore reaping the child.

Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
Signed-off-by: Richard Weinberger <richard@nod.at>

The thread is running outside of the UML kernel scope and is a helper.
As such, printk cannot work and os_info must be used instead.

Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
Signed-off-by: Richard Weinberger <richard@nod.at>

The threads allocated inside the kernel have only a single page of
stack. Unfortunately, the vfprintf function in standard glibc may use
too much stack-space, overflowing it.

To make os_info safe to be used by helper threads, use the kernel
vscnprintf function into a smallish buffer and write out the information
to stderr.

Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
Signed-off-by: Richard Weinberger <richard@nod.at>

For the detection code to check whether SYSEMU_SINGLESTEP works
correctly we needed some error cases while stopping to be non-fatal.
However, at this point stop_ptraced_child must always succeed, and we
can therefore simplify it slightly to exit immediately on error.

Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
Signed-off-by: Richard Weinberger <richard@nod.at>

start_userspace is only called from exactly one location, and the passed
pointer for the userspace process stack cannot be NULL.

Remove the check, without changing the control flow.

Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
Signed-off-by: Richard Weinberger <richard@nod.at>

These features have existed since Linux 2.6.14 and can be considered
widely available at this point. Also drop the backward compatibility
code for PTRACE_SETOPTIONS.

Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>

----

v2:
 * Continue to define PTRACE_SYSEMU_SINGLESTEP as glibc only added it in
   version 2.27.
Signed-off-by: Richard Weinberger <richard@nod.at>

arch_futex_atomic_op_inuser was not documented correctly
resulting in build time warnings.

Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Richard Weinberger <richard@nod.at>

I removed all the users of this some time ago, but
evidently forgot the pointers. Remove them from the
data structure too.

Fixes: bfc58e2b

 ("um: remove process stub VMA")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Richard Weinberger <richard@nod.at>

__cant_sleep was already used and exported by the scheduler.
The name had to be changed to a UML specific one.

Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Reviewed-by: Peter Lafreniere <peter@n8pjl.ca>
Signed-off-by: Richard Weinberger <richard@nod.at>

The offset is currently always zero so the backend can't distinguish
between accesses to different ioremapped areas.

Fixes: 522c532c

 ("virt-pci: add platform bus support")
Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Signed-off-by: Richard Weinberger <richard@nod.at>

Pull x86 fixes from Ingo Molnar:

 - Fix a secondary CPUs enumeration regression caused by creative MADT
   APIC table entries on certain systems.

 - Fix a race in the NOP-patcher that can spuriously trigger crashes on
   bootup.

 - Fix a bootup failure regression caused by the parallel bringup code,
   caused by firmware inconsistency between the APIC initialization
   states of the boot and secondary CPUs, on certain systems.

* tag 'x86-urgent-2023-12-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/acpi: Handle bogus MADT APIC tables gracefully
  x86/alternatives: Disable interrupts and sync when optimizing NOPs in place
  x86/alternatives: Sync core before enabling interrupts
  x86/smpboot/64: Handle X2APIC BIOS inconsistency gracefully

Pull SCSI fixes from James Bottomley:
 "Four small fixes, three in drivers with the core one adding a batch
  indicator (for drivers which use it) to the error handler"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ufs: core: Let the sq_lock protect sq_tail_slot access
  scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in ufs_qcom_clk_scale_notify()
  scsi: core: Always send batch on reset or error handling command
  scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()

Pull USB / Thunderbolt fixes from Greg KH:
 "Here are some small bugfixes and new device ids for USB and
  Thunderbolt drivers for 6.7-rc7. Included in here are:

   - new usb-serial device ids

   - thunderbolt driver fixes

   - typec driver fix

   - usb-storage driver quirk added

   - fotg210 driver fix

  All of these have been in linux-next with no reported issues"

* tag 'usb-6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  USB: serial: option: add Quectel EG912Y module support
  USB: serial: ftdi_sio: update Actisense PIDs constant names
  usb: fotg210-hcd: delete an incorrect bounds test
  usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3
  usb: typec: ucsi: fix gpio-based orientation detection
  net: usb: ax88179_178a: avoid failed operations when device is disconnected
  USB: serial: option: add Quectel RM500Q R13 firmware support
  USB: serial: option: add Foxconn T99W265 with new baseline
  thunderbolt: Fix minimum allocated USB 3.x and PCIe bandwidth
  thunderbolt: Fix memory leak in margining_port_remove()

Pull char / misc driver fixes from Greg KH:
 "Here are a small number of various driver fixes for 6.7-rc7 that
  normally come through the char-misc tree, and one debugfs fix as well.

