kernel 6.7.5

9 files changed, 870 insertions, 236 deletions

diff --git a/SOURCES/Patchlist.changelog b/SOURCES/Patchlist.changelog
index 98e1271..00475c0 100644
--- a/SOURCES/Patchlist.changelog
+++ b/SOURCES/Patchlist.changelog
@@ -1,3 +1,27 @@
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/11fa2c73bc247b4d40c71e3220ead390202a2043
+ 11fa2c73bc247b4d40c71e3220ead390202a2043 selftests: openvswitch: Add validation for the recursion test
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/21fc802bce4938279432d1a4febef04de6354902
+ 21fc802bce4938279432d1a4febef04de6354902 net: openvswitch: limit the number of recursions from action sets
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/78a136fba17f14893a2cdd15bdaf9fcc1f48808f
+ 78a136fba17f14893a2cdd15bdaf9fcc1f48808f dm: limit the number of targets and parameter size area
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/ab98876014e44b8bad6575d69c9a65342d38f9d4
+ ab98876014e44b8bad6575d69c9a65342d38f9d4 btrfs: don't refill whole delayed refs block reserve when starting transaction
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/19a889e3c4589ccfbfc55056651847468054ff83
+ 19a889e3c4589ccfbfc55056651847468054ff83 drm/amd: Stop evicting resources on APUs in suspend
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/7fd92c3ac45f07f817b49b20b9f0d4dce0395eb4
+ 7fd92c3ac45f07f817b49b20b9f0d4dce0395eb4 Revert "drm/amd: flush any delayed gfxoff on suspend entry"
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/1c09c97c739e156ff5a7ce6b3df1173eeebeb3ef
+ 1c09c97c739e156ff5a7ce6b3df1173eeebeb3ef smb: client: set correct id, uid and cruid for multiuser automounts
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/4b490493dd82802f8b7f9977e09b4d8f5b5d55be
+ 4b490493dd82802f8b7f9977e09b4d8f5b5d55be platform/x86: Support for mode FN key
+
 "https://gitlab.com/cki-project/kernel-ark/-/commit"/067c5243fae90055e1276c8ba54076f4bbaef253
  067c5243fae90055e1276c8ba54076f4bbaef253 Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
 
diff --git a/SOURCES/amdgpu-ignore-min-pcap.patch b/SOURCES/amdgpu-ignore-min-pcap.patch
new file mode 100644
index 0000000..11ab34f
--- /dev/null
+++ b/SOURCES/amdgpu-ignore-min-pcap.patch
@@ -0,0 +1,86 @@
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+index 50f57d4dfd8f..b83697b75221 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -151,6 +151,7 @@ struct amdgpu_watchdog_timer
+  */
+ extern int amdgpu_modeset;
+ extern unsigned int amdgpu_vram_limit;
++extern int amdgpu_ignore_min_pcap;
+ extern int amdgpu_vis_vram_limit;
+ extern int amdgpu_gart_size;
+ extern int amdgpu_gtt_size;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index a7ad77ed09ca..2b7ed2e48e33 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -131,6 +131,7 @@ enum AMDGPU_DEBUG_MASK {
+ };
+ 
+ unsigned int amdgpu_vram_limit = UINT_MAX;
++int amdgpu_ignore_min_pcap = 1; /* do not ignore by default */
+ int amdgpu_vis_vram_limit;
+ int amdgpu_gart_size = -1; /* auto */
+ int amdgpu_gtt_size = -1; /* auto */
+@@ -238,6 +239,15 @@ struct amdgpu_watchdog_timer amdgpu_watchdog_timer = {
+ 	.period = 0x0, /* default to 0x0 (timeout disable) */
+ };
+ 
++/**
++ * DOC: ignore_min_pcap (int)
++ * Ignore the minimum power cap.
++ * Useful on graphics cards where the minimum power cap is very high.
++ * The default is 0 (Do not ignore).
++ */
++MODULE_PARM_DESC(ignore_min_pcap, "Ignore the minimum power cap");
++module_param_named(ignore_min_pcap, amdgpu_ignore_min_pcap, int, 0600);
++
+ /**
+  * DOC: vramlimit (int)
+  * Restrict the total amount of VRAM in MiB for testing.  The default is 0 (Use full VRAM).
+diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+index 20c53eefd680..6d00cae9caec 100644
+--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+@@ -2984,6 +2984,9 @@ static ssize_t amdgpu_hwmon_show_power_cap_min(struct device *dev,
+ 					 struct device_attribute *attr,
+ 					 char *buf)
+ {
++	if (amdgpu_ignore_min_pcap)
++		return sysfs_emit(buf, "%i\n", 0);
++
+ 	return amdgpu_hwmon_show_power_cap_generic(dev, attr, buf, PP_PWR_LIMIT_MIN);
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+index 60dce148b2d7..72891811b2d5 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+@@ -2487,7 +2487,10 @@ int smu_get_power_limit(void *handle,
+ 			*limit = smu->max_power_limit;
+ 			break;
+ 		case SMU_PPT_LIMIT_MIN:
+-			*limit = smu->min_power_limit;
++			if (amdgpu_ignore_min_pcap)
++				*limit = 0;
++			else
++				*limit = smu->min_power_limit;
+ 			break;
+ 		default:
+ 			return -EINVAL;
+@@ -2511,7 +2514,14 @@ static int smu_set_power_limit(void *handle, uint32_t limit)
+ 		if (smu->ppt_funcs->set_power_limit)
+ 			return smu->ppt_funcs->set_power_limit(smu, limit_type, limit);
+ 
+-	if ((limit > smu->max_power_limit) || (limit < smu->min_power_limit)) {
++	if (amdgpu_ignore_min_pcap) {
++		if ((limit > smu->max_power_limit)) {
++			dev_err(smu->adev->dev,
++				"New power limit (%d) is over the max allowed %d\n",
++				limit, smu->max_power_limit);
++			return -EINVAL;
++		}
++	} else if ((limit > smu->max_power_limit) || (limit < smu->min_power_limit)) {
+ 		dev_err(smu->adev->dev,
+ 			"New power limit (%d) is out of range [%d,%d]\n",
+ 			limit, smu->min_power_limit, smu->max_power_limit);
diff --git a/SOURCES/kernel-x86_64-debug-fedora.config b/SOURCES/kernel-x86_64-debug-fedora.config
index 0179bc2..1a2d8b0 100644
--- a/SOURCES/kernel-x86_64-debug-fedora.config
+++ b/SOURCES/kernel-x86_64-debug-fedora.config
@@ -3075,7 +3075,7 @@ CONFIG_INTEL_TURBO_MAX_3=y
 CONFIG_INTEL_TXT=y
 CONFIG_INTEL_UNCORE_FREQ_CONTROL=m
 CONFIG_INTEL_VBTN=m
-CONFIG_INTEL_VSC=m
+# CONFIG_INTEL_VSC is not set
 CONFIG_INTEL_VSEC=m
 CONFIG_INTEL_WMI_SBL_FW_UPDATE=m
 CONFIG_INTEL_WMI_THUNDERBOLT=m
diff --git a/SOURCES/kernel-x86_64-fedora.config b/SOURCES/kernel-x86_64-fedora.config
index 5110bd6..a1ba3a8 100644
--- a/SOURCES/kernel-x86_64-fedora.config
+++ b/SOURCES/kernel-x86_64-fedora.config
@@ -3055,7 +3055,7 @@ CONFIG_INTEL_TURBO_MAX_3=y
 CONFIG_INTEL_TXT=y
 CONFIG_INTEL_UNCORE_FREQ_CONTROL=m
 CONFIG_INTEL_VBTN=m
-CONFIG_INTEL_VSC=m
+# CONFIG_INTEL_VSC is not set
 CONFIG_INTEL_VSEC=m
 CONFIG_INTEL_WMI_SBL_FW_UPDATE=m
 CONFIG_INTEL_WMI_THUNDERBOLT=m
diff --git a/SOURCES/kernel.changelog b/SOURCES/kernel.changelog
index a1d854a..6cb5d52 100644
--- a/SOURCES/kernel.changelog
+++ b/SOURCES/kernel.changelog
@@ -1,3 +1,19 @@
+* Sat Feb 17 2024 Justin M. Forbes <jforbes@fedoraproject.org> [6.7.5-0]
+- Backported some CVE fixes lets note them in BugsFixed (Justin M. Forbes)
+- selftests: openvswitch: Add validation for the recursion test (Aaron Conole)
+- net: openvswitch: limit the number of recursions from action sets (Aaron Conole)
+- dm: limit the number of targets and parameter size area (Mikulas Patocka)
+- Add btrfs bug for 6.7.5 (Justin M. Forbes)
+- btrfs: don't refill whole delayed refs block reserve when starting transaction (Filipe Manana)
+- Add 6.7.5 fix to BugsFixed (Justin M. Forbes)
+- drm/amd: Stop evicting resources on APUs in suspend (Mario Limonciello)
+- Revert "drm/amd: flush any delayed gfxoff on suspend entry" (Mario Limonciello)
+- smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara)
+- Turn off CONFIG_INTEL_VSC for Fedora (Justin M. Forbes)
+- platform/x86: Support for mode FN key (Mark Pearson)
+- Linux v6.7.5
+Resolves: 
+
 * Mon Feb 05 2024 Augusto Caringi <acaringi@redhat.com> [6.7.4-0]
 - Add keyboard resume bugfixes (Justin M. Forbes)
 - Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID (Hans de Goede)
diff --git a/SOURCES/patch-6.7-redhat.patch b/SOURCES/patch-6.7-redhat.patch
index c7bea04..8ba4339 100644
--- a/SOURCES/patch-6.7-redhat.patch
+++ b/SOURCES/patch-6.7-redhat.patch
@@ -1,3 +1,4 @@
+ .../admin-guide/laptops/thinkpad-acpi.rst          |   7 +-
  Makefile                                           |  20 ++-
  arch/s390/include/asm/ipl.h                        |   1 +
  arch/s390/kernel/ipl.c                             |   5 +
@@ -13,15 +14,25 @@
  drivers/firmware/efi/efi.c                         | 124 +++++++++++----
  drivers/firmware/efi/secureboot.c                  |  38 +++++
  drivers/firmware/sysfb.c                           |  18 ++-
+ drivers/gpu/drm/amd/amdgpu/amdgpu.h                |   2 +
+ drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c           |  15 ++
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c         |  12 +-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c            |   9 +-
  drivers/hid/hid-rmi.c                              |  66 --------
  drivers/hwtracing/coresight/coresight-etm4x-core.c |  19 +++
- drivers/input/keyboard/atkbd.c                     |  14 +-
+ drivers/input/keyboard/atkbd.c                     |   3 +-
  drivers/input/rmi4/rmi_driver.c                    | 124 +++++++++------
  drivers/iommu/iommu.c                              |  22 +++
+ drivers/md/dm-core.h                               |   2 +
+ drivers/md/dm-ioctl.c                              |   3 +-
+ drivers/md/dm-table.c                              |   9 +-
  drivers/net/wireless/ath/ath10k/wmi-tlv.c          |   4 +
  drivers/pci/quirks.c                               |  24 +++
+ drivers/platform/x86/thinkpad_acpi.c               |  20 ++-
  drivers/scsi/sd.c                                  |  10 ++
  drivers/usb/core/hub.c                             |   7 +
+ fs/btrfs/transaction.c                             |  38 +----
+ fs/smb/client/namespace.c                          |  16 ++
  include/linux/efi.h                                |  22 ++-
  include/linux/lsm_hook_defs.h                      |   2 +
  include/linux/module.h                             |   1 +
@@ -30,6 +41,7 @@
  include/linux/security.h                           |   5 +
  kernel/module/main.c                               |   2 +
  kernel/module/signing.c                            |   9 +-
+ net/openvswitch/flow_netlink.c                     |  49 ++++--
  scripts/mod/modpost.c                              |   8 +
  scripts/tags.sh                                    |   2 +
  security/integrity/platform_certs/load_uefi.c      |   6 +-
@@ -37,10 +49,37 @@
  security/lockdown/lockdown.c                       |   1 +
  security/security.c                                |  12 ++
  tools/power/cpupower/Makefile                      |   2 +-
- 39 files changed, 683 insertions(+), 181 deletions(-)
+ .../selftests/net/openvswitch/openvswitch.sh       |  13 ++
+ .../testing/selftests/net/openvswitch/ovs-dpctl.py |  71 +++++++--
+ 53 files changed, 866 insertions(+), 253 deletions(-)
 
