Fixes for 6.8

Signed-off-by: Sasha Levin <sashal@kernel.org>

20 files changed, 1421 insertions, 0 deletions

diff --git a/queue-6.8/alsa-hda-realtek-fix-volumn-control-of-thinkbook-16p.patch b/queue-6.8/alsa-hda-realtek-fix-volumn-control-of-thinkbook-16p.patch
new file mode 100644
index 0000000000..5d95754995
--- /dev/null
+++ b/queue-6.8/alsa-hda-realtek-fix-volumn-control-of-thinkbook-16p.patch
@@ -0,0 +1,40 @@
+From bcadb5763a3cbc415f3b4bafe2e780be9861dcc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Apr 2024 19:41:22 +0800
+Subject: ALSA: hda/realtek: Fix volumn control of ThinkBook 16P Gen4
+
+From: Huayu Zhang <zhanghuayu1233@qq.com>
+
+[ Upstream commit dca5f4dfa925b51becee65031869e917e6229620 ]
+
+change HDA & AMP configuration from ALC287_FIXUP_CS35L41_I2C_2 to
+ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD for ThinkBook 16P Gen4
+models to fix volumn control issue (cannot fully mute).
+
+Signed-off-by: Huayu Zhang <zhanghuayu1233@qq.com>
+Fixes: 6214e24cae9b ("ALSA: hda/realtek: Add quirks for Lenovo Thinkbook 16P laptops")
+Message-ID: <tencent_37EB880C5E5BD99D21C16B288115C4545F06@qq.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 8c2467ed127ee..a57f5a02b498d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10381,8 +10381,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x17aa, 0x3886, "Y780 VECO DUAL", ALC287_FIXUP_TAS2781_I2C),
+ 	SND_PCI_QUIRK(0x17aa, 0x38a7, "Y780P AMD YG dual", ALC287_FIXUP_TAS2781_I2C),
+ 	SND_PCI_QUIRK(0x17aa, 0x38a8, "Y780P AMD VECO dual", ALC287_FIXUP_TAS2781_I2C),
+-	SND_PCI_QUIRK(0x17aa, 0x38a9, "Thinkbook 16P", ALC287_FIXUP_CS35L41_I2C_2),
+-	SND_PCI_QUIRK(0x17aa, 0x38ab, "Thinkbook 16P", ALC287_FIXUP_CS35L41_I2C_2),
++	SND_PCI_QUIRK(0x17aa, 0x38a9, "Thinkbook 16P", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD),
++	SND_PCI_QUIRK(0x17aa, 0x38ab, "Thinkbook 16P", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD),
+ 	SND_PCI_QUIRK(0x17aa, 0x38b4, "Legion Slim 7 16IRH8", ALC287_FIXUP_CS35L41_I2C_2),
+ 	SND_PCI_QUIRK(0x17aa, 0x38b5, "Legion Slim 7 16IRH8", ALC287_FIXUP_CS35L41_I2C_2),
+ 	SND_PCI_QUIRK(0x17aa, 0x38b6, "Legion Slim 7 16APH8", ALC287_FIXUP_CS35L41_I2C_2),
+-- 
+2.43.0
+
diff --git a/queue-6.8/configs-hardening-fix-disabling-ubsan-configurations.patch b/queue-6.8/configs-hardening-fix-disabling-ubsan-configurations.patch
new file mode 100644
index 0000000000..e3583bfb83
--- /dev/null
+++ b/queue-6.8/configs-hardening-fix-disabling-ubsan-configurations.patch
@@ -0,0 +1,80 @@
+From a54fba0bb1f52707b423c908e153d6429d08db58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Apr 2024 11:11:06 -0700
+Subject: configs/hardening: Fix disabling UBSAN configurations
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit e048d668f2969cf2b76e0fa21882a1b3bb323eca ]
+
+The initial change that added kernel/configs/hardening.config attempted
+to disable all UBSAN sanitizers except for the array bounds one while
+turning on UBSAN_TRAP. Unfortunately, it only got the syntax for
+CONFIG_UBSAN_SHIFT correct, so configurations that are on by default
+with CONFIG_UBSAN=y such as CONFIG_UBSAN_{BOOL,ENUM} do not get disabled
+properly.
+
+  CONFIG_ARCH_HAS_UBSAN=y
+  CONFIG_UBSAN=y
+  CONFIG_UBSAN_TRAP=y
+  CONFIG_CC_HAS_UBSAN_BOUNDS_STRICT=y
+  CONFIG_UBSAN_BOUNDS=y
+  CONFIG_UBSAN_BOUNDS_STRICT=y
+  # CONFIG_UBSAN_SHIFT is not set
+  # CONFIG_UBSAN_DIV_ZERO is not set
+  # CONFIG_UBSAN_UNREACHABLE is not set
+  CONFIG_UBSAN_SIGNED_WRAP=y
+  CONFIG_UBSAN_BOOL=y
+  CONFIG_UBSAN_ENUM=y
+  # CONFIG_TEST_UBSAN is not set
+
+Add the missing 'is not set' to each configuration that needs it so that
+they get disabled as intended.
+
+  CONFIG_ARCH_HAS_UBSAN=y
+  CONFIG_UBSAN=y
+  CONFIG_UBSAN_TRAP=y
+  CONFIG_CC_HAS_UBSAN_BOUNDS_STRICT=y
+  CONFIG_UBSAN_BOUNDS=y
+  CONFIG_UBSAN_BOUNDS_STRICT=y
+  # CONFIG_UBSAN_SHIFT is not set
+  # CONFIG_UBSAN_DIV_ZERO is not set
+  # CONFIG_UBSAN_UNREACHABLE is not set
+  CONFIG_UBSAN_SIGNED_WRAP=y
+  # CONFIG_UBSAN_BOOL is not set
+  # CONFIG_UBSAN_ENUM is not set
+  # CONFIG_TEST_UBSAN is not set
+
+Fixes: 215199e3d9f3 ("hardening: Provide Kconfig fragments for basic options")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Link: https://lore.kernel.org/r/20240411-fix-ubsan-in-hardening-config-v1-1-e0177c80ffaa@kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/configs/hardening.config | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/configs/hardening.config b/kernel/configs/hardening.config
+index 4dc0cd342cede..5b52cb1cc38f2 100644
+--- a/kernel/configs/hardening.config
++++ b/kernel/configs/hardening.config
+@@ -39,11 +39,11 @@ CONFIG_UBSAN=y
+ CONFIG_UBSAN_TRAP=y
+ CONFIG_UBSAN_BOUNDS=y
+ # CONFIG_UBSAN_SHIFT is not set
+-# CONFIG_UBSAN_DIV_ZERO
+-# CONFIG_UBSAN_UNREACHABLE
+-# CONFIG_UBSAN_BOOL
+-# CONFIG_UBSAN_ENUM
+-# CONFIG_UBSAN_ALIGNMENT
++# CONFIG_UBSAN_DIV_ZERO is not set
++# CONFIG_UBSAN_UNREACHABLE is not set
++# CONFIG_UBSAN_BOOL is not set
++# CONFIG_UBSAN_ENUM is not set
++# CONFIG_UBSAN_ALIGNMENT is not set
+ 
+ # Linked list integrity checking.
+ CONFIG_LIST_HARDENED=y
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-nv04-fix-out-of-bounds-access.patch b/queue-6.8/drm-nv04-fix-out-of-bounds-access.patch
new file mode 100644
index 0000000000..c552a95f64
--- /dev/null
+++ b/queue-6.8/drm-nv04-fix-out-of-bounds-access.patch
@@ -0,0 +1,86 @@
+From 702be1d88dcc1e6e8d9bc7fc58fda6978cbdef1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Apr 2024 14:08:52 +0300
+Subject: drm: nv04: Fix out of bounds access
+
+From: Mikhail Kobuk <m.kobuk@ispras.ru>
+
+[ Upstream commit cf92bb778eda7830e79452c6917efa8474a30c1e ]
+
+When Output Resource (dcb->or) value is assigned in
+fabricate_dcb_output(), there may be out of bounds access to
+dac_users array in case dcb->or is zero because ffs(dcb->or) is
+used as index there.
+The 'or' argument of fabricate_dcb_output() must be interpreted as a
+number of bit to set, not value.
+
+Utilize macros from 'enum nouveau_or' in calls instead of hardcoding.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 2e5702aff395 ("drm/nouveau: fabricate DCB encoder table for iMac G4")
+Fixes: 670820c0e6a9 ("drm/nouveau: Workaround incorrect DCB entry on a GeForce3 Ti 200.")