  Included in here are:

   - iio and hid sensor driver fixes for a number of small things

   - interconnect driver fixes

   - brcm_nvmem driver fixes

   - debugfs fix for previous fix

   - guard() definition in device.h so that many subsystems can start
     using it for 6.8-rc1 (requested by Dan Williams to make future
     merges easier)

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'char-misc-6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (21 commits)
  debugfs: initialize cancellations earlier
  Revert "iio: hid-sensor-als: Add light color temperature support"
  Revert "iio: hid-sensor-als: Add light chromaticity support"
  nvmem: brcm_nvram: store a copy of NVRAM content
  dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp
  driver core: Add a guard() definition for the device_lock()
  interconnect: qcom: icc-rpm: Fix peak rate calculation
  iio: adc: MCP3564: fix hardware identification logic
  iio: adc: MCP3564: fix calib_bias and calib_scale range checks
  iio: adc: meson: add separate config for axg SoC family
  iio: adc: imx93: add four channels for imx93 adc
  iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma()
  interconnect: qcom: sm8250: Enable sync_state
  iio: triggered-buffer: prevent possible freeing of wrong buffer
  iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
  iio: imu: adis16475: use bit numbers in assign_bit()
  iio: imu: adis16475: add spi_device_id table
  iio: tmag5273: fix temperature offset
  interconnect: Treat xlate() returning NULL node as an error
  iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table
  ...

Pull input updates from Dmitry Torokhov:

 - a quirk to AT keyboard driver to skip issuing "GET ID" command when
   8042 is in translated mode and the device is a laptop/portable,
   because the "GET ID" command makes a bunch of recent laptops unhappy

 - a quirk to i8042 to disable multiplexed mode on Acer P459-G2-M which
   causes issues on resume

 - psmouse will activate native RMI4 protocol support for touchpad on
   ThinkPad L14 G1

 - addition of Razer Wolverine V2 ID to xpad gamepad driver

 - mapping for airplane mode button in soc_button_array driver for
   TUXEDO laptops

 - improved error handling in ipaq-micro-keys driver

 - amimouse being prepared for platform remove callback returning void

* tag 'input-for-v6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: soc_button_array - add mapping for airplane mode button
  Input: xpad - add Razer Wolverine V2 support
  Input: ipaq-micro-keys - add error handling for devm_kmemdup
  Input: amimouse - convert to platform remove callback returning void
  Input: i8042 - add nomux quirk for Acer P459-G2-M
  Input: atkbd - skip ATKBD_CMD_GETID in translated mode
  Input: psmouse - enable Synaptics InterTouch for ThinkPad L14 G1

This add a mapping for the airplane mode button on the TUXEDO Pulse Gen3.

While it is physically a key it behaves more like a switch, sending a key
down on first press and a key up on 2nd press. Therefor the switch event
is used here. Besides this behaviour it uses the HID usage-id 0xc6
(Wireless Radio Button) and not 0xc8 (Wireless Radio Slider Switch), but
since neither 0xc6 nor 0xc8 are currently implemented at all in
soc_button_array this not to standard behaviour is not put behind a quirk
for the moment.

Signed-off-by: Christoffer Sandberg <cs@tuxedo.de>
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Link: https://lore.kernel.org/r/20231215171718.80229-1-wse@tuxedocomputers.com


Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Pull block fixes from Jens Axboe:
 "Just an NVMe pull request this time, with a fix for bad sleeping
  context, and a revert of a patch that caused some trouble"

* tag 'block-6.7-2023-12-22' of git://git.kernel.dk/linux:
  nvme-pci: fix sleeping function called from interrupt context
  Revert "nvme-fc: fix race between error recovery and creating association"

Pull kvm fixes from Paolo Bonzini:
"RISC-V:

   - Fix a race condition in updating external interrupt for
     trap-n-emulated IMSIC swfile