+diff --git a/Documentation/admin-guide/laptops/thinkpad-acpi.rst b/Documentation/admin-guide/laptops/thinkpad-acpi.rst
+index 98d304010170..7f674a6cfa8a 100644
+--- a/Documentation/admin-guide/laptops/thinkpad-acpi.rst
++++ b/Documentation/admin-guide/laptops/thinkpad-acpi.rst
+@@ -444,7 +444,9 @@ event	code	Key		Notes
+ 
+ 0x1008	0x07	FN+F8		IBM: toggle screen expand
+ 				Lenovo: configure UltraNav,
+-				or toggle screen expand
++				or toggle screen expand.
++				On newer platforms (2024+)
++				replaced by 0x131f (see below)
+ 
+ 0x1009	0x08	FN+F9		-
+ 
+@@ -504,6 +506,9 @@ event	code	Key		Notes
+ 
+ 0x1019	0x18	unknown
+ 
++0x131f	...	FN+F8	        Platform Mode change.
++				Implemented in driver.
++
+ ...	...	...
+ 
+ 0x1020	0x1F	unknown
 diff --git a/Makefile b/Makefile
-index 73a208d9d4c4..cfff9444b6ab 100644
+index 0f5bb9ddc98f..a46f4937fa26 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -22,6 +22,18 @@ $(if $(filter __%, $(MAKECMDGOALS)), \
@@ -580,6 +619,113 @@ index 3c197db42c9d..16e4a2e90fae 100644
  		pd = sysfb_create_simplefb(si, &mode);
  		if (!IS_ERR(pd))
  			goto unlock_mutex;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+index 50f57d4dfd8f..f65a1518546e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -1509,9 +1509,11 @@ static inline int amdgpu_acpi_smart_shift_update(struct drm_device *dev,
+ #if defined(CONFIG_ACPI) && defined(CONFIG_SUSPEND)
+ bool amdgpu_acpi_is_s3_active(struct amdgpu_device *adev);
+ bool amdgpu_acpi_is_s0ix_active(struct amdgpu_device *adev);
++void amdgpu_choose_low_power_state(struct amdgpu_device *adev);
+ #else
+ static inline bool amdgpu_acpi_is_s0ix_active(struct amdgpu_device *adev) { return false; }
+ static inline bool amdgpu_acpi_is_s3_active(struct amdgpu_device *adev) { return false; }
++static void amdgpu_choose_low_power_state(struct amdgpu_device *adev) { }
+ #endif
+ 
+ #if defined(CONFIG_DRM_AMD_DC)
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+index 2deebece810e..cc21ed67a330 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+@@ -1519,4 +1519,19 @@ bool amdgpu_acpi_is_s0ix_active(struct amdgpu_device *adev)
+ #endif /* CONFIG_AMD_PMC */
+ }
+ 
++/**
++ * amdgpu_choose_low_power_state
++ *
++ * @adev: amdgpu_device_pointer
++ *
++ * Choose the target low power state for the GPU
++ */
++void amdgpu_choose_low_power_state(struct amdgpu_device *adev)
++{
++	if (amdgpu_acpi_is_s0ix_active(adev))
++		adev->in_s0ix = true;
++	else if (amdgpu_acpi_is_s3_active(adev))
++		adev->in_s3 = true;
++}
++
+ #endif /* CONFIG_SUSPEND */
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 5fe1df95dc38..7f48c7ec4136 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -4441,13 +4441,15 @@ int amdgpu_device_prepare(struct drm_device *dev)
+ 	struct amdgpu_device *adev = drm_to_adev(dev);
+ 	int i, r;
+ 
++	amdgpu_choose_low_power_state(adev);
++
+ 	if (dev->switch_power_state == DRM_SWITCH_POWER_OFF)
+ 		return 0;
+ 
+ 	/* Evict the majority of BOs before starting suspend sequence */
+ 	r = amdgpu_device_evict_resources(adev);
+ 	if (r)
+-		return r;
++		goto unprepare;
+ 
+ 	for (i = 0; i < adev->num_ip_blocks; i++) {
+ 		if (!adev->ip_blocks[i].status.valid)
+@@ -4456,10 +4458,15 @@ int amdgpu_device_prepare(struct drm_device *dev)
+ 			continue;
+ 		r = adev->ip_blocks[i].version->funcs->prepare_suspend((void *)adev);
+ 		if (r)
+-			return r;
++			goto unprepare;
+ 	}
+ 
+ 	return 0;
++
++unprepare:
++	adev->in_s0ix = adev->in_s3 = false;
++
++	return r;
+ }
+ 
+ /**
+@@ -4496,7 +4503,6 @@ int amdgpu_device_suspend(struct drm_device *dev, bool fbcon)
+ 		drm_fb_helper_set_suspend_unlocked(adev_to_drm(adev)->fb_helper, true);
+ 
+ 	cancel_delayed_work_sync(&adev->delayed_init_work);
+-	flush_delayed_work(&adev->gfx.gfx_off_delay_work);
+ 
+ 	amdgpu_ras_suspend(adev);
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+index b9674c57c436..6ddc8e3360e2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+@@ -723,8 +723,15 @@ void amdgpu_gfx_off_ctrl(struct amdgpu_device *adev, bool enable)
+ 
+ 		if (adev->gfx.gfx_off_req_count == 0 &&
+ 		    !adev->gfx.gfx_off_state) {
+-			schedule_delayed_work(&adev->gfx.gfx_off_delay_work,
++			/* If going to s2idle, no need to wait */
++			if (adev->in_s0ix) {
++				if (!amdgpu_dpm_set_powergating_by_smu(adev,
++						AMD_IP_BLOCK_TYPE_GFX, true))
++					adev->gfx.gfx_off_state = true;
++			} else {
++				schedule_delayed_work(&adev->gfx.gfx_off_delay_work,
+ 					      delay);
++			}
+ 		}
+ 	} else {
+ 		if (adev->gfx.gfx_off_req_count == 0) {
 diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
 index d4af17fdba46..154f0403cbf4 100644
 --- a/drivers/hid/hid-rmi.c
@@ -734,52 +880,19 @@ index 34aee59dd147..7c5a7f7c11bd 100644
  	platform_driver_unregister(&etm4_platform_driver);
  	etm4_pm_clear();
 diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
-index 13ef6284223d..7f67f9f2946b 100644
+index c229bd6b3f7f..7f67f9f2946b 100644
 --- a/drivers/input/keyboard/atkbd.c
 +++ b/drivers/input/keyboard/atkbd.c
-@@ -811,7 +811,6 @@ static int atkbd_probe(struct atkbd *atkbd)
- {
- 	struct ps2dev *ps2dev = &atkbd->ps2dev;
- 	unsigned char param[2];
--	bool skip_getid;
- 
- /*
-  * Some systems, where the bit-twiddling when testing the io-lines of the
-@@ -825,6 +824,11 @@ static int atkbd_probe(struct atkbd *atkbd)
- 				 "keyboard reset failed on %s\n",
- 				 ps2dev->serio->phys);
+@@ -826,7 +826,7 @@ static int atkbd_probe(struct atkbd *atkbd)
  