+Signed-off-by: Mikhail Kobuk <m.kobuk@ispras.ru>
+Signed-off-by: Danilo Krummrich <dakr@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240411110854.16701-1-m.kobuk@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_bios.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
+index 479effcf607e2..79cfab53f80e2 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
++++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
+@@ -23,6 +23,7 @@
+  */
+ 
+ #include "nouveau_drv.h"
++#include "nouveau_bios.h"
+ #include "nouveau_reg.h"
+ #include "dispnv04/hw.h"
+ #include "nouveau_encoder.h"
+@@ -1677,7 +1678,7 @@ apply_dcb_encoder_quirks(struct drm_device *dev, int idx, u32 *conn, u32 *conf)
+ 	 */
+ 	if (nv_match_device(dev, 0x0201, 0x1462, 0x8851)) {
+ 		if (*conn == 0xf2005014 && *conf == 0xffffffff) {
+-			fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, 1);
++			fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, DCB_OUTPUT_B);
+ 			return false;
+ 		}
+ 	}
+@@ -1763,26 +1764,26 @@ fabricate_dcb_encoder_table(struct drm_device *dev, struct nvbios *bios)
+ #ifdef __powerpc__
+ 	/* Apple iMac G4 NV17 */
+ 	if (of_machine_is_compatible("PowerMac4,5")) {
+-		fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, 1);
+-		fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, 2);
++		fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, DCB_OUTPUT_B);
++		fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, DCB_OUTPUT_C);
+ 		return;
+ 	}
+ #endif
+ 
+ 	/* Make up some sane defaults */
+ 	fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG,
+-			     bios->legacy.i2c_indices.crt, 1, 1);
++			     bios->legacy.i2c_indices.crt, 1, DCB_OUTPUT_B);
+ 
+ 	if (nv04_tv_identify(dev, bios->legacy.i2c_indices.tv) >= 0)
+ 		fabricate_dcb_output(dcb, DCB_OUTPUT_TV,
+ 				     bios->legacy.i2c_indices.tv,
+-				     all_heads, 0);
++				     all_heads, DCB_OUTPUT_A);
+ 
+ 	else if (bios->tmds.output0_script_ptr ||
+ 		 bios->tmds.output1_script_ptr)
+ 		fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS,
+ 				     bios->legacy.i2c_indices.panel,
+-				     all_heads, 1);
++				     all_heads, DCB_OUTPUT_B);
+ }
+ 
+ static int
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-panel-visionox-rm69299-don-t-unregister-dsi-devi.patch b/queue-6.8/drm-panel-visionox-rm69299-don-t-unregister-dsi-devi.patch
new file mode 100644
index 0000000000..07967065c4
--- /dev/null
+++ b/queue-6.8/drm-panel-visionox-rm69299-don-t-unregister-dsi-devi.patch
@@ -0,0 +1,38 @@
+From 2deb5bf961a52f0e845718b2bafe73f1e2c75d32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Apr 2024 13:07:59 +0300
+Subject: drm/panel: visionox-rm69299: don't unregister DSI device
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 9e4d3f4f34455abbaa9930bf6b7575a5cd081496 ]
+
+The DSI device for the panel was registered by the DSI host, so it is an
+error to unregister it from the panel driver. Drop the call to
+mipi_dsi_device_unregister().
+
+Fixes: c7f66d32dd43 ("drm/panel: add support for rm69299 visionox panel")
+Reviewed-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240404-drop-panel-unregister-v1-1-9f56953c5fb9@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-visionox-rm69299.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-visionox-rm69299.c b/drivers/gpu/drm/panel/panel-visionox-rm69299.c
+index 775144695283f..b15ca56a09a74 100644
+--- a/drivers/gpu/drm/panel/panel-visionox-rm69299.c
++++ b/drivers/gpu/drm/panel/panel-visionox-rm69299.c
+@@ -253,8 +253,6 @@ static void visionox_rm69299_remove(struct mipi_dsi_device *dsi)
+ 	struct visionox_rm69299 *ctx = mipi_dsi_get_drvdata(dsi);
+ 
+ 	mipi_dsi_detach(ctx->dsi);
+-	mipi_dsi_device_unregister(ctx->dsi);
+-
+ 	drm_panel_remove(&ctx->panel);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-radeon-make-fstrict-flex-arrays-3-happy.patch b/queue-6.8/drm-radeon-make-fstrict-flex-arrays-3-happy.patch
new file mode 100644
index 0000000000..e10c8f891e
--- /dev/null
+++ b/queue-6.8/drm-radeon-make-fstrict-flex-arrays-3-happy.patch
@@ -0,0 +1,50 @@
+From c4197e2979573fea1ee481df8563c5607d2c849a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Apr 2024 22:06:08 -0400
+Subject: drm/radeon: make -fstrict-flex-arrays=3 happy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 0ba753bc7e79e49556e81b0d09b2de1aa558553b ]
+
+The driver parses a union where the layout up through the first
+array is the same, however, the array has different sizes
+depending on the elements in the union.  Be explicit to
+fix the UBSAN checker.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3323
+Fixes: df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3")
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_atombios.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index 3596ea4a8b60f..fc7b0e8f1ca15 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -923,8 +923,12 @@ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
+ 		max_device = ATOM_MAX_SUPPORTED_DEVICE_INFO;
+ 
+ 	for (i = 0; i < max_device; i++) {
+-		ATOM_CONNECTOR_INFO_I2C ci =
+-		    supported_devices->info.asConnInfo[i];
++		ATOM_CONNECTOR_INFO_I2C ci;
++
++		if (frev > 1)
++			ci = supported_devices->info_2d1.asConnInfo[i];
++		else
++			ci = supported_devices->info.asConnInfo[i];
+ 
+ 		bios_connectors[i].valid = false;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-v3d-don-t-increment-enabled_ns-twice.patch b/queue-6.8/drm-v3d-don-t-increment-enabled_ns-twice.patch
new file mode 100644
index 0000000000..4d5fda4f08
--- /dev/null
+++ b/queue-6.8/drm-v3d-don-t-increment-enabled_ns-twice.patch
@@ -0,0 +1,74 @@
+From 3199f618fdb2141a09f214001a7f9c9781f774f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Apr 2024 17:24:50 -0300
+Subject: drm/v3d: Don't increment `enabled_ns` twice
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maíra Canal <mcanal@igalia.com>
+
+[ Upstream commit 35f4f8c9fc972248055096d63b782060e473311b ]
+
+The commit 509433d8146c ("drm/v3d: Expose the total GPU usage stats on sysfs")
+introduced the calculation of global GPU stats. For the regards, it used
+the already existing infrastructure provided by commit 09a93cc4f7d1 ("drm/v3d:
+Implement show_fdinfo() callback for GPU usage stats"). While adding
+global GPU stats calculation ability, the author forgot to delete the
+existing one.
+
+Currently, the value of `enabled_ns` is incremented twice by the end of
+the job, when it should be added just once. Therefore, delete the
+leftovers from commit 509433d8146c ("drm/v3d: Expose the total GPU usage
+stats on sysfs").