   - Fix print_reg defaults in get-reg-list selftest

  ARM:

   - Ensure a vCPU's redistributor is unregistered from the MMIO bus if
     vCPU creation fails

   - Fix building KVM selftests for arm64 from the top-level Makefile

  x86:

   - Fix breakage for SEV-ES guests that use XSAVES

  Selftests:

   - Fix bad use of strcat(), by not using strcat() at all"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: SEV: Do not intercept accesses to MSR_IA32_XSS for SEV-ES guests
  KVM: selftests: Fix dynamic generation of configuration names
  RISCV: KVM: update external interrupt atomically for IMSIC swfile
  KVM: riscv: selftests: Fix get-reg-list print_reg defaults
  KVM: selftests: Ensure sysreg-defs.h is generated at the expected path
  KVM: Convert comment into an assertion in kvm_io_bus_register_dev()
  KVM: arm64: vgic: Ensure that slots_lock is held in vgic_register_all_redist_iodevs()
  KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy
  KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy()
  KVM: arm64: vgic: Simplify kvm_vgic_destroy()

KVM/riscv fixes for 6.7, take #1

- Fix a race condition in updating external interrupt for
  trap-n-emulated IMSIC swfile
- Fix print_reg defaults in get-reg-list selftest

Merge tag 'kvmarm-fixes-6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into kvm-master

KVM/arm64 fixes for 6.7, part #2

 - Ensure a vCPU's redistributor is unregistered from the MMIO bus
   if vCPU creation fails

 - Fix building KVM selftests for arm64 from the top-level Makefile

Pull printk fix from Petr Mladek:

 - Prevent refcount warning from code releasing a fwnode

* tag 'printk-for-6.8' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
  lib/vsprintf: Fix %pfwf when current node refcount == 0

Pull sound fixes from Takashi Iwai:
 "Apparently there were so many kids wishing bug fixes that made Santa
  busy; here we have lots of fixes although it's a bit late. But all
  changes are device-specific, hence it should be relatively safe to
  apply.

  Most of changes are for Cirrus codecs (for both ASoC and HD-audio),
  while the remaining are fixes for TI codecs, HD-audio and USB-audio
  quirks"

* tag 'sound-6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (24 commits)
  ALSA: hda: cs35l41: Only add SPI CS GPIO if SPI is enabled in kernel
  ALSA: hda: cs35l41: Do not allow uninitialised variables to be freed
  ASoC: fsl_sai: Fix channel swap issue on i.MX8MP
  ASoC: hdmi-codec: fix missing report for jack initial status
  ALSA: hda/realtek: Add quirks for ASUS Zenbook 2023 Models
  ALSA: hda: cs35l41: Support additional ASUS Zenbook 2023 Models
  ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models
  ALSA: hda: cs35l41: Support additional ASUS Zenbook 2022 Models
  ALSA: hda/realtek: Add quirks for ASUS ROG 2023 models
  ALSA: hda: cs35l41: Support additional ASUS ROG 2023 models
  ALSA: hda: cs35l41: Add config table to support many laptops without _DSD
  ASoC: Intel: bytcr_rt5640: Add new swapped-speakers quirk
  ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346
  kselftest: alsa: fixed a print formatting warning
  ALSA: usb-audio: Increase delay in MOTU M quirk
  ASoC: tas2781: check the validity of prm_no/cfg_no
  ALSA: hda/tas2781: select program 0, conf 0 by default
  ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA
  ASoC: cs42l43: Don't enable bias sense during type detect
  ASoC: Intel: soc-acpi-intel-mtl-match: Change CS35L56 prefixes to AMPn
  ...

Pull i2c fixes from Wolfram Sang:

 - error path fixes (qcom-geni)

 - polling mode fix (rk3x)

 - target mode state machine fix (aspeed)

* tag 'i2c-for-6.7-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: aspeed: Handle the coalesced stop conditions with the start conditions.
  i2c: rk3x: fix potential spinlock recursion on poll
  i2c: qcom-geni: fix missing clk_disable_unprepare() and geni_se_resources_off()

Pull gpio fixes from Bartosz Golaszewski:
 "Here's another round of fixes from the GPIO subsystem for this release
  cycle.