-+	if (atkbd_skip_getid(atkbd)) {
-+		atkbd->id = 0xab83;
+ 	if (atkbd_skip_getid(atkbd)) {
+ 		atkbd->id = 0xab83;
+-		return 0;
 +		goto deactivate_kbd;
-+	}
-+
- /*
-  * Then we check the keyboard ID. We should get 0xab83 under normal conditions.
-  * Some keyboards report different values, but the first byte is always 0xab or
-@@ -833,18 +837,17 @@ static int atkbd_probe(struct atkbd *atkbd)
-  */
- 
- 	param[0] = param[1] = 0xa5;	/* initialize with invalid values */
--	skip_getid = atkbd_skip_getid(atkbd);
--	if (skip_getid || ps2_command(ps2dev, param, ATKBD_CMD_GETID)) {
-+	if (ps2_command(ps2dev, param, ATKBD_CMD_GETID)) {
- 
- /*
-- * If the get ID command was skipped or failed, we check if we can at least set
-+ * If the get ID command failed, we check if we can at least set
-  * the LEDs on the keyboard. This should work on every keyboard out there.
-  * It also turns the LEDs off, which we want anyway.
-  */
- 		param[0] = 0;
- 		if (ps2_command(ps2dev, param, ATKBD_CMD_SETLEDS))
- 			return -1;
--		atkbd->id = skip_getid ? 0xab83 : 0xabba;
-+		atkbd->id = 0xabba;
- 		return 0;
  	}
  
-@@ -860,6 +863,7 @@ static int atkbd_probe(struct atkbd *atkbd)
+ /*
+@@ -863,6 +863,7 @@ static int atkbd_probe(struct atkbd *atkbd)
  		return -1;
  	}
  