+
+Fixes: 509433d8146c ("drm/v3d: Expose the total GPU usage stats on sysfs")
+Reported-by: Tvrtko Ursulin <tursulin@igalia.com>
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Reviewed-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240403203517.731876-2-mcanal@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/v3d/v3d_irq.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c
+index afc76390a197a..b8f9f2a3d2fb3 100644
+--- a/drivers/gpu/drm/v3d/v3d_irq.c
++++ b/drivers/gpu/drm/v3d/v3d_irq.c
+@@ -105,7 +105,6 @@ v3d_irq(int irq, void *arg)
+ 		struct v3d_file_priv *file = v3d->bin_job->base.file->driver_priv;
+ 		u64 runtime = local_clock() - file->start_ns[V3D_BIN];
+ 
+-		file->enabled_ns[V3D_BIN] += local_clock() - file->start_ns[V3D_BIN];
+ 		file->jobs_sent[V3D_BIN]++;
+ 		v3d->queue[V3D_BIN].jobs_sent++;
+ 
+@@ -126,7 +125,6 @@ v3d_irq(int irq, void *arg)
+ 		struct v3d_file_priv *file = v3d->render_job->base.file->driver_priv;
+ 		u64 runtime = local_clock() - file->start_ns[V3D_RENDER];
+ 
+-		file->enabled_ns[V3D_RENDER] += local_clock() - file->start_ns[V3D_RENDER];
+ 		file->jobs_sent[V3D_RENDER]++;
+ 		v3d->queue[V3D_RENDER].jobs_sent++;
+ 
+@@ -147,7 +145,6 @@ v3d_irq(int irq, void *arg)
+ 		struct v3d_file_priv *file = v3d->csd_job->base.file->driver_priv;
+ 		u64 runtime = local_clock() - file->start_ns[V3D_CSD];
+ 
+-		file->enabled_ns[V3D_CSD] += local_clock() - file->start_ns[V3D_CSD];
+ 		file->jobs_sent[V3D_CSD]++;
+ 		v3d->queue[V3D_CSD].jobs_sent++;
+ 
+@@ -195,7 +192,6 @@ v3d_hub_irq(int irq, void *arg)
+ 		struct v3d_file_priv *file = v3d->tfu_job->base.file->driver_priv;
+ 		u64 runtime = local_clock() - file->start_ns[V3D_TFU];
+ 
+-		file->enabled_ns[V3D_TFU] += local_clock() - file->start_ns[V3D_TFU];
+ 		file->jobs_sent[V3D_TFU]++;
+ 		v3d->queue[V3D_TFU].jobs_sent++;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/hardening-drop-obsolete-ubsan_sanitize_all-from-conf.patch b/queue-6.8/hardening-drop-obsolete-ubsan_sanitize_all-from-conf.patch
new file mode 100644
index 0000000000..462937ec84
--- /dev/null
+++ b/queue-6.8/hardening-drop-obsolete-ubsan_sanitize_all-from-conf.patch
@@ -0,0 +1,42 @@
+From 2109a3fd1413eb8f5990f54ba1bbb95b882b6da5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 10:10:44 +0100
+Subject: hardening: drop obsolete UBSAN_SANITIZE_ALL from config fragment
+
+From: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+
+[ Upstream commit 006eac3fe20f03ea70765cb02a823dbb8737ec00 ]
+
+Commit 7a628f818499 ("ubsan: Remove CONFIG_UBSAN_SANITIZE_ALL") removes the
+config UBSAN_SANITIZE_ALL, but one reference to that config is left in the
+hardening.config fragment.
+
+Drop this reference in hardening.config fragment.
+
+Note that CONFIG_UBSAN is still enabled in the hardening.config fragment,
+so the functionality when using this fragment remains the same.
+
+Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+Link: https://lore.kernel.org/r/20240208091045.9219-2-lukas.bulwahn@gmail.com
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Stable-dep-of: e048d668f296 ("configs/hardening: Fix disabling UBSAN configurations")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/configs/hardening.config | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/kernel/configs/hardening.config b/kernel/configs/hardening.config
+index 95a400f042b12..4dc0cd342cede 100644
+--- a/kernel/configs/hardening.config
++++ b/kernel/configs/hardening.config
+@@ -44,7 +44,6 @@ CONFIG_UBSAN_BOUNDS=y
+ # CONFIG_UBSAN_BOOL
+ # CONFIG_UBSAN_ENUM
+ # CONFIG_UBSAN_ALIGNMENT
+-CONFIG_UBSAN_SANITIZE_ALL=y
+ 
+ # Linked list integrity checking.
+ CONFIG_LIST_HARDENED=y
+-- 
+2.43.0
+
diff --git a/queue-6.8/iommufd-add-config-needed-for-iommufd_fail_nth.patch b/queue-6.8/iommufd-add-config-needed-for-iommufd_fail_nth.patch
new file mode 100644
index 0000000000..45a9775461
--- /dev/null
+++ b/queue-6.8/iommufd-add-config-needed-for-iommufd_fail_nth.patch
@@ -0,0 +1,35 @@
+From fffe79c0afa1b27c1680bad97093d1a6d0118164 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2024 14:00:48 +0500
+Subject: iommufd: Add config needed for iommufd_fail_nth
+
+From: Muhammad Usama Anjum <usama.anjum@collabora.com>
+
+[ Upstream commit 2760c51b8040d7cffedc337939e7475a17cc4b19 ]
+
+Add FAULT_INJECTION_DEBUG_FS and FAILSLAB configurations to the kconfig
+fragment for the iommfd selftests. These kconfigs are needed by the
+iommufd_fail_nth test.
+
+Fixes: a9af47e382a4 ("iommufd/selftest: Test IOMMU_HWPT_GET_DIRTY_BITMAP")
+Link: https://lore.kernel.org/r/20240325090048.1423908-1-usama.anjum@collabora.com
+Signed-off-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/iommu/config | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/iommu/config b/tools/testing/selftests/iommu/config
+index 110d73917615d..02a2a1b267c1e 100644
+--- a/tools/testing/selftests/iommu/config
++++ b/tools/testing/selftests/iommu/config
+@@ -1,3 +1,5 @@
+ CONFIG_IOMMUFD=y
++CONFIG_FAULT_INJECTION_DEBUG_FS=y
+ CONFIG_FAULT_INJECTION=y
+ CONFIG_IOMMUFD_TEST=y
++CONFIG_FAILSLAB=y
+-- 
+2.43.0
+
diff --git a/queue-6.8/iommufd-add-missing-iommufd_driver-kconfig-for-the-s.patch b/queue-6.8/iommufd-add-missing-iommufd_driver-kconfig-for-the-s.patch
new file mode 100644
index 0000000000..6bb3504e6a
--- /dev/null
+++ b/queue-6.8/iommufd-add-missing-iommufd_driver-kconfig-for-the-s.patch
@@ -0,0 +1,38 @@
+From e8f66e6b117d556bc4faedcbdf1f662cefc8887b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Apr 2024 21:05:14 -0300
+Subject: iommufd: Add missing IOMMUFD_DRIVER kconfig for the selftest
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 8541323285994528ad5be2c1bdc759e6c83b936e ]
+
+Some kconfigs don't automatically include this symbol which results in sub
+functions for some of the dirty tracking related things that are
+non-functional. Thus the test suite will fail. select IOMMUFD_DRIVER in
+the IOMMUFD_TEST kconfig to fix it.
+
+Fixes: a9af47e382a4 ("iommufd/selftest: Test IOMMU_HWPT_GET_DIRTY_BITMAP")
+Link: https://lore.kernel.org/r/20240327182050.GA1363414@ziepe.ca
+Tested-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommufd/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/iommu/iommufd/Kconfig b/drivers/iommu/iommufd/Kconfig
+index 99d4b075df49e..76656fe0470d7 100644
+--- a/drivers/iommu/iommufd/Kconfig
++++ b/drivers/iommu/iommufd/Kconfig
+@@ -37,6 +37,7 @@ config IOMMUFD_TEST
+ 	depends on DEBUG_KERNEL
+ 	depends on FAULT_INJECTION
+ 	depends on RUNTIME_TESTING_MENU
++	select IOMMUFD_DRIVER
+ 	default n
+ 	help
+ 	  This is dangerous, do not enable unless running
+-- 
+2.43.0
+
diff --git a/queue-6.8/nfsd-fix-endianness-issue-in-nfsd4_encode_fattr4.patch b/queue-6.8/nfsd-fix-endianness-issue-in-nfsd4_encode_fattr4.patch
new file mode 100644
index 0000000000..1cd7d7c88e
--- /dev/null
+++ b/queue-6.8/nfsd-fix-endianness-issue-in-nfsd4_encode_fattr4.patch
@@ -0,0 +1,164 @@
+From e83893b2fd602a35d260e52809b13d2247674e57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Apr 2024 11:45:57 +0200
+Subject: NFSD: fix endianness issue in nfsd4_encode_fattr4
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit f488138b526715c6d2568d7329c4477911be4210 ]
+
+The nfs4 mount fails with EIO on 64-bit big endian architectures since
+v6.7. The issue arises from employing a union in the nfsd4_encode_fattr4()
+function to overlay a 32-bit array with a 64-bit values based bitmap,
+which does not function as intended. Address the endianness issue by
+utilizing bitmap_from_arr32() to copy 32-bit attribute masks into a
+bitmap in an endianness-agnostic manner.
+
+Cc: stable@vger.kernel.org
+Fixes: fce7913b13d0 ("NFSD: Use a bitmask loop to encode FATTR4 results")
+Link: https://bugs.launchpad.net/ubuntu/+source/nfs-utils/+bug/2060217
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4xdr.c | 47 +++++++++++++++++++++++------------------------
+ 1 file changed, 23 insertions(+), 24 deletions(-)
+
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index c719c475a068e..c17bdf973c18d 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -3490,11 +3490,13 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
+ 		    struct dentry *dentry, const u32 *bmval,
+ 		    int ignore_crossmnt)
+ {
++	DECLARE_BITMAP(attr_bitmap, ARRAY_SIZE(nfsd4_enc_fattr4_encode_ops));
+ 	struct nfsd4_fattr_args args;
+ 	struct svc_fh *tempfh = NULL;
+ 	int starting_len = xdr->buf->len;
+ 	__be32 *attrlen_p, status;
+ 	int attrlen_offset;
++	u32 attrmask[3];
+ 	int err;
+ 	struct nfsd4_compoundres *resp = rqstp->rq_resp;
+ 	u32 minorversion = resp->cstate.minorversion;
+@@ -3502,10 +3504,6 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
+ 		.mnt	= exp->ex_path.mnt,
+ 		.dentry	= dentry,
+ 	};
+-	union {
+-		u32		attrmask[3];
+-		unsigned long	mask[2];
+-	} u;
+ 	unsigned long bit;
+ 
+ 	WARN_ON_ONCE(bmval[1] & NFSD_WRITEONLY_ATTRS_WORD1);
+@@ -3519,20 +3517,19 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
+ 	/*
+ 	 * Make a local copy of the attribute bitmap that can be modified.