  There's one commit adding synchronization to an ioctl() we overlooked
  previously and another synchronization changeset for one of the
  drivers:

   - add protection against GPIO device removal to an overlooked ioctl()

   - synchronize the interrupt mask register manually in gpio-dwapb"

* tag 'gpio-fixes-for-v6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpio: dwapb: mask/unmask IRQ when disable/enale it
  gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl()

Pull xen fix from Juergen Gross:
 "A single patch fixing a build issue for x86 32-bit configurations with
  CONFIG_XEN, which was introduced in the 6.7 development cycle"

* tag 'for-linus-6.7a-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  x86/xen: add CPU dependencies for 32-bit build

Pull drm fixes from Dave Airlie:
 "Pretty quiet for this week, just i915 and amdgpu fixes,

  I think the misc tree got lost this week, but didn't seem to have too
  much in it, so it can wait. I've also got a bunch of nouveau GSP fixes
  sailing around that'll probably land next time as well.

  amdgpu:
   - DCN 3.5 fixes
   - DCN 3.2 SubVP fix
   - GPUVM fix

  amdkfd:
   - SVM fix for APUs

  i915:
   - Fix state readout and check for DSC and bigjoiner combo
   - Fix a potential integer overflow
   - Reject async flips with bigjoiner
   - Fix MTL HDMI/DP PLL clock selection
   - Fix various issues by disabling pipe DMC events"

* tag 'drm-fixes-2023-12-22' of git://anongit.freedesktop.org/drm/drm:
  drm/amdgpu: re-create idle bo's PTE during VM state machine reset
  drm/amd/display: dereference variable before checking for zero
  drm/amd/display: get dprefclk ss info from integration info table
  drm/amd/display: Add case for dcn35 to support usb4 dmub hpd event
  drm/amd/display: disable FPO and SubVP for older DMUB versions on DCN32x
  drm/amdkfd: svm range always mapped flag not working on APU
  drm/amd/display: Revert " drm/amd/display: Use channel_width = 2 for vram table 3.0"
  drm/i915/dmc: Don't enable any pipe DMC events
  drm/i915/mtl: Fix HDMI/DP PLL clock selection
  drm/i915: Reject async flips with bigjoiner
  drm/i915/hwmon: Fix static analysis tool reported issues
  drm/i915/display: Get bigjoiner config before dsc config during readout

Pull 9p fixes from Dominique Martinet:
 "Two small fixes scheduled for stable trees:

  A tracepoint fix that's been reading past the end of messages forever,
  but semi-recently also went over the end of the buffer. And a
  potential incorrectly freeing garbage in pdu parsing error path"

* tag '9p-for-6.7-rc7' of https://github.com/martinetd/linux:
  net: 9p: avoid freeing uninit memory in p9pdu_vreadf
  9p: prevent read overrun in protocol dump tracepoint

Merge tag 'usb-serial-6.7-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus

Johan writes:

USB-serial device ids for 6.7-rc6

Here are some new modem device ids and a rename of a few ftdi product id
defines.

All have been in linux-next with no reported issues.

* tag 'usb-serial-6.7-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial:
  USB: serial: option: add Quectel EG912Y module support
  USB: serial: ftdi_sio: update Actisense PIDs constant names
  USB: serial: option: add Quectel RM500Q R13 firmware support
  USB: serial: option: add Foxconn T99W265 with new baseline

Tetsuo Handa pointed out that in the (now reverted)
lockdep commit I initialized the data too late. The
same is true for the cancellation data, it must be
initialized before the cmpxchg(), otherwise it may
be done twice and possibly even overwriting data in
there already when there's a race. Fix that, which
also requires destroying the mutex in case we lost
the race.