@@ -1019,6 +1132,60 @@ index 33e2a9b5d339..6ae1abc3f11c 100644
  /**
   * iommu_setup_default_domain - Set the default_domain for the group
   * @group: Group to change
+diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h
+index 095b9b49aa82..e6757a30dcca 100644
+--- a/drivers/md/dm-core.h
++++ b/drivers/md/dm-core.h
+@@ -22,6 +22,8 @@
+ #include "dm-ima.h"
+ 
+ #define DM_RESERVED_MAX_IOS		1024
++#define DM_MAX_TARGETS			1048576
++#define DM_MAX_TARGET_PARAMS		1024
+ 
+ struct dm_io;
+ 
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index e65058e0ed06..3b1ad7127cb8 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -1941,7 +1941,8 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern
+ 			   minimum_data_size - sizeof(param_kernel->version)))
+ 		return -EFAULT;
+ 
+-	if (param_kernel->data_size < minimum_data_size) {
++	if (unlikely(param_kernel->data_size < minimum_data_size) ||
++	    unlikely(param_kernel->data_size > DM_MAX_TARGETS * DM_MAX_TARGET_PARAMS)) {
+ 		DMERR("Invalid data size in the ioctl structure: %u",
+ 		      param_kernel->data_size);
+ 		return -EINVAL;
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index 198d38b53322..08c9c20f9c66 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -129,7 +129,12 @@ static int alloc_targets(struct dm_table *t, unsigned int num)
+ int dm_table_create(struct dm_table **result, blk_mode_t mode,
+ 		    unsigned int num_targets, struct mapped_device *md)
+ {
+-	struct dm_table *t = kzalloc(sizeof(*t), GFP_KERNEL);
++	struct dm_table *t;
++
++	if (num_targets > DM_MAX_TARGETS)
++		return -EOVERFLOW;
++
++	t = kzalloc(sizeof(*t), GFP_KERNEL);
+ 
+ 	if (!t)
+ 		return -ENOMEM;
+@@ -144,7 +149,7 @@ int dm_table_create(struct dm_table **result, blk_mode_t mode,
+ 
+ 	if (!num_targets) {
+ 		kfree(t);
+-		return -ENOMEM;
++		return -EOVERFLOW;
+ 	}
+ 
+ 	if (alloc_targets(t, num_targets)) {
 diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
 index 6b6aa3c36744..0ce08e9a0a3d 100644
 --- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -1069,6 +1236,51 @@ index a2bf6de11462..692a9e777d72 100644
  /*
   * Intersil/Techwell TW686[4589]-based video capture cards have an empty (zero)
   * class code.  Fix it.
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index c4895e9bc714..ceb22f8d8442 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -166,6 +166,7 @@ enum tpacpi_hkey_event_t {
+ 	TP_HKEY_EV_VOL_MUTE		= 0x1017, /* Mixer output mute */
+ 	TP_HKEY_EV_PRIVACYGUARD_TOGGLE	= 0x130f, /* Toggle priv.guard on/off */
+ 	TP_HKEY_EV_AMT_TOGGLE		= 0x131a, /* Toggle AMT on/off */
++	TP_HKEY_EV_PROFILE_TOGGLE	= 0x131f, /* Toggle platform profile */
+ 
+ 	/* Reasons for waking up from S3/S4 */
+ 	TP_HKEY_EV_WKUP_S3_UNDOCK	= 0x2304, /* undock requested, S3 */
+@@ -3731,6 +3732,7 @@ static bool hotkey_notify_extended_hotkey(const u32 hkey)
+ 	switch (hkey) {
+ 	case TP_HKEY_EV_PRIVACYGUARD_TOGGLE:
+ 	case TP_HKEY_EV_AMT_TOGGLE:
++	case TP_HKEY_EV_PROFILE_TOGGLE:
+ 		tpacpi_driver_event(hkey);
+ 		return true;
+ 	}
+@@ -11118,7 +11120,23 @@ static void tpacpi_driver_event(const unsigned int hkey_event)
+ 		else
+ 			dytc_control_amt(!dytc_amt_active);
+ 	}
+-
++	if (hkey_event == TP_HKEY_EV_PROFILE_TOGGLE) {
++		switch (dytc_current_profile) {
++		case PLATFORM_PROFILE_LOW_POWER:
++			dytc_profile_set(NULL, PLATFORM_PROFILE_BALANCED);
++			break;
++		case PLATFORM_PROFILE_BALANCED:
++			dytc_profile_set(NULL, PLATFORM_PROFILE_PERFORMANCE);
++			break;
++		case PLATFORM_PROFILE_PERFORMANCE:
++			dytc_profile_set(NULL, PLATFORM_PROFILE_LOW_POWER);
++			break;
++		default:
++			pr_warn("Profile HKEY unexpected profile %d", dytc_current_profile);
++		}
++		/* Notify user space the profile changed */
++		platform_profile_notify();
++	}
+ }
+ 
+ static void hotkey_driver_event(const unsigned int scancode)
 diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
 index 542a4bbb21bc..62161ceed2e2 100644
 --- a/drivers/scsi/sd.c
@@ -1115,6 +1327,103 @@ index ef8d9bda94ac..3fab06f3b43e 100644
  	/* Lock the device, then check to see if we were
  	 * disconnected while waiting for the lock to succeed. */
  	usb_lock_device(hdev);
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index 5b3333ceef04..c52807d97efa 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -564,56 +564,22 @@ static int btrfs_reserve_trans_metadata(struct btrfs_fs_info *fs_info,
+ 					u64 num_bytes,
+ 					u64 *delayed_refs_bytes)
+ {
+-	struct btrfs_block_rsv *delayed_refs_rsv = &fs_info->delayed_refs_rsv;
+ 	struct btrfs_space_info *si = fs_info->trans_block_rsv.space_info;
+-	u64 extra_delayed_refs_bytes = 0;
+-	u64 bytes;
++	u64 bytes = num_bytes + *delayed_refs_bytes;
+ 	int ret;
+ 
+-	/*
+-	 * If there's a gap between the size of the delayed refs reserve and
+-	 * its reserved space, than some tasks have added delayed refs or bumped
+-	 * its size otherwise (due to block group creation or removal, or block
+-	 * group item update). Also try to allocate that gap in order to prevent
+-	 * using (and possibly abusing) the global reserve when committing the
+-	 * transaction.
+-	 */
+-	if (flush == BTRFS_RESERVE_FLUSH_ALL &&
+-	    !btrfs_block_rsv_full(delayed_refs_rsv)) {
+-		spin_lock(&delayed_refs_rsv->lock);
+-		if (delayed_refs_rsv->size > delayed_refs_rsv->reserved)
+-			extra_delayed_refs_bytes = delayed_refs_rsv->size -
+-				delayed_refs_rsv->reserved;
+-		spin_unlock(&delayed_refs_rsv->lock);
+-	}
+-
+-	bytes = num_bytes + *delayed_refs_bytes + extra_delayed_refs_bytes;
+-
+ 	/*
+ 	 * We want to reserve all the bytes we may need all at once, so we only
+ 	 * do 1 enospc flushing cycle per transaction start.
+ 	 */
+ 	ret = btrfs_reserve_metadata_bytes(fs_info, si, bytes, flush);
+-	if (ret == 0) {
+-		if (extra_delayed_refs_bytes > 0)
+-			btrfs_migrate_to_delayed_refs_rsv(fs_info,
+-							  extra_delayed_refs_bytes);
+-		return 0;
+-	}
+-
+-	if (extra_delayed_refs_bytes > 0) {
+-		bytes -= extra_delayed_refs_bytes;
+-		ret = btrfs_reserve_metadata_bytes(fs_info, si, bytes, flush);
+-		if (ret == 0)
+-			return 0;
+-	}
+ 
+ 	/*
+ 	 * If we are an emergency flush, which can steal from the global block
+ 	 * reserve, then attempt to not reserve space for the delayed refs, as
+ 	 * we will consume space for them from the global block reserve.
+ 	 */
+-	if (flush == BTRFS_RESERVE_FLUSH_ALL_STEAL) {
++	if (ret && flush == BTRFS_RESERVE_FLUSH_ALL_STEAL) {
+ 		bytes -= *delayed_refs_bytes;
+ 		*delayed_refs_bytes = 0;
+ 		ret = btrfs_reserve_metadata_bytes(fs_info, si, bytes, flush);
+diff --git a/fs/smb/client/namespace.c b/fs/smb/client/namespace.c
+index a6968573b775..4a517b280f2b 100644
+--- a/fs/smb/client/namespace.c
++++ b/fs/smb/client/namespace.c
+@@ -168,6 +168,21 @@ static char *automount_fullpath(struct dentry *dentry, void *page)
+ 	return s;
+ }
+ 
++static void fs_context_set_ids(struct smb3_fs_context *ctx)
++{
++	kuid_t uid = current_fsuid();
++	kgid_t gid = current_fsgid();
++
++	if (ctx->multiuser) {
++		if (!ctx->uid_specified)
++			ctx->linux_uid = uid;
++		if (!ctx->gid_specified)
++			ctx->linux_gid = gid;
++	}
++	if (!ctx->cruid_specified)
++		ctx->cred_uid = uid;
++}
++
+ /*
+  * Create a vfsmount that we can automount
+  */
+@@ -205,6 +220,7 @@ static struct vfsmount *cifs_do_automount(struct path *path)
+ 	tmp.leaf_fullpath = NULL;
+ 	tmp.UNC = tmp.prepath = NULL;
+ 	tmp.dfs_root_ses = NULL;
++	fs_context_set_ids(&tmp);
+ 
+ 	rc = smb3_fs_context_dup(ctx, &tmp);
+ 	if (rc) {
 diff --git a/include/linux/efi.h b/include/linux/efi.h
 index 9cc5bf32f6f2..7462fb1fc99e 100644
 --- a/include/linux/efi.h
@@ -1464,6 +1773,181 @@ index a2ff4242e623..f0d2be1ee4f1 100644
  }
  