+ 	 */
+-	memset(&u, 0, sizeof(u));
+-	u.attrmask[0] = bmval[0];
+-	u.attrmask[1] = bmval[1];
+-	u.attrmask[2] = bmval[2];
++	attrmask[0] = bmval[0];
++	attrmask[1] = bmval[1];
++	attrmask[2] = bmval[2];
+ 
+ 	args.rdattr_err = 0;
+ 	if (exp->ex_fslocs.migrated) {
+-		status = fattr_handle_absent_fs(&u.attrmask[0], &u.attrmask[1],
+-						&u.attrmask[2], &args.rdattr_err);
++		status = fattr_handle_absent_fs(&attrmask[0], &attrmask[1],
++						&attrmask[2], &args.rdattr_err);
+ 		if (status)
+ 			goto out;
+ 	}
+ 	args.size = 0;
+-	if (u.attrmask[0] & (FATTR4_WORD0_CHANGE | FATTR4_WORD0_SIZE)) {
++	if (attrmask[0] & (FATTR4_WORD0_CHANGE | FATTR4_WORD0_SIZE)) {
+ 		status = nfsd4_deleg_getattr_conflict(rqstp, d_inode(dentry));
+ 		if (status)
+ 			goto out;
+@@ -3547,16 +3544,16 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
+ 
+ 	if (!(args.stat.result_mask & STATX_BTIME))
+ 		/* underlying FS does not offer btime so we can't share it */
+-		u.attrmask[1] &= ~FATTR4_WORD1_TIME_CREATE;
+-	if ((u.attrmask[0] & (FATTR4_WORD0_FILES_AVAIL | FATTR4_WORD0_FILES_FREE |
++		attrmask[1] &= ~FATTR4_WORD1_TIME_CREATE;
++	if ((attrmask[0] & (FATTR4_WORD0_FILES_AVAIL | FATTR4_WORD0_FILES_FREE |
+ 			FATTR4_WORD0_FILES_TOTAL | FATTR4_WORD0_MAXNAME)) ||
+-	    (u.attrmask[1] & (FATTR4_WORD1_SPACE_AVAIL | FATTR4_WORD1_SPACE_FREE |
++	    (attrmask[1] & (FATTR4_WORD1_SPACE_AVAIL | FATTR4_WORD1_SPACE_FREE |
+ 		       FATTR4_WORD1_SPACE_TOTAL))) {
+ 		err = vfs_statfs(&path, &args.statfs);
+ 		if (err)
+ 			goto out_nfserr;
+ 	}
+-	if ((u.attrmask[0] & (FATTR4_WORD0_FILEHANDLE | FATTR4_WORD0_FSID)) &&
++	if ((attrmask[0] & (FATTR4_WORD0_FILEHANDLE | FATTR4_WORD0_FSID)) &&
+ 	    !fhp) {
+ 		tempfh = kmalloc(sizeof(struct svc_fh), GFP_KERNEL);
+ 		status = nfserr_jukebox;
+@@ -3571,10 +3568,10 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
+ 		args.fhp = fhp;
+ 
+ 	args.acl = NULL;
+-	if (u.attrmask[0] & FATTR4_WORD0_ACL) {
++	if (attrmask[0] & FATTR4_WORD0_ACL) {
+ 		err = nfsd4_get_nfs4_acl(rqstp, dentry, &args.acl);
+ 		if (err == -EOPNOTSUPP)
+-			u.attrmask[0] &= ~FATTR4_WORD0_ACL;
++			attrmask[0] &= ~FATTR4_WORD0_ACL;
+ 		else if (err == -EINVAL) {
+ 			status = nfserr_attrnotsupp;
+ 			goto out;
+@@ -3586,17 +3583,17 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
+ 
+ #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
+ 	args.context = NULL;
+-	if ((u.attrmask[2] & FATTR4_WORD2_SECURITY_LABEL) ||
+-	     u.attrmask[0] & FATTR4_WORD0_SUPPORTED_ATTRS) {
++	if ((attrmask[2] & FATTR4_WORD2_SECURITY_LABEL) ||
++	     attrmask[0] & FATTR4_WORD0_SUPPORTED_ATTRS) {
+ 		if (exp->ex_flags & NFSEXP_SECURITY_LABEL)
+ 			err = security_inode_getsecctx(d_inode(dentry),
+ 						&args.context, &args.contextlen);
+ 		else
+ 			err = -EOPNOTSUPP;
+ 		args.contextsupport = (err == 0);
+-		if (u.attrmask[2] & FATTR4_WORD2_SECURITY_LABEL) {
++		if (attrmask[2] & FATTR4_WORD2_SECURITY_LABEL) {
+ 			if (err == -EOPNOTSUPP)
+-				u.attrmask[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
++				attrmask[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
+ 			else if (err)
+ 				goto out_nfserr;
+ 		}
+@@ -3604,8 +3601,8 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
+ #endif /* CONFIG_NFSD_V4_SECURITY_LABEL */
+ 
+ 	/* attrmask */
+-	status = nfsd4_encode_bitmap4(xdr, u.attrmask[0],
+-				      u.attrmask[1], u.attrmask[2]);
++	status = nfsd4_encode_bitmap4(xdr, attrmask[0], attrmask[1],
++				      attrmask[2]);
+ 	if (status)
+ 		goto out;
+ 
+@@ -3614,7 +3611,9 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
+ 	attrlen_p = xdr_reserve_space(xdr, XDR_UNIT);
+ 	if (!attrlen_p)
+ 		goto out_resource;
+-	for_each_set_bit(bit, (const unsigned long *)&u.mask,
++	bitmap_from_arr32(attr_bitmap, attrmask,
++			  ARRAY_SIZE(nfsd4_enc_fattr4_encode_ops));
++	for_each_set_bit(bit, attr_bitmap,
+ 			 ARRAY_SIZE(nfsd4_enc_fattr4_encode_ops)) {
+ 		status = nfsd4_enc_fattr4_encode_ops[bit](xdr, &args);
+ 		if (status != nfs_ok)
+-- 
+2.43.0
+
diff --git a/queue-6.8/perf-annotate-make-sure-to-call-symbol__annotate2-in.patch b/queue-6.8/perf-annotate-make-sure-to-call-symbol__annotate2-in.patch
new file mode 100644
index 0000000000..19ffc7db72
--- /dev/null
+++ b/queue-6.8/perf-annotate-make-sure-to-call-symbol__annotate2-in.patch
@@ -0,0 +1,63 @@
+From 8f1b0066988a40901dcd3ef3feb55db2f8ec1502 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Apr 2024 14:17:57 -0700
+Subject: perf annotate: Make sure to call symbol__annotate2() in TUI
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit 2b8dbf69ec60faf6c7db49e57d7f316409ccec92 ]
+
+The symbol__annotate2() initializes some data structures needed by TUI.
+It has a logic to prevent calling it multiple times by checking if it
+has the annotated source.  But data type profiling uses a different
+code (symbol__annotate) to allocate the annotated lines in advance.
+So TUI missed to call symbol__annotate2() when it shows the annotation
+browser.
+
+Make symbol__annotate() reentrant and handle that situation properly.
+This fixes a crash in the annotation browser started by perf report in
+TUI like below.