Fixes: 8c88a474

 ("debugfs: add API to allow debugfs operations cancellation")
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Link: https://lore.kernel.org/r/20231221150444.1e47a0377f80.If7e8ba721ba2956f12c6e8405e7d61e154aa7ae7@changeid


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge tag 'drm-intel-fixes-2023-12-21' of git://anongit.freedesktop.org/drm/drm-intel

 into drm-fixes

drm/i915 fixes for v6.7-rc7:
- Fix state readout and check for DSC and bigjoiner combo
- Fix a potential integer overflow
- Reject async flips with bigjoiner
- Fix MTL HDMI/DP PLL clock selection
- Fix various issues by disabling pipe DMC events

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/87plyzsnxi.fsf@intel.com

Merge tag 'amd-drm-fixes-6.7-2023-12-20' of https://gitlab.freedesktop.org/agd5f/linux

 into drm-fixes

amd-drm-fixes-6.7-2023-12-20:

amdgpu:
- DCN 3.5 fixes
- DCN 3.2 SubVP fix
- GPUVM fix

amdkfd:
- SVM fix for APUs

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231220164845.4975-1-alexander.deucher@amd.com

Pull pin control fixes from Linus Walleij:
 "Some driver fixes for v6.7, all are in drivers, the most interesting
  one is probably the AMD laptop suspend bug which really needs fixing.
  Freedestop org has the bug description:

    https://gitlab.freedesktop.org/drm/amd/-/issues/2812

  Summary:

   - Ignore disabled device tree nodes in the Starfive 7100 and 7100
     drivers.

   - Mask non-wake source pins with interrupt enabled at suspend in the
     AMD driver, this blocks unnecessary wakeups from misc interrupts.
     This can be power consuming because in many cases the system
     doesn't really suspend, it just wakes right back up.

   - Fix a typo breaking compilation of the cy8c95x0 driver, and fix up
     bugs in the get/set config callbacks.

   - Use a dedicated lock class for the PIO4 drivers IRQ. This fixes a
     crash on suspend"

* tag 'pinctrl-v6.7-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl: at91-pio4: use dedicated lock class for IRQ
  pinctrl: cy8c95x0: Fix get_pincfg
  pinctrl: cy8c95x0: Fix regression
  pinctrl: cy8c95x0: Fix typo
  pinctrl: amd: Mask non-wake source pins with interrupt enabled at suspend
  pinctrl: starfive: jh7100: ignore disabled device tree nodes
  pinctrl: starfive: jh7110: ignore disabled device tree nodes

Pull NVMe fixes from Keith:

"nvme fixes for Linux 6.7

 - Revert a commit with improper sleep context (Keith)
 - Fix async event handling sleep context (Maurizio)"

* tag 'nvme-6.7-2023-12-21' of git://git.infradead.org/nvme:
  nvme-pci: fix sleeping function called from interrupt context
  Revert "nvme-fc: fix race between error recovery and creating association"

When an afs_volume struct is put, its refcount is reduced to 0 before
the cell->volume_lock is taken and the volume removed from the
cell->volumes tree.

Unfortunately, this means that the lookup code can race and see a volume
with a zero ref in the tree, resulting in a use-after-free:

    refcount_t: addition on 0; use-after-free.
    WARNING: CPU: 3 PID: 130782 at lib/refcount.c:25 refcount_warn_saturate+0x7a/0xda
    ...
    RIP: 0010:refcount_warn_saturate+0x7a/0xda
    ...
    Call Trace:
     afs_get_volume+0x3d/0x55
     afs_create_volume+0x126/0x1de
     afs_validate_fc+0xfe/0x130
     afs_get_tree+0x20/0x2e5
     vfs_get_tree+0x1d/0xc9
     do_new_mount+0x13b/0x22e
     do_mount+0x5d/0x8a
     __do_sys_mount+0x100/0x12a
     do_syscall_64+0x3a/0x94
     entry_SYSCALL_64_after_hwframe+0x62/0x6a

Fix this by:

 (1) When putting, use a flag to indicate if the volume has been removed
     from the tree and skip the rb_erase if it has.

 (2) When looking up, use a conditional ref increment and if it fails
     because the refcount is 0, replace the node in the tree and set the
     removal flag.

Fixes: 20325960

 ("afs: Reorganise volume and server trees to be rooted on the cell")
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The IDA usually detects double-frees, but that detection failed to
consider the case when there are no nearby IDs allocated and so we have a
NULL bitmap rather than simply having a clear bit.  Add some tests to the
test-suite to be sure we don't inadvertently reintroduce this problem.
Unfortunately they're quite noisy so include a message to disregard
the warnings.

Reported-by: Zhenghan Wang <wzhmmmmm@gmail.com>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>