  int module_sig_check(struct load_info *info, int flags)
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index 88965e2068ac..ebc5728aab4e 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -48,6 +48,7 @@ struct ovs_len_tbl {
+ 
+ #define OVS_ATTR_NESTED -1
+ #define OVS_ATTR_VARIABLE -2
++#define OVS_COPY_ACTIONS_MAX_DEPTH 16
+ 
+ static bool actions_may_change_flow(const struct nlattr *actions)
+ {
+@@ -2545,13 +2546,15 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
+ 				  const struct sw_flow_key *key,
+ 				  struct sw_flow_actions **sfa,
+ 				  __be16 eth_type, __be16 vlan_tci,
+-				  u32 mpls_label_count, bool log);
++				  u32 mpls_label_count, bool log,
++				  u32 depth);
+ 
+ static int validate_and_copy_sample(struct net *net, const struct nlattr *attr,
+ 				    const struct sw_flow_key *key,
+ 				    struct sw_flow_actions **sfa,
+ 				    __be16 eth_type, __be16 vlan_tci,
+-				    u32 mpls_label_count, bool log, bool last)
++				    u32 mpls_label_count, bool log, bool last,
++				    u32 depth)
+ {
+ 	const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1];
+ 	const struct nlattr *probability, *actions;
+@@ -2602,7 +2605,8 @@ static int validate_and_copy_sample(struct net *net, const struct nlattr *attr,
+ 		return err;
+ 
+ 	err = __ovs_nla_copy_actions(net, actions, key, sfa,
+-				     eth_type, vlan_tci, mpls_label_count, log);
++				     eth_type, vlan_tci, mpls_label_count, log,
++				     depth + 1);
+ 
+ 	if (err)
+ 		return err;
+@@ -2617,7 +2621,8 @@ static int validate_and_copy_dec_ttl(struct net *net,
+ 				     const struct sw_flow_key *key,
+ 				     struct sw_flow_actions **sfa,
+ 				     __be16 eth_type, __be16 vlan_tci,
+-				     u32 mpls_label_count, bool log)
++				     u32 mpls_label_count, bool log,
++				     u32 depth)
+ {
+ 	const struct nlattr *attrs[OVS_DEC_TTL_ATTR_MAX + 1];
+ 	int start, action_start, err, rem;
+@@ -2660,7 +2665,8 @@ static int validate_and_copy_dec_ttl(struct net *net,
+ 		return action_start;
+ 
+ 	err = __ovs_nla_copy_actions(net, actions, key, sfa, eth_type,
+-				     vlan_tci, mpls_label_count, log);
++				     vlan_tci, mpls_label_count, log,
++				     depth + 1);
+ 	if (err)
+ 		return err;
+ 
+@@ -2674,7 +2680,8 @@ static int validate_and_copy_clone(struct net *net,
+ 				   const struct sw_flow_key *key,
+ 				   struct sw_flow_actions **sfa,
+ 				   __be16 eth_type, __be16 vlan_tci,
+-				   u32 mpls_label_count, bool log, bool last)
++				   u32 mpls_label_count, bool log, bool last,
++				   u32 depth)
+ {
+ 	int start, err;
+ 	u32 exec;
+@@ -2694,7 +2701,8 @@ static int validate_and_copy_clone(struct net *net,
+ 		return err;
+ 
+ 	err = __ovs_nla_copy_actions(net, attr, key, sfa,
+-				     eth_type, vlan_tci, mpls_label_count, log);
++				     eth_type, vlan_tci, mpls_label_count, log,
++				     depth + 1);
+ 	if (err)
+ 		return err;
+ 
+@@ -3063,7 +3071,7 @@ static int validate_and_copy_check_pkt_len(struct net *net,
+ 					   struct sw_flow_actions **sfa,
+ 					   __be16 eth_type, __be16 vlan_tci,
+ 					   u32 mpls_label_count,
+-					   bool log, bool last)
++					   bool log, bool last, u32 depth)
+ {
+ 	const struct nlattr *acts_if_greater, *acts_if_lesser_eq;
+ 	struct nlattr *a[OVS_CHECK_PKT_LEN_ATTR_MAX + 1];
+@@ -3111,7 +3119,8 @@ static int validate_and_copy_check_pkt_len(struct net *net,
+ 		return nested_acts_start;
+ 
+ 	err = __ovs_nla_copy_actions(net, acts_if_lesser_eq, key, sfa,
+-				     eth_type, vlan_tci, mpls_label_count, log);
++				     eth_type, vlan_tci, mpls_label_count, log,
++				     depth + 1);
+ 
+ 	if (err)
+ 		return err;
+@@ -3124,7 +3133,8 @@ static int validate_and_copy_check_pkt_len(struct net *net,
+ 		return nested_acts_start;
+ 
+ 	err = __ovs_nla_copy_actions(net, acts_if_greater, key, sfa,
+-				     eth_type, vlan_tci, mpls_label_count, log);
++				     eth_type, vlan_tci, mpls_label_count, log,
++				     depth + 1);
+ 
+ 	if (err)
+ 		return err;
+@@ -3152,12 +3162,16 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
+ 				  const struct sw_flow_key *key,
+ 				  struct sw_flow_actions **sfa,
+ 				  __be16 eth_type, __be16 vlan_tci,
+-				  u32 mpls_label_count, bool log)
++				  u32 mpls_label_count, bool log,
++				  u32 depth)
+ {
+ 	u8 mac_proto = ovs_key_mac_proto(key);
+ 	const struct nlattr *a;
+ 	int rem, err;
+ 
++	if (depth > OVS_COPY_ACTIONS_MAX_DEPTH)
++		return -EOVERFLOW;
++
+ 	nla_for_each_nested(a, attr, rem) {
+ 		/* Expected argument lengths, (u32)-1 for variable length. */
+ 		static const u32 action_lens[OVS_ACTION_ATTR_MAX + 1] = {
+@@ -3355,7 +3369,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
+ 			err = validate_and_copy_sample(net, a, key, sfa,
+ 						       eth_type, vlan_tci,
+ 						       mpls_label_count,
+-						       log, last);
++						       log, last, depth);
+ 			if (err)
+ 				return err;
+ 			skip_copy = true;
+@@ -3426,7 +3440,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
+ 			err = validate_and_copy_clone(net, a, key, sfa,
+ 						      eth_type, vlan_tci,
+ 						      mpls_label_count,
+-						      log, last);
++						      log, last, depth);
+ 			if (err)
+ 				return err;
+ 			skip_copy = true;
+@@ -3440,7 +3454,8 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
+ 							      eth_type,
+ 							      vlan_tci,
+ 							      mpls_label_count,
+-							      log, last);
++							      log, last,
++							      depth);
+ 			if (err)
+ 				return err;
+ 			skip_copy = true;
+@@ -3450,7 +3465,8 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
+ 		case OVS_ACTION_ATTR_DEC_TTL:
+ 			err = validate_and_copy_dec_ttl(net, a, key, sfa,
+ 							eth_type, vlan_tci,
+-							mpls_label_count, log);
++							mpls_label_count, log,
++							depth);
+ 			if (err)
+ 				return err;
+ 			skip_copy = true;
+@@ -3495,7 +3511,8 @@ int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
+ 
+ 	(*sfa)->orig_len = nla_len(attr);
+ 	err = __ovs_nla_copy_actions(net, attr, key, sfa, key->eth.type,
+-				     key->eth.vlan.tci, mpls_label_count, log);
++				     key->eth.vlan.tci, mpls_label_count, log,
++				     0);
+ 	if (err)
+ 		ovs_nla_free_flow_actions(*sfa);
+ 
 diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
 index cb6406f485a9..71e1f15d9dce 100644
 --- a/scripts/mod/modpost.c
@@ -1606,3 +2090,176 @@ index b53753dee02f..90701fc65aa2 100644
  