+
+  $ perf report -s type,sym --tui
+  # and press 'a' key and then move down
+
+Fixes: 81e57deec325 ("perf report: Support data type profiling")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240405211800.1412920-2-namhyung@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/ui/browsers/annotate.c | 2 +-
+ tools/perf/util/annotate.c        | 3 +++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c
+index ec5e219328760..4790c735599bd 100644
+--- a/tools/perf/ui/browsers/annotate.c
++++ b/tools/perf/ui/browsers/annotate.c
+@@ -970,7 +970,7 @@ int symbol__tui_annotate(struct map_symbol *ms, struct evsel *evsel,
+ 	if (dso->annotate_warned)
+ 		return -1;
+ 
+-	if (not_annotated) {
++	if (not_annotated || !sym->annotate2) {
+ 		err = symbol__annotate2(ms, evsel, &browser.arch);
+ 		if (err) {
+ 			char msg[BUFSIZ];
+diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
+index 9b70ab110ce79..86a996290e9ab 100644
+--- a/tools/perf/util/annotate.c
++++ b/tools/perf/util/annotate.c
+@@ -2435,6 +2435,9 @@ int symbol__annotate(struct map_symbol *ms, struct evsel *evsel,
+ 	if (parch)
+ 		*parch = arch;
+ 
++	if (!list_empty(&notes->src->source))
++		return 0;
++
+ 	args.arch = arch;
+ 	args.ms = *ms;
+ 	if (annotate_opts.full_addr)
+-- 
+2.43.0
+
diff --git a/queue-6.8/perf-lock-contention-add-a-missing-null-check.patch b/queue-6.8/perf-lock-contention-add-a-missing-null-check.patch
new file mode 100644
index 0000000000..ec64b1e6cd
--- /dev/null
+++ b/queue-6.8/perf-lock-contention-add-a-missing-null-check.patch
@@ -0,0 +1,66 @@
+From 5e6ec456b8074d11b26d5585e33526b2f68d0196 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Apr 2024 15:55:42 -0700
+Subject: perf lock contention: Add a missing NULL check
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit f3408580bac8ce5cd76e7391e529c0a22e7c7eb2 ]
+
+I got a report for a failure in BPF verifier on a recent kernel with
+perf lock contention command.  It checks task->sighand->siglock without
+checking if sighand is NULL or not.  Let's add one.
+
+  ; if (&curr->sighand->siglock == (void *)lock)
+  265: (79) r1 = *(u64 *)(r0 +2624)     ; frame1: R0_w=trusted_ptr_task_struct(off=0,imm=0)
+                                        ;         R1_w=rcu_ptr_or_null_sighand_struct(off=0,imm=0)
+  266: (b7) r2 = 0                      ; frame1: R2_w=0
+  267: (0f) r1 += r2
+  R1 pointer arithmetic on rcu_ptr_or_null_ prohibited, null-check it first
+  processed 164 insns (limit 1000000) max_states_per_insn 1 total_states 15 peak_states 15 mark_read 5
+  -- END PROG LOAD LOG --
+  libbpf: prog 'contention_end': failed to load: -13
+  libbpf: failed to load object 'lock_contention_bpf'
+  libbpf: failed to load BPF skeleton 'lock_contention_bpf': -13
+  Failed to load lock-contention BPF skeleton
+  lock contention BPF setup failed
+  lock contention did not detect any lock contention
+
+Fixes: 1811e82767dcc ("perf lock contention: Track and show siglock with address")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Song Liu <song@kernel.org>
+Cc: bpf@vger.kernel.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240409225542.1870999-1-namhyung@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf_skel/lock_contention.bpf.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/bpf_skel/lock_contention.bpf.c b/tools/perf/util/bpf_skel/lock_contention.bpf.c
+index 95cd8414f6ef8..e5d78565f479f 100644
+--- a/tools/perf/util/bpf_skel/lock_contention.bpf.c
++++ b/tools/perf/util/bpf_skel/lock_contention.bpf.c
+@@ -289,6 +289,7 @@ static inline __u32 check_lock_type(__u64 lock, __u32 flags)
+ 	struct task_struct *curr;
+ 	struct mm_struct___old *mm_old;
+ 	struct mm_struct___new *mm_new;
++	struct sighand_struct *sighand;
+ 
+ 	switch (flags) {
+ 	case LCB_F_READ:  /* rwsem */
+@@ -310,7 +311,9 @@ static inline __u32 check_lock_type(__u64 lock, __u32 flags)
+ 		break;
+ 	case LCB_F_SPIN:  /* spinlock */
+ 		curr = bpf_get_current_task_btf();
+-		if (&curr->sighand->siglock == (void *)lock)
++		sighand = curr->sighand;
++
++		if (sighand && &sighand->siglock == (void *)lock)
+ 			return LCD_F_SIGHAND_LOCK;
+ 		break;
+ 	default:
+-- 
+2.43.0
+
diff --git a/queue-6.8/rdma-cm-print-the-old-state-when-cm_destroy_id-gets-.patch b/queue-6.8/rdma-cm-print-the-old-state-when-cm_destroy_id-gets-.patch
new file mode 100644
index 0000000000..fb67419973
--- /dev/null
+++ b/queue-6.8/rdma-cm-print-the-old-state-when-cm_destroy_id-gets-.patch
@@ -0,0 +1,67 @@
+From 37061e4cd21cbc4b299cd4091d12c33e181036fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2024 13:20:49 +0200
+Subject: RDMA/cm: Print the old state when cm_destroy_id gets timeout
+
+From: Mark Zhang <markzhang@nvidia.com>
+
+[ Upstream commit b68e1acb5834ed1a2ad42d9d002815a8bae7c0b6 ]
+
+The old state is helpful for debugging, as the current state is always
+IB_CM_IDLE when timeout happens.
+
+Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait")
+Signed-off-by: Mark Zhang <markzhang@nvidia.com>
+Link: https://lore.kernel.org/r/20240322112049.2022994-1-markzhang@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cm.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index bf0df6ee4f785..07fb8d3c037f0 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1026,23 +1026,26 @@ static void cm_reset_to_idle(struct cm_id_private *cm_id_priv)
+ 	}
+ }
+ 
+-static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id)
++static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id,
++						enum ib_cm_state old_state)
+ {
+ 	struct cm_id_private *cm_id_priv;
+ 
+ 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+-	pr_err("%s: cm_id=%p timed out. state=%d refcnt=%d\n", __func__,
+-	       cm_id, cm_id->state, refcount_read(&cm_id_priv->refcount));
++	pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
++	       cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
+ }
+ 
+ static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
+ {
+ 	struct cm_id_private *cm_id_priv;
++	enum ib_cm_state old_state;
+ 	struct cm_work *work;
+ 	int ret;
+ 
+ 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+ 	spin_lock_irq(&cm_id_priv->lock);
++	old_state = cm_id->state;
+ retest:
+ 	switch (cm_id->state) {
+ 	case IB_CM_LISTEN:
+@@ -1151,7 +1154,7 @@ static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
+ 						  msecs_to_jiffies(
+ 						  CM_DESTROY_ID_WAIT_TIMEOUT));
+ 		if (!ret) /* timeout happened */
+-			cm_destroy_id_wait_timeout(cm_id);
++			cm_destroy_id_wait_timeout(cm_id, old_state);
+ 	} while (!ret);
+ 
+ 	while ((work = cm_dequeue_work(cm_id_priv)) != NULL)
+-- 
+2.43.0
+
diff --git a/queue-6.8/rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch b/queue-6.8/rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch
new file mode 100644
index 0000000000..6cc6c41a2d
--- /dev/null
+++ b/queue-6.8/rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch
@@ -0,0 +1,41 @@
+From cd2e7c615dd131108f0b500c464dec5e2fb71c1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Apr 2024 12:03:46 +0300
+Subject: RDMA/mlx5: Fix port number for counter query in multi-port
+ configuration
+
+From: Michael Guralnik <michaelgur@nvidia.com>
+
+[ Upstream commit be121ffb384f53e966ee7299ffccc6eeb61bc73d ]
+
+Set the correct port when querying PPCNT in multi-port configuration.
+Distinguish between cases where switchdev mode was enabled to multi-port
+configuration and don't overwrite the queried port to 1 in multi-port
+case.