  PACKAGE =			cpupower
  PACKAGE_BUGREPORT =		linux-pm@vger.kernel.org
+diff --git a/tools/testing/selftests/net/openvswitch/openvswitch.sh b/tools/testing/selftests/net/openvswitch/openvswitch.sh
+index f8499d4c87f3..36e40256ab92 100755
+--- a/tools/testing/selftests/net/openvswitch/openvswitch.sh
++++ b/tools/testing/selftests/net/openvswitch/openvswitch.sh
+@@ -502,7 +502,20 @@ test_netlink_checks () {
+ 	    wc -l) == 2 ] || \
+ 	      return 1
+ 
++	info "Checking clone depth"
+ 	ERR_MSG="Flow actions may not be safe on all matching packets"
++	PRE_TEST=$(dmesg | grep -c "${ERR_MSG}")
++	ovs_add_flow "test_netlink_checks" nv0 \
++		'in_port(1),eth(),eth_type(0x800),ipv4()' \
++		'clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(drop)))))))))))))))))' \
++		>/dev/null 2>&1 && return 1
++	POST_TEST=$(dmesg | grep -c "${ERR_MSG}")
++
++	if [ "$PRE_TEST" == "$POST_TEST" ]; then
++		info "failed - clone depth too large"
++		return 1
++	fi
++
+ 	PRE_TEST=$(dmesg | grep -c "${ERR_MSG}")
+ 	ovs_add_flow "test_netlink_checks" nv0 \
+ 		'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(0),2' \
+diff --git a/tools/testing/selftests/net/openvswitch/ovs-dpctl.py b/tools/testing/selftests/net/openvswitch/ovs-dpctl.py
+index b97e621face9..5e0e539a323d 100644
+--- a/tools/testing/selftests/net/openvswitch/ovs-dpctl.py
++++ b/tools/testing/selftests/net/openvswitch/ovs-dpctl.py
+@@ -299,7 +299,7 @@ class ovsactions(nla):
+         ("OVS_ACTION_ATTR_PUSH_NSH", "none"),
+         ("OVS_ACTION_ATTR_POP_NSH", "flag"),
+         ("OVS_ACTION_ATTR_METER", "none"),
+-        ("OVS_ACTION_ATTR_CLONE", "none"),
++        ("OVS_ACTION_ATTR_CLONE", "recursive"),
+         ("OVS_ACTION_ATTR_CHECK_PKT_LEN", "none"),
+         ("OVS_ACTION_ATTR_ADD_MPLS", "none"),
+         ("OVS_ACTION_ATTR_DEC_TTL", "none"),
+@@ -465,29 +465,42 @@ class ovsactions(nla):
+                     print_str += "pop_mpls"
+             else:
+                 datum = self.get_attr(field[0])
+-                print_str += datum.dpstr(more)
++                if field[0] == "OVS_ACTION_ATTR_CLONE":
++                    print_str += "clone("
++                    print_str += datum.dpstr(more)
++                    print_str += ")"
++                else:
++                    print_str += datum.dpstr(more)
+ 
+         return print_str
+ 
+     def parse(self, actstr):
++        totallen = len(actstr)
+         while len(actstr) != 0:
+             parsed = False
++            parencount = 0
+             if actstr.startswith("drop"):
+                 # If no reason is provided, the implicit drop is used (i.e no
+                 # action). If some reason is given, an explicit action is used.
+-                actstr, reason = parse_extract_field(
+-                    actstr,
+-                    "drop(",
+-                    "([0-9]+)",
+-                    lambda x: int(x, 0),
+-                    False,
+-                    None,
+-                )
++                reason = None
++                if actstr.startswith("drop("):
++                    parencount += 1
++
++                    actstr, reason = parse_extract_field(
++                        actstr,
++                        "drop(",
++                        "([0-9]+)",
++                        lambda x: int(x, 0),
++                        False,
++                        None,
++                    )
++
+                 if reason is not None:
+                     self["attrs"].append(["OVS_ACTION_ATTR_DROP", reason])
+                     parsed = True
+                 else:
+-                    return
++                    actstr = actstr[len("drop"): ]
++                    return (totallen - len(actstr))
+ 
+             elif parse_starts_block(actstr, "^(\d+)", False, True):
+                 actstr, output = parse_extract_field(
+@@ -504,6 +517,7 @@ class ovsactions(nla):
+                     False,
+                     0,
+                 )
++                parencount += 1
+                 self["attrs"].append(["OVS_ACTION_ATTR_RECIRC", recircid])
+                 parsed = True
+ 
+@@ -516,12 +530,22 @@ class ovsactions(nla):
+ 
+             for flat_act in parse_flat_map:
+                 if parse_starts_block(actstr, flat_act[0], False):
+-                    actstr += len(flat_act[0])
++                    actstr = actstr[len(flat_act[0]):]
+                     self["attrs"].append([flat_act[1]])
+                     actstr = actstr[strspn(actstr, ", ") :]
+                     parsed = True
+ 
+-            if parse_starts_block(actstr, "ct(", False):
++            if parse_starts_block(actstr, "clone(", False):
++                parencount += 1
++                subacts = ovsactions()
++                actstr = actstr[len("clone("):]
++                parsedLen = subacts.parse(actstr)
++                lst = []
++                self["attrs"].append(("OVS_ACTION_ATTR_CLONE", subacts))
++                actstr = actstr[parsedLen:]
++                parsed = True
++            elif parse_starts_block(actstr, "ct(", False):
++                parencount += 1
+                 actstr = actstr[len("ct(") :]
+                 ctact = ovsactions.ctact()
+ 
+@@ -553,6 +577,7 @@ class ovsactions(nla):
+                         natact = ovsactions.ctact.natattr()
+ 
+                         if actstr.startswith("("):
++                            parencount += 1
+                             t = None
+                             actstr = actstr[1:]
+                             if actstr.startswith("src"):
+@@ -607,15 +632,29 @@ class ovsactions(nla):
+                                     actstr = actstr[strspn(actstr, ", ") :]
+ 
+                         ctact["attrs"].append(["OVS_CT_ATTR_NAT", natact])
+-                        actstr = actstr[strspn(actstr, ",) ") :]
++                        actstr = actstr[strspn(actstr, ", ") :]
+ 
+                 self["attrs"].append(["OVS_ACTION_ATTR_CT", ctact])
+                 parsed = True
+ 
+-            actstr = actstr[strspn(actstr, "), ") :]
++            actstr = actstr[strspn(actstr, ", ") :]
++            while parencount > 0:
++                parencount -= 1
++                actstr = actstr[strspn(actstr, " "):]
++                if len(actstr) and actstr[0] != ")":
++                    raise ValueError("Action str: '%s' unbalanced" % actstr)
++                actstr = actstr[1:]
++
++            if len(actstr) and actstr[0] == ")":
++                return (totallen - len(actstr))
++
++            actstr = actstr[strspn(actstr, ", ") :]
++
+             if not parsed:
+                 raise ValueError("Action str: '%s' not supported" % actstr)
+ 
++        return (totallen - len(actstr))
++
+ 
+ class ovskey(nla):
+     nla_flags = NLA_F_NESTED
+@@ -2111,6 +2150,8 @@ def main(argv):
+     ovsflow = OvsFlow()
+     ndb = NDB()
+ 
++    sys.setrecursionlimit(100000)
++
+     if hasattr(args, "showdp"):
+         found = False
+         for iface in ndb.interfaces:
diff --git a/SOURCES/t2linux.patch b/SOURCES/t2linux.patch
index ba58dde..0c6e17a 100644
--- a/SOURCES/t2linux.patch
+++ b/SOURCES/t2linux.patch
@@ -6814,13 +6814,12 @@ diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
 index 902a59928..dd5509eeb 100644
 --- a/drivers/hid/hid-multitouch.c
 +++ b/drivers/hid/hid-multitouch.c
-@@ -78,6 +78,8 @@ MODULE_LICENSE("GPL");
+@@ -78,6 +78,7 @@
  #define MT_QUIRK_ORIENTATION_INVERT	BIT(22)
  #define MT_QUIRK_HAS_TYPE_COVER_BACKLIGHT	BIT(23)
  #define MT_QUIRK_HAS_TYPE_COVER_TABLET_MODE_SWITCH	BIT(24)
 +#define MT_QUIRK_TOUCH_IS_TIPSTATE	BIT(25)
-+
-
+ 
  #define MT_INPUTMODE_TOUCHSCREEN	0x02
  #define MT_INPUTMODE_TOUCHPAD		0x03
 @@ -810,6 +811,15 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
@@ -6982,12 +6981,12 @@ diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
 index f98fb36ff..f881b19db 100644
 --- a/drivers/hid/hid-multitouch.c
 +++ b/drivers/hid/hid-multitouch.c
-@@ -226,6 +229,7 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app);
+@@ -226,6 +226,7 @@
  #define MT_CLS_RAZER_BLADE_STEALTH		0x0112
  #define MT_CLS_SMART_TECH			0x0113
  #define MT_CLS_WIN_8_MS_SURFACE_TYPE_COVER	0x0114
 +#define MT_CLS_APPLE_TOUCHBAR			0x0115
-
+ 
  #define MT_DEFAULT_MAXCONTACT	10
  #define MT_MAX_MAXCONTACT	250
 @@ -421,6 +421,13 @@
@@ -7004,10 +7003,10 @@ index f98fb36ff..f881b19db 100644
  	{ }
  };
  
-@@ -1883,6 +1906,17 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
+@@ -1883,6 +1883,17 @@
  		}
  	}
-
+ 
 +	ret = hid_parse(hdev);
 +	if (ret != 0) {
 +		unregister_pm_notifier(&td->pm_notifier);
@@ -7015,17 +7014,17 @@ index f98fb36ff..f881b19db 100644
 +	}
 +
 +	if (mtclass->name == MT_CLS_APPLE_TOUCHBAR &&
-+	    !hid_find_field(hdev, HID_INPUT_REPORT,
-+			    HID_DG_TOUCHPAD, HID_DG_TRANSDUCER_INDEX))
++		!hid_find_field(hdev, HID_INPUT_REPORT,
++				HID_DG_TOUCHPAD, HID_DG_TRANSDUCER_INDEX))
 +		return -ENODEV;
 +
  	td = devm_kzalloc(&hdev->dev, sizeof(struct mt_device), GFP_KERNEL);
  	if (!td) {
  		dev_err(&hdev->dev, "cannot allocate multitouch data\n");
-@@ -1933,12 +1967,6 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
-
+@@ -1933,12 +1944,6 @@
+ 
  	timer_setup(&td->release_timer, mt_expired_timeout, 0);
-
+ 
 -	ret = hid_parse(hdev);
 -	if (ret != 0) {
 -		unregister_pm_notifier(&td->pm_notifier);
@@ -7034,15 +7033,15 @@ index f98fb36ff..f881b19db 100644
 -
  	if (mtclass->quirks & MT_QUIRK_FIX_CONST_CONTACT_ID)
  		mt_fix_const_fields(hdev, HID_DG_CONTACTID);
-
-@@ -2418,6 +2418,11 @@
+ 
+@@ -2423,6 +2423,11 @@
  		HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY,
  			USB_VENDOR_ID_MICROSOFT, 0x09c0) },
  
 +	/* Apple Touch Bars */
 +	{ .driver_data = MT_CLS_APPLE_TOUCHBAR,
 +		HID_USB_DEVICE(USB_VENDOR_ID_APPLE,
-+			       USB_DEVICE_ID_APPLE_TOUCHBAR_DISPLAY) },
++			USB_DEVICE_ID_APPLE_TOUCHBAR_DISPLAY) },
 +
  	/* Google MT devices */
  	{ .driver_data = MT_CLS_GOOGLE,
@@ -8829,8 +8828,8 @@ index 70b325a2f..2131f8543 100644
 +	}
 +}
 +
- void efi_adjust_memory_range_protection(unsigned long start,
- 					unsigned long size)
+ efi_status_t efi_adjust_memory_range_protection(unsigned long start,
+ 						unsigned long size)
  {
 @@ -321,6 +345,9 @@ static void setup_quirks(struct boot_params *boot_params)
  	if (IS_ENABLED(CONFIG_APPLE_PROPERTIES) &&
diff --git a/SOURCES/tkg-misc-additions.patch b/SOURCES/tkg-misc-additions.patch
index 618b53c..31368a7 100644
--- a/SOURCES/tkg-misc-additions.patch
+++ b/SOURCES/tkg-misc-additions.patch
@@ -97,161 +97,3 @@ index f4b210ab061291..837d0dbb28ea08 100644
  	depends on HAVE_ARCH_MMAP_RND_COMPAT_BITS
  	help
  	  This value can be used to select the number of bits to use to
-
-From 3cfb591e23181791195a74efe2e9065e0d4bd201 Mon Sep 17 00:00:00 2001
-From: Etienne JUVIGNY <ti3nou@gmail.com>
-Date: Mon, 15 Jan 2024 19:09:39 +0100
-Subject: Revert: drm/amd/pm: fix the high voltage and temperature issue
-
-This was supposed to fix the high voltage and temperature issue after the driver is unloaded on smu 13.0.0,
-smu 13.0.7 and smu 13.0.10, but introduced an arguably more annoying issue. Let's revert it until a proper fix is offered.
-
-Fixes rdna3 shutdown/reboot hang.
-
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
-index 93cf73d6f..960966f4b 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
-@@ -4050,23 +4050,13 @@ int amdgpu_device_init(struct amdgpu_device *adev,
- 				}
- 			}
- 		} else {
--			switch (amdgpu_ip_version(adev, MP1_HWIP, 0)) {
--			case IP_VERSION(13, 0, 0):
--			case IP_VERSION(13, 0, 7):
--			case IP_VERSION(13, 0, 10):
--				r = psp_gpu_reset(adev);
--				break;
--			default:
--				tmp = amdgpu_reset_method;
--				/* It should do a default reset when loading or reloading the driver,
--				 * regardless of the module parameter reset_method.
--				 */
--				amdgpu_reset_method = AMD_RESET_METHOD_NONE;
--				r = amdgpu_asic_reset(adev);
--				amdgpu_reset_method = tmp;
--				break;
--			}
--
-+			tmp = amdgpu_reset_method;
-+			/* It should do a default reset when loading or reloading the driver,
-+			 * regardless of the module parameter reset_method.
-+			 */
-+			amdgpu_reset_method = AMD_RESET_METHOD_NONE;
-+			r = amdgpu_asic_reset(adev);
-+			amdgpu_reset_method = tmp;
- 			if (r) {
- 				dev_err(adev->dev, "asic reset on init failed\n");
- 				goto failed;
-diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
-index e1a5ee911..308ebeb43 100644
---- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
-+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
-@@ -733,7 +733,7 @@ static int smu_early_init(void *handle)
- 	smu->adev = adev;
- 	smu->pm_enabled = !!amdgpu_dpm;
- 	smu->is_apu = false;
--	smu->smu_baco.state = SMU_BACO_STATE_NONE;
-+	smu->smu_baco.state = SMU_BACO_STATE_EXIT;
- 	smu->smu_baco.platform_support = false;
- 	smu->user_dpm_profile.fan_mode = -1;
-
-@@ -1753,31 +1753,10 @@ static int smu_smc_hw_cleanup(struct smu_context *smu)
- 	return 0;
- }
-
--static int smu_reset_mp1_state(struct smu_context *smu)
--{
--	struct amdgpu_device *adev = smu->adev;
--	int ret = 0;
--
--	if ((!adev->in_runpm) && (!adev->in_suspend) &&
--		(!amdgpu_in_reset(adev)))
--		switch (amdgpu_ip_version(adev, MP1_HWIP, 0)) {
--		case IP_VERSION(13, 0, 0):
--		case IP_VERSION(13, 0, 7):
--		case IP_VERSION(13, 0, 10):
--			ret = smu_set_mp1_state(smu, PP_MP1_STATE_UNLOAD);
--			break;
--		default:
--			break;
--		}
--
--	return ret;
--}
--
- static int smu_hw_fini(void *handle)
- {
- 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
- 	struct smu_context *smu = adev->powerplay.pp_handle;
--	int ret;
-
- 	if (amdgpu_sriov_vf(adev) && !amdgpu_sriov_is_pp_one_vf(adev))
- 		return 0;
-@@ -1795,15 +1774,7 @@ static int smu_hw_fini(void *handle)
-
- 	adev->pm.dpm_enabled = false;
-
--	ret = smu_smc_hw_cleanup(smu);
--	if (ret)
--		return ret;
--
--	ret = smu_reset_mp1_state(smu);
--	if (ret)
--		return ret;
--
--	return 0;
-+	return smu_smc_hw_cleanup(smu);
- }
-
- static void smu_late_fini(void *handle)
-diff --git a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
-index f8b2e6cc2..e8329d157 100644
---- a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
-+++ b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
-@@ -419,7 +419,6 @@ enum smu_reset_mode {
- enum smu_baco_state {
- 	SMU_BACO_STATE_ENTER = 0,
- 	SMU_BACO_STATE_EXIT,
--	SMU_BACO_STATE_NONE,
- };
-
- struct smu_baco_context {
-diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
-index 82c4e1f1c..2ba77b1d1 100644
---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
-+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
-@@ -2772,13 +2766,7 @@ static int smu_v13_0_0_set_mp1_state(struct smu_context *smu,
-
- 	switch (mp1_state) {
- 	case PP_MP1_STATE_UNLOAD:
--		ret = smu_cmn_send_smc_msg_with_param(smu,
--											  SMU_MSG_PrepareMp1ForUnload,
--											  0x55, NULL);
--
--		if (!ret && smu->smu_baco.state == SMU_BACO_STATE_EXIT)
--			ret = smu_v13_0_disable_pmfw_state(smu);
--
-+		ret = smu_cmn_set_mp1_state(smu, mp1_state);
- 		break;
- 	default:
- 		/* Ignore others */
-diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
-index 81eafed76..19c1289d0 100644
---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
-+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
-@@ -2499,13 +2499,7 @@ static int smu_v13_0_7_set_mp1_state(struct smu_context *smu,
-
- 	switch (mp1_state) {
- 	case PP_MP1_STATE_UNLOAD:
--		ret = smu_cmn_send_smc_msg_with_param(smu,
--											  SMU_MSG_PrepareMp1ForUnload,
--											  0x55, NULL);
--
--		if (!ret && smu->smu_baco.state == SMU_BACO_STATE_EXIT)
--			ret = smu_v13_0_disable_pmfw_state(smu);
--
-+		ret = smu_cmn_set_mp1_state(smu, mp1_state);
- 		break;
- 	default:
- 		/* Ignore others */
diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec
index fd47436..7eb5f47 100644
--- a/SPECS/kernel.spec
+++ b/SPECS/kernel.spec
@@ -160,18 +160,18 @@ Summary: The Linux kernel
 #  the --with-release option overrides this setting.)
 %define debugbuildsenabled 1
 %define buildid .fsync
-%define specrpmversion 6.7.4
-%define specversion 6.7.4
+%define specrpmversion 6.7.5
+%define specversion 6.7.5
 %define patchversion 6.7
 %define pkgrelease 200
 %define kversion 6
-%define tarfile_release 6.7.4
+%define tarfile_release 6.7.5
 # This is needed to do merge window version magic
 %define patchlevel 7
 # This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 204%{?buildid}%{?dist}
+%define specrelease 201%{?buildid}%{?dist}
 # This defines the kabi tarball version
-%define kabiversion 6.7.4
+%define kabiversion 6.7.5
 