+
+Fixes: 74b30b3ad5ce ("RDMA/mlx5: Set local port to one when accessing counters")
+Signed-off-by: Michael Guralnik <michaelgur@nvidia.com>
+Link: https://lore.kernel.org/r/9bfcc8ade958b760a51408c3ad654a01b11f7d76.1712134988.git.leon@kernel.org
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/mad.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/mad.c b/drivers/infiniband/hw/mlx5/mad.c
+index 0c3c4e64812c5..3e43687a7f6f7 100644
+--- a/drivers/infiniband/hw/mlx5/mad.c
++++ b/drivers/infiniband/hw/mlx5/mad.c
+@@ -188,7 +188,8 @@ static int process_pma_cmd(struct mlx5_ib_dev *dev, u32 port_num,
+ 		mdev = dev->mdev;
+ 		mdev_port_num = 1;
+ 	}
+-	if (MLX5_CAP_GEN(dev->mdev, num_ports) == 1) {
++	if (MLX5_CAP_GEN(dev->mdev, num_ports) == 1 &&
++	    !mlx5_core_mp_enabled(mdev)) {
+ 		/* set local port to one for Function-Per-Port HCA. */
+ 		mdev = dev->mdev;
+ 		mdev_port_num = 1;
+-- 
+2.43.0
+
diff --git a/queue-6.8/rdma-rxe-fix-the-problem-mutex_destroy-missing.patch b/queue-6.8/rdma-rxe-fix-the-problem-mutex_destroy-missing.patch
new file mode 100644
index 0000000000..49ec5f9a07
--- /dev/null
+++ b/queue-6.8/rdma-rxe-fix-the-problem-mutex_destroy-missing.patch
@@ -0,0 +1,38 @@
+From 12f127fe9c8f3b27d8520b3c6916b80cc8c98575 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2024 07:51:40 +0100
+Subject: RDMA/rxe: Fix the problem "mutex_destroy missing"
+
+From: Yanjun.Zhu <yanjun.zhu@linux.dev>
+
+[ Upstream commit 481047d7e8391d3842ae59025806531cdad710d9 ]
+
+When a mutex lock is not used any more, the function mutex_destroy
+should be called to mark the mutex lock uninitialized.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Signed-off-by: Yanjun.Zhu <yanjun.zhu@linux.dev>
+Link: https://lore.kernel.org/r/20240314065140.27468-1-yanjun.zhu@linux.dev
+Reviewed-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
+index 54c723a6eddac..6f9ec8db014c7 100644
+--- a/drivers/infiniband/sw/rxe/rxe.c
++++ b/drivers/infiniband/sw/rxe/rxe.c
+@@ -33,6 +33,8 @@ void rxe_dealloc(struct ib_device *ib_dev)
+ 
+ 	if (rxe->tfm)
+ 		crypto_free_shash(rxe->tfm);
++
++	mutex_destroy(&rxe->usdev_lock);
+ }
+ 
+ /* initialize rxe device parameters */
+-- 
+2.43.0
+
diff --git a/queue-6.8/s390-cio-fix-race-condition-during-online-processing.patch b/queue-6.8/s390-cio-fix-race-condition-during-online-processing.patch
new file mode 100644
index 0000000000..7a94030f1e
--- /dev/null
+++ b/queue-6.8/s390-cio-fix-race-condition-during-online-processing.patch
@@ -0,0 +1,72 @@
+From b88d22b791a46e233f14a73eae7b3a073787e862 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Apr 2024 11:46:19 +0200
+Subject: s390/cio: fix race condition during online processing
+
+From: Peter Oberparleiter <oberpar@linux.ibm.com>
+
+[ Upstream commit 2d8527f2f911fab84aec04df4788c0c23af3df48 ]
+
+A race condition exists in ccw_device_set_online() that can cause the
+online process to fail, leaving the affected device in an inconsistent
+state. As a result, subsequent attempts to set that device online fail
+with return code ENODEV.
+
+The problem occurs when a path verification request arrives after
+a wait for final device state completed, but before the result state
+is evaluated.
+
+Fix this by ensuring that the CCW-device lock is held between
+determining final state and checking result state.
+
+Note that since:
+
+commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")
+
+path verification requests are much more likely to occur during boot,
+resulting in an increased chance of this race condition occurring.
+
+Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")
+Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
+Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
+Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/device.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
+index 0cfb179e1bcb6..34b2567b8df49 100644
+--- a/drivers/s390/cio/device.c
++++ b/drivers/s390/cio/device.c
+@@ -363,10 +363,8 @@ int ccw_device_set_online(struct ccw_device *cdev)
+ 
+ 	spin_lock_irq(cdev->ccwlock);
+ 	ret = ccw_device_online(cdev);
+-	spin_unlock_irq(cdev->ccwlock);
+-	if (ret == 0)
+-		wait_event(cdev->private->wait_q, dev_fsm_final_state(cdev));
+-	else {
++	if (ret) {
++		spin_unlock_irq(cdev->ccwlock);
+ 		CIO_MSG_EVENT(0, "ccw_device_online returned %d, "
+ 			      "device 0.%x.%04x\n",
+ 			      ret, cdev->private->dev_id.ssid,
+@@ -375,7 +373,12 @@ int ccw_device_set_online(struct ccw_device *cdev)
+ 		put_device(&cdev->dev);
+ 		return ret;
+ 	}
+-	spin_lock_irq(cdev->ccwlock);
++	/* Wait until a final state is reached */
++	while (!dev_fsm_final_state(cdev)) {
++		spin_unlock_irq(cdev->ccwlock);
++		wait_event(cdev->private->wait_q, dev_fsm_final_state(cdev));
++		spin_lock_irq(cdev->ccwlock);
++	}
+ 	/* Check if online processing was successful */
+ 	if ((cdev->private->state != DEV_STATE_ONLINE) &&
+ 	    (cdev->private->state != DEV_STATE_W4SENSE)) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/s390-qdio-handle-deferred-cc1.patch b/queue-6.8/s390-qdio-handle-deferred-cc1.patch
new file mode 100644
index 0000000000..0bf385a7f7
--- /dev/null
+++ b/queue-6.8/s390-qdio-handle-deferred-cc1.patch
@@ -0,0 +1,121 @@
+From 6943b6e9ad82a38b3a1dc5eb204e41a1170eb961 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Apr 2024 11:46:18 +0200
+Subject: s390/qdio: handle deferred cc1
+
+From: Peter Oberparleiter <oberpar@linux.ibm.com>
+
+[ Upstream commit 607638faf2ff1cede37458111496e7cc6c977f6f ]
+
+A deferred condition code 1 response indicates that I/O was not started
+and should be retried. The current QDIO implementation handles a cc1
+response as I/O error, resulting in a failed QDIO setup. This can happen
+for example when a path verification request arrives at the same time
+as QDIO setup I/O is started.
+
+Fix this by retrying the QDIO setup I/O when a cc1 response is received.
+
+Note that since
+
+commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")
+commit 5ef1dc40ffa6 ("s390/cio: fix invalid -EBUSY on ccw_device_start")
+
+deferred cc1 responses are much more likely to occur. See the commit
+message of the latter for more background information.