 # If this variable is set to 1, a bpf selftests build failure will cause a
 # fatal kernel package build error
@@ -1050,6 +1050,8 @@ Patch408: 0001-acpi-proc-idle-skip-dummy-wait.patch
 Patch411: 0001-Revert-nvme-pci-drop-redundant-pci_enable_pcie_error.patch
 # Allows corectl to work out of the box
 Patch412: 0001-Set-amdgpu.ppfeaturemask-0xffffffff-as-default.patch
+# fix https://gitlab.freedesktop.org/drm/amd/-/issues/3183
+Patch413: amdgpu-ignore-min-pcap.patch
 
 # Allow to set custom USB pollrate for specific devices like so:
 # usbcore.interrupt_interval_override=045e:00db:16,1bcf:0005:1
@@ -1903,6 +1905,8 @@ ApplyOptionalPatch 0001-acpi-proc-idle-skip-dummy-wait.patch
 ApplyOptionalPatch 0001-Revert-nvme-pci-drop-redundant-pci_enable_pcie_error.patch
 #  enable full amd power control by default
 ApplyOptionalPatch 0001-Set-amdgpu.ppfeaturemask-0xffffffff-as-default.patch
+# fix https://gitlab.freedesktop.org/drm/amd/-/issues/3183
+ApplyOptionalPatch amdgpu-ignore-min-pcap.patch
 
 # Allow to set custom USB pollrate for specific devices like so:
 # usbcore.interrupt_interval_override=045e:00db:16,1bcf:0005:1
@@ -3971,17 +3975,23 @@ fi\
 #
 #
 %changelog
-* Sun Feb 11 2024 Jan Drögehoff <sentrycraft123@gmail.com> - 6.7.4-204.fsync.1
-- kernel-fsync v6.7.4 rog ally patches update
-
-* Sun Feb 11 2024 Jan Drögehoff <sentrycraft123@gmail.com> - 6.7.4-203.fsync.1
-- kernel-fsync v6.7.4 Steam Deck OLED fixes 2
-
-* Sat Feb 10 2024 Jan Drögehoff <sentrycraft123@gmail.com> - 6.7.4-202.fsync.1
-- kernel-fsync v6.7.4 Steam Deck OLED fixes
-
-* Thu Feb 08 2024 Jan Drögehoff <sentrycraft123@gmail.com> - 6.7.4-201.fsync
-- kernel-fsync v6.7.4
+* Sun Feb 18 2024 Jan Drögehoff <sentrycraft123@gmail.com> - 6.7.5-201.fsync
+- kernel-fsync v6.7.5
+
+* Sat Feb 17 2024 Justin M. Forbes <jforbes@fedoraproject.org> [6.7.5-0]
+- Backported some CVE fixes lets note them in BugsFixed (Justin M. Forbes)
+- selftests: openvswitch: Add validation for the recursion test (Aaron Conole)
+- net: openvswitch: limit the number of recursions from action sets (Aaron Conole)
+- dm: limit the number of targets and parameter size area (Mikulas Patocka)
+- Add btrfs bug for 6.7.5 (Justin M. Forbes)
+- btrfs: don't refill whole delayed refs block reserve when starting transaction (Filipe Manana)
+- Add 6.7.5 fix to BugsFixed (Justin M. Forbes)
+- drm/amd: Stop evicting resources on APUs in suspend (Mario Limonciello)
+- Revert "drm/amd: flush any delayed gfxoff on suspend entry" (Mario Limonciello)
+- smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara)
+- Turn off CONFIG_INTEL_VSC for Fedora (Justin M. Forbes)
+- platform/x86: Support for mode FN key (Mark Pearson)
+- Linux v6.7.5
 
 * Mon Feb 05 2024 Augusto Caringi <acaringi@redhat.com> [6.7.4-0]
 - Add keyboard resume bugfixes (Justin M. Forbes)