+
+Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")
+Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
+Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/qdio_main.c | 28 +++++++++++++++++++++++-----
+ 1 file changed, 23 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
+index 9cde55730b65a..ebcb535809882 100644
+--- a/drivers/s390/cio/qdio_main.c
++++ b/drivers/s390/cio/qdio_main.c
+@@ -722,8 +722,8 @@ static void qdio_handle_activate_check(struct qdio_irq *irq_ptr,
+ 	lgr_info_log();
+ }
+ 
+-static void qdio_establish_handle_irq(struct qdio_irq *irq_ptr, int cstat,
+-				      int dstat)
++static int qdio_establish_handle_irq(struct qdio_irq *irq_ptr, int cstat,
++				     int dstat, int dcc)
+ {
+ 	DBF_DEV_EVENT(DBF_INFO, irq_ptr, "qest irq");
+ 
+@@ -731,15 +731,18 @@ static void qdio_establish_handle_irq(struct qdio_irq *irq_ptr, int cstat,
+ 		goto error;
+ 	if (dstat & ~(DEV_STAT_DEV_END | DEV_STAT_CHN_END))
+ 		goto error;
++	if (dcc == 1)
++		return -EAGAIN;
+ 	if (!(dstat & DEV_STAT_DEV_END))
+ 		goto error;
+ 	qdio_set_state(irq_ptr, QDIO_IRQ_STATE_ESTABLISHED);
+-	return;
++	return 0;
+ 
+ error:
+ 	DBF_ERROR("%4x EQ:error", irq_ptr->schid.sch_no);
+ 	DBF_ERROR("ds: %2x cs:%2x", dstat, cstat);
+ 	qdio_set_state(irq_ptr, QDIO_IRQ_STATE_ERR);
++	return -EIO;
+ }
+ 
+ /* qdio interrupt handler */
+@@ -748,7 +751,7 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
+ {
+ 	struct qdio_irq *irq_ptr = cdev->private->qdio_data;
+ 	struct subchannel_id schid;
+-	int cstat, dstat;
++	int cstat, dstat, rc, dcc;
+ 
+ 	if (!intparm || !irq_ptr) {
+ 		ccw_device_get_schid(cdev, &schid);
+@@ -768,10 +771,12 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
+ 	qdio_irq_check_sense(irq_ptr, irb);
+ 	cstat = irb->scsw.cmd.cstat;
+ 	dstat = irb->scsw.cmd.dstat;
++	dcc   = scsw_cmd_is_valid_cc(&irb->scsw) ? irb->scsw.cmd.cc : 0;
++	rc    = 0;
+ 
+ 	switch (irq_ptr->state) {
+ 	case QDIO_IRQ_STATE_INACTIVE:
+-		qdio_establish_handle_irq(irq_ptr, cstat, dstat);
++		rc = qdio_establish_handle_irq(irq_ptr, cstat, dstat, dcc);
+ 		break;
+ 	case QDIO_IRQ_STATE_CLEANUP:
+ 		qdio_set_state(irq_ptr, QDIO_IRQ_STATE_INACTIVE);
+@@ -785,12 +790,25 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
+ 		if (cstat || dstat)
+ 			qdio_handle_activate_check(irq_ptr, intparm, cstat,
+ 						   dstat);
++		else if (dcc == 1)
++			rc = -EAGAIN;
+ 		break;
+ 	case QDIO_IRQ_STATE_STOPPED:
+ 		break;
+ 	default:
+ 		WARN_ON_ONCE(1);
+ 	}
++
++	if (rc == -EAGAIN) {
++		DBF_DEV_EVENT(DBF_INFO, irq_ptr, "qint retry");
++		rc = ccw_device_start(cdev, irq_ptr->ccw, intparm, 0, 0);
++		if (!rc)
++			return;
++		DBF_ERROR("%4x RETRY ERR", irq_ptr->schid.sch_no);
++		DBF_ERROR("rc:%4x", rc);
++		qdio_set_state(irq_ptr, QDIO_IRQ_STATE_ERR);
++	}
++
+ 	wake_up(&cdev->private->wait_q);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/series b/queue-6.8/series
index f75011e5f0..ed55776af7 100644
--- a/queue-6.8/series
+++ b/queue-6.8/series
@@ -51,3 +51,22 @@ ravb-group-descriptor-types-used-in-rx-ring.patch
 net-ravb-count-packets-instead-of-descriptors-in-r-c.patch
 net-ravb-allow-rx-loop-to-move-past-dma-mapping-erro.patch
 net-ethernet-ti-am65-cpsw-nuss-cleanup-dma-channels-.patch
+nfsd-fix-endianness-issue-in-nfsd4_encode_fattr4.patch
+rdma-rxe-fix-the-problem-mutex_destroy-missing.patch
+rdma-cm-print-the-old-state-when-cm_destroy_id-gets-.patch
+rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch
+perf-annotate-make-sure-to-call-symbol__annotate2-in.patch
+perf-lock-contention-add-a-missing-null-check.patch
+s390-qdio-handle-deferred-cc1.patch
+s390-cio-fix-race-condition-during-online-processing.patch
+iommufd-add-missing-iommufd_driver-kconfig-for-the-s.patch
+iommufd-add-config-needed-for-iommufd_fail_nth.patch
+drm-nv04-fix-out-of-bounds-access.patch
+drm-v3d-don-t-increment-enabled_ns-twice.patch
+ubsan-remove-config_ubsan_sanitize_all.patch
+hardening-drop-obsolete-ubsan_sanitize_all-from-conf.patch
+configs-hardening-fix-disabling-ubsan-configurations.patch
+drm-panel-visionox-rm69299-don-t-unregister-dsi-devi.patch
+drm-radeon-make-fstrict-flex-arrays-3-happy.patch
+alsa-hda-realtek-fix-volumn-control-of-thinkbook-16p.patch
+thermal-debugfs-add-missing-count-increment-to-therm.patch
diff --git a/queue-6.8/thermal-debugfs-add-missing-count-increment-to-therm.patch b/queue-6.8/thermal-debugfs-add-missing-count-increment-to-therm.patch
new file mode 100644
index 0000000000..48b7eecae9
--- /dev/null
+++ b/queue-6.8/thermal-debugfs-add-missing-count-increment-to-therm.patch
@@ -0,0 +1,56 @@
+From b4d6a5351c3d1c2c9db5a3d2a52c4f1204c598f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Apr 2024 21:02:12 +0200
+Subject: thermal/debugfs: Add missing count increment to
+ thermal_debug_tz_trip_up()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit b552f63cd43735048bbe9bfbb7a9dcfce166fbdd ]
+
+The count field in struct trip_stats, representing the number of times
+the zone temperature was above the trip point, needs to be incremented
+in thermal_debug_tz_trip_up(), for two reasons.
+
+First, if a trip point is crossed on the way up for the first time,
+thermal_debug_update_temp() called from update_temperature() does
+not see it because it has not been added to trips_crossed[] array
+in the thermal zone's struct tz_debugfs object yet.  Therefore, when
+thermal_debug_tz_trip_up() is called after that, the trip point's
+count value is 0, and the attempt to divide by it during the average
+temperature computation leads to a divide error which causes the kernel
+to crash.  Setting the count to 1 before the division by incrementing it
+fixes this problem.
+
+Second, if a trip point is crossed on the way up, but it has been
+crossed on the way up already before, its count value needs to be
+incremented to make a record of the fact that the zone temperature is
+above the trip now.  Without doing that, if the mitigations applied
+after crossing the trip cause the zone temperature to drop below its
+threshold, the count will not be updated for this episode at all and
+the average temperature in the trip statistics record will be somewhat
+higher than it should be.
+
+Fixes: 7ef01f228c9f ("thermal/debugfs: Add thermal debugfs information for mitigation episodes")
+Cc :6.8+ <stable@vger.kernel.org> # 6.8+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/thermal_debugfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/thermal/thermal_debugfs.c b/drivers/thermal/thermal_debugfs.c
+index c617e8b9f0ddf..d78d54ae2605e 100644
+--- a/drivers/thermal/thermal_debugfs.c
++++ b/drivers/thermal/thermal_debugfs.c
+@@ -616,6 +616,7 @@ void thermal_debug_tz_trip_up(struct thermal_zone_device *tz,
+ 	tze->trip_stats[trip_id].timestamp = now;
+ 	tze->trip_stats[trip_id].max = max(tze->trip_stats[trip_id].max, temperature);
+ 	tze->trip_stats[trip_id].min = min(tze->trip_stats[trip_id].min, temperature);
++	tze->trip_stats[trip_id].count++;
+ 	tze->trip_stats[trip_id].avg = tze->trip_stats[trip_id].avg +
+ 		(temperature - tze->trip_stats[trip_id].avg) /
+ 		tze->trip_stats[trip_id].count;
+-- 
+2.43.0
+
diff --git a/queue-6.8/ubsan-remove-config_ubsan_sanitize_all.patch b/queue-6.8/ubsan-remove-config_ubsan_sanitize_all.patch
new file mode 100644
index 0000000000..8829b90425
--- /dev/null
+++ b/queue-6.8/ubsan-remove-config_ubsan_sanitize_all.patch
@@ -0,0 +1,231 @@
+From f5c7b6cc597d1cef781c35cda31828b87e5a9f74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jan 2024 10:45:29 -0800
+Subject: ubsan: Remove CONFIG_UBSAN_SANITIZE_ALL
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 918327e9b7ffb45321cbb4b9b86b58ec555fe6b3 ]
+
+For simplicity in splitting out UBSan options into separate rules,
+remove CONFIG_UBSAN_SANITIZE_ALL, effectively defaulting to "y", which
+is how it is generally used anyway. (There are no ":= y" cases beyond
+where a specific file is enabled when a top-level ":= n" is in effect.)
+
+Cc: Andrey Konovalov <andreyknvl@gmail.com>
+Cc: Marco Elver <elver@google.com>
+Cc: linux-doc@vger.kernel.org
+Cc: linux-kbuild@vger.kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Stable-dep-of: e048d668f296 ("configs/hardening: Fix disabling UBSAN configurations")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/dev-tools/ubsan.rst | 28 ++++++++--------------------
+ arch/arm/Kconfig                  |  2 +-
+ arch/arm64/Kconfig                |  2 +-
+ arch/mips/Kconfig                 |  2 +-
+ arch/parisc/Kconfig               |  2 +-
+ arch/powerpc/Kconfig              |  2 +-
+ arch/riscv/Kconfig                |  2 +-
+ arch/s390/Kconfig                 |  2 +-
+ arch/x86/Kconfig                  |  2 +-
+ lib/Kconfig.ubsan                 | 13 +------------
+ scripts/Makefile.lib              |  2 +-
+ 11 files changed, 18 insertions(+), 41 deletions(-)
+
+diff --git a/Documentation/dev-tools/ubsan.rst b/Documentation/dev-tools/ubsan.rst
+index 2de7c63415da0..e3591f8e9d5b4 100644
+--- a/Documentation/dev-tools/ubsan.rst
++++ b/Documentation/dev-tools/ubsan.rst
+@@ -49,34 +49,22 @@ Report example
+ Usage
+ -----
+ 
+-To enable UBSAN configure kernel with::
++To enable UBSAN, configure the kernel with::
+ 
+-	CONFIG_UBSAN=y
++  CONFIG_UBSAN=y
+ 
+-and to check the entire kernel::
+-
+-        CONFIG_UBSAN_SANITIZE_ALL=y
+-
+-To enable instrumentation for specific files or directories, add a line
+-similar to the following to the respective kernel Makefile:
+-
+-- For a single file (e.g. main.o)::
+-
+-    UBSAN_SANITIZE_main.o := y
+-
+-- For all files in one directory::
+-
+-    UBSAN_SANITIZE := y
+-
+-To exclude files from being instrumented even if
+-``CONFIG_UBSAN_SANITIZE_ALL=y``, use::
++To exclude files from being instrumented use::
+ 
+   UBSAN_SANITIZE_main.o := n
+ 
+-and::
++and to exclude all targets in one directory use::
+ 
+   UBSAN_SANITIZE := n
+ 
++When disabled for all targets, specific files can be enabled using::
++
++  UBSAN_SANITIZE_main.o := y
++
+ Detection of unaligned accesses controlled through the separate option -
+ CONFIG_UBSAN_ALIGNMENT. It's off by default on architectures that support
+ unaligned accesses (CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y). One could
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 0d4e316a389e0..c45e3bfb9f16e 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -29,7 +29,7 @@ config ARM
+ 	select ARCH_HAVE_NMI_SAFE_CMPXCHG if CPU_V7 || CPU_V7M || CPU_V6K
+ 	select ARCH_HAS_GCOV_PROFILE_ALL
+ 	select ARCH_KEEP_MEMBLOCK
+-	select ARCH_HAS_UBSAN_SANITIZE_ALL
++	select ARCH_HAS_UBSAN
+ 	select ARCH_MIGHT_HAVE_PC_PARPORT
+ 	select ARCH_OPTIONAL_KERNEL_RWX if ARCH_HAS_STRICT_KERNEL_RWX
+ 	select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT if CPU_V7
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 6b96d75a3a3d8..e92cbd56602bb 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -107,7 +107,7 @@ config ARM64
+ 	select ARCH_WANT_LD_ORPHAN_WARN
+ 	select ARCH_WANTS_NO_INSTR
+ 	select ARCH_WANTS_THP_SWAP if ARM64_4K_PAGES
+-	select ARCH_HAS_UBSAN_SANITIZE_ALL
++	select ARCH_HAS_UBSAN
+ 	select ARM_AMBA
+ 	select ARM_ARCH_TIMER
+ 	select ARM_GIC
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index 797ae590ebdba..9750ce3e40d59 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -14,7 +14,7 @@ config MIPS
+ 	select ARCH_HAS_STRNCPY_FROM_USER
+ 	select ARCH_HAS_STRNLEN_USER
+ 	select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
+-	select ARCH_HAS_UBSAN_SANITIZE_ALL
++	select ARCH_HAS_UBSAN
+ 	select ARCH_HAS_GCOV_PROFILE_ALL
+ 	select ARCH_KEEP_MEMBLOCK
+ 	select ARCH_USE_BUILTIN_BSWAP
+diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
+index 5c845e8d59d92..42822265c59bb 100644
+--- a/arch/parisc/Kconfig
++++ b/arch/parisc/Kconfig
+@@ -12,7 +12,7 @@ config PARISC
+ 	select ARCH_HAS_ELF_RANDOMIZE
+ 	select ARCH_HAS_STRICT_KERNEL_RWX
+ 	select ARCH_HAS_STRICT_MODULE_RWX
+-	select ARCH_HAS_UBSAN_SANITIZE_ALL
++	select ARCH_HAS_UBSAN
+ 	select ARCH_HAS_PTE_SPECIAL
+ 	select ARCH_NO_SG_CHAIN
+ 	select ARCH_SUPPORTS_HUGETLBFS if PA20
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index b9fc064d38d28..2065973e09d20 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -154,7 +154,7 @@ config PPC
+ 	select ARCH_HAS_SYSCALL_WRAPPER		if !SPU_BASE && !COMPAT
+ 	select ARCH_HAS_TICK_BROADCAST		if GENERIC_CLOCKEVENTS_BROADCAST
+ 	select ARCH_HAS_UACCESS_FLUSHCACHE
+-	select ARCH_HAS_UBSAN_SANITIZE_ALL
++	select ARCH_HAS_UBSAN
+ 	select ARCH_HAVE_NMI_SAFE_CMPXCHG
+ 	select ARCH_KEEP_MEMBLOCK
+ 	select ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE	if PPC_RADIX_MMU
+diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
+index e3142ce531a09..e4921c1bd2659 100644
+--- a/arch/riscv/Kconfig
++++ b/arch/riscv/Kconfig
+@@ -37,7 +37,7 @@ config RISCV
+ 	select ARCH_HAS_STRICT_MODULE_RWX if MMU && !XIP_KERNEL
+ 	select ARCH_HAS_SYSCALL_WRAPPER
+ 	select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
+-	select ARCH_HAS_UBSAN_SANITIZE_ALL
++	select ARCH_HAS_UBSAN
+ 	select ARCH_HAS_VDSO_DATA
+ 	select ARCH_KEEP_MEMBLOCK if ACPI
+ 	select ARCH_OPTIONAL_KERNEL_RWX if ARCH_HAS_STRICT_KERNEL_RWX
+diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
+index fe565f3a3a917..97dd25521617e 100644
+--- a/arch/s390/Kconfig
++++ b/arch/s390/Kconfig
+@@ -82,7 +82,7 @@ config S390
+ 	select ARCH_HAS_STRICT_KERNEL_RWX
+ 	select ARCH_HAS_STRICT_MODULE_RWX
+ 	select ARCH_HAS_SYSCALL_WRAPPER
+-	select ARCH_HAS_UBSAN_SANITIZE_ALL
++	select ARCH_HAS_UBSAN
+ 	select ARCH_HAS_VDSO_DATA
+ 	select ARCH_HAVE_NMI_SAFE_CMPXCHG
+ 	select ARCH_INLINE_READ_LOCK
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index b07f8b007ed9b..08a97d63f1966 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -100,7 +100,7 @@ config X86
+ 	select ARCH_HAS_STRICT_MODULE_RWX
+ 	select ARCH_HAS_SYNC_CORE_BEFORE_USERMODE
+ 	select ARCH_HAS_SYSCALL_WRAPPER
+-	select ARCH_HAS_UBSAN_SANITIZE_ALL
++	select ARCH_HAS_UBSAN
+ 	select ARCH_HAS_DEBUG_WX
+ 	select ARCH_HAS_ZONE_DMA_SET if EXPERT
+ 	select ARCH_HAVE_NMI_SAFE_CMPXCHG
+diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan
+index 59e21bfec188c..56d7653f49413 100644
+--- a/lib/Kconfig.ubsan
++++ b/lib/Kconfig.ubsan
+@@ -1,5 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+-config ARCH_HAS_UBSAN_SANITIZE_ALL
++config ARCH_HAS_UBSAN
+ 	bool
+ 
+ menuconfig UBSAN
+@@ -142,17 +142,6 @@ config UBSAN_ALIGNMENT
+ 	  Enabling this option on architectures that support unaligned
+ 	  accesses may produce a lot of false positives.
+ 
+-config UBSAN_SANITIZE_ALL
+-	bool "Enable instrumentation for the entire kernel"
+-	depends on ARCH_HAS_UBSAN_SANITIZE_ALL
+-	default y
+-	help
+-	  This option activates instrumentation for the entire kernel.
+-	  If you don't enable this option, you have to explicitly specify
+-	  UBSAN_SANITIZE := y for the files/directories you want to check for UB.
+-	  Enabling this option will get kernel image size increased
+-	  significantly.
+-
+ config TEST_UBSAN
+ 	tristate "Module for testing for undefined behavior detection"
+ 	depends on m
+diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
+index cd5b181060f15..52efc520ae4fa 100644
+--- a/scripts/Makefile.lib
++++ b/scripts/Makefile.lib
+@@ -175,7 +175,7 @@ endif
+ 
+ ifeq ($(CONFIG_UBSAN),y)
+ _c_flags += $(if $(patsubst n%,, \
+-		$(UBSAN_SANITIZE_$(basetarget).o)$(UBSAN_SANITIZE)$(CONFIG_UBSAN_SANITIZE_ALL)), \
++		$(UBSAN_SANITIZE_$(basetarget).o)$(UBSAN_SANITIZE)y), \
+ 		$(CFLAGS_UBSAN))
+ endif
+ 
+-- 
+2.43.0
+